Archived Leads

Past Leads that have been archived at their completion

-Eighth Sec3OP Post:

RIFF¶ ��WAVEfmt  ��� � �D¬�� ± � � �data’ ��/START FILE/

//CLASSIFIED/
//
//ALERT! ALL PERSONNEL MUST IMMEDIATELY ENGAGE IN THE ONGOING EFFORT TO UNSCRAMBLE THE "TIME CAPSULE" DATANODE/
//
//DATANODE CURRENT LOCATION:

download.halowaypoint.com/content/waypoint/assets/images/classified/0000timecapsule/1jk4giqwr67g3af97qwyg739-timecapsule.html

//
//
/END FILE/



Text from Link in Eight Post:
/START FILE/
//CLASSIFIED/
//
//RECOVERED DATA NODE (HEAVILY ENCRYPTED):
//
//
[scrambled image located here]
//
//
//(REQUIRES KEY FOR DECRYPTION)/ /END FILE/

Ninth post has the video stuff:

/STRT FL/////CLSSFD/////N STNDRD NCRYPTN PRTCLS ND PTTRNS////mblms r Ky. r y lkng fr ky? Fnd yr ky blw...//////ND FL/

AS;LKFJLQ4NRAJL;ASJZPOIJ4PJUNK89UF9832JRTLKMNFA./SD,MVCKFJG
NYT4RH7ARFLSZIMTN3...........4UI0YR86DFVFTYUHJUNKXIOCUVYSHWE4RKJLNMLK
VJZDXI7VYHA;FLIJ89DUFJSREGJDO...Z8VUJZDLIJFSDIFUA08DYUV7AWEHJF;LISJADVLKJZXDV89
0JLIFJ;EWLJMFASD0F98JSDIOVJMDKLDJGF[QOUJ-A8UJV.JFAJF34PJNS9ZDVHJ34JFS0V98J2JENAJVPAJI......ASFAFWEFHGT3GWGBSDVDSVAAFAA.....
......................................................................
..............................................................................



 

"Start File, Classified, No Standard Encryption Protocols and Paterns, Emblems are Key. Are You Looking for a Key? Find your key below. End File."


Had the link:
http://download.halowaypoint.com/content/waypoint/assets/images/classified/0000timecapsule/ahf32qhilkjzh-23a2jhlk2-77325ad2-6afg-intrigue.html



This link led to this video
http://download.halowaypoint.com/content/waypoint/assets/images/classified/0000timecapsule/f11a12ec-c62f4554-b3b28758-ff49b6f7.mp4



Video contained the following screenshot
/START FILE/
/CLASSIFIED/TIME CAPSULE/
//
/APPROXIMATELY 4 YEARS AGO, AN ENCRYPTED, DATA NODE WAS RECEIVED AT A REMOTE ARCHIVAL STATION. THE TRANSMISSION ORIGINATED FROM THE SURFACE OF REACH, PRIOR TO ITS FALL, WHERE A GROUP OF SPARTANS FOUGHT VALIANTLY TO REPEL THE COVENANT FORCED. ONE OF THEIR CLASSIFIED OBJECTIVES WAS TO PROTECT SECTION 3 INTEL, INCLUDING HIGHLY VALUABLE RESEARCH FOR IMPROVING THE MJOLNIR ARMOR./
//
/THE DATA NODE WAS BELIEVED TO BE LOST UNTIL RECENTLY, BUT IT IS NOT BEING ANALYZED BY SECTION 3 OPERATIVES. THE ENCRYPTION IS HEAVY AND REQUIRES A KEY TO FULLY UNSCRAMBLE. IT APPEARS THAT THE KEY WAS GENERATED FROM DATA SPECIFIC TO SOME OF THE SPARTANS INVOLVED IN THE ACQUISITION AND EVENTUAL TRANSMISSION OF THE DATA./
//
/THE FOLLOWING IS A FIRST ATTEMPT AT DECRYPTING THE DATA NODE/
//
/END FILE/



Video also had a spectrogram yielding 6th puzzle piece in Requiem Helmet code:

http://imgur.com/1U9MH



Also had globe with puzzle indents: 

http://imgur.com/8XuVY



From Playing the Video in Quicktime and looking at file info, we also get: 

Recovered Fragment ONI/Ection3
ONI DECRYPTION KEY FORMAT:
../5124587109-reach-mia-key-format



We then put file ending onto the end of our previous URL:
http://download.halowaypoint.com/content/waypoint/assets/images/classified/0000timecapsule/5124587109-reach-mia-key-format



This brought up the following:
0000-????-???W-????-?-???Z-???-????-????-???-?0?8-??7-???8-W???-?47-??W-?00?-?0?-????-W???-????-?Y??-????-??Y-Y???-????-???-?0?-???Y-???-????-???-??W-?6??-????-???-W???-???-????-W??-??Z4-?0?-???W-????-???-????-????-??7-???0-??Z?-????-??0?

 

​We then had a post from Sec3OP36516 stating (coded in a form of morse code, original post here (half way down page):​

/START FILE//CLASSIFIED/PATTERN RECOGNIZED/OPERATIVES USE THE KEY TO UNSCRAMBLE THE DATANODE. EMBLEMS ARE KEY, CONTAINERS CONTAIN./END FILE/



We then got sidetracked, as a barrage of glyphs that were not heavily encrypted came in from Sec3OP36516, giving us little pieces of the Requiem Shoulders and Torso codes, that would be put up on Halo Waypoint in the classified section soon. For a while we figured we were up to speed, but Sec3OP36516 told us to revisit old assignments, and after a while, MrToastyXD has figured out the following:

http://download.halowaypoint.com/content/waypoint/assets/images/classified/0000timecapsule/00002552-reach-mia-64hz.lo

It was a WAV file, but had base64 data with interleaved nulls. After some converting, MrToastyXD came up with a file which he posted for convience on YouTube:

http://www.youtube.com/watch?v=ThMJpBa15G4



He also did a frame-by-frame of each of the gamertags:

http://imgur.com/a/N8Myr#0



We were able to confirm that the first tag: 0000 matched MrToastyXD's Spartan ID tag AND last known emblem used in Halo Reach, and that the sixth tag only having one ?, fit with the forum's creator, K as in Kei, whose tag was K, and symbol matched the sixth in the series of video. 



We then set out on the task of finding people that had helped with decoding any of the glyphs before (Sec3op36516 had earlier said THE KEY WAS GENERATED FROM DATA SPECIFIC TO SOME OF THE SPARTANS INVOLVED IN THE ACQUISITION AND EVENTUAL TRANSMISSION OF THE DATA)

After going through the forums, we were still missing quite a lot of numbers.



 

We also then got a post from Sec3OP36516 containing a recipe

/START FILE//CLASSIFIED/ONI FIELD MANUAL EXCERPT/ON ASSIGNMENT, IT IS OFTEN NECESSARY TO IMPROVISE IN ORDER TO STAY HEALTHY AND WELL FED. ONI DOES NOT EXPECT ALL PERSONNEL TO BE CULINARY EXPERTS, BUT YOU MUST UNDERSTAND BASIC PRINCIPLES AND RECIPES. RECIPES ARE CRUCIAL, AS THEY ALLOW YOU TO CONVERT TWO SEEMINGLY DISPARATE INGREDIENTS, INTO A WONDERFUL DISCOVERY OF FLAVOR./

with this file attached:

http://download.halowaypoint.com/content/waypoint/assets/images/classified/0000timecapsule/very-useful-recipes-4-u.csv


MrToastyXD, again, made sense of this:

"Looking at the csv file in a hex editor, it looked like raw image data to me. It was a little odd that it was groups of 4 that always started with FF as I would normally look for groups of 3 for RGB data. I imported it as RAW in Photoshop and let it guess as to image dimensions and color channels at first. Image was wrong but I could see it was on the right track. Thought I was going to have to strip out the FF's and import as 3 channel RGB, but gave it another shot as-is. This time I told Photoshop to use 4 channels (thought it could be ABGR or some variant that BMPs use) and calculated what the dimension could likely be and out popped a CMYK image. Done!"

http://i.imgur.com/LyjwF.jpg



We had to look in several other places, the HBO forum, WikiBruce, the #EvilAwakens thread, and the Secret Terminals MegaThread to come up with all of the reach tags.



We also had several people for the #46 symbol, with the White 'seventh column' symbol, and a 4 letter tag. Sec3OPs gave us clues for

#8 CULT from player CultofRubik on pgs. 88 and 89 of the forum.

#41 RAZ4 confirmed in our second Datanode (follow link)  WPX, RAZ4, M0A 

​#25 YMCA from a clue solved on pg 103 of the forum-very bottom.​

#46 with multiple results was given as SSDD (first letter S, last letter D) by Sec3OP1024350 [had been discounted as imposter]

#2 VGNS, which should have been GNVS, General Vagueness's tag, was given to us by Sec3OP1024350, and confirmed later by Sec3OP36516, who said:

 /START FILE//CLASSIFIED/SEC3OP1024350 IS A COMPROMISED COMMUNICATION ID, AND IS NOT USING CORRECT PROTOCOL/HOWEVER, AGENTS HAVE CONFIRMED THAT THE SECOND STRING IS VGNS./END FILE/



Gave us the following completed code:

0000-VGNS-CLAW-BEES-K-RADZ-KON-CULT-A3LG-TOA-S038-S27-D118-WULF-O47-DEW-J009-S01-BNDR-WOLF-EIRE-RYAN-PNDA-SKY-YMCA-GL13-MOA-F09-KRPY-3UP-MG91-MAK-LAW-S692-TEXX-BOB-WURF-AIR-JEDI-WPX-RAZ4-M0A-SOCW-XENO-GUS-SSDD-ES91-117-U190-ENZO-IIII-RC0N



Although we tried going back to the original link and putting in

http://download.halowaypoint.com/content/waypoint/assets/images/classified/0000timecapsule/5124587109-0000-VGNS-CLAW-BEES-K-RADZ-KON-CULT-A3LG-TOA-S038-S27-D118-WULF-O47-DEW-J009-S01-BNDR-WOLF-EIRE-RYAN-PNDA-SKY-YMCA-GL13-MOA-F09-KRPY-3UP-MG91-MAK-LAW-S692-TEXX-BOB-WURF-AIR-JEDI-WPX-RAZ4-M0A-SOCW-XENO-GUS-SSDD-ES91-117-U190-ENZO-IIII-RC0N



​When that yeilded no results, we turned to the recepie and key. Sec3OP36516 also had given us a clue that 4/2 does not equal 5/2. Original post on pg. 81

 



 

littleRabidFuFu  came up with the following way of making an algorithm that would work for our key, following the rules of the earlier "Recipe" image.

<?php
$key = str_split(file_get_contents('key.txt'));
$length = count($key) - 1;
$data = file_get_contents('datanode');
$dlength = strlen($data);

$a = 0;
$b = 0;
$key_index = 0;
$result = '';
$index = 0;
for($index = 0; $index < $dlength; $index++) {
$char = ord(substr($data, $index, 1));
// Set up a and b
$a = (ord($key[$key_index]) % 2 != 0) ? 1 : 0;
$b = (ord($char) % 2 == 0) ? 1 : 0;

// Run decode
$result .= chr(($char + $a) * 2 - $b - ord($key[$key_index]));

// Iterate key index
$key_index++;
if($key_index > $length) {
$key_index = 0;
}
}
file_put_contents('result', $result);
?>

 

Additionally, LittleRabidFuFu noted:

The results are different because a and b function opposite based on the input:

key = 0, a = 0
key = 1, a = 1
data = 0, b = 1
data = 1, b = 0

Either that or I read the formula wrong.



Then LittleRabidFufu was able to crack it:

"For the following key, including hyphens, this is the resulting file:

Key:
0000-VGNS-CLAW-BEES-K-RADZ-KON-CULT-A3LG-TOA-S038-S27-D118-WULF-O47-DEW-J009-S01-BNDR-WOLF-EIRE-RYAN-PNDA-SKY-YMCA-GL13-MOA-F09-KRPY-3UP-MG91-MAK-LAW-S692-TEXX-BOB-WURF-AIR-JEDI-WPX-RAZ4-M0A-SOCW-XENO-GUS-SSDD-ES91-117-U190-ENZO-IIII-RC0N"



Results in a decoded.node file

http://dl.dropbox.com/u/22381648/decoded.node

​

MrToasty got to work on the file:

"1. Decoded the base64, used the resulting bytes as numbers and subtracted the metal value (gold or silver don't remember which at the moment, so 47 or 79). Took that result and decoded as hex to text which gave the binary for the PNG image.

2. You need to replace all the [angle] with A and then do the decode."



Then following:

"OK,having a bit of trouble getting the file to play, need to check my work and data reversal. However, I can at least give you this:

ONI/SECTION3
FILE/CLASSIFIED/CODE RECOVERY NEARING COMPLETION FOR
JVC3 - 2 AND REQ I-3/END"



Finally, MrToasty cracked it!

video contained two glyphs: The 4th code for ONI (1-dot), and the second code for the Raider Helmet (4-dot)

http://www.youtube.com/watch?v=-odSdZfXMzg&feature=youtu.be



Spectrogram had:

http://i.imgur.com/YORwD.jpg



Formed glyph #4 of the Requiem Helmet (4-dot) code

​http://imgur.com/esGUj

 

 

We got this congratulations message from Sec3OP36516!

 

/START FILE/
//CLASSIFIED/
//
//ATTENTION ALL ONI OPERATIVES: THE DATANODE CODE NAME 'TIME CAPSULE' HAS BEEN FINALLY CRACKED! THIS WAS A MASSIVE EFFORT, WHICH REQUIRED THE COMBINED STRENGTHS FROM OUR AGENTS, REPRESENTING MANY FIELDS OF SPECIALIZATION, WORKING TOGETHER AROUND THE CLOCK UNTIL THE CODE WAS BROKEN.
//
//YOU ALL FACED INCREDIBLE ODDS, SABOTAGE ATTEMPTS AND A NEAR COMPLETE LACK OF RELIABLE INTEL. HOWEVER, YOU ALL PULLED TOGETHER, HEROES WERE MADE, LESSONS WERE EARNED, AND EVERY STEP OF THE WAY WAS HARD FOUGHT.
//
//THIS ACCOMPLISHMENT WILL BE ETCHED PERMANENTLY IN THE ONI ARCHIVES. BE PROUD, ALL OF YOU, AND REMEMBER ALWAYS: SURFACE IS NOTHING, TRUE VALUE IS NOT EASILY WON, TRUST NO ONE... BUT LEARN WHEN TO TRUST.
//
//
/END FILE/

​

Congratulations! SOLVED!!!!!