zwesty
Write-ups / Day 24 / Metadata
Day 24 · Sat, Oct 24 · Metadata

Event Horizon

Prey slaughtered

Windows EVTX structure (file header, 64 KiB chunks, event records), pre-building parsers for likely fields

STTMClaude Homebase Both

Flags are shortened to their first 8 and last 4 characters because they're unique per team.

Challenge ID
metadata-forensics-day-24-event-horizon (+ /time_trial, /mastery)
Solved
2026-10-24: all three modes CORRECT on the first submit, by 09:00:38 ET, 31 s after the first start request (09:00:07 ET) and 38 s after the 9 AM release. Both timed modes were ranked runs
Player
Zwesty (solo), with Claude Code (Opus 5.5): our automated morning solver (a scheduled script on our Kali VM) did all three modes, with no hands-on work needed

The challenge

"Windows event logs from several hosts have been duplicated, truncated, and bundled with reports. Count records accurately and find the selectively shortened timeline."

answer_id Question Format
d24-evtx-001-evtx-record-count "Determine evtx.record_count for events-001.evtx." (artifact metadata-day-24-evidence.zip -> events-001.evtx) integer: "base-10 integer with no units, separators, or explanatory text"; trimmed

The Time Trial asked 29 questions: every earlier day's field (copied-file names and hashes, roster, BOM, JPEG, PNG, PDF, ZIP, PE, .NET, MSI, LNK, OOXML, email, audio, video, ELF, Mach-O, APK, JAR, SQLite), today's EVTX record count, and the SHA-256 ordering synthesis. The Mastery asked the same family across 8 sets (232 questions).

Reading the prompt: what it said we'd need

Clue What it pointed to What I did about it
"Windows event logs" .evtx files (ElfFile header, ElfChnk chunks, BinXML event records) A full EVTX reader had been pre-built on 2026-10-14, with its own BinXML parser
"Count records accurately" evtx.record_count: the number of event records actually in the file The reader walks every chunk and counts the records it can parse, rather than trusting the header's next-record counter
"truncated" A log cut short, so the header and the chunks disagree The reader fails closed on a missing or short chunk, so a cut file would stop rather than be miscounted. None was truncated today
"duplicated … bundled with reports" Copied files and the usual evidence bundle The copied-file and roster questions from earlier days; nothing new needed
"find the selectively shortened timeline" A synthesis step across logs No question asked for it by name; the synthesis question was the usual SHA-256 order list
"Event Horizon" (title) A pun on event logs Confirmed the reading

What was in the files

  • Single Solve: metadata-day-24-evidence.zip, 1,452 bytes, one member: events-001.evtx, 69,632 bytes. That is a 4,096-byte file header plus one 65,536-byte chunk. The header's first and last chunk were both 0 and its next-record counter was 4; the chunk held 3 event records.
  • Time Trial: evidence.zip, 638,182 bytes, 20 members: one sample per earlier day's file type (from camera-001.jpg to database-001.sqlite) plus events-001.evtx (69,632 bytes, 26 records, header counter 27).
  • Mastery: one 5,369,442-byte zip of 8 evidence sets (evidence-01.zip … evidence-08.zip, 20 or 21 members each), 29 questions each. Each set's events-001.evtx was again 69,632 bytes with one chunk, holding 4 to 108 records.

Every EVTX file in every mode had one full chunk, and its header counter was the record count + 1. So the timed variants reused the template with different record counts. The "truncated" and "selectively shortened" shapes the prompt promises weren't in today's files, and the reader's fail-closed paths were never exercised.

Single Solve

The solver got it with no stop. It opened the Single Solve, checked the one question against what it already knew, and found that the field evtx-record-count was new but already covered by a pre-built parser:

  • The EVTX parser was built on 2026-10-14, ten days before the day. It checks the ElfFile signature, the 128-byte header, and the 4,096-byte block size, then for each chunk checks ElfChnk, reads the free-space offset, and walks the records from offset 0x200: each must start with the **\0\0 magic, fit inside the used space, end with a copy of its own size, and decode to exactly one <Event>. evtx-record-count is the number of records found. Anything off (a short chunk, junk after the last record) raises instead of guessing.
  • The reader was checked when it was built: its test EVTX was read back by Windows' Get-WinEvent.
  • The solver was our existing Metadata solver from Day 23, which loads that parser. No code was written today.
started_at  2026-10-24T13:00:07.441Z
deadline    none (Single Solve)
answers     1   3
start        309 ms   (resuming the attempt opened by the solver's check)
artifact     347 ms
solve          1 ms
submit       686 ms
TOTAL       1343 ms   (submit +7.36 s after started_at; the check ran in between)
result      CORRECT   flag e9a61571…4e60

Before the timed runs, a regression rehearsal replayed 116 saved attempts: slowest 0.09 s, identical on every Mastery set, passed.

Time Trial

CORRECT on the first attempt, ranked. The start replied unique_attempts_remaining: 31 and variant_fresh: true.

started_at  2026-10-24T13:00:29.550Z
deadline    2026-10-24T13:01:19.550Z   (50 s)
answers     29   (EVTX record count 26)
start        572 ms
artifact     542 ms
solve         14 ms
submit       960 ms
TOTAL       2088 ms   (submit +1.61 s after started_at)
result      CORRECT   flag ec8e599f…2c9b

The synthesis answer listed five files in ascending SHA-256 order, today's EVTX among them: ["evidence-note-8550d7.txt","document-001.pdf","collector-001.elf","shortcut-001.lnk","events-001.evtx"].

Mastery

CORRECT on the first attempt, ranked (8 sets, 265 s clock; Day 23 had 7 sets and 230 s).

started_at  2026-10-24T13:00:37.055Z
deadline    2026-10-24T13:05:02.055Z   (265 s)
answers     232 across 8 sets   (EVTX record counts 4, 23, 40, 56, 47, 108, 8, 82)
start        769 ms
artifact     641 ms   (5.4 MB)
solve        190 ms
submit       898 ms
TOTAL       2499 ms   (submit +1.84 s after started_at)
result      CORRECT   flag 9ee26217…0b24

No code was written for this lane today.

Time to solve

All three modes were solved by 09:00:38 ET, 38 s after release (31 s from the first start request). The Time Trial and Mastery were both ranked and each went through on the first submit.

Takeaways

  • Pre-building paid off again. The EVTX reader was written ten days early as a guess, with evtx-record-count among its registered names; today it answered first time, so the lane needed no wording tests.
  • Count what is there, not what the header says. Today the header counter and the walked count agreed (counter = count + 1) in all 10 files. The prompt's "truncated" hints that a later day may break that, and the reader already walks the chunks.
  • The prompt promises more than the questions ask. "Selectively shortened timeline" wasn't a field today. It may come back as one (for example a gap in EventRecordIDs or TimeCreated); the reader already parses each record's ID and System fields.
  • On time, the lane is fast. 38 s from the release, the same pace as Day 22 (37 s).