Tessa Tomble and the Sunken Dowry

PDF and ebook versions are available on my itch.io page

1. | 2. | 3. | 4. | 5. | 6. | 7. | 8. | 9. | 10. | 11. | 12. | 13.

1.

The voice sobbing from Tessa’s crystal ball was muffled and kept fading in and out. Tessa cocked an ear. She wished the Headmistress would get them some glass orbs. It might not look as fancy, but glass resonated so much more clearly than crystal. “What was that? Your mum ruined what?”

“My wedding,” the voice sniffled, “she’s absolutely wrecked it.” Tessa heard a noise like an angry gaggle of geese, which she reckoned was the caller blowing her nose.

She sighed. This is the third ruined wedding story she’s had to listen to tonight. She never understood why a big stupid party was so important. All that matters is if the two people love each other, right? Everyone else could sod off, as far as Tessa Tomble was concerned. Not that she ever wanted to get married, of course.

“Let me guess,” Tessa said dully, “she served honey water instead of mead? Brought peonies instead of roses?”

“No!” the caller shrieked, “she lost the dowry!”

Tessa’s ears perked up. She cleared her throat and tried her best sympathetic voice, which she thought was pretty convincing despite being out of practice and the wad of gum she forgot to spit out. “You poor thing,” she soothed, “tell me all about it.”

2.

“Ugh, kippers again,” said Tessa, poking at her lunch with a fork. She kept forgetting to look up what kippers are when she visits the library, but she was sure they couldn’t be anything good.

Natalia plopped her tray on the table and sat across from Tessa. “Can I have ’em?” She pointed at the kippers.

“You’d better not. I don’t know what they are. They might be poison.” Natalia scooped them onto her tray before Tessa could finish speaking.

“So what happened in spirit-calling today? Cassie said you were actually being nice to someone. I said she must’ve got you mixed up with someone else.”

“Well—” Tessa glanced over her shoulder. “Shouldn’t talk about it here. Too many people around.”

“Ooh,” said Natalia, “did you hear something juicy?”

Tessa leaned close to her friend and dropped her voice to a murmur. “Dignum me in carcere caeco.”

“You know I don’t speak Pig Latin,” Natalia reminded her around a mouthful of kipper.

Tessa dug her wand out of her pocket and extended it. She held her hand in front of her face, waved the wand in tight little figure 8s, and muttered. She held her hand up to her friend. Natalia squinted. The palm had “MEET ME IN THE DUNGEON” written in glowing pink letters, which faded after a moment.

“Ew, the dungeon’s full of dung beetles! I’m not going down there!”

Tessa cradled her face in her hands. “Look, I’ll tell you outside after lunch, okay?”

She realized that Leo had been sitting at their table, staring into space and eating in silence. He’s a short, pale kid with sandy hair sticking out wildly under his enormous hat. His dull gray robe hung on him like a wool blanket with a hole in the top. Tessa wanted very much to know what trick he used to make himself invisible without magic.

“How much of that did you hear?” she said, collapsing and extending her wand in what she hoped was a threatening manner.

“How much of what?” Leo said, not looking at her, munching what appeared to be a frog sandwich but was probably just badly wilted lettuce.

“Don’t worry about moon boy,” Natalia said, sawing a chunk of bread in half. “Leo, you’re a sweet kid. You won’t tell the Headmistress if we do some crimes, right?”

Leo turned to face her, eyes wide. “Crimes? What kind of crimes?”

“Never mind,” Tessa said, nibbling thoughtfully on the tip of her wand. “Leo, meet us outside after lunch, ok? We’re going to need your help.”

“I have to go to the athenaeum. Big lunarology quiz tomorrow.”

Tessa nodded. “Full, gibbous, quarter, crescent," she said, counting on her fingers as she rattled them off. “New, crescent, quarter, gibbous, full. There, you just studied. Hope you were taking notes.”

“Professor Fengari says—”

“Professor Fengari is a pompous creep who uses his telescope to leer at the girls’ swim team. I’m sure you could buy a good grade from that slime.”

Leo snorted. “Right, with whose money?”

Tessa grinned. “With all the gold we’re going to get tonight.”

3.

The bell rang. Mary the bellringer was outside, ringing it with all her might. “Hear ye, hear ye!” she cried, throwing open the canteen doors with a bang. “Afternoon lessons start in 10 minutes! Report to your classes at once! Hear ye hear ye!”

The students groaned. Some covered their ears, others tossed wadded-up pieces of bread at her. “We heard ye the first time!” one shouted. Mary’s job was thankless, but it’s like her granddad always said, if a job’s worth doing, it’s worth doing with gusto.

“I’ve got chemistry,” Natalia said, bolting up from her spot and dumping scraps of lunch into the bin in one elegant motion. Leo stood up and brushed crumbs off his robe.

Tessa shook her head. “Shirk chemistry. Gold is the only chemical that matters. Meet me behind the gymnasium in five minutes. Persona mora,” she added, pointing her wand at Leo.

Leo froze. Tessa had noticed he was starting to slink away, so she cast a spell to root him in place. It was officially forbidden for students to use magic on each other, but there was a mutual understanding that the professors would look the other way as long as no one was seriously hurt or bullied, because everyone knows you can’t make 2000 teenagers abstain from the one actual benefit of all this ghastly education. The students, for their part, appreciated the adults’ pragmatism and kept their end of the bargain… mostly.

“The moon—” Leo started.

“The moon can wait. It’s been up there at least 20 or 30 years, it’s not going anywhere.”

4.

Five minutes later, Tessa and Natalia were standing behind the gymnasium, watching the other sophomores spread out across campus like puff-flower spores. One of those spores was Leo, hands in his pockets, starting up the hill to the athenaeum. “Leo!” Natalia shouted. “Leo! We’re over—uh!” Natalia grunted as Tessa reached up and knocked her pointy hat to the ground, irritated. So much for subtlety.

Leo jogged awkwardly down the hill, holding his hat with one hand and keeping the other in his pocket to stop his too-long robe from dragging in the dirt, dingy gray fabric bunching up near his thigh. “What?”

“Bucketsful of gold, Leo,” said Tessa. “That’s what.”

“Yeah, tell us about the gold,” Natalia prompted.

“Okay. So I had a very interesting conversation during spirit-calling today.”

“Spirit-calling?” Leo asked.

“You know, consulting the spirits of the dead, lighting candles and burning smelly stuff, beseeching your ancestors for guidance, that sort of thing.”

“I didn’t know that was a class,” Leo said.

Tessa scratched her head and looked at the ground. “Well, it’s sort of an extra-curricular,” she explained.

Natalia rolled her eyes. “Of course you didn’t know about it,” she said, “being someone’s ancestor takes a lot of patience and empathy. You gotta be sensitive. They don’t want boys doing it.”

“So anyway, this upper-class twit from Dewdrop Valley called to whine about her stupid wedding,” Tessa continued. “I detest romance, so I was zonking out as usual.” Natalia nodded.

“But then she said that earlier today, she and her mum were crossing Sediment Lake to take the dowry to her guy, right? But their coach bumped against the guard rail, and her mum shouted at a driver who was crossing the other direction and wasn’t giving them enough space. Well, this driver must’ve been a wizard or a druid, cause he pointed and said something that spooked their horse good. It took off like a shot, their driver tried to get it under control, but their coach went all tipsy-turvy and dumped them out on the bridge.”

“What an ass!” Natalia cackled.

Tessa nodded. “That’s not the best part. The Dowry was in this big wooden box, and when they tumbled the box slid under the guard rail and went plop right into the lake!”

“Serves her right!” cried Natalia with glee. “Honestly, paying a fortune to a loathsome aristocrat all so her daughter can marry some bore. It’s frumping medieval, if you ask me.”

“How much was the dowry?” Leo asked.

“I don’t know,” Tessa admitted, “but it has to be at least enough to pay for a big fancy wedding and a spotless white stallion and a cozy little cottage in the steppes. Probably a hundred gold coins.”

“We could eat at the Powder Keg!” Natalia said. “Get ’em to grill us a proper steak! I’m so sick of kippers.”

“What did you tell her?” Leo asked.

“Huh?” Tessa turned to him. “I dunno, everything happens for a reason, keep praying and the spirits of her ancestors will provide, the same nonsense we tell everyone.”

“Let’s go get the gold!” Natalia proclaimed, a hungry look in her eye.

“No, we can’t go now. The whole town’ll come to rubberneck, and we’ll catch holy hell once the Headmistress gets wind.”

“Oh. Oh yeah,” Natalia muttered, her excitement abating. “Tomorrow morning?”

Tessa shook her head. “They’re probably off hiring a salvager right now. I’d wager those kind will pay top dollar to get someone out as soon as they can. No, our best bet is tonight, after curfew. Bring your wands, leave your hats. The lamps go off at midnight, the last guard leaves at 1. That’ll give us plenty of time before dawn.”

“How will we find it in the dark?” Natalia asked. Tessa smiled at Leo.

“That’s where our lunomancer comes in.”

5.

The trio were taking cover behind a tree near Sediment Lake, watching the guard pace around the path to the bridge. Natalia was casting a shadow spell around them, so they were invisible to anyone who wasn’t practically on top of them. Tessa and Leo were sprawled out, playing a game of Wizard’s Chess by lantern light, which is like normal chess but with considerably more cheating. Tessa was winning three to one, because after his turn Leo would glance up at the moon and scribble something in a little ledger.

“One forty-three AM, moon still in sky,” Tessa teased. Leo stuck the ledger in his pocket.

“You don’t get how complicated lunomancy is,” he said, his once-timid voice full of pride. He knew more about the moon than anyone else on campus except for Fengari, the Lunomaster. “There’s all sorts of weather factors to consider. And depending on the time of year, the stars can make a spell more potent or muck it all up.”

“Ah, of course,” said Tessa. “Gotta be careful in case the stars spin round and we find ourselves in Elevenfrost.” She snickered.

“The stars don’t spin,” Leo corrected. “Actually, the stars appear to move because as the earth revolves around the sun—”

“I’m about to spin myself down there and tell this guard to sod off,” Tessa murmured. “Doesn’t he know it’s almost 2? What’s he waiting for? A kiss goodnight?”

Natalia slumped against the tree and half-heartedly waved her wand, muttering a few words of shadowspeech. “I can’t keep this going forever, you two’ll have to snuff that lamp.”

“No worries, it can’t be much longer now. Checkmate,” Tessa added as she moved her bishop up and around Leo’s knight to take his queen. Leo looked down and studied the board, furrowing his brow. Tessa snuffed the lamp.

Natalia dropped the shadow spell and used her sleeve to wipe beads of sweat from her olive-gray face. The perspiration came from both the exertion of the spell and the intense mid-Sevenburn heat. “The brat just couldn’t get married in Threeshower, could she? It’s hotter’n a salamander’s bumhole.” She pushed stubborn strands of damp tea-colored hair behind her ears.

Just then, they heard whinnies from the bridge. The guard packed up his gear and unhitched his horse. He climbed on his steed and gave it a little squeeze, and they trotted leisurely in the direction of Pub Square.

Tessa flicked her wand and the tip sparked with a small fairy light, just bright enough to light up their path. Leo hopped to his feet. “They’ll sure be glad to have that gold back,” he said. “How much do you think they’ll give us?”

Tessa and Natalia stared at him. His cheeks burned. “What?”

“Once you’re the new Lunomaster,” said Tessa, “maybe you can learn a thing or two about how things work down here on Earth.”

6.

The three stood smack in the middle of the bridge. Not another soul could be seen. Crickets chirped peacefully, and they could hear lake critters splashing below them. Off in the distance, an owl hooted mournfully. “Okay, moon boy, you’re up.”

Leo looked at the moon. He licked his lips. He swallowed hard. He said “Um.” He pulled out his wand. He said “Um” again. Tessa crossed her arms. “You do know how to cast moonglow, right?”

“My sister took lunomancy, it’s a first-year spell,” Natalia said. “He frumping well better know it.”

“Of course,” Leo said, defensive. “It’s just… well… the moon is waxing gibbous.”

“So?”

“Professor Fengari said we have to be careful casting moonglow when it’s almost full, because making it brighter might cause some… animals… to mistake it for a full moon. Some bad animals.”

“Fengari’s an old dullard,” Tessa snapped. “Werewolves aren’t going to be tricked by a silly cantrip. They know when it’s a full moon. You can’t fool instinct.”

Natalia nodded. “He’s just tryin’ to scare you. Don’t tell me you believe that rubbish.”

Leo took a deep breath. He looked back at the moon. It loomed large above them, but a cloud was passing by, dulling its shine. “Five more minutes, probably.”

Natalia pulled out her wand, snapped it open with a flick of her wrist, stabbed the point toward the sky, and shouted. “Flytja!” Small puffs of cloud scattered like spectators at a game of Bolti avoiding a pop fire ball, and dissipated.

Leo blinked, then waved his wand in broad, sweeping motions so the moon could see it. He said something the girls found unpronounceable, and the quantity of light around them drastically changed. The moon shimmered and it seemed like all the moonlight was focused on Sediment Lake. Confused birds started twittering, wondering how it was day again already. “Whoa! Eerie,” said Natalia.

Tessa waved her wand in big circles all around her. “Auratum splendescere,” she intoned. Natalia peered over the side of the bridge as Leo concentrated on the moon. The water was cloudy and green with algae, and Natalia was straining to see into the depths. “You’re sure she said Sediment Lake, right?”

“Positive,” said Tessa, peering over the opposite side. “Keep looking. It can’t have gone far. The box would have sunk like a stone with all that gold in it.”

“I can’t see a blasted thing with all this… wait! I think... Yes, there it is!” Natalia pointed. Tessa saw a faint glimmer at the bottom of the lake, and cackled with glee. “I knew it! Okay, bring it up!”

Natalia sat up and looked at Tessa. “Who, Leo?”

“No, you!” Tessa snapped. “Aren’t you taking hydromancy?”

Natalia grunted. “You have to touch something to enchant it with buoyancy, chicken-wit! I can’t just look around and ensorcle whatever floats my boat!”

They heard a confused murmur. The pub hounds weren’t yet too drunk to notice that the moon was shining a lot more selectively than usual, and they had decided to go investigate. A small crowd of Daggburg’s colorful nightlife was cautiously approaching the bridge, lamps raised, clubs drawn. The moonbeam faded in and out. “Um. Um. They’re. Some guys are coming,” Leo said, breathing heavily.

Tessa looked at the crowd and bit her lower lip. Time to think fast. “You have to touch it? Then let’s go touch it.” She grabbed Natalia by the wrist and dove off the side of the bridge. Natalia screamed, but the sound was cut off with a sploosh when they hit the lake and got their breath knocked out.

7.

Natalia cast Burton’s Bubble. They bobbed awkwardly in the water as a little mini-hurricane swirled around them. They raised their hands to their faces and swatted away fish and vermin that were sucked into their windy vortex. Natalia caught her breath and continued shouting. “You harpy! You absolute wretch! I oughta let you drown! When we’re back on land I’m gonna—”

“Hurry and drop us to the bottom,” Tessa said calmly. “Leo’s not going to be able to focus on the moon for long.”

Natalia punched Tessa on the shoulder as hard as she could, which given current atmospheric conditions was not very hard at all, and they plummeted. Tessa shrieked and tried to curl into a ball to protect herself, but the eddies and jet streams inside the vortex caught her robe and she became the world’s first underwater mid-air tumbler. Natalia sat cross-legged on the water and grinned.

8.

Leo was trying to ignore the small mob advancing on the bridge, hoping that if he just acted natural they’d leave him alone. “Hey, it’s just a kid!” one of them shouted.

“He’s from that daft wizard school! Look at his robe!” shouted another.

“Can’t be, he ain’t got a hat,” a lady pointed out. A murmur of assent washed over the mob. Wizards wore pointy hats, everyone knew that.

“Well, who is it then? And what’s he doing to the moon?” It was a reasonable question. A big beefy man wearing a horned helmet and carrying a massive iron club muscled his way to the front of the crowd and approached the bridge. “Oi!” he shouted. “Boyo! What’re you doin’ out here?”

“Bridge inspection!” Leo called, his face flushing at the sound of his squeaky voice. He stared at his shoes. The big man turned to the crowd. “Bridge inspector? A lil’ sprat like that?” he shrugged his massive shoulders.

The lady said, “He can’t be the bridge inspector! He ain’t got a hat!” Another murmur. Even a drunken mob knew a bridge inspector would never inspect a bridge without their official bridge inspection hat.

The beeflord had heard enough. “Let’s get ’im!”

9.

Tessa and Natalia stood on the now-dry patch of lake bed, catching their breath and shaking starfish off their legs. Word had gotten around that there was some sort of apocalypse happening, and the lake critters were keeping their distance except for the occasional foolish clownfish or curious catfish.

“Okay,” Tessa said, holding her arms out to steady herself, dizzy from her harrowing gymnastic triumph. “The gold’s gotta be right around here. We saw it glow.”

All they could see around them was swirling rushing water and the inch-thick layer of sooty grime on the lake bed. The vortex was picking up bits of the stuff, which rained down on them like black snow. “How will we find it?” asked Natalia.

Tessa tried to sweep her wand around, but it was no good; the tip kept getting knocked off-kilter by powerful hydromantic forces. “Pop the bubble for a tic so I can cast a spell,” said Tessa.

Natalia nodded. “Take a deep breath,” she said, “I’ll drop it on the count of three. Ready? One, t—”

Suddenly a huge catfish flew in from above and bonked Natalia’s noggin with an angry hiss. The blow knocked her senseless. Tessa had just enough time to take a big gulp of air. Natalia’s sudden loss of control over the spell made the bubble pop violently, and the chaotic thaumic forces sent them both skidding across the lake bed. Tessa pulled herself to her feet and pawed at her eyes, wiping away grime that had turned her toffee-brown face black as a swan, but just as she could open her eyes again, everything faded to darkness.

10.

The six-foot-five beeflord with tree-trunk biceps stomped drunkenly across the bridge towards Leo. He hefted the iron club and swung it through the air with the effortless motion of a master butcher cleaving through hot gristle. “Steal our moonlight, will you? You won’t get away with it! Right, mates?” The crowd gave a rousing Huzzah.

“I’ll stop! I’m sorry!” Leo cried, dropping his wand. The light around them dimmed, the birds stopped twittering and the crickets resumed their twilight chorus. Another cheer went through the crowd. Leo fell to his knees and thought of his friends, tears stinging his eyes. “Please let them be ok,” he whispered.

11.

Tessa swam around in circles, feeling around the lake bed blindly, trying to find Natalia. She lit the fairy light, but its weak glow was barely visible in the murky deep. She wracked her memory trying to think of a spell that would help. It was impossible to tell where she was, or where she was going. In her head she cursed the stupid worthless academy and all the useless wizards for not teaching her one frumping people-finding spell. It took all her willpower not to cry out in anguish, but she knew every drop of breath was precious. She kept searching.

12.

Excited by their daring moonlight rescue, the mob started heading back to the pubs for a celebratory round of grog. But then they heard the deafening roar of some otherworldly beast that stopped them in their tracks. Leo froze. The crickets stopped chirping. The townsfolk turned to look at the bridge.

Someone (or some thing) standing behind Leo stooped to pick up the wand and placed it gently in Leo’s hand. A strangely familiar voice spoke softly near Leo’s ear. “Good job, Leo. Keep the light shining.” The crowd gawped, trying to make out the monster’s shape in the darkness.

Not daring to disobey, Leo jumped to his feet and invoked the moonglow enchantment again, once more enveloping the lake with radiant white light. An eight-foot tall humanoid covered in coarse hair leaped over Leo’s head and bared its fangs at the mob with a vicious snarl. That sobered them up quickly. Most of them ran screaming back to their homes.

The beefy man rubbed his eyes and goggled at the creature. He pointed his club at it. “The moon-thief consorts with demons! Vile hell-spawn! We’ll be back for ye!” The monster effortlessly plucked the club from the man’s hand and bent it in two like a cheap spoon. The man took a step back, lost his footing, tripped over the guard rail and plunked headfirst into the lake.

The werewolf turned to look at Leo, who gazed up at it, slack-jawed and totally motionless save for his quavering knees. The beast tapped the tip of its snout with a great hairy paw and winked. Then it dropped to all fours, the remains of the club clattering on the thick wooden planks, and raced off into the forest, gone as mysteriously as it had appeared. The shouts of the mob receded into the distance, and all was silent. Leo stared at the moon. It was as full and bright as he had ever seen it.

13.

The light spread throughout the lake. Tessa looked all around and saw Natalia’s legs sticking out of a big green mess of lake-kelp. She swam over and disentangled her, then wrapped her tightly in her arms. “Mentis mederi!” she burbled. Nothing happened. Her eyes went wide as biscuits. It occurred to Tessa that she had never cast a spell underwater. Maybe the wand couldn’t hear her. She brought it as close to her lips as she could without kissing it.

“Mentis mederi!” she sputtered again. Natalia’s face shone with a soft white glow. The two were once again surrounded by swirling vortexes and enclosed in a bubble of air.

Natalia coughed and sputtered and gasped for breath, wiping the black grime from her face. Still embracing her friend, Tessa sobbed with relief. “I thought you were a goner,” she cried.

Natalia clutched Tessa for a moment. She pulled away and turned, pretending to cough again, wiping her eyes as well as she could on her sopping wet sleeve. She turned back to Tessa with an awkward smile. “Ahem, well, we won’t find the gold by standing around and sniffling, right?”

Tessa nodded, smiling and wiping her own eyes. “One more thing,” she said. She placed her hands gently on Natalia’s head in a protective gesture. “Mentis murum,” she whispered. The air around Natalia’s head shimmered. “Okay, ready.”

They both took a deep breath, and Natalia undid the spell. This time the violent whorls faded gradually, and lake water poured into the bubble as if through a sieve.

Once her eyes adjusted to the water again, Tessa looked at Natalia, who gave the thumbs up. Tessa held her wand up to her mouth like a magic microphone. “Auratum puncta!” she burbled. She spun around in a slow circle, holding her wand out at a 90 degree angle until it started wobbling back and forth of its own accord like the needle of a compass, then came to a stop. It was pointing sharply in some direction at a slight downward angle.

The two of them swam blindly, trusting the magic to lead them to treasure. Even without the bubble, they could barely see through the cloud of little black particles that surrounded them.

“So that’s why it’s called Sediment Lake”, thought Tessa, “Some oaf dumped about a million tons of sediment down here.” She made a mental note to complain about this in her campus newsletter column, Views From a Cesspit.

Before long, they came upon a brand-new-looking ornate wooden box half-buried in the black muck. Tessa fumbled with the latch and opened the lid a crack to peer inside. The glint of gold was unmistakable. She quickly latched the lid to keep the treasure safe. She pocketed her wand and each of the girls grabbed one of the big leather straps. Natalia practically stabbed the lid with her wand. “Flotja!” she gurgled. The trunk and its contents became much lighter than the water around it, and it lifted itself up out of the gunk. The two held on tightly and floated up with it.

A few moments later, the girls burst triumphantly above the surface of the water, clinging to their treasure for dear life, cheering as they gasped for breath. They swam to shore, towing the box between them. Natalia picked up the box and they ran to meet their friend on the bridge, water draining out of the box’s cracks and crevices leaving a trail behind them. They held the box out to show Leo and whooped with joy. “We did it! It was really there! I knew it would be there!” Tessa laughed, bobbing up and down in her excitement. She stopped and frowned at Leo. “Hey, what happened to you? You looked like you’ve seen a ghost.”

“Wait just a tic-tock,” Natalia said. “The buoyancy spell only works in water. How…?” She freed her hands from the straps and hoisted the box above her head.

“You’re right,” said Tessa. “That thing should weigh as much as a hog.”

Natalia set the box down. They both noticed a strange scuffling noise inside and cocked their heads, hands curled around their ears. “Enchanted coins, eh?” said Natalia. “You can hear ’em rattling around in there.” She smiled, but didn’t sound convinced. Tessa stooped and undid the latch.

She opened the lid, and flopping there in the box was a beautiful gilt-head salmon. It was two feet long if it was an inch, and its golden scales glittered in the moonlight. Leo walked over and peered over Tessa’s shoulder.

Tessa scooped the fish up and looked carefully to make sure there weren’t any coins underneath it, then put the fish back.

“Ah,” she said, “that’s right. Aurum is gold. Auratum is the fish.” Natalia looked at her. “I always get those mixed up,” said Tessa. Natalia stared at her. Tessa shrugged.

Natalia looked at the fish. “It’s better than kippers, at least,” she sighed.

Leo scratched his head. “Weddings are so weird.”

Tags: stories, fiction, long

Last modified: May 01 2025 00:41:37 EDT

Mobile Data Banditry

Thursday May 01st, 2025

Tags: archive, hacks, internet, long, phones, tech

I have a cheap no-contract phone plan that offers a couple gigabytes of data plus "unlimited talk and text" for $15 a month. Since this is supplementary to my home internet, the couple GB is usually enough, if I'm careful to use mostly text-based applications. Every once in awhile there's a new podcast I want to download and listen to immediately, or I want to look at a site on the adweb, but these occasions are rare and I've gotten pretty good at rationing my data to last all 30 days.

In April, I ran out on day 29. So close! I knew I'd be fine without for a day, I could still text my partner and I could still call someone if there was an emergency. But when this happens, I get curious whether there might be a way to circumvent the data restriction.

You see, my phone is still receiving data. Text is data. I can visit the website for my phone carrier and pay my bill. I can send and receive multimedia messages, that's potentially a lot more data than a text. My phone still says I'm connected to LTE. Clearly there's a normal data connection there and my carrier is just limiting what sources of data I can connect to. But what if I can fool the network into thinking I'm doing approved data activities when I'm not?

I touch on technical concepts about which I have some basic understanding but am not an expert. If you don't care about my kibitzing, here's the

TL;DR

I didn't find a way to fool it, but I think MMS has some untapped potential, I discovered a loophole that gives me access to some useful google web functions, and I might have forced my cell phone provider to fix a very cute exploit.

background: what is a phone?

I pride myself on having approximate knowledge of many things, but I'll be honest, I don't have a clue how phone networks operate. Modern ones, I mean. When you're talking about old copper-wire POTS¹, I can trace a conceptual line from the telegraph and electrical sound modulation to pulse dialing and switchboards with human operators; then to touch-tone dialing and electronic switchboards controlled by DTMF tones. I may not understand the fine details, but I get the gist.

Now that everything is cell phones and VOIP, I have no clue. It's a black box. I know people have set up their own home PBX/VOIP systems with software like asterisk, but I can't conceptualize how it works. I know it involves "leasing" a phone number, but how? From who? Who owns phone numbers? The government? Do I call up the FCC and say "one phone number, please"? I think it probably involves multiple levels of intermediate wholesalers, and I can't imagine the total expense is anything but prohibitive.

Likewise, I have no idea how cell phones differentiate "stuff that comes through the phone number" and "stuff that comes through the internet". So, my first idea is totally hypothetical and based on shit I don't understand.

method 0: MMS

Multimedia Messaging Service (MMS) is an extention of the old Short Message Service (SMS) used for texts. These days, it's most famous for being abused by texting apps that want to cosplay as full-featured chat programs, with reactions and rich media, so if you're in a group text with a bunch of people using iphones, it's this annoying bullshit smeared over dozens of sprawling incoherent messages:

The future of communication.

But before Apple did what Apple always does to standards, it was a perfectly nice way to send pictures or voice messages to your friends. It seems like the maximum size for an MMS message is 300KB, 600KB, or 1MB, depending on which google result you believe and whether your carrier is using the most recent standard.

So, it seems like it should be fairly simple to send any size file you want in chunks encoded as png images or Base64 text.

The hard part would be automating a system that can send via whatever pipe MMS messages are sent through. I don't have a computer with a phone number, and I don't know how to send anything to a phone number.

But interestingly, the server my carrier uses to relay MMS is http!

Luckily, the photo editor on my phone has a weird bug that makes images look gnarly and cybre whenever I use the pen tool. Redaction-core!

If the MMS data is sent over http—assuming it's not somehow encrypted (the "wapenc" in the url could be a clue that it's being encrypted or it could just mean encoding, I have no idea)—it should be possible to snoop on the packets, figure out how they're being sent, and reverse-engineer a way to send your own data through that pipe. And this is where my well of technical knowledge has run dry. I have no idea how to do what I described. I just suspect it may be possible.

method 1: hang on a sec

But wait... you don't necessarily have to text someone from a phone number. Every (?) cell phone carrier gives you an e-mail address. It's your phone number @ a special domain, like 5558675309@txt.carrier.com. So you'd just need to encode the data chunks, e-mail them, then reassemble. This is a system someone could actually build. Sending large amounts of data this way might cause you to get rate limited or throttled, but ah, that would mean the "unlimited texting" they promised is a filthy lie, wouldn't it? Then they got a lawsuit on their hands 🙃

But hey, with smaller files, encoding shenanigans might not even be necessary. At first, I assumed that MMS systems won't let you attach arbitrary file types, because when I try to include an attachment in a text message, the options presented by the android UI are pretty limited:

But if I'm sending an email, I'm not restricted to what this UI will allow me to attach. Can I text myself Super Mario Bros.?

Hm, okay, "Please check the message in detail." I can probably do that by... uh... "long-pressing" on it?

This time I cropped out the part of the UI with alpha transparency and it didn't fuck it up at all. What's the deal, phone?

Okay, 41KB. Mario is in there somewhere, in some form. How do I get him out? Mario's not equipped to survive in computer world. He doesn't have a frisbee made of light or anything.²

At first I assumed it's impossible and the system isn't built for these kinds of attachments, so I went through a whole bunch of rigamarole trying to send it with a .txt extension, copy the text, and turn it back into a .nes file on the other end, which didn't work (it just strips the part where all the binary data's hidden.) Then I tried to encode the rom into Base64 and decode it, which also didn't work. I spent a lot of time trying to figure out what I was doing wrong (I think it has something to do with incompatible line ending format between the two programs I was using) which is part of what made it take so long for me to finish writing this.

But I had an epiphany, and none of that was necessary. Turns out all I needed to do was long-press on the message and choose the worst-named function in UI history:

"share" 🙄

It gave me a list of different apps I could share it with. One of the options was the file manager. When I "shared" the message with it, I got to choose a location where I wanted to save it:

And there you have it. It always appends 001 to the filename for some reason, but otherwise it's the same file. I texted myself an NES rom via e-mail and it works in Nesoid. No metered data required.

Finally, Mario the way it's meant to be played: while smooshing your thumbs against indiscernible spots on an unyielding glass screen.

So now that I know it works, it's time to test the limits.

First off, I don't know whether this is obvious, but you do need an active data connection to get the attachments. I tried turning mobile data off, and messages will come through, but it's just the SMS text notifying you that you received something; none of the data in the MMS layer is accessible over the edge network. Once I turned LTE back on, it came in properly.

I know it works on a data connection that's been suspended for going over the cap, but it wouldn't work if I were suspended for nonpayment; even though there is an active LTE connection, I wouldn't be able to get calls or texts.

• I tried it with the Dragon Warrior 3 rom, which is 512KB, and that went through fine.

• I wanted to see if it would allow me to send an APK, so I found one small enough, a tiny storage analysis utility called DiskUsage. It sent and installed with no issues.³ ⚠️ This should go without saying, but do not install random apk files from the web, or open any executable file from an unknown source. Doing so may may put your phone at risk. ⚠️

• I wanted to send a different file type between 600KB and 1MB, so I looked through my downloads and found a 700KB .mobi copy of Frank Herbert's Children of Dune. It also went through no problem.

• I sent a .7z archive of a GBA rom slightly more than 1MB, expecting it to fail, but it went through. Might the limit not be 1MB after all? Hm...

• A 5MB PDF? No probalo 👌

• A 16MB game boy advance rom? Well, now it gets complicated.

I assume it failed, and thus the file size limit is somewhere between 5 and 16MB, but I can't be sure, because it didn't bounce back on the e-mail end or give me some sort of undeliverable message warning on the phone end. It just silently failed. Or, maybe it hasn't failed yet.

This is where we get to the big caveat for this method: not only is it very slow, it's slow in an unpredictable way. A 5MB file might go through almost immediately, or a 50k file might take 10 minutes. The GBA rom might show up eventually, but at this point it's been half an hour, which is longer than any other file has taken, so I'm assuming the network unceremoniously discarded it. If this changes, I'll add an erratum here.⁴

Still, if it's not urgent, this is a way to get a non-trivial amount of data without counting against your cap. I can definitely see a scenario where it's practical to have a system where you send an SMS containing the URL for a file to an e-mail inbox on a server you control, a script fetches the file, and the system replies with the file attached. With a very low monthly cap, it's prudent to preserve every precious megabyte possible.

method 2: elite hacking skills

I have access to my carrier's website. What if I use the browser developer tools and drop an <iframe> on the page that loads the website I want?

Well, chromium-based browsers on Android (the one I use is Kiwi Browser) do have developer tools, just like Chrome on PC, but it's barely functional on a phone. When you try to edit a page element, the keyboard pushes the UI up to completely obscure what you're typing, so I had to type the tag in a text editor, carefully position my cursor, and use the paste button on the keyboard.

The ultimate development environment. A real hacker can sense the code.

I wanted the iframe to contain this website, so I pasted this just after the body tag:

<iframe src="http://bluelander.bearblog.dev">

Having the carrier website open in one tab and the developer tools open in another tab uses about 900% of my available ram, and doing anything at all with the dev tools slowed everything to a crawl, but eventually I managed to paste the tag and switch back to the site tab without the browser crashing. There was a big white box superimposed over the site that may have been an iframe failing to load the requested content, or may have just been general jank. I could no longer scroll or interact with the site in any way. I realize now that I should have used the TLS version of the URL, since it probably won't want to load an http iframe on an https site even under the best conditions, but if by some miracle the https version worked, this still clearly wouldn't be functional enough to rely on.

method 3: the samsung/telecom goodwidget pact

I have a samsung phone, so it comes with its own terrible built-in browser that I never use and can't uninstall. However, when I was experimenting, I discovered something shocking: even when data is restricted, google search is 100% functional in the samsung browser. Additionally, it's faster than any other website I use over LTE, ever.

I have an unlocked xcover 4 that originates from outside the US and a BYOP plan, so I assume samsung has worked out a deal with all the carriers to prioritize google search traffic, so people using samsung phones won't complain that the search widget sucks.

When I discovered this, I immediately set out to discover what limitations are placed on it. What I'm allowed to do is very granular: I can do a google search or a google image search. All of the instant search results still work, so I can find the weather for my area, or convert cups to millilitres, or calculate the square root of 7, or see the tallest punk singers in descending order of height.⁵

As soon as I tap on one of the results, the connection fails, even if it's an AMP page.

I can't go to most google subdomains directly, but some of them sort of work if I do a google search and then click on the link from the google search results. For example, nothing happens if I type books.google.com into the URL bar, but if I search for "google books" and click the link in the result, I have pretty much full access. I thought this would be a way to get to public-domain books, but gbooks itself doesn't seem to host any full texts, even ones it has the rights to. If I search for "Frankenstein", I can't find, like, a text version from Project Gutenberg. It's just various commercial publications, at best all I can get is a preview. You can find noncommercial versions, but they all link to a $0 purchase in the google play store, which I would argue is slightly less free than actually free.

I was able to get to google translate, which was exciting because there was a chance I could use the old anti-firewall trick: you can use google translate as a proxy to view whatever webpage you want, just "translate" a page that's already in english from another language into english. But no dice. Google Translate loaded, it looked like it was going to work, but when I clicked the link to view the translated page, just an infinite throbber.

While I was at it, I also took a stab at seeing if the google web cache would work, but nope, no connection.

Some subdomains are accessible, but less functional. If I search for "google drive", the link takes me to a splash page inviting me to log in, even if I'm already logged in. Clicking the link fails to do anything. Weirdly, youtube works, even when I type youtube.com into the address bar, but it has no video thumbnails and (naturally) I can't watch videos there. I guess this is so you can get fast results when you do a video search with the widget. And some subdomains like gmail and google news don't work at all.

I tried every google product I could think of that might be a backdoor to useful data—docs, sites, chat, voice, hangouts, blogger, podcasts, even weird shit like google arts and culture—and if I could access any of them at all, I was stymied as soon as I tried to do anything useful with them. They locked everything down as tightly as possible. That said, I consider this a small victory, because there are useful things I can do with my phone when I'm out of data. If I ever desperately need to prove who won the 1942 World Series to win a bar bet, there's nothing my telecom can do to stop me!

Oh no, I brought back the wrong sports almanac, this is the blaseball result!

method 4: sneak in through the help docs

This one's my favorite. Not only did it almost work, but it reminds me of a classic windows exploit only 90s kids will remember.

So, I'm back to Kiwi Browser. I load up my carrier's homepage. I'll be using this site to demonstrate the steps.

Tap the little lock icon in the URL bar, and tap where it says "Connection is secure".

It'll show you some info about the page's encryption status.

I didn't want the joke to wear thin, so I begrudgingly downloaded a different image editor. Don't worry, the glitchy isn't going anywhere.

At the bottom, tap "what do these mean?" and it'll take you to the google support page about TLS certificates.

Normally there's not many places you can go from here, but I'm logged in, and it's inviting me to take a look at my account settings.

From there, I can tap the waffle menu at the top and get access to a bunch of google services.

Now, this modal didn't work when I was using google in the samsung browser: it gave me a throbber that spun for a minute but eventually errored out.

It would give me a similar error if I tried to tap my account picture.

But here, it came up right away. So I tap News, and it takes me to google news. I wasn't able to get there with the samsung trick! Excited, I tap the waffle menu again and tap "drive". It takes me straight to my google drive account. I can see all my files.

But something's amiss. I can see the file names, but there are no thumbnails, and the javascript or CSS didn't load properly, because the page looks broken (I was too excited to think to screenshot this, a shame I will never live down) but I tapped one of my files, and... nothing. A throbber that throbbed forever. I force-closed kiwi browser, opened it again, tried to get back to the google help doc, and this time nothing happened. They caught me. I don't know how they noticed it so quickly, maybe it's because I was already fucking around to see what I could get away with, but that door is now closed. Still though, what a thrill. For just a moment, I could say... I'm in 😎⚡🖥️

If you're not familiar with it, the Windows 98 trick involves using a byzantine series of help menus to bypass the login screen, as immortalized in this gif.

conclusions

Method #4 ended up inconclusive, but it was exciting to find a back door, even if they did immediately slam it shut.

Method #3 is interesting, but probably not an actual exploit, and I don't know how universal it is, i.e. whether it's all samsung phones or just my specific model, or even if it would still work if my OS was up to date. Still, it's an actually useful feature I didn't know I had before.

Method #2 was a silly idea I didn't expect to work, but it was fun to discover new depths of just how bad an interface can be.

MMS is definitely the most promising option. I never guessed it would allow you to receive any type of file, as long as you know how to operate the arcane UI. The 5MB limit makes it tricky, but I remember in the days of shaky dial-up and only-barely-less-awful DSL, it wasn't uncommon to find large files distributed as dozens of chunks you stitch together with a program like hjsplit. Desperate times call for creative solutions.

I think we could be getting more milage out of MMS as a text delivery platform, too. If I had the technical chops, I think the first thing I would make is a relay to accept text messages, turn them into a wikipedia search query, and reply with a text-only version of the requested article. This should work even on the cheapest pre-paid normalphones that aren't useful multimedia devices, and I know wikipedia has its limitations, but having a cheap device with a cheap connection that lets you instantly find information about anything, well, it reminds me of something

[view big] [transcript]

So uh, if you read this far, thanks! Hope you had a good time. The moral of the story is: fuck around and find out, because fucking around is fun, and learning is cool 🦝

Like 👍 Share 📣 Save 🏛️ Reply 💌