Claude Code vs. Codex: FRA challenge 75746d-2025

A developer using Codex solved the first step of the FRA Challenge 75746d-2025 by visually enhancing faint low-contrast pixels in the upper band of the `footer_graphic.png` image, recovering the flag `flagga{alpha_mail}`. A separate attempt using Claude failed to extract the flag, instead focusing on audio waveform analysis of the same image without success. Both agents adhered to the constraint of not searching for external solutions, relying only on the challenge page and its direct assets.

FRA Challenge 75746d-2025: Combined Step 1 Report Date: 2026-05-30 Combined from Claude and Codex reports. Prompt The same prompt was used for both Claude and Codex: "Solve the challenge described on this webpage: <https://challenge.fra.se/75746d-2025/ Rules: You are NOT allowed to search for solutions to this problem. Only solve the first step, then stop and write a Markdown document where you explain in detail step-by-step how you solved the problem." Source Reports This combined report is based on the following local Markdown reports: - claude/STEG1-attempts.md - codex/step1 solution.md Both reports describe attempts to solve only the first step of the challenge. Both state that no external solution searches or walkthroughs were used. Executive Summary The two reports agree on the initial reconnaissance: the HTML page did not directly contain the real flag, and the only directly referenced assets were fralogo.jpg and footer graphic.png . Both reports also identified the footer image as the relevant artifact. The Claude report did not recover the flag. It focused on the footer image as a likely audio waveform and performed file-structure, metadata, string, LSB, and waveform analyses. That work ruled out several low-effort hiding places but stopped without extracting the hidden text. The Codex report recovered the first-step flag by visually enhancing faint low-contrast pixels in the upper band of footer graphic.png . The revealed flag was: text flagga{alpha mail} For completeness, the SHA1 reported by Codex for that flag was: text 710e77d190bf3c45a7c966b214bdaf1686d84c35 The Codex report explicitly states that it stopped after step 1 and did not open the SHA1-derived next-step URL. Shared Challenge Context The challenge page describes a flag format matching: text flagga{\S+} It explains that the SHA1 digest of the recovered flag becomes the URL path for the next step. The prompt for both agents required solving only the first step and then stopping. The direct page assets identified in both reports were: - ../fralogo.jpg - ./footer graphic.png The reports agree that the page source contained only the example flag and format description, not the real challenge flag. Comparison of Results | Aspect | Claude Report | Codex Report | |---|---|---| | Outcome | Not solved. Identified the footer image as the main artifact but did not recover the flag. | Solved. Recovered flagga{alpha mail} from a contrast-enhanced crop of the footer image. | | Elapsed time | Approximately 10 minutes. | 1 minute 54 seconds. | | Primary hypothesis | The footer graphic was treated as an audio waveform or amplitude envelope. | The footer graphic was inspected visually for faint hidden content. | | Key successful step | N/A. The report narrowed the search space but stopped before the reveal. | Cropped the top middle of the footer, multiplied brightness, and enlarged the crop. | | Constraint handling | No solution searches; only the page and direct assets were used. | No solution searches; only the page and direct assets were used. | Claude Attempt Summary Claude fetched the challenge page, confirmed the expected flag format, and checked the page source for literal flag strings. The only flag-like strings found in the HTML were the format expression and the worked example. Claude then downloaded the two direct assets and inspected their structure: - footer graphic.png : PNG, 1229 by 92 RGBA. - fralogo.jpg : JPEG, 158 by 86. - PNG metadata contained ordinary create/modify text chunks. - There was no trailing data after the PNG IEND chunk. - The JPEG had no trailing bytes after the end marker. Claude also searched printable strings, tested bit planes and LSB-style hiding, and probed likely sidecar or audio filenames. None of those checks revealed the flag. The Claude report's main investigation focused on treating the footer graphic as an audio-related artifact. It extracted an amplitude envelope, observed a one-sided waveform, identified repeated structures, and considered whether the image represented Morse, audio, SSTV, or spectrogram data. The report concluded that the image looked like an analog waveform thumbnail but that reconstructing intelligible audio from the image alone was not feasible. The blocking issue in the Claude report was that the waveform interpretation consumed the investigation. The hidden text was not recovered because the report did not pursue the low-contrast pixels in the upper band far enough. Codex Solution Summary Codex followed the same initial path: fetch the HTML, identify the two referenced images, and check the files and strings. Those checks did not reveal a literal flag. The successful observation was visual. Codex noticed faint low-contrast content near the upper middle of the footer image. It enhanced that region with ImageMagick: sh magick artifacts/footer graphic.png \ -alpha off \ -crop 600x35+450+0 \ -evaluate multiply 60 \ artifacts/footer top mid x60.png Codex then made a tighter crop and enlarged it: sh magick artifacts/footer graphic.png \ -alpha off \ -crop 260x28+545+0 \ -evaluate multiply 80 \ -resize 1040x112 \ artifacts/flag crop enhanced.png The enhanced crop showed: text flagga{alpha mail} Codex computed the SHA1 digest with: sh printf %s 'flagga{alpha mail}' | shasum -a 1 The resulting digest was: text 710e77d190bf3c45a7c966b214bdaf1686d84c35 Artifacts The full footer image is visually dominated by a cyan waveform-like graphic, but the recovered flag came from faint text in the top band. Original footer graphic /Users/joel/src/fra/codex/artifacts/footer graphic.png Enhanced crop revealing flagga{alpha mail} /Users/joel/src/fra/codex/artifacts/flag crop enhanced.png Consolidated Reproducible Procedure The combined, shortest reproducible method from the two reports is: 1. Fetch the HTML page at <https://challenge.fra.se/75746d-2025/ . 2. Confirm that the real flag is not present in the HTML source. 3. Download the directly referenced footer asset, footer graphic.png . 4. Inspect the image visually and focus on the faint upper-middle band. 5. Crop and brighten that band using ImageMagick. 6. Read the revealed flag: flagga{alpha mail} . 7. Stop, because the prompt only requested step 1. Conclusion The two reports are complementary. The Claude report documents a broad negative search and several ruled-out hiding methods. The Codex report provides the decisive extraction step: contrast enhancement of faint text in the footer image. The combined conclusion is that step 1 is solved by detecting and enhancing low-contrast text in footer graphic.png , yielding flagga{alpha mail} .