Hive Mind · Huntress CTF 2026

The challenge

"Registry hives from multiple systems have been renamed and separated from host labels. Identify each true root, regroup the systems, and isolate the planted hive."

answer_id	Question	Format
`d25-registry-001-registry-hive-root-name`	"Determine registry.hive_root_name for hive-001.hiv." (artifact `metadata-day-25-evidence.zip -> hive-001.hiv`)	exact text: "exact artifact-derived value only … use the literal none only when the requested field is absent"; trimmed

The Time Trial asked 30 questions: every earlier day's field (copied-file names and hashes, roster, BOM, JPEG, PNG, PDF, ZIP, PE, .NET, MSI, LNK, OOXML, email, audio, video, ELF, Mach-O, APK, JAR, SQLite, EVTX), today's hive root name, and the SHA-256 ordering synthesis. The Mastery asked the same family across 9 sets (270 questions).

Reading the prompt: what it said we'd need

Clue	What it pointed to	What I did about it
"Registry hives"	`regf` files: a 4 KiB base block, then `hbin` bins holding cells	A registry reader had been pre-built on 2026-10-14
"Identify each true root"	The hive's root key: the `nk` cell the base block points to, flagged as the hive entry	`registry.hive_root_name` is that key's name, read verbatim
"renamed and separated from host labels"	The file name and the base block's own FileName won't match the root	Today's hives were all `hive-001.hiv`, and the TT hive's embedded FileName (`cobalt-98d0d139.hiv`) had nothing to do with its root name, so only the root cell gives the answer
"regroup the systems … isolate the planted hive"	A synthesis step across several hives	No question asked for it; each set had one hive, and the synthesis question was the usual SHA-256 order list
"use the literal none only when the requested field is absent" (format)	`none` is a real answer only for a missing field	The solver's placeholder was `none`; it was never sent
"Hive Mind" (title)	Registry hives	Confirmed the reading

What was in the files

Single Solve: metadata-day-25-evidence.zip, 657 bytes, one member: hive-001.hiv, 8,192 bytes. The base block points to a root cell at 0x1020: an allocated nk with flags 0x2c (hive entry, no delete, ASCII name) and a 28-byte name, HuntressArtifactAssemblyLine. The base block's FileName field holds the last 31 characters of a path, ress-artifact-assembly-line.hiv.
Time Trial: evidence.zip, 705,800 bytes, 22 members: one sample per earlier day's file type plus hive-001.hiv (8,192 bytes). Root HyYmCLBQLqnViZFWdHHKbtP; FileName cobalt-98d0d139.hiv.
Mastery: one 5,841,162-byte zip of 9 evidence sets (evidence-01.zip … evidence-09.zip), 30 questions each. Each set's hive had a random-looking root name of 8 to 25 characters (VVFD4G85 … HqjLV8EYyDVYa7Zr0pTh6myHV).

Same template, different values. The Single's root name was a readable phrase; the timed hives used random names and unrelated file labels, so no value could be carried over.

Single Solve

The solver got it with no stop, through its candidate ladder. It opened the Single Solve untimed and checked the one question against what it knew: the field was new. Our Metadata solver from Day 23 raised don't know what this question asks for the slug registry-hive-root-name, and its best-effort placeholder was none. That placeholder was not sent.

A new field sends the solver to the candidate ladder, which runs on the untimed Single Solve only and stops at the first accepted value. It surveys the file with the solver's pure-Python parsers and ranks values whose rule names match the question's terms. Its plan had one candidate:

HuntressArtifactAssemblyLine, rule pure:regf-root-key-name. That rule is the pre-built regf reader (built 2026-10-14, eleven days early). It checks the regf signature and the hbin at 0x1000, follows the root-cell offset at 0x24, requires an allocated nk cell with the hive-entry flag (0x0004), and reads the name (ASCII when flag 0x0020 is set, UTF-16 otherwise). Anything off raises.
The reader registers regf-, registry-, hive-, and reg-root-key-name, but not today's registry-hive-root-name. That is why the solver didn't answer directly and the ladder had to match it.

Accepted on the first try. The ladder then saved the rule (not the value) for the slug at 09:00:13 ET: {rule: pure:regf-root-key-name}.

started_at  2026-10-25T13:00:07.127Z
deadline    none (Single Solve)
answers     1   HuntressArtifactAssemblyLine   (ladder candidate 1 of 1)
submit      13:00:13 UTC, ~6 s after started_at (the question check and the ladder plan ran in between)
result      CORRECT   flag a9a7836b…9840

The ladder doesn't record timings, so there is no per-step breakdown for this mode.

Before the timed runs, a regression rehearsal replayed 119 saved attempts through the solver plus the ladder's overlay: slowest 0.14 s, identical on every Mastery set, passed.

Time Trial

CORRECT on the first attempt, ranked. The start replied unique_attempts_remaining: 31 and variant_fresh: true.

Where the timed value came from. The solver runs every Metadata timed mode through the ladder's overlay: it runs the base solver, then applies only rules already accepted in an untimed Single. For this slug it re-runs pure:regf-root-key-name on today's hive and overwrites the base solver's answer. So the solver's report lines showing BEST-EFFORT … = 'none' in the timed sections are the placeholder before the overlay. The request log shows the real root name sent, and no none anywhere in the 30 answers.

started_at  2026-10-25T13:00:29.206Z
deadline    2026-10-25T13:01:19.206Z   (50 s)
answers     30   (hive root HyYmCLBQLqnViZFWdHHKbtP)
start        739 ms
artifact     318 ms   (705,800 bytes)
solve        147 ms
submit       749 ms
TOTAL       1953 ms   (submit +1.30 s after started_at)
result      CORRECT   flag f87edd2f…f1ae

The synthesis answer listed five files in ascending SHA-256 order, today's hive among them: ["document-001.pdf","collector-001.elf","shortcut-001.lnk","evidence-note-d7b9f5.txt","hive-001.hiv"].

Mastery

CORRECT on the first attempt, ranked (9 sets, 295 s clock; Day 24 had 8 sets and 265 s). The same overlay filled all nine root names from each set's own hive; the log shows 270 answers and no none.

started_at  2026-10-25T13:00:36.000Z
deadline    2026-10-25T13:05:31.000Z   (295 s)
answers     270 across 9 sets   (roots VVFD4G85, SxazC09l939GzLmg, TABtjZFAQjl1JRXn8DZtJ3, S254EYxUn,
            N8wzJZqqXmp, Wl2UBldZWy4E, WhfntLkBKoQGl, HqjLV8EYyDVYa7Zr0pTh6myHV, JgAkz64qHnjF6a8Cpehnfy)
start        123 ms after started_at
artifact     699 ms after started_at   (5.8 MB)
solve       2261 ms after started_at   (1562 ms)
submit      3057 ms after started_at
result      CORRECT   flag c40a10fc…3b22

No code was written for this lane today. The new field lives on as the ladder's stored rule.

Time to solve

All three modes were solved by 09:00:38 ET, 38 s after release (32 s from the first start request). The Time Trial and Mastery were both ranked and each went through on the first submit.

Takeaways

The ladder did what it was built for. A brand-new field name, an existing parser under a different name: the ladder matched them, sent one candidate untimed, and stored the rule for the timed modes. Same pace as Day 24 (38 s).
Store the rule, not the value. Every timed hive had a different random root name; re-running the accepted rule on each file is what made the timed answers right.
Read the report with the overlay in mind. The timed sections' BEST-EFFORT … = 'none' lines look alarming, but they are placeholders before the overlay replaces them. The request log is the place to check what was sent.
Pre-building paid off again. The regf reader was written eleven days early as a guess.
The prompt promises more than the questions ask. "Regroup the systems" and "isolate the planted hive" weren't fields today. They may come back as a multi-hive set; the reader already returns the root name, the FileName, and both timestamps, which is what a regrouping question would need.