Main Character Energy · Huntress CTF 2026

The challenge

"Java archives contain libraries, applications, and nested dependencies whose manifests disagree with their launchers. Determine what is runnable and where execution begins."

answer_id	Question	Format
`d22-jar-001-jar-main-class`	"Determine jar.main_class for application-001.jar." (artifact `metadata-day-22-evidence.zip -> application-001.jar`)	exact text: "exact artifact-derived value only, without quotes or explanatory text unless quotes are part of the value; use the literal none only when the requested field is absent"; trimmed

The Time Trial asked 27 questions: every earlier day's field (roster, evidence note, JPEG, PNG, PDF, ZIP, PE, .NET, MSI, LNK, OOXML, email, audio, video, ELF, Mach-O, APK), today's Main-Class, and the SHA-256 ordering synthesis. The Mastery asked the same family across 6 sets (162 questions).

Reading the prompt: what it said we'd need

Clue	What it pointed to	What I did about it
"Java archives"	A JAR: a zip with a `META-INF/MANIFEST.MF`	The pre-built parser reads JARs as zips and parses the manifest's main section
"Determine what is runnable and where execution begins"	The manifest's `Main-Class`: the class the `java -jar` launcher starts	The pre-built parser returns `Main-Class` verbatim; that answered the one new field
"Main Character Energy" (title)	A pun on Main-Class	Confirmed the reading
"libraries, applications"	A library JAR has no `Main-Class` (answer `none`); an application has one	Not a question today; the parser already answers `none` when the attribute is absent
"nested dependencies whose manifests disagree with their launchers"	Fat JARs with JARs inside, and launchers that start a different class (for example Spring Boot's `Start-Class`)	Not asked today. Today's JAR had no nested JARs, and its `Main-Class` file was present. The parser already knows `Start-Class`, `Premain-Class`, and the agent keys

What was in the files

Single Solve: metadata-day-22-evidence.zip, 741 bytes, one member: application-001.jar, 1,146 bytes. Inside:
META-INF/MANIFEST.MF (111 bytes): Manifest-Version: 1.0, Main-Class: arena.evidence.ArtifactMain, Created-By: Huntress Artifact Assembly Line;
arena/evidence/ArtifactMain.class (370 bytes), the class the manifest names;
evidence/header.bin (8 bytes) and evidence/marker.txt (13 bytes).
Time Trial: evidence.zip, 633,832 bytes, 18 members: one sample per earlier day's file type (from camera-001.jpg to mobile-001.apk) plus the same 1,146-byte application-001.jar.
Mastery: one 3,804,220-byte zip of 6 evidence sets (evidence-01.zip … evidence-06.zip), 27 questions each.

Every JAR in every mode was the same file with the same Main-Class, so the timed variants reused the template with the same JAR value. The Mach-O sample was still thin arm64 in every set (["0x0100000c"]), so Day 20's fat / ar ordering rule is still unconfirmed. The APK package name was the same as on Day 21.

Single Solve

The solver solved it with no stop. Its preparation step started the Single Solve untimed and checked the one question. The field jar-main-class was new, but a parser we had built ahead of time already covered it:

A pre-built media and package parser (built 2026-10-15, a week before the day). It registers every common manifest attribute under JAR-style field names; jar-main-class maps to the Main-Class attribute of the manifest's main section (case-insensitive name, continuation lines joined), verbatim, and none if there is no manifest or no attribute. Its tests already asserted jar-main-class on a synthetic JAR.
The solver was our Day 20 Metadata solver, which loads that parser through its chain. No code was written today and no candidate guessing was needed.

Because the one question was already covered, the solver sent the Single Solve on its own. It logged the same harmless note as on Day 21: one module skipped two field names (pe-signed, pe-is-signed) that another module already registers.

started_at  2026-10-22T13:00:06.631Z
deadline    none (Single Solve)
answers     1   arena.evidence.ArtifactMain
start        300 ms   (the send step's start, resuming the attempt the preparation step opened)
artifact     298 ms
solve          1 ms
submit       743 ms
TOTAL       1342 ms   (submit +7.24 s after started_at; the preparation step ran in between)
result      CORRECT   flag 2bb5aa58…acde

Before the timed runs, a regression rehearsal replayed 97 saved attempts: slowest 0.09 s, identical on every Mastery set; it passed.

Time Trial

CORRECT on the first attempt, ranked. The start reply showed unique_attempts_remaining: 31.

started_at  2026-10-22T13:00:27.906Z
deadline    2026-10-22T13:01:17.906Z   (50 s)
answers     27
start        822 ms
artifact     489 ms
solve         15 ms
submit       823 ms
TOTAL       2149 ms   (submit +1.43 s after started_at)
result      CORRECT   flag df435898…4313

Mastery

CORRECT on the first attempt, ranked (6 sets, 200 s clock; Day 21 had 5 sets and 170 s).

started_at  2026-10-22T13:00:35.161Z
deadline    2026-10-22T13:03:55.161Z   (200 s)
answers     162 across 6 sets
start        693 ms
artifact     695 ms
solve        101 ms
submit       976 ms
TOTAL       2465 ms   (submit +1.89 s after started_at)
result      CORRECT   flag 4e6a7397…4f83

Time to solve

All three modes were solved by 09:00:37 ET, 37 s after release and 31 s after the solver's first start request. Each went through on the first submit, and both timed modes were ranked; about 14 s of that was the rehearsal before the timed runs.

Takeaways

Pre-building paid off again. The JAR manifest reader was written seven days early as a guess, with a test for this exact field name; today it answered first time, so the lane needed no candidate guessing.
The prompt promises more than the questions ask. Libraries, nested JARs, and launcher disagreements weren't asked today. They may come back as fields later; the parser already covers none for libraries and the launcher keys.
On time, the lane is fast. With the scheduled run starting on time, the lane finished 37 s after the release, 1 min 34 s earlier than Day 21's late-started run (2 min 11 s).