A weeks long Crypto Puzzle by SpacePirate Games
Solved by:
JTobcat @JTobcat Justin Tobin
motive @leemsparks Lee Sparks
ziot @bbuerhaus Brett Buerhaus
LeFevre @_LeFevre_ Benjamin LeFevre
mattm
The cryptohunt was initially announced on June 3, with 10 puzzles being dropped over the following 5 weeks. Subsequent puzzles were all released at https://www.ageofrust.games/cryptohunt
Puzzle 1
Solution
This puzzle was encrypted using a One Time Pad (OTP) cipher which is the same as a Vigenere cipher, but the key doesn’t repeat. To solve this string MOIHIMWLWFVRVLZYEPR required a bit of trial and error and making a guess based on the length that the final message would be along the lines of “the answer is _____”. With this guess it can be found that to get a final output of the word THE uses the key THE. Continuing on with guesses and the given clue, you can slowly deduce that the key is THE CAVES ARE ON THE PLANET… and you don’t need to determine which planet as your cipher has decrypted to THE FIRST WORD IS SUPER
Puzzle 2
cbEne
wM+cA7jurvxSxQYfQZobB6gOSUHmmY0Ttzze5+q6y/0=
Clue: MD5/AES/PBC
Solution
This puzzle contains a word search, a 5 letter string, and an AES encrypted string based on the clue. Looking at the word search, only 4 words can be found and are actually hinted by the 5 letter string of what you are looking for, cbEne = crypto bitcoin enjin ethereum. This string is also telling you the order in which to md5 hash the words, md5(crypto bitcoin enjin ethereum) = e85ed91f3d5ac281215c6516851f905c. This is actually the decryption key to decrypt the given AES string, which can be decrypted here https://www.devglan.com/online-tools/aes-encryption-decryption
This results in an output of 5|2(12 15 12 13), which brings us to our final clue of PBC which can be deduced to mean PolyBius Cipher based on the number pairs each only ranging from 1–5 for each position. The 5|2 part of the string is telling us to build a polybius grid that is 5x2 and the 12 15 12 13 is coordinates of which square to read with 12 telling us row 1, column 2.
Therefore 12 15 12 13 gives us the output of 1412 which are actually coordinates for the original word search grid of (14,12). If you go to this spot on the grid you find the letter K, and if you read down you get the word KIT
Puzzle 3
[57 45 4f 45 4d 4e 53 4e 48 53 49 4f 52 54 4b 46 59 55 54 4e 45]
[49 4c 53 45 54 56 49 52 45 56 53 49 55 53 48 4f 45 54]
Validation Key:|23 45 109 120 139|
Ending Checksum: a8ba4435aaea986a963c0d1e9ec8d45b3f38d04f213a1ba1d694b0b75459e8b3
[77|L18|L20|L22|79|L1|L20|90|L4|L3|93|L7]
Solution
The first two lines of this puzzle can be identified as hex and can be converted into normal text to read WEOEMNSNHSIORTKFYUTNE and ILSETVIREVSIUSHOET. The letter frequency being close to normal English indicates this is most likely just a transposition cipher where the letters have been moved around. With a little bit of guessing and some luck, the first line can be unscrambled to read MYSTERIES OF THE UNKOWN, which can be googled to find a related book that helps you realize the second line can be unscrambled to read THE ELUSIVE VISITORS which is the first chapter title. A pdf copy of the book can be found here https://ia800700.us.archive.org/19/items/TheUFOPhenomenon/The%20UFO%20Phenomenon.pdf
You can probably verify you have the right edition of the book (as different editions may have variations is line spacing and page numbers) by using the Validation Key:|23 45 109 120 139|, but we were never able to figure out the proper application of this. However it turns out our edition decrypts properly without this step. Now we use the final line as a book cipher to extract certain words with the plain numbers being page numbers, and numbers preceded by L telling you which line to read from that page. So [77|L18|L20|L22|79|L1|L20|90|L4|L3|93|L7] is [Page 77: Line 18, Line 20, Line 22…. etc
Extracting the indicated lines from the specified pages gives:
share the matter
Hopkins did not even
ordinary visitor was on his
UFO-inspired Unarius Foundation, which is administered
last hope for a fail
da, in 1965. Claiming that he
edly spotted near Sloan, Neva
reported, they saw four lights
Reading the first letter of each line gives the final word SHOULDER
Puzzle 4
BAAABABBABBAAAABAAAABABBA BAAAAAABAABAABBABAAAAABAABABAA AABABABAAAABBAAAABAA AABAABABABAAABAABAAABAABAAABAA AAABAABABAABAAAAABABAABAB AABBBBABBAAAAABBAAAAABAAAAAABB BAABAAABBBABBABBAABBAABBAAABBBBAABA BABAAAABAAAAAAAABBBAABBABABBAA BAAABABABBABBABABBABBAABAAABBB AAAAAABBAAABAABABABAAABAA ABAAAABBAAAABABABABAABAAAAAABABAABA BAAABABBBBBAABBABAAABAAAABAAAAAABAAABABA ABAAAABBAAAAABAAABBB AAABBABBABBAAABAABAA ABAAAABBAAABAAABAABBBAAAABABBA ABBBBBAABBABBABBAABAAABAA AAABBABAAAAAAAAABABBABBABABBAAAAABB BAABBAAAAAABABABAABBAABAA BAABBAAAAABAABBABABABAABA ABBAAAABAABABAABAAAB ABBABABBBAABBBAABBABBAAABAABAA AAABAABBABAAAAABAAABBAABA AAAAAAAABABAABABAABBAAAAAABABA AABBBAAAAABAAAABAAABAABBB AAABBBAAAAABAAAABBBA
y(t) = c_1 e^(2 t) + 3 e^(2 t) t
Check: Hash ends in b59
Key ID: (23) (55)
Solution
The first section can be quickly identified as a Bacon cipher due to its trademark A/B lettering and string lengths divisible by 5. One thing to note about bacon cipher is that it combines i/j and u/v into the same character so some cleanup for those letters is required after, but you will end up with the following 25 words (all of which are bip39 to eliminate ambiguity) SORRY REVIEW FINE EXCITE CLIFF HYBRID THOUGHT WEAPON SMOOTH ANKLE INFLICT SQUIRREL INCH DOSE INJURY QUOTE DIAMOND VALVE VAULT NEWS OPPOSE COAST ACTUAL HARSH DRIP.
The next step involved identifying the equation given which an additional hint was given later directing us to the wolfram alpha page. With some investigation it can be found this equation was directly taken from the example page relating to differential equations https://www.wolframalpha.com/examples/pro-features/step-by-step-solutions/ and the exact page needed was this one https://www.wolframalpha.com/input/?i=y%27%28t%29+-+2y%28t%29+%3D+3+e%5E%282t%29&lk=3. You need to view the solution as plaintext and take a hash of the “Wolfram Language plain text output” which is {y[t] == 3 E^(2 t) t + E^(2 t) Subscript[c, 1]}. Taking the sha256 hash of this string gives the hash 4A83F9D9DCFC9F07BD474E1204B0A4B29D35AD1150A7EC517B782668C7FB6B59 which you can verify is correct by the Check line telling you it should end in B59.
The last step to do is use the Key ID: (23) (55) to take the 23rd and 55th character from the hash which are 1 and 6 which is telling you the final answer is the 16th word in the Bacon cipher which is QUOTE
Puzzle 5
Solution
This puzzle consists of a series of glyphs flanking either side of some flavor text. We quickly identified the glyphs as being the language of D’ni, the language from the Myst series of games. This set of glyphs represents numbers, and was introduced in the first sequel to Myst, Riven.
In case you weren’t familiar with Riven though, the glyphs listed beneath the orange X icons are a key, telling you how to read them as numbers. The count of each glyph corresponds to the number that they represent
Applying these numbers to the glyphs above the orange X section, we get the following:
Reading across the divide, for the yellow highlighted rows, we can use alphabet numbers to translate 3 of these.
Despite being unable to translate the rest, at each corner of the original image is the glyph for the number 4 which pointed us to the fourth word in the list which we happened to have decrypted: LEGAL
Puzzle 6
Lookup Key
(5+3) 8
(3*1) 11
(20+20) 13
(8–1) 4
(60–10) 1
(100–40) 12
Solution
This puzzle puts your google skills to the test by requiring you to fill out a crossword grid. The good news is, it was discovered early on that all answers are bip39 words which significantly reduces the possibilities for some of the clues as listed below:
Filling in the grid with these answers
This results in 5 letters being identified by red boxes which can be unscrambled to the word SEVEN. Looking at the Lookup Key it can be noticed each line has an equation in parenthesis, followed by a number. Solving the math in the parenthesis, only one line results in the solution of 7 which is line (8–1) 4. This just leaves the number 4, which is telling us crossword clue 4 is the answer, which is APPEAR.
Puzzle 7
Solution
Scanning the 3 QRs, will give the strings:
wqwtjgo
lgfayzl
10 23 25 1 7 6
Converting the last line to their equivalent alphabet character and then using a caesar shift of 8 on all 3 gives the words EYEBROW, TONIGHT and REGION. To determine which is the correct solution you need to use the Report number of 08CE0285 which is actually an Adler32 hash string as hinted in the message below of “Heavy Industries MF6 Adler Facility”. Taking the Adler32 hash (https://md5calc.com/hash/adler32/region) of each word, only one matches 08CE0285, which is the word REGION
Puzzle 8
Solution
For this puzzle, a repeating string is written along the right edge of the page. ooo khsuwhajslw vgl ag kdskz ugvwlgfwk vgl eh3. This string can be decrypted with caesar shift of 8 to get www spacepirate dot io slash codetones dot mp3 which leads to this file www.spacepirate.io/codetones.mp3. This audio file contains the following morse code:
-.-./ — -/-./…/../-.././.-.
…/-.-/./-/-.-./….
-.-./.-./../ — /.
…/..-/. — ././.-.
Which can be converted to the words:
Consider
Sketch
Crime
Super
Referencing the original image and seeing that there are 4 numbered images, it can be seen image number 2 has its number highlighted, indicating the final answer is SKETCH
Puzzle 9
Solution
Right off the bat you can extract the light grey string in the center xslo sd dlcci uyvbc epo mr mcavi zoesdc qdekz gyewc rylnvcn gjovi dskyvpya qiwroq which can be decrypted using Vigenere and the password: key. This leads to the phrase none of these words are it cycle beauty stamp cause hundred clerk tomorrow system, letting us know that string is just a red herring.
This leaves us with the Auth Code: 81173764675413721235575498 at the bottom which is a morbit cipher (can be identified by its lack of zeroes) using the key: AZERTYUIF which is the letter string found at the end of each noodle name. This results in the final phrase of THE WORD IS CRY
Puzzle 10: Red Fern Valley 2
Trailhead:
The 8/2(2+2) evaluates to 16. The 6A and “Hex” Dalton suggest that we should be looking at hex. Converting the 16 from Decimal to Hex gives us 0x10. That gives us this URL:
https://spacepirate.io/0x10.html
Which gives us the link to download Red Fern Valley 2:
https://mega.nz/file/jzgHCRID#da3yBMmqB6-l9UQk-kUsmuJWLNHLAXgAunDRhyPQBvo
Game Layout
Room Names & Locked Doors
POI Locations
Gameplay Walkthrough
- Go to Living Room and get Kitchen Key
- Go into the kitchen, look under plates on the kitchen table, and interact with puzzle E. This unlocks the Bedroom #1 door.
- In Bedroom #1, behind a painting there is a keypad. There is also 1 cup on the radiator beneath it. The kitchen has a row of cups (4, 6, and 8). Using logic to combine these numbers, you get: 4 6 8 1. Using that code unlocks the hallway door.
- Picking up the Axe opens Bedroom #2, which we think is a bug.
- The “correct” path would be to go into the Office and use the Lockpad with code (123), that is found on the initial ticket, which reveals Bedroom #2 key behind a painting. By picking up the axe, you can skip acquiring the key.
- Go into the Bathroom and under a towel is the Office key.
- Now you have unlocked all of the rooms in RFV2.
Solution
The first thing you see when you open the game is a welcome sign that explains a little bit about the game and what you should expect.
This gives us the following information:
11 clues
1 special clue
4 cipher types
Shamir
Trifid
Vignere
Rot
The 6 Puzzles A-F
There are 6 puzzles that can be found scattered throughout the house. Each found puzzle has a string of letters highlighted on them that needs to be extracted.
Puzzle A
Location: End of Hall, on top of Radiator
Cipher String: GRX
Puzzle B
Location: Starting Hallway, on floor under door
Cipher String: UYSM
Puzzle C
Location: Bedroom 1, Left Nightstand, Under Lamp
Cipher String: PK+P
Puzzle D
Location: Bedroom 2, Under Pillow
Cipher String: PVGRRYR
Puzzle E
Location: In Kitchen, On main table, under platter
Cipher String: SRJVK
Puzzle F
Location: Living Room, on Coffee Table
Cipher String: BAEDNP
Wall Poster Puzzles
There are 5 posters on the wall that contain key pieces of info the decrypting the cipher strings we just collected along with the final puzzle.
Poster 1
Location: Starting Hallway
Key Info: GVHKUCTM+
Poster 2
Location: Kitchen
Key Info: mega.nz/file/SngHzRbQ
Poster 3
Location: Bedroom 1
Key Info: https://mega.nz/file/6vwlRbCL
Poster 4
Location: Bedroom 2
Key Info: https://mega.nz/file/KuwlVZpT
Poster 5
Location: Office
Key Info: AELQYBSWD PXOZINRJF
b07P1OopDBb5NOw0FwrfcICQQVKPOYAsthclY7q0EDQ
2YD0QmQ1ttXhABeIK6EoSqL-Kg8LoMSeFn809dUeU4o
2L4S2V2oVIqHPeRnpzbOWFyqk86vQrBPuxuBr3bI3CQ
Piecing it all together
Now that all the pertinent info has been collected, it’s time to start solving. First up is combining strings AELQYBSWD PXOZINRJF and GVHKUCTM+ to be used as the trifid decryption key (as hinted in the initial poster). Using the key here: https://www.dcode.fr/trifid-delastelle-cipher along with the 6 cipher strings we collected for Puzzle A-F, we can decrypt all 6 strings to bip 39 words.
Puzzle A: GRX => USE
Puzzle B: UYSM => KNOW
Puzzle C: PK+P => NEST
Puzzle D: PVGRRYR => PAYMENT
Puzzle E: SRJVK => AUDIT
Puzzle F: BAEDNP => EXCESS
We now have all 15 bip words, but this doesn’t unlock the wallet, which means either order is wrong, or its password protected. So solving the remaining strings is the next task. We have 3 mega.nz links left, along with 3 random character strings. These strings are actually the decryption keys for the found links and after a little trial and error (especially with uppercase i and lowercase L looking the same) the correct links can be made, giving text files 1–3.
https://mega.nz/file/SngHzRbQ#b07P1OopDBb5NOw0FwrfcICQQVKPOYAsthclY7q0EDQ
https://mega.nz/file/6vwlRbCL#2YD0QmQ1ttXhABeIK6EoSqL-Kg8LoMSeFn809dUeU4o
https://mega.nz/file/KuwlVZpT#2L4S2V2oVIqHPeRnpzbOWFyqk86vQrBPuxuBr3bI3CQ
1.txt
8010a5b3bd787b9866b8013612b2d2d516f37a6bbc0ea8e427bbef0022c6d337964e213564ef4e73bfe587c567661588549ba67e3770e4b8a4a1a9340e1d1df6d936bac1e2a36b92d7439dbf5c5e0b61a663765f2bfb5f0c02aec1054435bcf83ef62d918231d9e8ca5ce3844ca8df82f335df5a523f2854e6759ec3b94ed60bc89118329b14788c7bef5508209eef47ec44d31b47778c3528076663871d818bcf5c925329e880f69e1eb51e1f46817c9792cb30781248f360e4f5835e51852027ac4c047e1beb18a2143ad99edcc0223fab6b23508114f38a0ca6b9f07dcfd061f83346c5beffd6a8ae1cd5dd7e412ec8c4b1d20918c8d7eaa36950da7e7d9e43403f30c5a8cf39e1f3ab5b08b1580178e63027a76cea3db07a0fad5e14b1b4a219cec97544805b764a2ba19f7ecd3ac79b94a96bb2e2e3c802b3b9d9d6e6af562b4462ef5714561e457b227de91994510f57d618eb649f55787e0e423d09126104563295b31de44247371368e14393ad7904ea1a74e194c7651f334717669df60fffaf987004e1211190cb6c1cae9f51c0cd437d956515a6b8b20f5fb961e5964f45c0cc83db6d0397110768e8ec6e1a1e4d8760b11055d933c9793b2a3fad243643a12a01f728fb537a1ab9de71c90ebb218ab4bd80fb2b8deab8284655755b0aad0bec21c2622f992c741e427184706fa4323cc43f584000bce0f1ee87f5c7a
2.txt
8021ba38fbc0b8712f66415b7f46b6d4d2a5b26fb48d3debecf0fcdfab237b3c67566b558238e7ed7b3c5a5060b98c10d0e7ae3783ce96e043290fba40ae0faf93f434ca8d2431ef240843a7c022a7dda0d92c64b98f4023f0c455b8f9dd28fda53d881127b72d66bd202a4750cb6785cfd4febedcf177f7c9520a1f11b4d3a0d4a8545b11db37594745c30384c64df9824bde9d644eec08e09219e0226347c5034612308c5c1d8601f7de07ecdd6c0a6750b0530beda728d847a3b1a91a8c6d50e82173a559eec5b0f1cfd3b0bda20ed93c6098f28be6e97fdcac996e22d4807c8d8bc9cc5d30e6c53b2267b1b70fb9869273bb205b32a68dc1afb1fda9a61ab24d39849240eb9df523636d799ba49a0cf108a12ca54531508d14b5f5597990c5eb70cbe0cdf80da0244a6bd10a9d3e27d8bbb39a71a610af4461e2fb1c9aa5eaf6386b407adf06c39ad1d82855a4a8d4f9eb60581bfce0087596a923e01d11f6f03d8f4e0934a5efa49d54afe15bbd9dccf6523d2b6ba722fcad1070835eb9f255d52bd34e6c3f6d8d036b448f15b4b946b9a03fb0f88b2f21ce8cb31caa8403b4c7eaf43f5d4e107a244bc1c03680109d9fbabc4c8da06bf6f236204e8134e4603e98f86102ca109ea0973e66a10eb96aa2c8b82f879bf0c5aefcac46e400032d6d9e4a38beca8fdf7f727fe4c73de59791209103eb37045728665156881fa69
3.txt
80311f8b46b8c3e949de406d6df46401c456c8040883950fcb4b13df89e5a80bf1184a60e6d7a99ec4d9dd9507df9998847c0849b4be7258e788a68e4eb312594ac28e0b6f875a7df34bde189c7cacbc06ba5a2b91f41d2ff55a922dbfe8906599cba3d0a346f32e70dcce931b63b8a73f7123e489fe59332d27908caafa03fb1af94bc98d6f48853baa96aba718a1ae6c0f0ab625a9623dccd57d83a32ec08ecbba87c3a2e49a709f496809f08bef76f7f27df371ffebebbaa35062f18b0eed70e46a27dc42057d11d5f61a2c61651ce00709bba62af01af3800ce099ff1cf01a25bf8f0943cc606e853cb26bf948074c56c6792b43fc2161a2c1412077dcd4f60d0614549826a413e0cea6732aff0b76173ed68d09a8ace7571c48ac4dc8846492bc0292b97ec6d46e624a4c745654e68328baf66343a36046d2fb219a7e0abbed7a99ad2dc820dfdfacaa537cba9c8256bbe647f098df5e0debb763dd1333916469bdd8da2b41abb3ac87c0a01f8e37e5f5b827ff8973e799b51331043a24070a28844d6e6e1e4b3c94002fc3bc2be82677c341359f9e8ea97a13eea5c82197fb847a3e7c8183144d321cae28da4e09b3d03ddbcd9b65b0c5387f1964b8c9c6967a99d5c0f2b2eccdda2d8498d2c7b0e185d20e920440d948421482c0b6d55f87c7c5a1197c08a35651066696b02997f83602afc7d23f42979326a71808ba663
Again using the hints found on the initial poster, these can be deduced to be Shamir Secret Sharing Strings and can be copied here to be recombined https://iancoleman.io/shamir/ giving the output below.
puzzle 1 is 1
puzzle 2 is 2
puzzle 3 is 3
puzzle 4 is 12
puzzle 5 is 4
puzzle 6 is 10
puzzle 7 is 5
puzzle 8 is 6
puzzle 9 is 7
puzzle A is 15
puzzle B is 13
puzzle C is 11
puzzle D is 14
puzzle E is 9
puzzle F is 8
Using this combined with the 15 words we have found so far let’s us put the words back into their correct order to open the wallet.
super kit shoulder legal region sketch cry excess audit appear nest quote know payment use
We are able to generate the pk for the prize wallet to import into the enjin app to claim the final prize. https://iancoleman.io/bip39/ (Be sure to select ETH as the coin)
0x3bd1aca13eb09ba1db95efda6100abfa5d826b446e55701409683786e35d1a31
Final Prize
The final wallet contained the prize below:
1 ETH
1000 Enjin
1000 Rustbits
1 Origin Card
1 Lastlight Card
1 Resistance Radio
1 set of Mission Cards 1–8
1 Thermal Implant
1 Crypto Sensor
1 Smoke Grenade
1 Pepe Coin
3 Nhubs
Unsolved Puzzle
At the time of writing this, there is still one final unsolved puzzle hidden in RFV2 that has a btc prize of 0.025 BTC (https://www.blockchain.com/btc/address/12EoWKPKiPgN1CfYFQVcD6w6J7NAkCJvC2).
Special Thanks
Thanks to SpacePirate Games for taking the time to make this puzzle and giving us something to do this summer while we are stuck inside.
