85 and two zeros

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-04-05 | Status: Solved Techniques: android_data_extraction, ascii_decoding, contacts_database_analysis, sqlite_forensics

Summary

Task: Android /data/data/ dump (~303MB ZIP), find a person's phone number. Solution: Extract contacts2.db, decode space-separated ASCII decimal codes stored in phone number fields to reveal the flag.

85 and two zeros — HackerLab

Description

"Мне нужно узнать номер одного человека на этом телефоне. Бро, я знаю, ты изучал форензику Android и уверен, что ты справишься. Только вот не знаю, можно ли через телефон записать буквы ASCII."

(I need to find out the number of one person on this phone. Bro, I know you've studied Android forensics and I'm sure you can handle it. I just don't know if there's any way to write ASCII letters through the phone.)

File: task_8500.zip (~303MB)

A large ZIP archive containing a full Android /data/data/ directory dump from an Android device (emulator, x86_64 architecture). The task name "85 and two zeros" refers to the task ID (8500). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Analysis

Step 1: Download and Extract

The file was downloaded using aria2c with 16 threads for speed. The ZIP archive uses the Store compression method and contains a full Android /data/data/ directory dump.

Step 2: Identify Forensically Relevant Databases

From the ZIP listing, four key databases were identified:

These were selectively extracted from the archive for analysis.

Step 3: Analyze contacts2.db

The main contacts database uses a standard Android schema. The data table stores all contact fields, with field types mapped via the mimetypes table:

• mimetype_id = 5 → vnd.android.cursor.item/phone_v2 (phone numbers)
• mimetype_id = 7 → vnd.android.cursor.item/name (display names)

 sql read-only • copy allowed Copy
SELECT d.raw_contact_id, d.mimetype_id, d.data1
FROM data d
JOIN mimetypes m ON d.mimetype_id = m.mimetype_id
WHERE m.mimetype IN (
    'vnd.android.cursor.item/phone_v2',
    'vnd.android.cursor.item/name'
);

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Six contacts were found:

Three contacts had "phone numbers" that were actually space-separated decimal ASCII codes — the key observation pointed to by the hint about "ASCII letters through the phone."

Step 4: Additional Findings (SMS and Call Log)

• Call log: One call to 88005553535 (Russian toll-free number)
• SMS messages: Two messages sent to ASCII-encoded addresses (681011021051101051161011081213299111111108 and 82101971081081213299111111108) asking "Hi! Do you have a flag?"
• Normal SMS to +79613450643 ("Hi)") and +48459669127 ("BOBR!" and "👾") ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Extract Contacts Database

 bash read-only • copy allowed Copy
# Download the large archive with multi-threaded download
aria2c -x 16 -s 16 "<url>/task_8500.zip"

# Selectively extract the contacts database
unzip task_8500.zip "data/data/com.android.providers.contacts/databases/*"

Step 2: Query Contact Data

 bash read-only • copy allowed Copy
sqlite3 com.android.providers.contacts/databases/contacts2.db \
  "SELECT d.data1 FROM data d JOIN mimetypes m ON d.mimetype_id = m._id \
   WHERE m.mimetype = 'vnd.android.cursor.item/phone_v2';"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Decode ASCII from Phone Number Fields

The contact "Мой Фсбшник" (My FSB agent) had the flag encoded as decimal ASCII codes in the phone number field:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
# Decode space-separated ASCII decimal codes from phone number field

contacts = {
    "N1GGA Bro 1": "82 101 97 108 108 121 32 99 111 111 108",
    "Trager Bro 2": "68 101 102 105 110 105 116 101 108 121 32 99 111 111 108",
    "Мой Фсбшник": "67 79 68 69 66 89 123 65 110 100 114 48 73 100 95 102 48 114 69 110 115 49 99 83 95 99 48 110 116 97 67 116 115 125",
}
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

for name, codes in contacts.items():
    decoded = ''.join(chr(int(c)) for c in codes.split())
    print(f"{name}: {decoded}")

# N1GGA Bro 1: Really cool
# Trager Bro 2: Definitely cool
# Мой Фсбшник: CODEBY{REDACTED}

The Android phone_v2 field accepts arbitrary text — it does not validate that the content is actually a phone number. This allows storing encoded data in what appears to be a phone number field.

Android Contacts Database Reference

The standard Android contacts database (contacts2.db) uses a normalized schema: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key mimetypes:

• vnd.android.cursor.item/phone_v2 — Phone numbers
• vnd.android.cursor.item/name — Structured name
• vnd.android.cursor.item/organization — Company/organization
• vnd.android.cursor.item/email_v2 — Email addresses

The data table uses generic columns (data1 through data15) whose meaning depends on the mimetype. For phone_v2, data1 is the phone number string — but Android does not enforce any format validation on this field. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍