Mordor Activator

Platform: CyberAreaCTF | Category: Reversing | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-07-15 | Status: Solved Techniques: custom_action_reversing, decoy_identification, msi_table_inspection, repeating_key_xor

Summary

Task: A Windows MSI activator hides an encoded flag across ControlEvent properties and an embedded custom-action DLL with decoy exports. Solution: recover five hex chunks, reverse RealBypass, and XOR the bytes with repeating MSI! after validating MORDOR-2026.

Mordor Activator — CyberAreaCTF

Description

Попробуй разобраться с этим зверем слышал, что ORC'и помогают

English summary: The challenge provides MordorActivator.msi (also distributed as MordorActivator.msi.zip). The goal is to inspect the installer, identify its real activation path among several decoys, and recover a CYBERAREA{...} flag.

The capitalized “ORC” hint points to Orca, Microsoft's MSI database and table editor.

Analysis

MSI tables

Open MordorActivator.msi in Orca and inspect the ControlEvent table. Its SetProperty actions build the KEY property from five chunks, in order: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 text read-only • copy allowed Copy
0E0A0B641F12
1B640C280711
390C7C4E1227
3B101B62286D
305349214D534921

Concatenating them produces a hex-looking ciphertext rather than a plaintext flag. The installer also contains product.cab. It can be extracted directly with 7-Zip:

 bash read-only • copy allowed Copy
7z x MordorActivator.msi -oextracted
file extracted/ActivatorDllFile
rabin2 -E extracted/ActivatorDllFile

ActivatorDllFile is a PE32+ x86-64 DLL. Its exports include GenerateFlag, FullActivation, and RealBypass, along with several deliberately misleading actions. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Custom-action DLL

The relevant routines can be inspected with radare2:

 bash read-only • copy allowed Copy
r2 -q -e scr.color=false -e bin.relocs.apply=true \
  -c 'aaa; s 0x2d05d18f0; pdf; s 0x2d05d13f0; pdf' \
  extracted/ActivatorDllFile

RealBypass implements the genuine path:

1. Read the MSI property BYPASS_CODE.
2. Require it to equal MORDOR-2026 exactly via lstrcmpA.
3. Read MODE (it does not affect the decoding) and KEY.
4. Keep only characters in [0-9A-Fa-f] from KEY.
5. Parse each pair of hex digits as one byte.
6. XOR byte i with MSI![i mod 4].
7. Store the decoded value in ACTIVATION_RESULT. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The final six decoded bytes are NUL padding, so they must be removed before displaying the result.

Decoy paths

The export names alone are not sufficient to identify the real routine:

• GenerateFlag returns the explicit decoy CYBERAREA{another_one_fake_flag}.
• Other exported actions similarly return plainly fake or error-themed flags.
• FullActivation runs the same style of decoder with the key CTF!, producing garbage.
• Only RealBypass, gated by MORDOR-2026, selects MSI! and yields a valid flag. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

This is why following the data flow into each exported custom action matters more than choosing the most plausible export name.

Solution

The complete solve is a direct reimplementation of the hex filtering and repeating-key XOR performed by RealBypass:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import re

key_property = (
    "0E0A0B641F12"
    "1B640C280711"
    "390C7C4E1227"
    "3B101B62286D"
    "305349214D534921"
)

filtered = "".join(re.findall(r"[0-9A-Fa-f]", key_property))
ciphertext = bytes.fromhex(filtered[:256])
xor_key = b"MSI!"
plaintext = bytes(c ^ xor_key[i & 3] for i, c in enumerate(ciphertext))
flag = plaintext.rstrip(b"\0").decode()
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

assert flag == "CYBERAREA{REDACTED}"
print(flag)

Run the supplied solver:

 bash read-only • copy allowed Copy
python3 solve.py
# CYBERAREA{REDACTED}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍