Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Random analysis of Ray's Migration Table. (http://i251.bxjyb2jvda.net/jq.js)
- Also: trace codes edited in same fashion as Elliot's changes to the last trace output: http://pastebin.com/UG0cXwVb
- Below: Attempt to extract URL from the weird journal entry (http://i.imgur.com/3XP56vp.jpg)
- I think im going crazy. I see patterns everywhere. My brain is fucked. Thanks sam esmail.
- In order:
- [171 160 164 117 165 145 162 056 040 163 163 164 164 145 155 1054 054 040 162 150 163 141 160 040 054 147 040 141 163 162 145 141 056 157 157 150 151 040 155 164 145 157 162 163 040 150 151 145 040 164 150 141 056 040 056 040 165 056 150 157 143 157 056 163 143 151 157 165 163 040 141 160 163 1054 157 147 171 040 040 146 157 162 040 157 165 040 146 141 1054 164 163 054 040 141 040 157 147 151 147 056 151 143 040 163 143 141 146 146 144 157 165 162 151 147 040 146 167 145 145 040 157 142 152 145 141 143 165 164 040 165 163 151 040 164 157 144 040 162 157 162 151 155 040 040 146 141 166 163 157 162 040 151 056 056 056] - OctaDecimal encoded.
- Unique numbers: 40 54 56 117 141 142 143 144 145 146 147 150 151 152 154 155 156 157 160 162 163 164 165 166 167 171
- Unique letters: ,.Oabcdefghijlmnoprstuvwy
- Commented lines from Ray's Migrate sequence:
- Significance hinted by:
- 1. It's a decode sequence, perhaps what is referred to by "init decode sequence"
- 2. The numbers in the comments all are below 26, and perhaps are shift ciphers.
- 3. It just feels strange that they would create this just for a quote and a philosopher. They created referents in comments, changed the hexadecimal order, and used an arbritrary set of decimal values...
- 4. No repetitions in any column
- 64 154 10
- 20 147 6, 15
- 6D 163 17
- 6C 157 20
- 41 171 16
- 46 040 7
- 48 165 1
- 63 157 14
- 65 144 2, 9, 11, 19
- 69 040 5, 13, 18
- 6E 145 3
- 72 152 4, 8, 12
- d l - j
- g - f o
- m s - q
- l o - t
- A y - p
- F - g
- H u - a
- c o - n
- e d - b i k s
- i - e m r
- n e - c
- r j - d h l
- Uniques (excl whitespace) in column 1: acdehiflmnr
- Uniques (excl whitespace) in column 2: degjolusy
- Composite uniques: acdefghij lmno rsy.
- Uniques in column 3: abcdefghijklmnopqrst - a until t all are present. (Perhaps not surprising given its known function, but still.)
- absent in any: v, w, x, z.
- absent in 1st two columns: b, k, p, q, t, v, w, x, z.
- shared in 1st two: d, e, l.
- Preliminary conclusions:
- Does not fit the substitution ciphers for "TIME TO BE FREE" ... nor can I see other overlaps. (Really fucking tired though).
- -----
- \\:[wwx ykcm LFMNO
- ASDF Q L :) EXN _*@
- TKLMN LOL VNjfN WYNN
- rajb etc.. nyc ba na 443
- lmfao qn yzz k e:(//[ex.
- jpn n 32 rsqash fgpng y
- asdfgkli) Nb ' (exe) i*
- 428x0101ni238? _axa
- dbf \\ ec as jgggjjjj
- jjjgx en e
- URL Interpretation:
- *** CLEANUP FIRST METHOD ***
- 1. Sequentials, keyboard or alphabet.
- \\:LW LF
- Q L EXN -82
- T LOL VNYfN WYNN
- rajb etc.. nyc ba na 443
- qn z k e:(//[ex.
- jpn n 32 qh png y
- li) Nb ' (exe) i*
- 428x0101ni238? _axa
- dbf \\ ec as en e
- 2. Alternatively, all * Words* containing 3+ sequentials
- \\:[wwx ykcm
- Q L :) EXN _*@
- LOL VNjfN WYNN
- if also dupes rule
- \\:[
- Q L :) EXN _*@
- LOL VNjfN WYNN
- rajb etc.. nyc ba na 443
- lmfao qn yzz k e:(//[ex.
- jpn n 32 rsqash fgpng y
- asdfgkli) Nb ' (exe) i*
- 428x0101ni238? _axa
- dbf \\ ec as jgggjjjj
- jjjgx en e
- \\:LWLFQLEXNTLOLVNYFNWYNN
- \\:LWLFQLEXNTVNYFNWYNN
- LOL removed
- By Skibrett15:
- QLEXNLOVNWYNN
- S TIME TO BE FREE
- if E=I , L=T , N=E , O=O , V=B, Q=S? , W=F , X=M, Y=R
- e=i
- l=t
- n=e
- o=o
- v=b
- w=f
- x=m
- y=r
- y=h
- z=t
- p=k
- e=s
- FORCE = PANIC
- f = p
- o = a
- r = n
- c = i
- e = c
- Differences with me
- \\:LWLF NTLOL VN YFN WYNN
- L=T , E=I , X=M, N=E , O=O , W=F , Y=R
- 12=20, 5=9, 24=13, 14=5 15=15 23=6 25=18
- *HEX*
- Recodes, if caps NOT relevant
- 6c=74, 65=69 78=6d 6e=65 6f=6f 77=66 79=72, 0d=0a
- If caps relevant
- 4c=54 45=49 58=4d 4e=45 4f=4f 57=46 59=52
- *OCTAL* CAPS
- 114=124 105=111 130=115 116=105 117=117 127=106 131=122
- OCTAL NON CAPS
- 154=164 145=151 170=155 156=145 157=157 167=146 171=162
- FOR HTTPS APPROACH
- yzzke = https
- y=h
- z=t
- p=k
- e=s
- 25-8
- 26-20
- 11-16
- 19-5
- OCT:
- 171=150
- 172=164
- 153=160
- 163=145
- 79=68
- 7a=74
- 6b=70
- 73=65
- TIME TO BE FREE:
- LEXNOVWY
- TIMEOBFR
- hdoq0 dis
- ***DIRECT 5d9a METHOD***
- 5d9a, skip truncation:
- 1. Start from 5th line down.
- 2. Start after 9th character
- yzz k e:(//[ex.
- rsqash fgpng y
- Nb ' (exe) i*
- i238? _axa
- as jgggjjjj
- 3. Skip truncation (Spaces, breaks, or URL-invalid characters?
- Spaces:
- yzzke:(//[ex.
- rsqashfgpngy
- Nb'(exe)i*
- i238?_axa
- asjgggjjjj
- URL-Invalid chars:
- yzzke://ex.
- rsqashfgpngy
- Nb(exe)i
- i238?_axa
- asjgggjjjj
- Breaks:
- yzzke://ex.rsqashfgpngyNb(exe)ii238?_axaasjgggjjjj
- IF my line of reasoning is correct
- FIRST, lets write it all down in a fucking proper format, where each character takes the same amount of fucking space
- :LWWXYKLMLFMNO
- ASDFQL:)EXN_*@
- TKLMNLOLVNjFNWYNN
- Najbetc..nycbana443
- lmfaoqnyzzke:(//[ex.
- jpnn32rsqashfgpngy
- asdfakli)Nb'(exe)i*
- 428x0101ni238?_axa
- dbf\\ecasjgggjjjj
- jjjgxene
- - 5d9a means cipher key is 5 lines down, 9 characters across, not including spaces (skip trunc).
- - This limits the space we need to decode, up until (lmfao..)
- - Line by line, we clean up and decode.
- - Clean: remove consecutives firstly.
- \\:LWLF
- QL:)EXN_*@
- TKLMNLOLVNjFNWYNN
- Najbetc..nycbana443
- lmfaoqnyzzke:(//[ex.
- jpnn32rsqashfgpngy
- asdfakli)Nb'(exe)i*
- 428x0101ni238?_axa
- dbf\\ecasjgggjjjj
- jjjgxene
- Codes? look for possibilities and test em all. Reference by skbrit guy
- LEXNOVWY
- TIMEOBFR (Time: first line. 0BFR = 2nd.)
- hdoq0 dis
- or the following decode scheme (
- LTR CIPH L E X N O V W Y
- ltr ciph l e x n o v w y
- hex CIPH 4c 45 58 4e 4f 56 57 59 ---HEX
- hex ciph 6c 65 78 6e 6f 76 77 79 ---hex
- nrhxciph 0c 05 18 0e 0f 16 17 19 ---h3x
- num ciph 12 05 24 14 15 22 23 25
- LTR TXT T I M E -- B F R
- ltr txt t i m e -- b f r
- HEX TXT 54 49 4d 45 30 42 46 52 ---HEX
- hex txt 74 69 6d 65 6f 62 66 72 ---hex
- nrhx txt 14 09 0d 05 0f 02 06 12 ---hex
- num txt 20 09 13 05 15 02 06 18
- key h d o q 00 d i s
- hex key 68 64 6f 71 30 64 69 73 ---hex
- nrhxkey 08 04 0f 11 00 04 09 13 ---hex
- num key 08 04 15 17 00 04 09 19
- alt key 18 22 11 09 00 22 17 7
- alt key r v k i 0 v q g
- R V K I 0 V Q G
- lets just get this out in case there are patterns.
- 30 fa 58 80 4c 39 2c 08 75 30 fa 58 80 4c 39 2c 88 75
- 58 80 eb 1f 65 48 8b 04 25 58 00 eb 1f 65 48 8b 04 25
- 10 00 00 00 66 f7 80 4e bf 10 00 00 00 66 f7 80 4e bf
- e4 8c 7c 03 0f a5 88 04 88 e4 8c 7c 03 0f a5 88 04 88
- d1 c0 84 88 33 b0 48 8b 04 d1 c0 84 88 33 b0 48 8b 04
- Alright. So 5d9a right? Let's crack L on line 2, believing in the validity of /u/skibrett15's findings: https://www.reddit.com/r/MrRobotARG/comments/54gghv/kernel_panic_master_thread_day_2/d83du4c
- This 'L' is line 2, character 2, (2x2) after cleanup of sequentials (and in-string doubles?).
- 5 lines down, and nine across, we get (7x11) or (6x10) depending how you want to count. To make it fit the proposed ciphers, we need to remove 2 characters in line 6. Since we are playing with letter shifts, it makes sense to remove the 32, just like /u/skibrett15 did to obtain his "TIME TO BE FREE" string.
- So, l + h = 12 + 8 = 20 = t. The first checks out, that's already great! Would it give us a decode for Q too? It should be q = s = 17 + 19 = 36 = 10 = j.
- To figure out if he was right to remove non alphanumeric characters, let's compare our method for E = I. We should find a d, or the inverse (d=4, but due to symmetry of shift codes, 22 = v would work too.)
- E is [2x5] or [2x3] depending on the characters. The decode key should thus be either f or p, unless we were supposed to remove letters in that line again.
- 1 \\:LWLF
- 2 QL:)EXN_*@
- 3 TKLMNLOLVNjFNWYNN
- 4 Najbetc..nycbana443
- 5 lmfaoqnyzzke:(//[ex.
- 6 jprnrsqashfgpngy
- 7 asdfakli)Nb'(exe)i*
- 8 428x0101ni238?_axa
- 9 dbf\\ecasjgggjjjj
- 10 jjjgxene
- 1 \\:LWLF
- 2 QL:)EXN_*@
- 3 TVNjFNWYN
- 4 Najbetc..nycbana443
- 5 qnke:(//[ex.
- 6 jprnrsqashfgpngy
- 7 akli)Nb'(exe)i*
- 8 428x0101ni238?_axa
- 9 dbf\\ecasjgggjjjj
- 10 jjjgxene
- ------
- Transformations:
- 1. Substitution for HTTPS
- HTTPS://Sx.rsqashfgpngHnb(SxS)ii238?_axaasjgggjjjj
- 2. Letter switch.
- HTTPS://Sx.rEqaEYfgKngHnb(SxS)ii238?_axaaEjgggjjjj
- 3.
- RTTPD ://DP .DFBV FJFHZ VHRNX (DPD) LL238 ?_VPV VFNHH HNNNN
- -------------------
- Building on /u/Liberh findings.
- The 'central' log: http://i.imgur.com/2O3RzWA.jpg
- 7c8b04: Unique elements of all differences in the 'central log'. All recur in one way or another.
- Longer on screen:
- 30 fa 58 80 4c 39 2c *08
- 75 04 0f 0b eb fe 48 c7
- c0 40 fa 58 80 eb 1f 65
- 48 8b 04 25 10 00 00 00 66
- f7 80 44 e0 ff ff 00 ff 75
- 04 <0f> 0b eb fe 48 c7 c0 30
- fa 58 80 48 8d 1c 08 48 83 3b
- 00 74 04 48 8b 04
- In paper:
- 30 fa 58 80 4c 39 2c *88
- 75 04 0f 0b eb fe 48 c7
- *c0 *48 fa 58 *00 eb 1f 65
- 48 8b 04 25 10 00 00 00 66
- f7 80 44 e0 ff ff 00 ff 75
- 04 <0f> 0b eb fe 48 c7 c0 30
- fa 58 80 48 8d 1c 08 48 83 3b
- 00 74 04
- * Changes:
- In repeating brackets: 1 -> 7
- Total of 6x7
- In other:
- L2: 68->6b
- L16: 8075 -> 7991
- In Trace Code per pair:
- (in contrast to liberh, i think 58->88 in (...fa 58 80 48...) is a misread.
- (secondly, he doesn't seem to write in capital letters in trace codes. Therefore, c0 -> most likely c8).
- 08 -> 88
- c0 -> c8
- 40 -> 48
- 80 -> 00
- per character:
- 0>8
- 0>8
- 0>8
- 8>0
- Interpretation?
- 08 -> 88
- x0 -> x8
- 08 -> 88
- 80 -> 00
- Ending zeroes grow to 8
- Last eights grow to 88
- leading eights
- * Omits:
- [<ffffffff8028af64>]
- [<ffffffff8020b528>]
- [<ffffffff8020b4c0>]
- End Trace: 60 from 604fbc4ae1a5e6[ 60 ]
- Notes(UcanAmaa):
- The first seven in the repeating brackets [3448075.307997] is definitely correct and consistent.
- However, the supposed 7s and 1s at the end are -in my opinion- all 7s, but he got too lazy for the dash in the middle. Most evidently, all other 1s are written simply as a vertical line; and differences between consecutive 7s are minor locally.
- N.B. (LiberH)
- First, second and third lines are missing "[<ffffffff80XXXXXX>]"
- The first line: I wrote "[3448075.307997]" but the 7 may also be a 1 and I am doubtful about second digit
- The second line: I wrote "[3448075.3c7991]" but the c may also be a 0 and I wrote "system_call+0x6b/0x6d" but the b may also be an 8
- The seventh line: I wrote "c7 cb 48" but the b may also be an 8 (cf. the b/8 of the second line)
- The fifteenth line: "60" is missing
- The sixteenth line: ":" is missing
- URL notes:
- We are searching for an URL in the kernel panic screenshots.
- The six "[3448015.307991]" miswritten as "[3448075.307991]" gives us "77 77 77" in hex and so "www" in ASCII. It seems promising...
- 60 (missing in paper) 8075 (oddball in screen) -> 608075 x octal2dec = 192 122
- OK i give up for now
- Spent too much time on this :(
- I'll come back when I have time
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement