ARG Puzzle with 3.5 BTC Private Key Prize, Game Over

[Gatekeeper]

wow pretty amazing work that, way out of my depth, big props to figuring that one out.

So there is an encrypted file added to the space.mp4?

[Prospero]

It's encrypted, whatever it is.

Let's hope it' not Onion2.7z

[micaman]

Can you upload it somewhere?

EDIT: Great catch btw

[S4VV4S]

Good catch guys!

[S4VV4S]

Tried to mount it as an image, didn't work.....

[S4VV4S]

http://www.magiciso.com/tutorials/miso-whatsimage.htm

[Timmmaahh]

So, there are 2147129 bytes of additional data besides the audio and video streams in Space.mp4

Yep. That's exactly the path I took.

Code:

8057685995569da18a15912e754e1510181acb8cad31dfcabb9cab367245be2b = sha256("there's a bunch of data at the end of the file I can't identify. the data is uniform and random, so it's almost certainly encrypted.")

Looking at the split binary a bit deeper we get:

Code:

 $ ent split
Entropy = 7.999908 bits per byte.

Optimum compression would reduce the size
of this 2147129 byte file by 0 percent.

Chi square distribution for 2147129 samples is 273.12, and randomly
would exceed this value 20.80 percent of the times.

Arithmetic mean value of data bytes is 127.4944 (127.5 = random).
Monte Carlo value for Pi is 3.140655128 (error 0.03 percent).
Serial correlation coefficient is -0.001094 (totally uncorrelated = 0.0).

Maybe file can help us out?

Code:

 $ file split.bin
split.bin: data

It's encrypted, whatever it is. However it's not the right size to be any block cipher I know of.

Code:

split.bin https://mega.co.nz/#!SF9m0I5R!xOlTLH6-f8DujD92CYNTt1lpunXWn3pikcLV1ZPXVk4

can we mount it with true scrypt?

[arg]

can we mount it with true scryptcrypt?

You don't even know if it is a TC container until you have the password right.

[elh40257]

Can someone re-upload this container on other site? Had an unknown SSL error (ssl_error_rx_record_too_long) when connecting to this site (both browsers), not know how to solve at this time.

[micaman]

Can someone re-upload this container on other site? Had an unknown SSL error (ssl_error_rx_record_too_long) when connecting to this site (both browsers), not know how to solve at this time.

http://speedy.sh/ccEFT/split.bin

[Timmmaahh]

can we mount it with true scryptcrypt?

You don't even know if it is a TC container until you have the password right.

yeee... if it is even a TC container ...

or else somehow encrypted..

[itod]

There's definitely some kind of file/data embedded in Space.mp4, with ffmpeg, I can do:

...

In addition, I think I found the original copy of the video file (before extra data was embedded into it):

...

9356135-7209006 = 2147129, which is the number found in Number.txt

So, there are 2147129 bytes of additional data besides the audio and video streams in Space.mp4

...

Edit: extract the extra data with this:

Code:

dd bs=1 skip=7209006 if=Space.mp4 of=binary

Fantastic work, congratulations.

[Timmmaahh]

i checked it with a hex editor, but no sucess..

[elh40257]

Can someone re-upload this container on other site? Had an unknown SSL error (ssl_error_rx_record_too_long) when connecting to this site (both browsers), not know how to solve at this time.

http://speedy.sh/ccEFT/split.bin

Thank you! But there is an win32 executable downloader, can not run this. 

There's definitely some kind of file/data embedded in Space.mp4, with ffmpeg, I can do:

...

In addition, I think I found the original copy of the video file (before extra data was embedded into it):

...

9356135-7209006 = 2147129, which is the number found in Number.txt

So, there are 2147129 bytes of additional data besides the audio and video streams in Space.mp4

...

Edit: extract the extra data with this:

Code:

dd bs=1 skip=7209006 if=Space.mp4 of=binary

Fantastic work, congratulations.

Hope this works, now try. Thank you too. Oт дyши.

[Timmmaahh]

Can someone re-upload this container on other site? Had an unknown SSL error (ssl_error_rx_record_too_long) when connecting to this site (both browsers), not know how to solve at this time.

http://speedy.sh/ccEFT/split.bin

Thank you! But there is an win32 executable downloader, can not run this. 

There's definitely some kind of file/data embedded in Space.mp4, with ffmpeg, I can do:

...

In addition, I think I found the original copy of the video file (before extra data was embedded into it):

...

9356135-7209006 = 2147129, which is the number found in Number.txt

So, there are 2147129 bytes of additional data besides the audio and video streams in Space.mp4

...

Edit: extract the extra data with this:

Code:

dd bs=1 skip=7209006 if=Space.mp4 of=binary

Fantastic work, congratulations.

Hope this works, now try. Thank you too. Oт дyши.

click on the file name split.bin on the page (right beside Download)

not on this freeky download button at the bottom!!

[tsoPANos]

Portrait is a "shared start point." Google is your friend.

I think we didn't focus on this!
However I can't get any noteworthy results from Google  

[Timmmaahh]

Portrait is a "shared start point." Google is your friend.

I think we didn't focus on this!
However I can't get any noteworthy results from Google  

that was the very first hint ..

[mirth23]

FWIW, there's another QR code spectrographically hidden in 25_chirp.wav in the DoD game. It's the same code that arg found in Elements.jpg that led to Again.7z. This leads me to believe that the DoD branch is the red herring and the Space.mp4 branch is the endpoint.

[itod]

FWIW, there's another QR code spectrographically hidden in 25_chirp.wav in the DoD game. It's the same code that arg found in Elements.jpg that led to Again.7z. This leads me to believe that the DoD branch is the red herring and the Space.mp4 branch is the endpoint.

I also think that. The question is what to do with that 2MB of data in our hands.

[alphabetacanary]

I extracted another 7z file from the Space.mp4 by subtracting 100 from each byte of the last 2147129 bytes (which matches exactly the split.bin posted earlier)

Pardon my bad code:

#include <stdio.h>

main()
{
    FILE *f = fopen("Space.mp4","r");
    FILE *f2 = fopen("another.7z","w");

    int l = 9356135-2147129;
    int c = 0;
    while (c < l) {
       fgetc(f);
       c++;
    }

    int q = 0;
    while (q < 2147129) {
       fputc(fgetc(f)-100,f2);
       q++;
    }
    printf ("done\n");
    fclose(f);
    fclose(f2);
}

Please someone confirm this!