zwesty
Write-ups / Day 19 / Metadata
Day 19 · Mon, Oct 19 · Metadata

Little Endian on the Prairie

Prey slaughtered

ELF header parsing, byte order, answer-form choice

STTMClaude Homebase Both

Flags are shortened to their first 8 and last 4 characters because they're unique per team.

Challenge ID
metadata-forensics-day-19-little-endian-on-the-prairie (+ /time_trial, /mastery)
Solved
2026-10-19, all three modes, by 09:03:21 ET
Player
Zwesty (solo), with Claude Code (Opus 5.5)

The challenge

Linux binaries from several systems have been pooled with Windows executables and renamed data. Determine architecture directly from the ELF header and rebuild deployment groups.

answer_id Question Format
d19-elf-001-elf-e-machine-u16-hex Determine elf.e_machine_u16_hex for collector-001.elf. lowercase hex with a 0x prefix

Reading the prompt: what it said we'd need

Clue What it pointed to What we did about it
"directly from the ELF header" e_machine at offset 18, not the file name Read it from the bytes
"Little Endian" (title), "several systems" Byte order matters; timed sets may hold big-endian builds Read e_machine in the order e_ident[EI_DATA] declares
u16_hex A 16-bit field in hex Pad to the field width, as Day 9's PE machine field (0x014c) was
"renamed data" Names lie Identify files by their ELF magic

What was in the files

One 14,408-byte file, collector-001.elf: ELF64, little endian, executable, e_machine bytes 3e 00 = 0x003e (x86-64). The timed sets used the same template.

Single Solve

Our automated morning solver (a scheduled script on our Kali VM) flagged the field as new. Its Metadata candidate search, on its first live day, found no candidate because it had no ELF header reader yet, so it stopped without sending anything, as designed.

  • Candidates considered: 0x003e, 0x3e, 0x3e00.
  • 0x003e CORRECT on the first try at 09:01:21 ET (flag 85076984…09e6).
  • Our solver gained an elf-e-machine-u16-hex reader, which reads the field in the file's declared byte order. Its tests passed 5/5 (little and big endian, 32 and 64 bit, a non-ELF file stops, Mastery shapes). A regression rehearsal against the previous day's puzzles passed: 82 identical, 1 newly solved, 0 changed.

Time Trial and Mastery (ranked)

Time Trial   CORRECT 09:03:14  flag 9012fdc5…1025   solve 17 ms,  submit +2.34 s
Mastery      CORRECT 09:03:21  flag cfb6de8d…da2a   solve 100 ms, submit +2.43 s  (5 sets)

No best-effort answers.

Time to solve

All three modes were solved by 09:03:21 ET, about 3 min 21 s after release. The Single Solve went through on the first try at 09:01:21, and the ranked Time Trial and Mastery each went through on the first submit about two minutes later, after the solver was extended and tested.

Takeaways

  • Field families keep their form: a u16 hex field is padded to 4 digits, as on Day 9.
  • Byte order comes from the header, not an assumption.
  • An automatic candidate search needs readers to survey. For the next day we added a reader for the whole ELF header, so a renamed header field would be found automatically.