26
$\begingroup$

There's a game development company which released a mysterious "countdown to reveal" web page, and the page is designed pretty fancy, so everyone in that gaming community is curious about this.

countdown web page

This seems to be a secret puzzle, to which hints are being released. So far, a forum post by the developers (1) claims 4 of 6 hints have been released:

enter image description here

(1)(The forum releasing the information is in Russian, however the game is popular in English speaking countries - If you use Google Chrome to translate that page and view the russian comments, lots of useful information is revealed.)

Update: TIMERCODE:::SOLVED:::get ready for escape

What could the secret message be?


Hint 1:

Everyone noticed this code, which is actually slightly visible on the web page:

N5TYJJETNWRXJ6KBNAYYFJEGPOSXD4EG

In the website code, it has the ID secret:

<div id="secret">N5TYJJETNWRXJ6KBNAYYFJEGPOSXD4EG</div>


Hint 2:

So, I look further into the code, and hidden is another mysterious, hidden element, containing binary data:

01001011 01001001 01011010 01010100 01000101 01010111 01010011 00110010 01001100 01000010 01001011 01010110 01001111 01010100 01000011 01001010 01001010 01001010 01000010 01000110 01000011 01010101 01000011 01010110 01000111 01011010 01000101 01010101 01010001 01010100 01000011 01000010 01001011 01001010 01000001 01010110 01001011 01010101 00110010 01001110 01001011 01001110 01001001 01000110 01001111 01010111 01010011 01001011 01001011 01010010 01001001 01010101 01001001 01010101 01000011 01001011 01001011 00110101 01001001 01010100 01000111 01010110 00110010 01000100 01001001 01001110 01001010 01000101 00110100 01010110 00110010 01001100 01001010 00110101 01001011 01000101 01000111 01010101 01000011 00110010 01001001 00110101 01001100 01010101 00110110 01001101 01010011 01010101 01001011 01000110 01000010 01010101 01010101 01010110 00110010 01011000 01001011 01000110 01001001 01000101 01010101 01010110 00110010 01000100 01001011 01001010 01001000 01000110 01001111 01010111 01001011 01010000 01001011 01010010 01000011 01010101 01001001 01010111 01010011 01001000 01001011 00110101 01000110 01010100 01000101 01010110 01000011 01010010 01001001 01001110 01001001 01000101 00110010 01010110 00110010 01010010 01000111 01001110 01001011 01000110 01001011 01010001 00110010 01010011 01001010 01011010 01000010 01010110 01001011 01010100 00110010 01010101 01001001 01001110 01000011 01010110 01000101 01010010 00110010 01011000 01001011 01000010 01000110 01000110 01001001 01010101 01001011 01000101 01001011 01000010 01000110 01000110 01001111 01010101 01001010 01010011 01001010 01001010 01001101 01010101 01000111 01010101 01010011 01001011 01001100 01000010 01001011 01010101 00110110 01010110 01000011 01011000 01001001 01010010 01001110 01000101 01001111 01010110 00110010 01010000 01001011 01000010 01001011 01000110 01000011 01010010 01000011 01001001 01001010 01001010 01001100 01010110 01000011 01001101 00110010 01010101 01001011 01001110 01000010 01010110 01000101 01010100 01010011 01000100 01001011 01010110 01001000 01010110 01001001 01010001 01001011 01000101 01001011 01000010 01000100 01010110 01001111 01010111 01010011 01001010 01001010 01001010 01001001 01010101 01001001 01010011 01010011 01010110 01001011 00110101 01001001 01010100 01000111 01010011 01010011 01010010 01001001 01001110 01001010 01000101 01010101 01010110 00110010 01000100 01001001 00110101 01001001 01010001

which translates to the alphabet characters:

KIZTEWS2LBKVOTCJJJBFCUCVGZEUQTCBKJAVKU2NKNIFOWSKKRIUIUCKK5ITGV2DINJE4V2LJ5KEGUC2I5LU6MSUKFBUUV2XKFIEUV2DKJHFOWKPKRCUIWSHK5FTEVCRINIE2V2RGNKFKQ2SJZBVKT2UINCVER2XKBFFIUKEKBFFOUJSJJMUGUSKLBKU6VCXIRNEOV2PKBKFCRCIJJLVCM2UKNBVETSDKVHVIQKEKBDVOWSJJJIUISSVK5ITGSSRINJEUV2DI5IQ

In the website code, it has the ID secret_code:

<div id="secret_code">
    <div class="secret_code">... binary data here ...<br><span>_</span></div>
</div>

Hint 3:

enter image description here


Hint 4:

This one seems to have a pixelated image of the bulb on the main page in the background. Upon reading into the Javascript, if you click the bulb 10 times, the binary code will drop down from above.

enter image description here


Hint 5:

The devs recently released this on the FB page. It looks like the bottom of hint 3.


Hint 6:

enter image description here


Hint 7:

This picture, along with the message "the true darkness is transparent". The image is a picture of a Wikipedia page in Cryllic/Russian. (Page in English: https://en.wikipedia.org/wiki/Portable_Network_Graphics#Transparency_of_image) enter image description here

Also, importantly, this image was uploaded along with the above:

enter image description here

enter image description here

"Darkness is transparent". This one has been worked on in image editors by users on the forum I link to at the top of this post and a short, perhaps 6 character string was discovered by editing it.


Hint 8:

"Look in the dark"


Hint 9:

A post on their FB page:

STATUS UPDATE: CRRNT RDDL STATUS: RDDL ADDED: S__RPUZZLE:::INPROGRESS http://www.countdowntoreveal.com/cam38/c38error_log.txt

Two helpful links from this (decoded the first line of base64 text for the second one and kinda guessed on the other two):

http://www.countdowntoreveal.com/cam38/corrupt2.rar

http://www.countdowntoreveal.com/cam38/corrupt4.rar

http://www.countdowntoreveal.com/cam38/node_14-4_kord.part1.rar

The code to open both of these is 89771130, the number from the Facebook group. However, the file inside cannot be extracted by conventional means.


Hint 10:

A post on their FB page:

STATUS UPDATE: KNOWTHETRUTH12_ALLSEEINGEYE STARTED

enter image description here

Hint 11:

enter image description here

Additional Hint A:

As Ivo Beckers pointed out in the comments, "tell me more" displays the following QR code which reads vjku ku pqv eyuc, using this decoder.

Then applying a Caesarian shift, this text translates to this is not cwsa which is the solved hint shown above.

QR code



Additional Hint B:

If one tries inputting the secret code as an extension to the URL, an interesting page is displayed:

description


$\endgroup$
  • $\begingroup$ By the way, binary translation resources: Here, and here $\endgroup$ – Viziionary Oct 7 '15 at 22:21
  • 1
    $\begingroup$ If you click "tell me more" a QR code appears on the bottom: countdowntoreveal.com/img/qrcode.png According to my qr code reader app it means: vjku ku pqv eyux. Not sure what to make of that $\endgroup$ – Ivo Beckers Oct 7 '15 at 22:42
  • $\begingroup$ @Ivo As stated in the question, it's THIS IS NOT CWSA $\endgroup$ – warspyking Oct 8 '15 at 1:32
  • 3
    $\begingroup$ So there are 3 dots around this planet resembling an atom (a Lithium atom), 3 words in "tell me more" and "countdown to reveal"... Half-Life 3 confirmed, you guys!!! $\endgroup$ – dmg Oct 8 '15 at 6:13
  • $\begingroup$ Get the notpr0n winners! $\endgroup$ – ioanD Oct 15 '15 at 10:38
16
+150
$\begingroup$

UPDATE 2

(Reorganizing the whole post to include only the parts that weren't dead ends)

The first mystery string, N5TYJJETNWRXJ6KBNAYYFJEGPOSXD4EG is decoded as follows:

Caesar_25("N5TYJJETNWRXJ6KBNAYYFJEGPOSXD4EG") -- A => Z, B => A, C => B, ...
= "M5SXIIDSMVQWI6JAMZXXEIDFONRWC4DF"

decode_base32("M5SXIIDSMVQWI6JAMZXXEIDFONRWC4DF") = "get ready for escape"

(Base 32 reference for those who haven't seen it yet: wikipedia)

The second mystery string:

KIZTEWS2LBKVOTCJJJBFCUCVGZEUQTCBKJAVKU2NKNIFOWSKKRIUIUCKK5ITGV2DINJE4V2LJ5KEGUC2I5LU6MSUKFBUUV2XKFIEUV2DKJHFOWKPKRCUIWSHK5FTEVCRINIE2V2RGNKFKQ2SJZBVKT2UINCVER2XKBFFIUKEKBFFOUJSJJMUGUSKLBKU6VCXIRNEOV2PKBKFCRCIJJLVCM2UKNBVETSDKVHVIQKEKBDVOWSJJJIUISSVK5ITGSSRINJEUV2DI5IQ

is decoded as follows:

decode_base32("KIZ...") = "R32ZZXUWLIJBQPU6IHLARAUSMSPWZJTQDPJWQ3WCCRNWKOTCPZGWO2TQCJWWQPJWCRNWYOTEDZGWK2TQCPMWQ3TUCRNCUOTCERGWPJTQDPJWQ2JYCRJXUOTWDZGWOPTQDHJWQ3TSCRNCUOTADPGWZIJQDJUWQ3JQCRJWCGQ"

Caesar_10("R32ZZX...") -- A => K, B => L, C => M, ...
= "B32JJHEGVSTLAZE6SRVKBKECWCZGJTDANZTGA3GMMBXGUYDMZJQGY2DAMTGGAZTGMBXGIYDONJQGU2DAMZWGA3DEMBXMEYDMOBQGZTDANZTGA2TIMBTHEYDGNJQGYZDANRTGA3DCMBXMEYDKNZQGJSTANTEGA3TAMBTGMQA"

The "B32" is a just a tag that says "hey, the rest of this is base32"

decode_base32("JJH...") = "JNCVSX2OJ5PTAXY2f07306f07506e06402f03307207505403606207a06806f07305403903506206306107a05702e06d070033 "

That string has 3 parts: 15 characters of base32 (ending with the Y, the last uppercase letter), 86 characters of hex (starting with 2f0730), and one trailing space which seems to serve no purpose at all.

decode_base32("JNCVSX2OJ5PTAXY") = "KEY_NO_0_"

The 2f0730... string, laid out in rows of 3, has an obvious structure:

2f0
730
6f0
750
6e0
640
2f0
330
720
750
540
360
620
7a0
680
6f0
730
540
390
350
620
630
610
7a0
570
2e0
6d0
700
33

Remove that column of 0's and you get a simple hex string in which every pair of hexdigits decodes into a printable ASCII character:

decode_hex("2f736f756e642f3372755436627a686f735439356263617a572e6d7033")
= "/sound/3ruT6bzhosT95bcazW.mp3"

which is a valid path on the server:

http://countdowntoreveal.com/sound/3ruT6bzhosT95bcazW.mp3

consisting of beeps (possible Morse code), voices (possibly Russian), and static. And static. And static.

The spectrogram of the audio looks something like:

enter image description here

UPDATE 3

Some thoughts about the new stuff: there is a strong suggestion we should extract the alpha channel from a PNG and view it as a separate image, but I've tried that on all the images on the page and none of them showed anything interesting. Also viewing the images without their alpha channels. One of the background images, /img/dg.png, has a little extra viewable area around the edges where the alpha channel was covering it up, but it's obviously only there for artistic effect.

UPDATE 4

I found the last piece of the rar archive at http://www.countdowntoreveal.com/cam04/corrupt3.rar

I probed http://www.countdowntoreveal.com/cam01/ through http://www.countdowntoreveal.com/cam99/ and got 404 replies from most of them. The exceptions were:

  • cam38 (which we already knew about, it gives a 403 reply when you try to get the directory)
  • cam02 and cam04 (403 reply just like cam38 indicating that a directory does exist; only cam04 contained the corrupt3.rar we needed)
  • cam01 cam03 cam11 cam12 cam33 cam34 cam35 cam36 cam37 - all of these reply to the directory query with an HTML page that says "NO SIGNAL" and "return", in the colors and font of the main page, with "return" being a link to the main page. There doesn't seem to be any hidden information on these pages; they're apparently just there to discourage people like me from persisting with a search long enough to find cam04.

With the complete rar file, we can now extract the DICOM image properly. Once again I'll have to shrink it to be allowed to upload it here.

CAM83 12:43:20:27 NODE 14-4 KORD

In addition to the skyscrapers and helicopter and "CAM83" that we could see before, we have some text at the bottom of the image: "12:43:20:27" and "NODE 14-4 KORD".

The timestamp "12:43:20:27" appears in the text file c38error_log.txt and as noted by 2012rcampion it's out of sequence in that file. I don't know what to make of that.

A question was asked about the DICOM metadata. I don't see anything interesting in it. Some timestamps pointing to October 8, somet blank fields, basic image metadata (width/height etc.) Here's a dump, created by the medcon utility:

(0002,0000) UL[1] MetaElementGroupLength: 196 (4 bytes)
(0002,0001) OB[1] FileMetaInformationVersion: (2 bytes)
(0002,0002) UI[1] MediaStorageSOPClassUID: [1.2.840.10008.5.1.4.1.1.7] (26 bytes)
(0002,0003) UI[1] MediaStorageSOPInstanceUID: [1.2.276.0.7230010.3.1.4.3408318492.4584.1444297906.1] (52 bytes)
(0002,0010) UI[1] TransferSyntaxUID: [1.2.840.10008.1.2.1] (20 bytes)
(0002,0012) UI[1] ImplementationClassUID: [1.2.276.0.7230010.3.0.3.5.4] (28 bytes)
(0002,0013) SH[1] ImplementationVersionName: [OFFIS_DCMTK_354] (16 bytes)
(0008,0016) UI[1] SOPClassUID: [1.2.840.10008.5.1.4.1.1.7] (26 bytes)
(0008,0018) UI[1] SOPInstanceUID: [1.2.276.0.7230010.3.1.4.3408318492.4584.1444297906.1] (52 bytes)
(0008,0020) DA[1] StudyDate: [20151008] (8 bytes)
(0008,0021) DA[1] SeriesDate: [20151008] (8 bytes)
(0008,0030) TM[1] StudyTime: [095146] (6 bytes)
(0008,0031) TM[1] SeriesTime: [095146] (6 bytes)
(0008,0050) SH[0] AccessionNumber: (no value)
(0008,0060) CS[1] Modality: [OT] (2 bytes)
(0008,0064) CS[1] ConversionType: [WSD] (4 bytes)
(0008,0070) LO[0] Manufacturer: (no value)
(0008,0080) LO[0] InstitutionName: (no value)
(0008,0090) PN[0] ReferringPhysiciansName: (no value)
(0008,1030) LO[0] StudyDescription: (no value)
(0008,103E) LO[0] SeriesDescription: (no value)
(0010,0010) PN[0] PatientsName: (no value)
(0010,0020) LO[0] PatientID: (no value)
(0010,0030) DA[0] PatientsBirthDate: (no value)
(0010,0032) TM[0] PatientsBirthTime: (no value)
(0010,0040) CS[0] PatientsSex: (no value)
(0020,000D) UI[1] StudyInstanceUID: [1.2.276.0.7230010.3.1.2.3408318492.4584.1444297906.2] (52 bytes)
(0020,000E) UI[1] SeriesInstanceUID: [1.2.276.0.7230010.3.1.3.3408318492.4584.1444297906.3] (52 bytes)
(0020,0010) SH[0] StudyID: (no value)
(0020,0011) IS[0] SeriesNumber: (no value)
(0020,0013) IS[0] InstanceNumber: (no value)
(0028,0002) US[1] SamplesPerPixel: 3 (2 bytes)
(0028,0004) CS[1] PhotometricInterpretation: [RGB] (4 bytes)
(0028,0006) US[1] PlanarConfiguration: 0 (2 bytes)
(0028,0008) IS[1] NumberOfFrames: [1] (2 bytes)
(0028,0010) US[1] Rows: 816 (2 bytes)
(0028,0011) US[1] Columns: 1866 (2 bytes)
(0028,0100) US[1] BitsAllocated: 8 (2 bytes)
(0028,0101) US[1] BitsStored: 8 (2 bytes)
(0028,0102) US[1] HighBit: 7 (2 bytes)
(0028,0103) US[1] PixelRepresentation: 0 (2 bytes)
(7FE0,0010) OW[1] PixelData: (4567968 bytes)

UPDATE 5

All the /camXX pages now say "Online"...

enter image description here

Actually, the ones that were 403 Forbidden or "NO SIGNAL" have changed to "ONLINE", the 404's (at least some of them - I didn't try them all again) are still 404, except for cam83 (which is now "ONLINE"). That's definitely interesting.

So /cam83/ exists now where it didn't before. By analogy with http://www.countdowntoreveal.com/cam38/c38error_log.txt I suspected http://www.countdowntoreveal.com/cam83/c83error_log.txt might exist and I was right. Here it is:

################################################

09:17:12:00,133 ###*#*#*@# fai&*###*#*#*@# fai&*
09:17:13:02,045 g a#sted service.
09:17:14:50,553 ting s#### 1450 In@#$$ficient sys##########
09:17:16:12,423  o# "@###@@#*@###*#*#*@####*#*#*@#50
09:17:17:00,045 RVJST1JfQUNDRVNTX0RFTklFRCA1ICgweDUp
09:17:18:03,453 RVJST1JfRklMRV9OT1RfRU5DUllQVEVEIDYwMDcgKDB4MTc3Nykg
09:17:23:10,023 #####*#*#*@# fai&*@
09:17:25:00,885 ERROR_FILE_NOT_FOUND 2 (0x2)
09:17:26:06,053 k## or restore op##ation termi###tin
09:17:27:10,603 RRnough server sto#age is av4$@able to 
09:17:29:00,035 ERROR @$$50: / hex #SYSTEM_RESOURCES
09:17:35:03,553 RVJST1JFUlJPUkVSUk9SRVJST1JFUlJPUkVSUk9SRVJST1JFUlJPUkVSUk9SRVJST1JFUlJPUg==
09:17:36:55,023 ERROR_PATH_NOT_FOUND 3 (0x3)
09:17:38:04,275 ##UNDEFIENED##
09:17:45:00,053 Key value 128 ##UNDEFIENED##
09:17:47:33,323 U2FsdGVkX18z6MR5KMT9DfGS3bP/YMBPnLkbfGNxPZgMR1817s89jBvWPb1WgRa6pP4ZJYNKTAw92hCrEzHVa3LtCK/Xt4yQIFogTBFSzcZ1aOP24BOFkJmaTYmlrHi9QWdESfji5ITIgt9JD8fmX6og9Wl8XZ29rhAIeImVPfShsLEVTswtE1vEM+IiX/xr9UvUql50r0RaN0abjbGQsQ==
09:17:48:07,035 Back## or###*#*#*@# op##ati###*#*#*@#mi###ting a####ly.
09:17:49:00,553 ERROR_PATH_NOT_FOUND 3 (0x3)
09:17:51:20,303 U2FsdGVkX18vM/BTHII1L4LTlvfkMjaB7s/84Al/y1L0hcUGGyMyeARy1TKnL90nB092FcSq2QnHcx03QrIauV6pG5oyisvxqzsJAMuD9gk=
09:17:54:00,325 ##UNDEFIENED##
09:18:15:50,553 T3BlcmF0aW5nIHN5cyMjbSBlcnIjIyAxNDUwIEluQCMkJGZpY2llbnQgc3lzIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj
09:18:18:12,523 Key value 256 ##UNDEFIENED##
09:18:19:00,025 hoBFujy/ucmQE6rOElwIxy9aCmDRXlnFtoJ9raVHsbI=
09:18:22:03,453 RVJST1IgMTEzMDogTm90IGVub3VnaCBzZXJ2ZXIgc3RvI2FnZSBpcyBhdjQkQGFibGUgdG8gIyNjZXNzIHRoaXMgY29tbWFuZC4=
09:18:25:10,023 ZXJyb3IgYSMjZXNzIExAI0skICNETUw6SiMjICMoKSok
09:18:26:00,835 Back## or###*#*#*@##ati@#mi###ting a####ly.
09:18:28:06,053 em reso@@#ces exist $$ complete the
09:18:34:10,343 ERROR_PATH_NOT_FOUND 3 (0x3)
09:18:45:00,035 S5tem co4ion EBa###*#*#*@# op##ati###*#*#*@#mi###ting a#sted service.
09:18:55:03,353 RVJST1JfRklMRV9OT1RfRU5DUllQVEVEIDYwMDcgKDB4MTc3Nykg
09:18:57:55,033 RVJST1JfQUNDRVNTX0RFTklFRCA1ICgweDUp
09:19:18:04,675 erat@#######*#*#*@#es exist $$ complet
09:19:25:00,053 ERROR_ACCESS_DENIED 5 (0x5)
09:19:27:33,373 m co4ion EBa###*#*#*@# op##ati###
09:19:28:07,035 ERROR_FILE_NOT_FOUND 2 (0x2)
09:19:39:00,853 ERROR_N$$%SYSTEM_RESOURCES
09:19:41:20,303 # ption
09:19:44:00,025 # c##r

################################################

These 3 lines of base64 are especially interesting:

09:17:47:33,323 U2FsdGVkX18z6MR5KMT9DfGS3bP/YMBPnLkbfGNxPZgMR1817s89jBvWPb1WgRa6pP4ZJYNKTAw92hCrEzHVa3LtCK/Xt4yQIFogTBFSzcZ1aOP24BOFkJmaTYmlrHi9QWdESfji5ITIgt9JD8fmX6og9Wl8XZ29rhAIeImVPfShsLEVTswtE1vEM+IiX/xr9UvUql50r0RaN0abjbGQsQ==
09:17:51:20,303 U2FsdGVkX18vM/BTHII1L4LTlvfkMjaB7s/84Al/y1L0hcUGGyMyeARy1TKnL90nB092FcSq2QnHcx03QrIauV6pG5oyisvxqzsJAMuD9gk=
09:18:19:00,025 hoBFujy/ucmQE6rOElwIxy9aCmDRXlnFtoJ9raVHsbI=

The first and second both decode to something starting with the 8 character string Salted__ followed by random-looking bytes. That format is consistent with the output of the openssl enc command. The third base64 decodes to 32 random-looking bytes (0x86 0x80 0x45 0xBA 0x3C 0xBF 0xB9 0xC9 0x90 0x13 0xAA 0xCE 0x12 0x5C 0x08 0xC7 0x2F 0x5A 0x0A 0x60 0xD1 0x5E 0x59 0xC5 0xB6 0x82 0x7D 0xAD 0xA5 0x47 0xB1 0xB2), which could possibly be a key for symmetric encryption.

UPDATE 6

After much unsuccessful guessing, I decided to try brute force on the encrypted strings. I made a special-purpose program to do it (openssl enc stripped down to have no features except the minimum necessary to try a bunch of passwords with aes-128-cbc on a single hardcoded input). I fed it a word list and got nothing. I fed it a bigger word list and got nothing. There was nothing left to do but try feeding it all possible passwords, starting with short ones and working up to longer ones.

It turns out the password is 1.

The decrypted text is

ares and mars h##e s#mething in co#mon, but are p##ntless wit%%#t their r^%@# which *&@&*&($ truth for whole bunch of people %##$#@#$###

The second encrypted string was also encrypted with the password 1 but it used aes-256-cbc. The lines 09:17:45:00,053 Key value 128 ##UNDEFIENED## and 09:18:18:12,523 Key value 256 ##UNDEFIENED## are probably hints about the different key sizes.

The second string decrypts to this:

ERROR @$$50: / hex ##5aa ERROR_N$$%SYSTEM_RESOURCES

So the first encrypted string is some weird stuff about "ares and mars", the second is just more of that fake error stuff we've seen already, and the third one is still a mystery.

$\endgroup$
  • 3
    $\begingroup$ It looks like the first string could be Vigenère-ciphered with the key BABBBBBBBBBBBABBBHBBBBBBBBBBBABB? Unshifting it, then base32 decoding results in get ready for escape. $\endgroup$ – 2012rcampion Oct 8 '15 at 22:32
  • 1
    $\begingroup$ @2012rcampion I never would have thought of it either, until Yaze posted an answer that involved a Caesar shift of the other base32 string. It just feels... unfair to permute 26 elements of a 32-element set. $\endgroup$ – Wumpus Q. Wumbley Oct 8 '15 at 23:09
  • 1
    $\begingroup$ Yeah, Caesar looked at base 32, took 10 steps, looked at base 32 again and decided to take the front 3 away... we've done all that! By the way, does anybody know what "cwsa" is? $\endgroup$ – Wumpus Q. Wumbley Oct 8 '15 at 23:23
  • 3
    $\begingroup$ That "old text" is too good to be true. Imagine you found that and saw all those bases and 32s and then Hex! You would have to make a puzzle. But "The Gaius Julius Caesar" and "the Rome" wouldn't be written by a native English speaker, and wouldn't get past the copyeditor of a serious book published in English, whether it was an original work or a translation. Makes sense as "video game quality English" translated from Russian though - they don't have any equivalent to "the" in their language, and it's really hard to figure out when to use it and when not to. $\endgroup$ – Wumpus Q. Wumbley Oct 8 '15 at 23:39
  • 3
    $\begingroup$ A user who speaks Russian mentioned that they understood the radio transmission: [radio](Emercom) In Saratov,[radio] no movement in (Tarkov),[radio] Lets leave until someone appears. $\endgroup$ – Viziionary Oct 9 '15 at 14:18
5
$\begingroup$

(It turns out this clue has already been solved; I'm posting because I haven't seen a description of the solution yet.)

One of the clues is located under the URL http://www.countdowntoreveal.com/spqr/. The page is blank, save for the text:

...THERE IS YZM4 EYES OUT
THERE, 38 TO BE ZXJYB,
WHO 3JFBG MAKE AN
ERROR 9NLN IN A WHILE, I
R4DA== JUDGE THEM...

The text appears to be interspersed with Base64-encoded fragments. Viewing the page source reveals the correct capitalization:

...There is YzM4 eyes out there, 38 to be ZXJyb, who 3JfbG make an error 9nLn in a while,
i R4dA== judge them...

Piecing together the fragments, we get the following string:

YzM4ZXJyb3JfbG9nLnR4dA==

Which decodes to:

c38error_log.txt

This leads to the URL http://www.countdowntoreveal.com/cam38/c38error_log.txt, a text file containing the following:

################################################

12:42:13:00,003 From server Observer14-4
12:42:14:00,033 ERROR @#0: Ins#$@icient system res@#$rces exist to complete the requested service.
12:42:35:00,203 ERROR @$$50: / hex ##5aa ERROR_N$$%SYSTEM_RESOURCES
12:42:56:00,003 Operating sys##m err## 1450 In@#$$ficient system reso@@#ces exist $$ complete the r%^@@#uested se#v##e.
12:43:34:00,030 #
12:43:35:00,003 #####*#*#*@#
12:43:20:27,000 Error Code 9$%%#@0###*#*#*@#
12:43:45:00,033 cam##:Remote system node14%#%#%##. The s##* # in an in##id state %#%#%## for #e*@*ed action
12:43:46:00,233 L2NhbTM4L25vZGVfMTQtNF9rb3JkLnBhcnQxLnJhcg==
12:43:47:00,133 /@###*#/corrupt2.rar
12:43:48:00,233 I0AjIyNAQCMqQCMjIyojKiMqQCMjIyMqIyojKkAj
12:43:56:00,015 #@###@@#*@###*#*#*@####*#*#*@#
12:43:58:00,343 Write o# "device" failed, status = %%$50
12:43:59:10,033 ERROR 1130: Not enough server sto#age is av4$@able to ##cess this command.
12:44:11:00,205 E##OR 1130 / hex 0x46a ERROR_NOT_ENOUGH_SERVER_MEMORY
12:44:13:00,053 Back## or restore op##ation termi###ting a####ly.
12:44:16:02,233 Back## or###*#*#*@# op##ati###*#*#*@#mi###ting a####ly.
12:44:35:00,303 ERROR @$$50: / hex ##5aa ERROR_N$$%SYSTEM_RESOURCES
12:44:56:00,053 Operating sys##m err## 1450 In@#$$ficient system reso@@#ces exist $$ complete the r%^@@#uested se#v##e.
12:47:38:00,073 Operating sys##m err## 1450 In@#$$ficient sys################################################

################################################

This fake error log contains another two Base64-encoded strings:

L2NhbTM4L25vZGVfMTQtNF9rb3JkLnBhcnQxLnJhcg==
/cam38/node_14-4_kord.part1.rar

and

I0AjIyNAQCMqQCMjIyojKiMqQCMjIyMqIyojKkAj
#@###@@#*@###*#*#*@####*#*#*@#

currently I'm working on the "timestamps," which contain four colon-separated parts and are non-monotonic.


I've spent some time trying to transcribe the morse code from the audio file that Wumpus Q. Wumbley found in his answer. Unfortunately it's been rather difficult, so my current results need more discussion than can fit in a comment.

I've generated two visual aids; first, a spectrogram (0 to 4 kHz, 1024 samples per bin, Hamming windowed):

enter image description here
(click for full resolution)

Note the appearance of a second signal at 3 kHz during the noise bursts; this could be an image of the morse resulting from distortion/clipping.

Second, a correlation of the audio with the first clean 'dit,' absolute-valued and lowpass filtered (200 Hz cutoff):

enter image description here
(click for full resolution)

I also added grid lines every three units (assuming one unit per dot, three per dash, one between parts of a letter, and three between letters) as accurately as I could.

Here's what I've been able to determine:

  • e
  • Probably m (dah dah); but possibly d (dah di dit). Although a gap appears in the "image signal" on the spectrogram, I'm not very trusting of it; the correlation plot doesn't show a significant gap.
  • e r
  • c (dah di dah dit) or x (dah di di dah); or even possibly 6 (dah di di di dit). There are two noise bursts right where the two spaces between dots would occur, making this one pretty much impossible to determine.
  • g, m, o, q, or z. All we can see clearly are the first two dahs, so any of these letters are possible. The "image signal" looks like the letter ends with dah dit: this would be Ч if the signal was Cyrillic morse, but no such letter (dah dah dah dit) exists in English morse. The correlation seems to indicate the letter is z (dah dah di dit).
  • There might be some more letters underneath the next few noise bursts; it certainly looks like the frequency content is there, but it is somewhat weaker than the previous characters, and there aren't any clearly visible gaps. Speculation is meaningless here. It does look like the "image signal" is part of the same signal as the voice cutting in and out of the "main" morse code signal.
  • t - The next visible letter could be any letter that ends with a dah, but there isn't a strong indication of any earlier components to the letter.
  • a r k
  • dah dah ... - again, this could be any of the (many) letters starting with two dahs.
    • From the correlation it looks like z again, followed by di di di di dah (4), then possibly dah, dit (t e)
    • The image signal is not trustworthy here, since it seems to indicate that the last dah is part of an extra-long dash. This would support the hypothesis that the "image signal" is in fact a second morse code signal cutting in and out, and not a distortion of the "main" signal.
  • The signal finally ends with what looks like a dash and an extra-long dash; but both are stronger than the rest of the morse code, the second tone is at a lower frequency, and there is no space between the two. Therefore I suspect this is somehow identifying a part of the transmission, like a sign-off tone. (Although, since we don't know if this is the complete signal, it could be e.g. identifying the start of the 'next' transmission.)
$\endgroup$
4
$\begingroup$

Based on the latest hint on their FB, the binary complex translates to

KIZTEWS2LBKVOTCJJJBFCUCVGZEUQTCBKJAVKU2NKNIFOWSKKRIUIUCKK5ITGV2DINJE4V2LJ5KEGUC2I5LU6MSUKFBUUV2XKFIEUV2DKJHFOWKPKRCUIWSHK5FTEVCRINIE2V2RGNKFKQ2SJZBVKT2UINCVER2XKBFFIUKEKBFFOUJSJJMUGUSKLBKU6VCXIRNEOV2PKBKFCRCIJJLVCM2UKNBVETSDKVHVIQKEKBDVOWSJJJIUISSVK5ITGSSRINJEUV2DI5IQ

which is base32 encoding, decoding it gives

R32ZZXUWLIJBQPU6IHLARAUSMSPWZJTQDPJWQ3WCCRNWKOTCPZGWO2TQCJWWQPJWCRNWYOTEDZGWK2TQCPMWQ3TUCRNCUOTCERGWPJTQDPJWQ2JYCRJXUOTWDZGWOPTQDHJWQ3TSCRNCUOTADPGWZIJQDJUWQ3JQCRJWCGQ

Caesar shift it by 10 gives

B32JJHEGVSTLAZE6SRVKBKECWCZGJTDANZTGA3GMMBXGUYDMZJQGY2DAMTGGAZTGMBXGIYDONJQGU2DAMZWGA3DEMBXMEYDMOBQGZTDANZTGA2TIMBTHEYDGNJQGYZDANRTGA3DCMBXMEYDKNZQGJSTANTEGA3TAMBTGMQA

Take away the first 3 character gives you

JJHEGVSTLAZE6SRVKBKECWCZGJTDANZTGA3GMMBXGUYDMZJQGY2DAMTGGAZTGMBXGIYDONJQGU2DAMZWGA3DEMBXMEYDMOBQGZTDANZTGA2TIMBTHEYDGNJQGYZDANRTGA3DCMBXMEYDKNZQGJSTANTEGA3TAMBTGMQA

This is another base 32 encoded string, so decoding it gives you

JNCVSX2OJ5PTAXY2f07306f07506e06402f03307207505403606207a06806f07305403903506206306107a05702e06d070033_
The '_' at the end is a space character

The lower case characters and number are probably hexes, but I'm not sure where to go from there.

$\endgroup$
  • $\begingroup$ I got a little farther... see update to my answer $\endgroup$ – Wumpus Q. Wumbley Oct 8 '15 at 18:05

protected by Aza Oct 8 '15 at 17:57

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.