zwesty
Write-ups / Day 17 / Metadata
Day 17 · Sat, Oct 17 · Metadata

Hear Me Out

Prey slaughtered

RIFF/WAVE structure, codec identification from bytes, ffprobe naming

STTMClaude Homebase Both

Flags are shortened to their first 8 and last 4 characters because they're unique per team.

Challenge ID
metadata-forensics-day-17-hear-me-out (+ /time_trial, /mastery)
Solved
2026-10-17, all three modes, by 09:07:44 ET
Player
Zwesty (solo), with Claude Code (Opus 5.5): our automated morning solver (a scheduled script on our Kali VM), then a Claude helper agent for this lane

The challenge

Voice notes were transcoded, renamed, and embedded in mail; determine the real codecs. Single Solve question: "Determine media.primary_audio_codec_name for audio-001.wav." (exact text).

Reading the prompt: what it said we'd need

Clue What it pointed to What we did
"transcoded, renamed" Extensions lie; read the codec from the bytes The parser sniffs the container from its header
media.primary_audio_codec_name A generic, ffprobe-style field (codec_name of the first audio stream) Ranked ffprobe's name first

What was in the files

audio-001.wav: RIFF/WAVE, fmt tag 1 (PCM), mono, 16 kHz, 16-bit, 1.25 s, with a LIST/INFO title. The codec is stored as a number, so there was no text to send verbatim.

The modes

  • Morning solver: the new field wasn't pre-built, so it downloaded and prepared the question but sent nothing.
  • Claude helper agent: ranked candidates (pcm_s16le, PCM, pcm, Microsoft PCM, WAVE_FORMAT_PCM, pcm_s16); the first was accepted. The parser covers WAV/RF64, MP3/MP2, AAC, FLAC, Ogg, MP4/MOV, Matroska, AIFF, CAF, AMR, Sun .au, and audio mail attachments. Tests 15/15. The regression rehearsal printed FAILED only because a best-effort placeholder on today's own Single became the real answer; a full diff showed nothing else changed, and the rehearsal was fixed the same morning to count that as "newly solved".
Single Solve   CORRECT 09:06:28  flag 6bcf4157…e8cc
Time Trial     CORRECT 09:07:37  flag f4524a98…d88c   ranked, 22 q (incl. the timed-only synthesis question), solve 25 ms
Mastery        CORRECT 09:07:44  flag bc8fdaed…f257   ranked, 5 sets, 110 q, solve 476 ms

Time to solve

All three modes were solved by 09:07:44 ET. The Single Solve went through on the first candidate at 09:06:28, and the ranked Time Trial and Mastery each went through on the first submit about a minute later.

Takeaways

  • ffprobe's vocabulary is the generator's vocabulary for media fields (pcm_s16le). Pre-build ffprobe-style fields for every audio/video type.
  • The previous evening's pre-build of extra Metadata fields didn't include an audio codec field: one more reason to pre-build by field family across formats, not by format.