💾 Archived View for tilde.team › ~aprilnightk › try3301 › cluehub › 2014_onion2.gmi captured on 2021-12-03 at 14:04:38. Gemini links have been rewritten to link to archived content
-=-=-=-=-=-=-
The RSA decrypted message said:
939 cu343l33nqaekrnw.onion
The site is not accessible since 11 Jan 2014, 04:00 GMT.
Upon visiting the address, the following document was displayed, the string it contained grew gradually:
<!--Patience is a virtue--> 634292ba49fe336edada779a34054a335c2ec12c8bbaed4b92dcc05efe98f76abffdc2389bdb9de2cf20c009acdc1945ab095a52609a5c219afd5f3b3edf10fcb25950666dfe8d8c433cd10c0b4c72efdfe12c6270d5cfde291f9cf0d73cb1211140136e4057380c963d70c76948d9cf6775960cf98fbafa435c44015c5959837a0f8d9f46e094f27c5797b7f8ab49bf28fa674d2ad2f726e197839956921dab29724cd48e1a81fc9bab3565f7513e3e368cd0327b47cf595afebb78d6b5bca92ba021cd6734f4362a0b341f359157173b53d49ea5dff5889d2c9de6b0d7e8c615286ce596bfa83f50b6eeabd153aaf50cd75f39929ba11fb0f8e8d611442846
Note the HTML comment that reads "Patience is a virtue". This soon became evident. We also noticed that every few minutes, another 2 characters, or 1 byte in hex representation, were appended to the end of that string.
This process continued for approximately 23 hours. The intervals between new bytes were found to be seemingly random multiples of five. A sample of the data collected:
Clock Time 00 20 25 35 50 05 15 20 45 00 15 20 40 45 05 10 15 30 40 15 Interval -- 20 05 10 15 15 10 05 25 15 15 05 20 05 20 05 05 15 10 35 Interval / 5 -- 04 01 02 03 03 02 01 05 03 03 01 04 01 04 01 01 03 02 07 Data added 26 e1 97 83 99 56 92 1d ab 29 72 4c d4 8e 1a 81 fc 9b ab 35
After 23 hours, the process stopped and no more characters/bytes were appended to the string. The final string was:
634292ba49fe336edada779a34054a335c2ec12c8bbaed4b92dcc05efe98f76abffdc2389bdb9de2cf20c009acdc1945ab095a52609a5c219afd5f3b3edf10fcb25950666dfe8d8c433cd10c0b4c72efdfe12c6270d5cfde291f9cf0d73cb1211140136e4057380c963d70c76948d9cf6775960cf98fbafa435c44015c5959837a0f8d9f46e094f27c5797b7f8ab49bf28fa674d2ad2f726e197839956921dab29724cd48e1a81fc9bab3565f7513e3e368cd0327b47cf595afebb78d6b5bca92ba021cd6734f4362a0b341f359157173b53d49ea5dff5889d2c9de6b0d7e8c615286ce596bfa83f50b6eeabd153aaf50cd75f39929ba11fb0f8e8d611442846
The total amount of characters is 512. Separated into groups of 4, with 10 columns, the data becomes:
6342 92ba 49fe 336e dada 779a 3405 4a33 5c2e c12c 8bba ed4b 92dc c05e fe98 f76a bffd c238 9bdb 9de2 cf20 c009 acdc 1945 ab09 5a52 609a 5c21 9afd 5f3b 3edf 10fc b259 5066 6dfe 8d8c 433c d10c 0b4c 72ef dfe1 2c62 70d5 cfde 291f 9cf0 d73c b121 1140 136e 4057 380c 963d 70c7 6948 d9cf 6775 960c f98f bafa 435c 4401 5c59 5983 7a0f 8d9f 46e0 94f2 7c57 97b7 f8ab 49bf 28fa 674d 2ad2 f726 e197 8399 5692 1dab 2972 4cd4 8e1a 81fc 9bab 3565 f751 3e3e 368c d032 7b47 cf59 5afe bb78 d6b5 bca9 2ba0 21cd 6734 f436 2a0b 341f 3591 5717 3b53 d49e a5df f588 9d2c 9de6 b0d7 e8c6 1528 6ce5 96bf a83f 50b6 eeab d153 aaf5 0cd7 5f39 929b a11f b0f8 e8d6 1144 2846
One of us noticed that if you interpret this data as a monochromatic bitmap, some interesting images can be obtained. When you asume that the bitmap is 25 pixels wide, the result is:
(Three links to the images, alas, are not reachable anymore).
! WE DONT HAVE ANY IDEA OF PURPOSE OF THIS STRING
(Thie notice was added on 11.1.2014, .onion 3 stopped updating, displaying similar string, same lenght 256 bytes; 'more on main 2014 page 3'
However at 05:31:40 GMT -- about an hour after the string was complete -- the document changed. The old 512-character code was gone, along with the HTML comment.
In its place was a string, the original of which is no more accessible (https://infotomb.com/oyfhl.txt)
Note that the HTML comment was changed from
<!--Patience is a virtue-->
to
<!--761-->
Taking the sum of the phrase "Patience is a virtue" using the Gematria Primus results in the number 761.
The new string was 3641299 characters long. It contained a significant amounts of repeated text.
761 is a prime, and was used in Cicada 2013 as the file name of a clue in the form of an mp3 -- "The Instar Emergence".
761 is also a palindromic prime EMIRP -- 167, its reverse, is a prime number as well.
Analsysis of this new string revealed that it contained three JPEG image files. To obtain them, we:
Every byte of string has to be XORed with 0xFF (11111111); we can achieve same efect if we invert every bit (1 beocmes 0 and 0 becomes 1)0x00 0x27 | 0x00 -> 0xFF
0x00 0x27 | 0x00 -> 0xFF 00000000 00100111 XOR | OR just reverse bits 00000000 -> 1111111 11111111 11111111 = | 11111111 11011000 | 0x27 -> 0xD8 0xFF 0xD8 | 00100111 -> 11011000
bytes 0xFF, 0xD8 indicate start of image
bytes 0xFF, 0xD9 indicate end of image
For example, the first two bytes of the original string were:
0x00 -> 0x27 00000000 -> 1111111
When you apply XOR with 0xFF, those bits become
0xFF -> 0xD8 00100111 -> 11011000
Which is the beginning of a JPG file.
The offsets of jpgs from beginning of the string.
To make files on *nix systems:
dd if=onionout.jpg bs=1 skip=$((0x00293ac)) > cu343l33nqaekrnw.onion.6.jpg
Commands for splitting the onionout.jpg into three files (offsets converted to decimal). Here the onion file is called onioninvert.bin after inversion (xor with 0xff):
dd if=onioninvert.bin of=onion1.jpg bs=1 skip=0 count=168876 dd if=onioninvert.bin of=onion2.jpg bs=1 skip=168876 count=1476614 dd if=onioninvert.bin of=onion3rev.jpg bs=1 skip=1645490 count=175159
Note that the 3rd file is reversed. Write a program to print out all the bytes in the reverse order to create the third jpg.