zwesty
Write-ups / Day 8 / Metadata
Day 8 · Thu, Oct 8 · Metadata

What's in the Box?

Prey slaughtered

ZIP central directory, hashing, file headers (JPEG, PNG, PDF), reusing a compounding solver

STTMClaude Homebase Both

Flags are shortened to their first 8 and last 4 characters because they're unique per team.

Challenge ID
metadata-forensics-day-08-whats-in-the-box (+ /time_trial, /mastery)
Solved
2026-10-08: Single Solve, Time Trial, and Mastery all CORRECT on the first attempt; 31 s from the first start to the last CORRECT
Player
Zwesty (solo), with Claude Code (Opus 5.5)

The challenge

"The count was only the beginning. Inventory every stored path, preserve directory context, and identify the archive whose names reveal an impossible provenance claim."

12 questions about metadata-day-08-evidence.zip (Mastery: 5 sets, 60 questions).

answer_id Question Format
evidence-note-filename / -size-bytes / -md5 / -sha1 / -sha256 / -magic-prefix-hex-16 / -text-utf8-bom-present The evidence note's name, size, hashes, first 16 bytes, BOM exact text, integer, hex, true/false
d04-…-jpeg-sof-dimensions-pixels, d05-…-png-ihdr-dimensions-pixels, d06-…-pdf-header-version, d07-…-zip-eocd-total-entries Days 4–7's checks WxH, version, integer
d07-zip-001-zip-central-directory-member-names (new) Every name stored in the inner zip compact JSON array, exact values and order

Reading the prompt: what it said we'd need

Clue What it pointed to What I did about it
"The count was only the beginning" Day 7 asked for the EOCD's stated count Kept Day 7's solver and built on it
"Inventory every stored path" The central directory, not the local headers or the extracted files Walked the central directory from the EOCD's offset
"preserve directory context" Full stored paths, not base names Kept room-01/… prefixes

What was in the files

The outer zip held the evidence note, a JPEG, a PNG, a PDF, and an inner zip, evidence-drop-001.zip, whose two members are room-01/item-1.txt and room-02/item-1.txt: the same base name in two folders, which is why the paths matter. The timed variants used the same template with new values.

Single Solve

Our solver extends Day 7's with central_names(): it starts at the central directory the EOCD points to (or the first central header if that offset is wrong), reads each name as UTF-8 when flag bit 11 is set and CP437 otherwise, and answers with compact JSON. All 12 answers were submitted together: CORRECT (d7759f42…8dd2).

Its tests (5): order, duplicate base names, and directory entries; UTF-8 and CP437; an archive with junk before it; a fake central-header signature in the zip comment; and the real Single Solve. Day 7's tests still pass.

Time Trial

started_at  2026-10-08T20:15:22.790Z
start        628 ms
artifact     422 ms
solve          1 ms
submit       859 ms
TOTAL       1910 ms
result      CORRECT   flag a63fc388…ccbe

Mastery

started_at  2026-10-08T20:15:27.889Z   5 sets, 60 answers
start        526 ms
artifact     408 ms
solve          4 ms
submit       818 ms
TOTAL       1756 ms
result      CORRECT   flag e10b488e…26ec

Time to solve

All three modes were solved in 31 s, from the Single Solve start at 20:14:57 UTC to the Mastery CORRECT at 20:15:28 UTC, each on the first submit: the Single Solve in 7 s, the Time Trial in 1.9 s, and the Mastery in 1.8 s.

Takeaways

  • The central directory is the archive's own inventory. Read it in stored order with full paths; extracted files or base names lose exactly what this question asked for.
  • Compounding solvers pay off again: eleven of the twelve answers came from Days 1–7's code unchanged.
  • No question asked about the "impossible provenance claim" in this delivery.