The challenge
One APK per attempt; the answer is an ANS- token hidden in the app. Written from our solver's report and a static read of the Single Solve APK's puzzle asset.
Safety
APKs are treated as hostile: read statically on our Kali VM (unzip of one JSON asset), never installed or run.
What was in the files
A 12,704-byte APK whose assets/huntress_puzzle.json declares codec xor with a one-byte key over Base64 data. The timed variants used the same template with different keys and tokens.
The modes
Single Solve CORRECT 09:00:37 flag af6299f7…df3e solve 1 ms, submit +1.57 s
Time Trial CORRECT 09:00:43 flag 266c0ce5…0e4c solve 1 ms, submit +1.14 s (ranked, 31 left)
Mastery CORRECT 09:00:50 flag af42ea19…ac99 solve 3 ms, submit +1.16 s (5 sets)
Time to solve
All three modes were solved by 09:00:50 ET, each on the first submit, with no hand work; the Time Trial was ranked.
Takeaways
- A known codec, so no code change: our puzzle-asset solver (the pre-built Day 17 Android solver) already had
xor, and the unknown-codec fallback wasn't needed.