User Tools

Site Tools


investigation:other:vi:ad02
To prevent vandalism, unregistered users cannot edit this wiki. If you would like to contribute, please create an account.

Access Dive : March 2013

With the factions readying to battle over which would save Klue at the Wallace Monument event, the Verum Inveniri split within themselves, with Viride and Caeruleum championing the Enlightened and the Resistance. shortly after midnight GMT on the 2nd of March, somehwere over the East of Scotland, each announced in their chosen faction chat that they wished to provide aid to the agents on the ground.

These messages each contained a link to the first stage of the dive, and the (theoretically) faction-secure IRC channel.

Enlightened Phase1 : 02/XX

00

Original Link

Hidden Info
The wordsearch contains some familiar words:
  • Ezekiel
  • Chapeau
  • Alaric
  • Shapers
  • ADA
  • Calvin
  • Oliver
  • Klue
  • Yuri
  • Jackland
  • Yuen
  • Statue
  • Felicia
  • Resistance
  • Portal
  • Auguta
  • Wave
  • NIA

Removing these leaves us with JGGFYHYW. This is the path key to the next stage of the dive: http://commondatastorage.googleapis.com/pac/accessdive/02/01/JGGFYHYW.html



01

Original Link

Hidden Info
At the bottom of the page is a plaintext passcode, 6se5verumq8s2w, and the source code contains two invite codes.
On the image shell's spiral we see VWWYZBVOQPOQCDDLMEXAQGGG The shell itself indicates the Fibonacci sequence, so, using Fibonacci numbers – 0 1 1 2 3 5 8 13 21 34 55 89 144 233 377 – we create a cipher key 01123581321345589144233377 to apply with a Gronsfeld cipher, yielding VVVWWWNNNNNNYYYDDDTWODDD. Removing the triple-repeated characters leaves VWNNYDTWOD; change “TWO” to “2” and we have VWNNYD2D, which is both an activation code, and the clue to the next page at http://commondatastorage.googleapis.com/pac/accessdive/02/02/VWNNYD2D.html.



02

Original Link

Hidden Info
Two more activation codes in the source.
This ‘maze’ is actually a cipher called Betamaze, which means each small square’s pattern is equivalent to a letter of the alphabet or single integer. Translating, it becomes 8W4P3IBB, another activation code, and a link to the next level: http://commondatastorage.googleapis.com/pac/accessdive/02/03/8W4P3IBB.html
At the bottom of the page is a link to a tangential page - http://commondatastorage.googleapis.com/pac/accessdive/02/dd/klue1.html - which has nothing immediate, but is a clue to the start of Dive Phase Two.



03

Original Link
100047100103032050057046
053103094050043055103040
055040098043100043049041
043054102041043051103040
049050099043049057101041
043051055103097061048032

Hidden Info
Link to http://commondatastorage.googleapis.com/pac/accessdive/02/dd/heading9843.html.
Puzzle Group by 3, DEC to ASCII. d/dg 29.5g^2+7g(7(b+d+1)+6f)+3g(12c+19e)+37ga=0 Simplify the equation, 37a+49b+36c+49d+57e+42f+59g+49=0 The unknown a to g is for ordering purpose, 37 49 36 49 57 42 59 49, Hex to ASCII, 7I6IWBYI leads to http://commondatastorage.googleapis.com/pac/accessdive/02/dd/7I6IWBYI.html.



dd

We now have three 02/dd links:

book


plaque


heading
0.50 km 69.5 degrees

Hidden Info
The heading page's source code contains two more activation codes, and the string <span title=“07 43 17 93 27 56 a7 56 27 57 b6 43 66 47 33”>.
Reversing and converting Hex→ASCII gave us another passcode – 3tf4kurezer9q4p.



Resistance Phase1 : 03/xx

00

Original Link

Hidden Info
Convert the numbers on the ruler from inches to centimetres to get 6.8, 7.1, 8.6, 7.3, 5.2, 5.4, 6.5, 7.7.
Remove the decimal points, and convert pairs Dec→ASCII to get DGVI46AM and the key to the next stage of the dive: http://commondatastorage.googleapis.com/pac/accessdive/03/01/DGVI46AM.html.



01

Original Link
zlanfeieiebeyoerl
hwukrawgzfvanjeta
rswtmaoebysgixthy
targcvozbspmnfwre

Hidden Info
Included passcode at the bottom - 2tc2pandorap5t8x - and two invite codes in the source.
This was quite a complex puzzle. Reading top to bottom, right to left, get “layerthreetwojxfynineagmbvspefysizbbegeziwooeaavfrmcnktgauwrlwsazhrt”. Exclude “layer three” as a label, and subtract an eight character activation code – 2JXFY9AG – to leave “mbvspefysizbbegeziwooeaavfrmcnktgauwrlwsazhrt”. Reverse, and using Railfence with four rails and an offset of 1, we find “layertwofouraweightzpekzngsecambvbrsfzbivwasm”, or “layer 2 4aw8 zpekzngsecambvbrsfzbivwasm”. Exclude “later two” as a label, and subtract another eight character activation code – 4AW8ZPEK – to leave “zngsecambvbrsfzbivwasm”.
Using Vigenere with ONION as passphrase (because onions, like ogres, have LAYERS!) yields LAYERONENINEKRMNVNINEZ, or 9KRMNV9Z with the “layer one” discounted. Again, an activation code, but this one, as the final layer, can be appended to the path to lead to: http://commondatastorage.googleapis.com/pac/accessdive/03/02/9KRMNV9Z.html.



02

Original Link
A redacted document, detailing the “discreet monitoring” of an unnamed individual in South Africa.

Transcript
SUMMARY INVESTIGATION REPORT

With your supplied information, we began our operation to discreetly monitor the activities and communications of XXXXXX.

First spotted arriving at George Airport in South Africa, he hastily left with a local guide.

As you indicated, they followed the routes and detours characteristic of someone visiting the Kalkkop impact crater. A few hours later, an alert operative spotted the road-weary XXXXXX at Port Elizabeth Airport. We were informed that his flight would land in Johannesburg, at the OR Tambo International Airport, and arranged for a local surveillance team there.

Early the next morning XXXXXX was seen leaving his hotel, once again meeting with a prepared guide. Tswaing and Vredefort craters were both visited, and we photographed him performing hasty chemical experiments on both the earth and vegetable matter at the site.

Returning to Johannesburg, he boarded a flight for Francistown without delay. After a day's travel to the Kgagodi crater and back, a very tired looking XXXXXX returned to Francistown and left on a flight for Gaborone. Sources informed us that he visited the Morokweng crater, although his next move was very difficult to discern. Once again we alerted operatives at the closest regional airports, and the next morning an unkempt XXXXXX trundled in to Upington Airport in the back of a dusty pickup truck. His flight to Oranjemund was apparently supposed to be a private matter, and our prodding for information may have perked the ears of other interests.

He met with a guide as before, and was escorted to the Roter Kamm crater. Here he performed experiments of a radiological nature, and so we arranged to have agents at Lüderitz Airport plausibly detain him for tripping a silent radioactivity alarm.

In a search of his belongings, he was found to be carrying a small amount of scientific equipment but most tellingly, a shortwave radio. Before being detained he was observed carelessly tossing away a notepad missing only a few sheets. Fortunately it was recovered, although a rubbing of the pad produced the head-scratching “LFDGONDOMNHTNOZTLXRFYJFMHTUPY”.

END REPORT


Hidden Info
Two more activation codes in the source.
Link to tangential page: http://commondatastorage.googleapis.com/pac/accessdive/03/dd/klue1.html which has nothing immediate, but is a clue to the start of Dive Phase Two.
The story points to various airports. Using the three-letter airport codes for these, we get: GRJPLZJNBJNBFRWFRWGBEUTNOMDLUD Applying this as a one time pad, as per the story yields FOURDOUBLEUSIXDOUBLEUPMZTHREE, which translates neatly to 4W6WPMZ3, the next stage's key: http://commondatastorage.googleapis.com/pac/accessdive/03/03/4W6WPMZ3.html



03

Original Link

Hidden Info
Letters hidden in upper right of image: JMWZF LLHEU DMTCZ EEGVG XGGYP IBIAD EFDRU IEYD JMW ZFL LHE UDM TCZ EEG VGX GGY PIB IAD EFD RUI EYD
Using Enigma cipher, with Rings: AAA and Ground Setting: RUR, yields SIXVI CTORT HREET WOZUL UFOXT ROTYA NKEER OMEO, which simplifies to 6V32ZFYR, another activation code, and another link to follow: http://commondatastorage.googleapis.com/pac/accessdive/03/dd/6V32ZFYR.html



dd

We now have three 03/dd links:

book


plaque


heading
0.59 km 118.7 degrees

Hidden Info
The source code contains <span title=“87 43 87 53 27 37 96 67 27 16 a6 63 56 37 33”>, which reversing and converting Hex→ASCII gives another passcode – 3se6jarvisr5x4x.



The Secession & Reunion

At this point, with the battle looming, and the long-term implications of Viride and Caeruleum's division becoming all too apparent, the Verum Inveniri announced a suspension of the dive until the following Monday.

Dead Drops

While Viride and Caeruleum worked through their differences, there were still the “dd” level clues for both factions to work through.

Enlightened

Using the book image , the plaque , and the directions the location of a ‘dead drop’ was revealed.

Hidden Info
The plaque is located at St. Bart’s Hospital in London, and “0.50 km 69.5 degrees” away is the Barbican Library, where, in the copy of “Medieval England: An Aerial Survey” was the dead drop.

Hidden Info
Reversing the text gives us yet another activation code, and sends us to http://commondatastorage.googleapis.com/pac/accessdive/02/dd/KP7FTKY9.html , which redirects to http://commondatastorage.googleapis.com/pac/accessdive/common/items/schism.html where the factions are reunited by the VI statement and call to decode fraternally.

Resistance

Using the book image , the plaque , and the directions the location of a ‘dead drop’ was revealed.

Hidden Info
The plaque is located at St. Bart’s Hospital in London, and “0.59 km 118.7 degrees” away is the Guildhall Library, where, in the copy of “Oxford Companion to the Mind” was the dead drop.

Hidden Info
Reversing the text gives us yet another activation code, and sends us to http://commondatastorage.googleapis.com/pac/accessdive/03/dd/PGT6YIXI.html , which redirects to http://commondatastorage.googleapis.com/pac/accessdive/common/items/schism.html where the factions are reunited by the VI statement and call to decode fraternally.

Phase 2

The reconciliation post

Link given

Transcription
“In a divided world, both sides of the schism are a slippery slope.” —P. A. Chapeau

“A house divided against itself cannot stand.” —Abraham Lincoln

The past few days nearly ended in ruin for Verum Inveniri.

We were torn apart by a bitter division. At the time, each of us believed we were doing what was right. In hindsight, we had lost sight of what mattered. Our emotions distracted us from our original unifying goal: to discover truth.

As individuals, we have fundamental differences of opinion, it is what makes us stronger. However, we must stay true to our purpose to realize our vision.

Investigators, fellow truthseekers, reach across the divide and unite your minds. Join us in #veruminveniri on irc.irchighway.net, and take these gifts (#1, #2).

Initially intended as tools in a conflict, celebrate them now as gifts to share with the world. All systems flourish in balance.

Hidden Info
The page links to both the dual-faction IRC channel – and the two ‘gifts’, one for Enlightened and one for Resistance.

Enlightened Phase2 - 02/xx

04

Part A

Original Link

Hidden Info
The source code contains <p class=“hid”>okytthpnvexgfispo</p> which translates to a passcode by looping the string, the end letters “spo” and the start letters “oky” combine to make the keyword, then using standard passcode structure, and a bit of Niantic math, extract the prefix from before the keyword – exgfi = 8xg5 – and the suffix from after it – tthpnv = t3p9v – creating 8xg5spookyt3p9v.
The audio track contains some unusual ‘chirps’ behind the recorded message. The ‘chirps’ are in the Right Track or Channel 2, depending on which program you look at it through. A spectrogram of the ‘chirps’ in isolation revealed the following:

Reversed, it reads “ENVELOPE.HTML”, leading us to http://commondatastorage.googleapis.com/pac/accessdive/02/04/envelope1304.html

Part B

Original Link

Hidden Info
The pattern at the bottom-right of the envelope is Intelligent Mail code. The string is DFTFFTDTAAAFFFFTTAAFFDTAADFFDTFAFTFTTFDDDDFDADFATDDATFTADADATDFD which reversed validates cleanly:

Another hint from the cat:
<Theresa_chic> For a certain envelope that I know/ Check the numbers see until where they go/ But don't forget to get into the flow/ you might have to later see all the show

We take all 31 of the digits yielded by the encoder tool – 3113203233002343043002430000005 – and recognise the hallmarks of Base5 (only digits 0-4, apart from the final digit, 5, which could be an indicator). Group into triplets – 311 320 323 300 234 304 300 243 – excluding the ‘marker’ 5, and convert from Base5 to Base10 (decimal) to get 81 85 88 75 69 79 75 73. This in turn converted Dec→ASCII is QUXKEOKI.
More hinting:

<!Verum_Inveniri>: Who was William Wallace?
<!Verum_Inveniri> fe

FE is iron, the lettering on the envelope indicate “William” (MIA WIL as an anagram) and ACTION, and yet again the 1304/9 shows face. Wallace fought a famous battle called Action at Earnside in September of 1304, and which is also thought to be called “Ironside”. Using Vigenere on the previously obtained QUXKEOKI string, using “ironside” as a key, yields IDJXMGHE, another activation code, and the link to the next level: http://commondatastorage.googleapis.com/pac/accessdive/02/05/IDJXMGHE.html


05

Original Link

Transcription
Congratulations, fellow truthseeker. You have completed Access Dive Phase 2. Our struggle will continue. End of Transmission.
Hidden Info
Two activation codes in the source code, as well as < span class=“hid” title=“-4” >ritiiicviqidirvpyoiv< /span >, which resolves to a passcode. Reverse the string and group into 4s, as per the clue in the string:
vioy
pvri
diqi
vcii
itir

Starting top-left, read down each column: vpdv ivict orqii yiiir Using Roman numerals, convert to numbers where required to fit the passcode format: 5pd7victorq2y3r.


Resistance Phase2 - 03/xx

04

Original Link

Hidden Info
The source code contains <p class=“hid”>istpfouthqsixdsires</p> which leads to a passcode by looping the string so that the end letters “res” and the start letters “ist” combine to make the keyword. Using standard passcode structure, and a bit of Niantic math, extract the prefix from before the keyword – sixdsi = 6xd6 – and the suffix from after it – pfouthq = p4u3q – creating 6xd6resistp4u3q.
Distortion at the bottom of the image is caused by odd hex code in the exif; when this is removed, so too is the distortion.

Using the Cheshire Cat’s clues in the IRC channel:
[23:21] <Theresa_chic> I wrote an Ebook / did not use a pen/ What number did it took / It was not twelve or ten
[23:47] <Theresa_chic> If you guess the number right/ a search for the ebook should make you more bright
[00:36] Theresa_chic: long ago he introduced europe to print / now  his name gives books online, that's a hint
* Theresa_chic fades away

The clue was held in Lewis Carroll’s “Alice’s Adventures in Wonderland” on Project Gutenburg – the 11th e-book, thus “not twelve or ten” and the book from which the image was taken, and as the code separates neatly by comma into 12 groups of four, and the book has 12 chapters, the digits indicate a Chapter:Paragraph:Sentence:Word selection pattern (e.g. the first string is 2:9:5:6, and the 6th word of the 5th sentence of the 9th paragraph of the 2nd chapter is “twenty”). This yields “twenty thousand taking two hundred two; seven thousand two hundred four times two adding one; fifteen thousand adding two thousand seven hundred twenty taking one; twenty one thousand nine hundred ten taking one hundred”.
Converting to numerals: 19798 14409 17719 21810 Then to Hex: 4d56 3849 4537 5532 And finally to ASCII: MV8IE7U2 Leading us down to the final level of this leg of the dive, located at: http://commondatastorage.googleapis.com/pac/accessdive/03/05/MV8IE7U2.html ←-


05

Original Link

Transcription
Congratulations, fellow truthseeker. You have completed Access Dive Phase 2. Our struggle will continue. End of Transmission.
Hidden Info
There are two activation codes in the page’s source code
In the source code is the following:
< style type="text/css" >
	._01544022 {} ._934d0e01 {}
	._c8319444 {} ._43904404 {}
	._05011a02 {} ._c0319350 {}
	._2d05e01c {} ._83193780 {}
	._444ec420 {} ._2554e053 {}
	._d4005093 {} ._78040648 {}
	._2212785c {} ._013d3484 {}
< /style >


A hint from the VI chaps:

[06:21] <!Verum_Inveniri> base
[06:22] == Verum_Inveniri [~Verum_Inv@verum.inveniri] has quit [Client closed connection]
[06:42] == Verum_Inveniri [~Verum_Inv@verum.inveniri] has joined #veruminveniri

Logging out at :22 and logging in at :42 indicates 64 (42+22). The word “base” preceding it alludes to base 64. Taking the numerals from the code and converting under Base64 yields SEPTEMWHISKEYECHOQUATTUORVICTORECHOROMEOUNIFORMMIKEQUEBECTRESROMEODUOSIERRA= This is broken down as follows:

SEPTEM = 7 WHISKEY = W ECHO = E QUATTUOR = 4

VICTOR = V ECHO = E ROMEO = R UNIFORM = U MIKE = M

QUEBEC = Q TRES = 3 ROMEO = R DUO = 2 SIERRA = S

Leaving us with an (invalid) passcode of 7we4verumq3r2s…until the Cat comes back!

[13:13] == Theresa_chic [~Theresa_c@a.grin.without.a.cat] has joined #Veruminveniri
[13:13] <Theresa_chic> September was 7 and now it is nine /  just reverse this path / And you should be fine / Think of it as Vi niantic math

7 to 9 reversed means -2, applied to “September” is 7-2=5, yielding 5we4verumq3r2s.

investigation/other/vi/ad02.txt · Last modified: 2016/06/18 21:20 (external edit)