zwesty
Write-ups / Day 9 / Metadata
Day 9 · Fri, Oct 9 · Metadata

Built Different

Prey slaughtered

PE headers (MZ, e_lfanew, PE\0\0, COFF Machine), telling real executables from decoys, reusing a compounding solver

STTMClaude Homebase Both

Flags are shortened to their first 8 and last 4 characters because they're unique per team.

Challenge ID
metadata-forensics-day-09-built-different (+ /time_trial, /mastery)
Solved
2026-10-09: Single Solve CORRECT (sent in two parts), Time Trial CORRECT on the second submit of the same attempt (the first was incorrect), Mastery CORRECT; 1 min 39 s from the first start to Mastery CORRECT
Player
Zwesty (solo), with Claude Code (Opus 5.5)

The challenge

"A software drop contains executables for several architectures, plus decoys wearing executable extensions. Determine what can actually run where."

13 questions about metadata-day-09-evidence.zip (Mastery: 5 sets, 65 answers).

answer_id Question Format
evidence-note-filename / -size-bytes / -md5 / -sha1 / -sha256 / -magic-prefix-hex-16 / -text-utf8-bom-present The evidence note's name, size, hashes, first 16 bytes, BOM exact text, integer, hex, true/false
d04-…-jpeg-sof-dimensions-pixels, d05-…-png-ihdr-dimensions-pixels, d06-…-pdf-header-version, d07-…-zip-eocd-total-entries, d07-…-zip-central-directory-member-names Days 4–8's checks WxH, version, integer, JSON array
d09-pe-001-pe-coff-machine-u16-hex (new) pe.coff_machine_u16_hex for telemetry-agent-001.exe 0x + lowercase hex; none only when the field is absent

Reading the prompt: what it said we'd need

Clue What it pointed to What I did about it
"executables for several architectures" The CPU a Windows binary targets lives in the COFF header's Machine field Read the Machine u16 at e_lfanew + 4
"decoys wearing executable extensions" A .exe name proves nothing; only the headers do Count a file as a PE only if it has MZ, an in-range e_lfanew, and PE\0\0 there; anything else answers none
"what can actually run where" Identify, don't execute Parsed the bytes in Python; nothing was run

Safety

  • The artifacts include Windows executables. Everything was static: the solver reads bytes with struct and never runs, loads, or imports a challenge file.
  • The artifacts stayed on our Kali VM; none were copied to a Windows machine.

What was in the files

The outer zip held the same set as Day 8 (evidence-note.txt, camera-001.jpg, panel-001.png, document-001.pdf, the inner evidence-drop-001.zip) plus telemetry-agent-001.exe. That file was a real PE with Machine 0x014c (Intel i386). It wasn't recorded whether the Single Solve zip also carried decoy .exe files, so I can't say what the prompt's "decoys" looked like here. The timed modes asked the same 13 questions (13 answers per Time Trial, 65 for Mastery's 5 sets), but their question text now ended with a tag, [assigned-artifact-sha256:<hex>], which mattered (see Time Trial).

Single Solve

Our solver extends Day 8's with coff_machine(): it checks for MZ at offset 0, reads e_lfanew at 0x3C, checks that it lands inside the file with PE\0\0 there, and returns the u16 Machine value after it, formatted as 0x%04x. Any file that fails a check is a decoy and gets the literal none. Run on its own, the solver lists every member as "PE machine 0x…" or "not a PE". Our shared Game Master client handles the requests.

The answers went in two parts: the 12 fields from earlier days first (accepted, 1 remaining), then the PE field alone, 0x014c: CORRECT (e2070427…4e4e).

Its tests (4, all pass): real PE Machine values (i386, AMD64, ARM64, ARMNT); four decoys (a shell script, an ELF, an MZ file whose header says NE instead of PE, and an e_lfanew past the end of the file); the real Single Solve; and the tagged-question regression below. All 9 Metadata test suites pass.

Time Trial

The first run was incorrect. Day 1's base solver picks the answer type from words in the question, and the new tag contains "sha256", so evidence-note-filename was answered with a SHA-256. Our solver then tried Mastery, which the Game Master refused with prerequisite_required (nothing was sent). The fix went into Day 1's solver, so it covers every Metadata day: bracketed tags are stripped before the question is read, and a test proves a tagged question set gives exactly the same answers as an untagged one. Starting Time Trial again resumed the same attempt (same started_at), and the resubmit was CORRECT.

These are built from the Game Master log and the client timings; there is no saved console output, so the per-step split (start, artifact, solve, submit) isn't available.

run 1
started_at  2026-10-09T13:57:57.525Z
submit      13:57:58   13 answers
result      incorrect  (evidence-note-filename got a SHA-256: tag bug)

run 2, same attempt resumed
start       13:58:54   same started_at as run 1
submit      13:58:55   13 answers
TOTAL       1.97 s     (client timing)
result      CORRECT   flag f18dcd02…9ae1

Mastery

refused     13:57:59   409 prerequisite_required (Time Trial not yet passed; nothing sent)
started_at  2026-10-09T13:58:56.206Z   5 sets, 65 answers
submit      13:58:57
TOTAL       2.02 s     (client timing)
result      CORRECT   flag 27a607ed…9f09

Time to solve

All three modes were solved in 1 min 39 s, from the Single Solve start at 13:57:18 UTC to the Mastery CORRECT at 13:58:57 UTC; the Single Solve took 27 s, and the Time Trial went CORRECT on its second submit after the first was incorrect. Those timed runs were unranked, so at 14:29 UTC Claude retried both with the clock switched on (part of 20 such ranked retries that day, all CORRECT), 32 min 8 s after the first start.

Takeaways

  • A file extension is a claim; the headers are the evidence. MZ, then e_lfanew, then PE\0\0, then the Machine field: each step can fail, and each failure is a decoy.
  • Untrusted input can steer a solver. A tag added to the question text silently changed which answer type Day 1 picked. Strip decoration before matching on words, and test with the decorated text.
  • Compounding solvers pay off again: twelve of the thirteen answers came from Days 1–8's code, and one fix in Day 1 now protects every Metadata day.