zwesty
Write-ups / Day 18 / Metadata
Day 18 · Sun, Oct 18 · Metadata

Frame of Reference

Prey slaughtered

ISO BMFF (MP4) box parsing, video stream geometry, answer-form choice, compounding solver chain

STTMClaude Homebase Both

Flags are shortened to their first 8 and last 4 characters because they're unique per team.

Challenge ID
metadata-forensics-day-18-frame-of-reference (+ /time_trial, /mastery)
Solved
2026-10-18, all three modes, 4 min 30 s from the first start (09:00:07 → 09:04:37 ET)
Player
Zwesty (solo), with Claude Code (Opus 5.5)

The challenge

Clips, previews, and screen recordings have been mixed together. Use stream geometry to identify originals, crops, and the recording that could not have come from the claimed device.

One question on the Single Solve:

answer_id Question Format
d18-video-001-media-primary-video-dimensions Determine media.primary_video_dimensions for video-001.mp4. exact_text, trimmed; none only when the field is absent

Reading the prompt: what it said we'd need

Clue What it pointed to What I did about it
"stream geometry" The width and height of the video stream, not the file's name or tags Read the first video track's sample entry from the MP4 boxes
"originals, crops" A crop changes the coded size; a track header can also claim a different display size Used the coded size (what ffprobe reports) and wrote a test where the track header disagrees
"could not have come from the claimed device" Size alone may expose a fake; later days may ask about the device Nothing extra needed today; noted for later fields
media.primary_… naming The same family as Day 17's media.primary_audio_codec_name, which took ffprobe's spelling Put ffprobe's WxH form first in the candidate list

What was in the files

The Single Solve zip held one file, video-001.mp4 (19,775 bytes): an isom MP4 made by ffmpeg, with an H.264 video track (avc1, libx264) and an AAC audio track, 0.5 s long, title Huntress MP4 evidence …. The video track's sample entry and its track header both said 320 × 180, with square pixels and an identity matrix (no rotation). The timed variants used the same template: every Time Trial and Mastery video was also 320 × 180.

Single Solve

Our automated morning solver (a scheduled script on our Kali VM) started the attempt and downloaded the zip at 09:00:07 ET. It marked the question as unconfirmed (a new field; the old chain could only answer none as a best effort), so it left the send to Claude.

  • exiftool on the VM showed the geometry at once (video track 320 × 180, stsd 320 × 180, rotation 0).
  • Ranked candidates: 320x180, 320×180, 320 x 180, 320X180, 320,180, 320:180.
  • My first send used the wrong route form (<id>/single_solve) and got HTTP 404 challenge_unavailable. Nothing was judged. The untimed Single Solve takes the plain challenge id.
  • 320x180 was CORRECT on the first try at 09:01:27 ET (flag 9cd1982c…8cca).

The solver loads the previous chain (the pre-built Day 18 solver, then Day 17, …) and adds one parser: the first video stream's coded size as WxH. It reads MP4/MOV (the first vide track's stsd entry, using the track header only when the entry says 0 × 0), Matroska/WebM (PixelWidth/PixelHeight), AVI (BITMAPINFOHEADER), and video attached to an e-mail message. It doesn't apply rotation or the track header's display size, matching ffprobe. Tests 8/8 (the real Single file, multi-track MP4, track header ≠ sample entry, no video → stop, MKV, AVI, mail, Mastery delivery N: / setN. names). Regression rehearsal: 78 saved attempts, slowest 0.06 s, 77 identical, 1 newly solved, 0 changed. It passed.

Time Trial (ranked)

mode time_trial, 23 questions (Days 1–18 fields + metadata-day-18-synthesis-sha256-order)
d18-video-001-media-primary-video-dimensions: 320x180
start 630 ms · artifact 687 ms · solve 14 ms · submit 1078 ms · TOTAL 2410 ms
vs started_at: submit +1868 ms
result CORRECT  flag 177de882…056e

Mastery (ranked)

mode mastery, 170 s clock, 5 sets, 115 questions, 31 ranked attempts left
setN.d18-video-001-media-primary-video-dimensions: 320x180 (all five)
start 589 ms · artifact 704 ms · solve 85 ms · submit 1167 ms · TOTAL 2545 ms
vs started_at: submit +2046 ms
result CORRECT  flag f40817ef…52bf

No best-effort answers in either run.

Time to solve

All three modes were solved by 09:04:37 ET, 4 min 30 s after the first start. The Single Solve went through on the first judged send at 09:01:27 (one earlier send hit the wrong route and wasn't judged); the solver, tests, and rehearsal took about 3 minutes, and the ranked Time Trial and Mastery each went through on the first submit.

Takeaways

  • Field families keep their spelling. media.primary_* took ffprobe's form on Day 17 and again today, so the candidate list's first entry was right.
  • Answer first, build second. Sending the Single Solve from exiftool's reading while the solver was still being written saved about 3 minutes.
  • Know the route form. The untimed Single Solve is the plain challenge id; the 404 cost 10 seconds this time.
  • Geometry has two sources in MP4. The sample entry (coded size) and the track header (display size) can differ on crops and scaled previews. The solver uses the coded size and keeps a test for the disagreeing case.