Age of Rust CryptoHunt Solution

A weeks long Crypto Puzzle by SpacePirate Games

Solved by:
JTobcat @JTobcat Justin Tobin
motive @leemsparks Lee Sparks
ziot @bbuerhaus Brett Buerhaus
LeFevre @_LeFevre_ Benjamin LeFevre
mattm

The cryptohunt was initially announced on June 3, with 10 puzzles being dropped over the following 5 weeks. Subsequent puzzles were all released at https://www.ageofrust.games/cryptohunt

Puzzle 1

https://twitter.com/SpacePirate_io/status/1268282529984819200

Solution

This puzzle was encrypted using a One Time Pad (OTP) cipher which is the same as a Vigenere cipher, but the key doesn’t repeat. To solve this string MOIHIMWLWFVRVLZYEPR required a bit of trial and error and making a guess based on the length that the final message would be along the lines of “the answer is _____”. With this guess it can be found that to get a final output of the word THE uses the key THE. Continuing on with guesses and the given clue, you can slowly deduce that the key is THE CAVES ARE ON THE PLANET… and you don’t need to determine which planet as your cipher has decrypted to THE FIRST WORD IS SUPER

Puzzle 2

cbEne

wM+cA7jurvxSxQYfQZobB6gOSUHmmY0Ttzze5+q6y/0=

Clue: MD5/AES/PBC

Solution

This puzzle contains a word search, a 5 letter string, and an AES encrypted string based on the clue. Looking at the word search, only 4 words can be found and are actually hinted by the 5 letter string of what you are looking for, cbEne = crypto bitcoin enjin ethereum. This string is also telling you the order in which to md5 hash the words, md5(crypto bitcoin enjin ethereum) = e85ed91f3d5ac281215c6516851f905c. This is actually the decryption key to decrypt the given AES string, which can be decrypted here https://www.devglan.com/online-tools/aes-encryption-decryption

This results in an output of 5|2(12 15 12 13), which brings us to our final clue of PBC which can be deduced to mean PolyBius Cipher based on the number pairs each only ranging from 1–5 for each position. The 5|2 part of the string is telling us to build a polybius grid that is 5x2 and the 12 15 12 13 is coordinates of which square to read with 12 telling us row 1, column 2.

Polybius grid

Therefore 12 15 12 13 gives us the output of 1412 which are actually coordinates for the original word search grid of (14,12). If you go to this spot on the grid you find the letter K, and if you read down you get the word KIT

Puzzle 3

[57 45 4f 45 4d 4e 53 4e 48 53 49 4f 52 54 4b 46 59 55 54 4e 45]

[49 4c 53 45 54 56 49 52 45 56 53 49 55 53 48 4f 45 54]

Validation Key:|23 45 109 120 139|

Ending Checksum: a8ba4435aaea986a963c0d1e9ec8d45b3f38d04f213a1ba1d694b0b75459e8b3

[77|L18|L20|L22|79|L1|L20|90|L4|L3|93|L7]

Solution

The first two lines of this puzzle can be identified as hex and can be converted into normal text to read WEOEMNSNHSIORTKFYUTNE and ILSETVIREVSIUSHOET. The letter frequency being close to normal English indicates this is most likely just a transposition cipher where the letters have been moved around. With a little bit of guessing and some luck, the first line can be unscrambled to read MYSTERIES OF THE UNKOWN, which can be googled to find a related book that helps you realize the second line can be unscrambled to read THE ELUSIVE VISITORS which is the first chapter title. A pdf copy of the book can be found here https://ia800700.us.archive.org/19/items/TheUFOPhenomenon/The%20UFO%20Phenomenon.pdf

You can probably verify you have the right edition of the book (as different editions may have variations is line spacing and page numbers) by using the Validation Key:|23 45 109 120 139|, but we were never able to figure out the proper application of this. However it turns out our edition decrypts properly without this step. Now we use the final line as a book cipher to extract certain words with the plain numbers being page numbers, and numbers preceded by L telling you which line to read from that page. So [77|L18|L20|L22|79|L1|L20|90|L4|L3|93|L7] is [Page 77: Line 18, Line 20, Line 22…. etc

Page 77: Line 18, Line 20, Line 22

Extracting the indicated lines from the specified pages gives:

share the matter

Hopkins did not even

ordinary visitor was on his

UFO-inspired Unarius Foundation, which is administered

last hope for a fail

da, in 1965. Claiming that he

edly spotted near Sloan, Neva

reported, they saw four lights

Reading the first letter of each line gives the final word SHOULDER

Puzzle 4

BAAABABBABBAAAABAAAABABBA BAAAAAABAABAABBABAAAAABAABABAA AABABABAAAABBAAAABAA AABAABABABAAABAABAAABAABAAABAA AAABAABABAABAAAAABABAABAB AABBBBABBAAAAABBAAAAABAAAAAABB BAABAAABBBABBABBAABBAABBAAABBBBAABA BABAAAABAAAAAAAABBBAABBABABBAA BAAABABABBABBABABBABBAABAAABBB AAAAAABBAAABAABABABAAABAA ABAAAABBAAAABABABABAABAAAAAABABAABA BAAABABBBBBAABBABAAABAAAABAAAAAABAAABABA ABAAAABBAAAAABAAABBB AAABBABBABBAAABAABAA ABAAAABBAAABAAABAABBBAAAABABBA ABBBBBAABBABBABBAABAAABAA AAABBABAAAAAAAAABABBABBABABBAAAAABB BAABBAAAAAABABABAABBAABAA BAABBAAAAABAABBABABABAABA ABBAAAABAABABAABAAAB ABBABABBBAABBBAABBABBAAABAABAA AAABAABBABAAAAABAAABBAABA AAAAAAAABABAABABAABBAAAAAABABA AABBBAAAAABAAAABAAABAABBB AAABBBAAAAABAAAABBBA

y(t) = c_1 e^(2 t) + 3 e^(2 t) t

Check: Hash ends in b59

Key ID: (23) (55)

Solution

The first section can be quickly identified as a Bacon cipher due to its trademark A/B lettering and string lengths divisible by 5. One thing to note about bacon cipher is that it combines i/j and u/v into the same character so some cleanup for those letters is required after, but you will end up with the following 25 words (all of which are bip39 to eliminate ambiguity) SORRY REVIEW FINE EXCITE CLIFF HYBRID THOUGHT WEAPON SMOOTH ANKLE INFLICT SQUIRREL INCH DOSE INJURY QUOTE DIAMOND VALVE VAULT NEWS OPPOSE COAST ACTUAL HARSH DRIP.

The next step involved identifying the equation given which an additional hint was given later directing us to the wolfram alpha page. With some investigation it can be found this equation was directly taken from the example page relating to differential equations https://www.wolframalpha.com/examples/pro-features/step-by-step-solutions/ and the exact page needed was this one https://www.wolframalpha.com/input/?i=y%27%28t%29+-+2y%28t%29+%3D+3+e%5E%282t%29&lk=3. You need to view the solution as plaintext and take a hash of the “Wolfram Language plain text output” which is {y[t] == 3 E^(2 t) t + E^(2 t) Subscript[c, 1]}. Taking the sha256 hash of this string gives the hash 4A83F9D9DCFC9F07BD474E1204B0A4B29D35AD1150A7EC517B782668C7FB6B59 which you can verify is correct by the Check line telling you it should end in B59.

The last step to do is use the Key ID: (23) (55) to take the 23rd and 55th character from the hash which are 1 and 6 which is telling you the final answer is the 16th word in the Bacon cipher which is QUOTE

Puzzle 5

Solution

This puzzle consists of a series of glyphs flanking either side of some flavor text. We quickly identified the glyphs as being the language of D’ni, the language from the Myst series of games. This set of glyphs represents numbers, and was introduced in the first sequel to Myst, Riven.

In case you weren’t familiar with Riven though, the glyphs listed beneath the orange X icons are a key, telling you how to read them as numbers. The count of each glyph corresponds to the number that they represent

Applying these numbers to the glyphs above the orange X section, we get the following:

Reading across the divide, for the yellow highlighted rows, we can use alphabet numbers to translate 3 of these.

Despite being unable to translate the rest, at each corner of the original image is the glyph for the number 4 which pointed us to the fourth word in the list which we happened to have decrypted: LEGAL

Puzzle 6

Lookup Key

(5+3) 8

(3*1) 11

(20+20) 13

(8–1) 4

(60–10) 1

(100–40) 12

Solution

This puzzle puts your google skills to the test by requiring you to fill out a crossword grid. The good news is, it was discovered early on that all answers are bip39 words which significantly reduces the possibilities for some of the clues as listed below:

Filling in the grid with these answers

This results in 5 letters being identified by red boxes which can be unscrambled to the word SEVEN. Looking at the Lookup Key it can be noticed each line has an equation in parenthesis, followed by a number. Solving the math in the parenthesis, only one line results in the solution of 7 which is line (8–1) 4. This just leaves the number 4, which is telling us crossword clue 4 is the answer, which is APPEAR.

Puzzle 7

Solution

Scanning the 3 QRs, will give the strings:

wqwtjgo

lgfayzl

10 23 25 1 7 6

Converting the last line to their equivalent alphabet character and then using a caesar shift of 8 on all 3 gives the words EYEBROW, TONIGHT and REGION. To determine which is the correct solution you need to use the Report number of 08CE0285 which is actually an Adler32 hash string as hinted in the message below of “Heavy Industries MF6 Adler Facility”. Taking the Adler32 hash (https://md5calc.com/hash/adler32/region) of each word, only one matches 08CE0285, which is the word REGION

Puzzle 8

Solution

For this puzzle, a repeating string is written along the right edge of the page. ooo khsuwhajslw vgl ag kdskz ugvwlgfwk vgl eh3. This string can be decrypted with caesar shift of 8 to get www spacepirate dot io slash codetones dot mp3 which leads to this file www.spacepirate.io/codetones.mp3. This audio file contains the following morse code:

-.-./ — -/-./…/../-.././.-.

…/-.-/./-/-.-./….

-.-./.-./../ — /.

…/..-/. — ././.-.

Which can be converted to the words:

Consider

Sketch

Crime

Super

Referencing the original image and seeing that there are 4 numbered images, it can be seen image number 2 has its number highlighted, indicating the final answer is SKETCH

Puzzle 9

Solution

Right off the bat you can extract the light grey string in the center xslo sd dlcci uyvbc epo mr mcavi zoesdc qdekz gyewc rylnvcn gjovi dskyvpya qiwroq which can be decrypted using Vigenere and the password: key. This leads to the phrase none of these words are it cycle beauty stamp cause hundred clerk tomorrow system, letting us know that string is just a red herring.

This leaves us with the Auth Code: 81173764675413721235575498 at the bottom which is a morbit cipher (can be identified by its lack of zeroes) using the key: AZERTYUIF which is the letter string found at the end of each noodle name. This results in the final phrase of THE WORD IS CRY

Puzzle 10: Red Fern Valley 2

Trailhead:

The 8/2(2+2) evaluates to 16. The 6A and “Hex” Dalton suggest that we should be looking at hex. Converting the 16 from Decimal to Hex gives us 0x10. That gives us this URL:

https://spacepirate.io/0x10.html

Which gives us the link to download Red Fern Valley 2:

https://mega.nz/file/jzgHCRID#da3yBMmqB6-l9UQk-kUsmuJWLNHLAXgAunDRhyPQBvo

Game Layout

Room Names & Locked Doors

POI Locations

Gameplay Walkthrough

  • Go to Living Room and get Kitchen Key
  • Go into the kitchen, look under plates on the kitchen table, and interact with puzzle E. This unlocks the Bedroom #1 door.
  • In Bedroom #1, behind a painting there is a keypad. There is also 1 cup on the radiator beneath it. The kitchen has a row of cups (4, 6, and 8). Using logic to combine these numbers, you get: 4 6 8 1. Using that code unlocks the hallway door.
  • Picking up the Axe opens Bedroom #2, which we think is a bug.
  • The “correct” path would be to go into the Office and use the Lockpad with code (123), that is found on the initial ticket, which reveals Bedroom #2 key behind a painting. By picking up the axe, you can skip acquiring the key.
  • Go into the Bathroom and under a towel is the Office key.
  • Now you have unlocked all of the rooms in RFV2.
This hallway is haunted
Don’t get spooked

Solution

The first thing you see when you open the game is a welcome sign that explains a little bit about the game and what you should expect.

This gives us the following information:

11 clues

1 special clue

4 cipher types

Shamir

Trifid

Vignere

Rot

The 6 Puzzles A-F

There are 6 puzzles that can be found scattered throughout the house. Each found puzzle has a string of letters highlighted on them that needs to be extracted.

Puzzle A

Location: End of Hall, on top of Radiator

Cipher String: GRX

Puzzle B

Location: Starting Hallway, on floor under door

Cipher String: UYSM

Puzzle C

Location: Bedroom 1, Left Nightstand, Under Lamp

Cipher String: PK+P

Puzzle D

Location: Bedroom 2, Under Pillow

Cipher String: PVGRRYR

Puzzle E

Location: In Kitchen, On main table, under platter

Cipher String: SRJVK

Puzzle F

Location: Living Room, on Coffee Table

Cipher String: BAEDNP

Wall Poster Puzzles

There are 5 posters on the wall that contain key pieces of info the decrypting the cipher strings we just collected along with the final puzzle.

Poster 1

Location: Starting Hallway

Key Info: GVHKUCTM+

Poster 2

Location: Kitchen

Key Info: mega.nz/file/SngHzRbQ

Poster 3

Location: Bedroom 1

Key Info: https://mega.nz/file/6vwlRbCL

Poster 4

Location: Bedroom 2

Key Info: https://mega.nz/file/KuwlVZpT

Poster 5

Location: Office

Key Info: AELQYBSWD PXOZINRJF

b07P1OopDBb5NOw0FwrfcICQQVKPOYAsthclY7q0EDQ

2YD0QmQ1ttXhABeIK6EoSqL-Kg8LoMSeFn809dUeU4o

2L4S2V2oVIqHPeRnpzbOWFyqk86vQrBPuxuBr3bI3CQ

Piecing it all together

Now that all the pertinent info has been collected, it’s time to start solving. First up is combining strings AELQYBSWD PXOZINRJF and GVHKUCTM+ to be used as the trifid decryption key (as hinted in the initial poster). Using the key here: https://www.dcode.fr/trifid-delastelle-cipher along with the 6 cipher strings we collected for Puzzle A-F, we can decrypt all 6 strings to bip 39 words.

Puzzle A: GRX => USE

Puzzle B: UYSM => KNOW

Puzzle C: PK+P => NEST

Puzzle D: PVGRRYR => PAYMENT

Puzzle E: SRJVK => AUDIT

Puzzle F: BAEDNP => EXCESS

We now have all 15 bip words, but this doesn’t unlock the wallet, which means either order is wrong, or its password protected. So solving the remaining strings is the next task. We have 3 mega.nz links left, along with 3 random character strings. These strings are actually the decryption keys for the found links and after a little trial and error (especially with uppercase i and lowercase L looking the same) the correct links can be made, giving text files 1–3.

https://mega.nz/file/SngHzRbQ#b07P1OopDBb5NOw0FwrfcICQQVKPOYAsthclY7q0EDQ

https://mega.nz/file/6vwlRbCL#2YD0QmQ1ttXhABeIK6EoSqL-Kg8LoMSeFn809dUeU4o

https://mega.nz/file/KuwlVZpT#2L4S2V2oVIqHPeRnpzbOWFyqk86vQrBPuxuBr3bI3CQ

1.txt

8010a5b3bd787b9866b8013612b2d2d516f37a6bbc0ea8e427bbef0022c6d337964e213564ef4e73bfe587c567661588549ba67e3770e4b8a4a1a9340e1d1df6d936bac1e2a36b92d7439dbf5c5e0b61a663765f2bfb5f0c02aec1054435bcf83ef62d918231d9e8ca5ce3844ca8df82f335df5a523f2854e6759ec3b94ed60bc89118329b14788c7bef5508209eef47ec44d31b47778c3528076663871d818bcf5c925329e880f69e1eb51e1f46817c9792cb30781248f360e4f5835e51852027ac4c047e1beb18a2143ad99edcc0223fab6b23508114f38a0ca6b9f07dcfd061f83346c5beffd6a8ae1cd5dd7e412ec8c4b1d20918c8d7eaa36950da7e7d9e43403f30c5a8cf39e1f3ab5b08b1580178e63027a76cea3db07a0fad5e14b1b4a219cec97544805b764a2ba19f7ecd3ac79b94a96bb2e2e3c802b3b9d9d6e6af562b4462ef5714561e457b227de91994510f57d618eb649f55787e0e423d09126104563295b31de44247371368e14393ad7904ea1a74e194c7651f334717669df60fffaf987004e1211190cb6c1cae9f51c0cd437d956515a6b8b20f5fb961e5964f45c0cc83db6d0397110768e8ec6e1a1e4d8760b11055d933c9793b2a3fad243643a12a01f728fb537a1ab9de71c90ebb218ab4bd80fb2b8deab8284655755b0aad0bec21c2622f992c741e427184706fa4323cc43f584000bce0f1ee87f5c7a

2.txt

8021ba38fbc0b8712f66415b7f46b6d4d2a5b26fb48d3debecf0fcdfab237b3c67566b558238e7ed7b3c5a5060b98c10d0e7ae3783ce96e043290fba40ae0faf93f434ca8d2431ef240843a7c022a7dda0d92c64b98f4023f0c455b8f9dd28fda53d881127b72d66bd202a4750cb6785cfd4febedcf177f7c9520a1f11b4d3a0d4a8545b11db37594745c30384c64df9824bde9d644eec08e09219e0226347c5034612308c5c1d8601f7de07ecdd6c0a6750b0530beda728d847a3b1a91a8c6d50e82173a559eec5b0f1cfd3b0bda20ed93c6098f28be6e97fdcac996e22d4807c8d8bc9cc5d30e6c53b2267b1b70fb9869273bb205b32a68dc1afb1fda9a61ab24d39849240eb9df523636d799ba49a0cf108a12ca54531508d14b5f5597990c5eb70cbe0cdf80da0244a6bd10a9d3e27d8bbb39a71a610af4461e2fb1c9aa5eaf6386b407adf06c39ad1d82855a4a8d4f9eb60581bfce0087596a923e01d11f6f03d8f4e0934a5efa49d54afe15bbd9dccf6523d2b6ba722fcad1070835eb9f255d52bd34e6c3f6d8d036b448f15b4b946b9a03fb0f88b2f21ce8cb31caa8403b4c7eaf43f5d4e107a244bc1c03680109d9fbabc4c8da06bf6f236204e8134e4603e98f86102ca109ea0973e66a10eb96aa2c8b82f879bf0c5aefcac46e400032d6d9e4a38beca8fdf7f727fe4c73de59791209103eb37045728665156881fa69

3.txt

80311f8b46b8c3e949de406d6df46401c456c8040883950fcb4b13df89e5a80bf1184a60e6d7a99ec4d9dd9507df9998847c0849b4be7258e788a68e4eb312594ac28e0b6f875a7df34bde189c7cacbc06ba5a2b91f41d2ff55a922dbfe8906599cba3d0a346f32e70dcce931b63b8a73f7123e489fe59332d27908caafa03fb1af94bc98d6f48853baa96aba718a1ae6c0f0ab625a9623dccd57d83a32ec08ecbba87c3a2e49a709f496809f08bef76f7f27df371ffebebbaa35062f18b0eed70e46a27dc42057d11d5f61a2c61651ce00709bba62af01af3800ce099ff1cf01a25bf8f0943cc606e853cb26bf948074c56c6792b43fc2161a2c1412077dcd4f60d0614549826a413e0cea6732aff0b76173ed68d09a8ace7571c48ac4dc8846492bc0292b97ec6d46e624a4c745654e68328baf66343a36046d2fb219a7e0abbed7a99ad2dc820dfdfacaa537cba9c8256bbe647f098df5e0debb763dd1333916469bdd8da2b41abb3ac87c0a01f8e37e5f5b827ff8973e799b51331043a24070a28844d6e6e1e4b3c94002fc3bc2be82677c341359f9e8ea97a13eea5c82197fb847a3e7c8183144d321cae28da4e09b3d03ddbcd9b65b0c5387f1964b8c9c6967a99d5c0f2b2eccdda2d8498d2c7b0e185d20e920440d948421482c0b6d55f87c7c5a1197c08a35651066696b02997f83602afc7d23f42979326a71808ba663

Again using the hints found on the initial poster, these can be deduced to be Shamir Secret Sharing Strings and can be copied here to be recombined https://iancoleman.io/shamir/ giving the output below.

puzzle 1 is 1

puzzle 2 is 2

puzzle 3 is 3

puzzle 4 is 12

puzzle 5 is 4

puzzle 6 is 10

puzzle 7 is 5

puzzle 8 is 6

puzzle 9 is 7

puzzle A is 15

puzzle B is 13

puzzle C is 11

puzzle D is 14

puzzle E is 9

puzzle F is 8

Using this combined with the 15 words we have found so far let’s us put the words back into their correct order to open the wallet.

super kit shoulder legal region sketch cry excess audit appear nest quote know payment use

We are able to generate the pk for the prize wallet to import into the enjin app to claim the final prize. https://iancoleman.io/bip39/ (Be sure to select ETH as the coin)

0x3bd1aca13eb09ba1db95efda6100abfa5d826b446e55701409683786e35d1a31

Final Prize

The final wallet contained the prize below:

1 ETH

1000 Enjin

1000 Rustbits

1 Origin Card

1 Lastlight Card

1 Resistance Radio

1 set of Mission Cards 1–8

1 Thermal Implant

1 Crypto Sensor

1 Smoke Grenade

1 Pepe Coin

3 Nhubs

Unsolved Puzzle

At the time of writing this, there is still one final unsolved puzzle hidden in RFV2 that has a btc prize of 0.025 BTC (https://www.blockchain.com/btc/address/12EoWKPKiPgN1CfYFQVcD6w6J7NAkCJvC2).

Special Thanks

Thanks to SpacePirate Games for taking the time to make this puzzle and giving us something to do this summer while we are stuck inside.

Destroyer and Builder of Puzzles