ARG Puzzle with 3.5 BTC Private Key Prize, Game Over - page 43.

itod

legendary

Activity: 1974

Merit: 1077

Honey badger just does not care

Quote from: Voyager on July 02, 2014, 06:01:25 PM

There's definitely some kind of file/data embedded in Space.mp4, with ffmpeg, I can do:

...

In addition, I think I found the original copy of the video file (before extra data was embedded into it):

...

9356135-7209006 = 2147129, which is the number found in Number.txt

So, there are 2147129 bytes of additional data besides the audio and video streams in Space.mp4

...

Edit: extract the extra data with this:

Code:

dd bs=1 skip=7209006 if=Space.mp4 of=binary

Fantastic work, congratulations.

Timmmaahh

member

Activity: 98

Merit: 10

Quote from: arg on July 02, 2014, 06:29:15 PM

Quote from: Timmmaahh on July 02, 2014, 06:26:32 PM

can we mount it with true ~~scrypt~~crypt?

You don't even know if it is a TC container until you have the password right.

yeee... if it is even a TC container ...

or else somehow encrypted..

micaman

sr. member

Activity: 345

Merit: 500

Quote from: elh40257 on July 02, 2014, 06:32:16 PM

Can someone re-upload this container on other site? Had an unknown SSL error (ssl_error_rx_record_too_long) when connecting to this site (both browsers), not know how to solve at this time.

http://speedy.sh/ccEFT/split.bin

elh40257

newbie

Activity: 14

Merit: 0

Can someone re-upload this container on other site? Had an unknown SSL error (ssl_error_rx_record_too_long) when connecting to this site (both browsers), not know how to solve at this time.

arg

newbie

Activity: 14

Merit: 0

Quote from: Timmmaahh on July 02, 2014, 06:26:32 PM

can we mount it with true ~~scrypt~~crypt?

You don't even know if it is a TC container until you have the password right.

Timmmaahh

member

Activity: 98

Merit: 10

Quote from: arg on July 02, 2014, 06:05:38 PM

Quote from: Voyager on July 02, 2014, 06:01:25 PM

So, there are 2147129 bytes of additional data besides the audio and video streams in Space.mp4

Yep. That's exactly the path I took.

Code:

8057685995569da18a15912e754e1510181acb8cad31dfcabb9cab367245be2b = sha256("there's a bunch of data at the end of the file I can't identify. the data is uniform and random, so it's almost certainly encrypted.")

Looking at the split binary a bit deeper we get:

Code:

 $ ent split
Entropy = 7.999908 bits per byte.

Optimum compression would reduce the size
of this 2147129 byte file by 0 percent.

Chi square distribution for 2147129 samples is 273.12, and randomly
would exceed this value 20.80 percent of the times.

Arithmetic mean value of data bytes is 127.4944 (127.5 = random).
Monte Carlo value for Pi is 3.140655128 (error 0.03 percent).
Serial correlation coefficient is -0.001094 (totally uncorrelated = 0.0).

Maybe file can help us out?

Code:

 $ file split.bin
split.bin: data

It's encrypted, whatever it is. However it's not the right size to be any block cipher I know of.

Code:

split.bin https://mega.co.nz/#!SF9m0I5R!xOlTLH6-f8DujD92CYNTt1lpunXWn3pikcLV1ZPXVk4

can we mount it with true scrypt?

S4VV4S

hero member

Activity: 1582

Merit: 502

http://www.magiciso.com/tutorials/miso-whatsimage.htm

S4VV4S

hero member

Activity: 1582

Merit: 502

Tried to mount it as an image, didn't work.....

S4VV4S

hero member

Activity: 1582

Merit: 502

Good catch guys!

micaman

sr. member

Activity: 345

Merit: 500

Can you upload it somewhere?

EDIT: Great catch btw

Prospero

full member

Activity: 194

Merit: 100

Quote from: arg on July 02, 2014, 06:05:38 PM

It's encrypted, whatever it is.

Let's hope it' not Onion2.7z

Gatekeeper

sr. member

Activity: 358

Merit: 250

wow pretty amazing work that, way out of my depth, big props to figuring that one out.

So there is an encrypted file added to the space.mp4?

Prospero

full member

Activity: 194

Merit: 100

good find!

arg

newbie

Activity: 14

Merit: 0

Quote from: Voyager on July 02, 2014, 06:01:25 PM

So, there are 2147129 bytes of additional data besides the audio and video streams in Space.mp4

Yep. That's exactly the path I took.

Code:

8057685995569da18a15912e754e1510181acb8cad31dfcabb9cab367245be2b = sha256("there's a bunch of data at the end of the file I can't identify. the data is uniform and random, so it's almost certainly encrypted.")

Looking at the split binary a bit deeper we get:

Code:

 $ ent split
Entropy = 7.999908 bits per byte.

Optimum compression would reduce the size
of this 2147129 byte file by 0 percent.

Chi square distribution for 2147129 samples is 273.12, and randomly
would exceed this value 20.80 percent of the times.

Arithmetic mean value of data bytes is 127.4944 (127.5 = random).
Monte Carlo value for Pi is 3.140655128 (error 0.03 percent).
Serial correlation coefficient is -0.001094 (totally uncorrelated = 0.0).

Maybe file can help us out?

Code:

 $ file split.bin
split.bin: data

It's encrypted, whatever it is. However it's not the right size to be any block cipher I know of.

Code:

split.bin https://mega.co.nz/#!SF9m0I5R!xOlTLH6-f8DujD92CYNTt1lpunXWn3pikcLV1ZPXVk4

Voyager

newbie

Activity: 33

Merit: 0

There's definitely some kind of file/data embedded in Space.mp4, with ffmpeg, I can do:

Code:

ffmpeg -i Space.mp4 -c:a copy -c:v copy out.mp4

and out.mp4 will be about 2.1mb smaller, even though it contains the same two streams.

Code:

Input #0, mov,mp4,m4a,3gp,3g2,mj2, from 'Space.mp4':
  Metadata:
    major_brand     : mp42
    minor_version   : 0
    compatible_brands: isommp42
    creation_time   : 2014-02-25 11:26:52
  Duration: 00:02:48.21, start: 0.000000, bitrate: 444 kb/s
    Stream #0:0(und): Video: h264 (Constrained Baseline) (avc1 / 0x31637661), yuv420p, 640x360 [SAR 1281:1280 DAR 427:240], 244 kb/s, 29.97 fps, 29.97 tbr, 30k tbn, 59.94 tbc (default)
    Metadata:
      handler_name    : VideoHandler
    Stream #0:1(und): Audio: aac (mp4a / 0x6134706D), 44100 Hz, stereo, fltp, 95 kb/s (default)
    Metadata:
      creation_time   : 2014-02-25 11:26:56
      handler_name    : IsoMedia File Produced by Google, 5-11-2011

In addition, I think I found the original copy of the video file (before extra data was embedded into it):

Code:

youtube-dl --format 18 https://www.youtube.com/watch?v=3rysbn9bZ54

This file contains the same video and audio streams found in Space.mp4. If extract using ffmpeg:

Code:

ffmpeg -i Space.mp4 -c:a copy -c:v copy a.mp4
ffmpeg -i Laffe\ the\ Fox\ -\ Left\ Alone\ in\ Outer\ Space-3rysbn9bZ54.mp4 -c:a copy -c:v copy b.mp4
sha256sum a.mp4 b.mp4

I get:

Code:

37f60f1717c142e15baec5a429a0ff07ed1d6efe122a06a15a77228170ed051f  a.mp4
37f60f1717c142e15baec5a429a0ff07ed1d6efe122a06a15a77228170ed051f  b.mp4

So I'm pretty sure that it's the original file before extra data was embedded.

So, now the interesting part, let's check the size in bytes of Space.mp4 and the original from YouTube:

Code:

du -b Space.mp4
9356135	Space.mp4
du -b Laffe\ the\ Fox\ -\ Left\ Alone\ in\ Outer\ Space-3rysbn9bZ54.mp4
7209006	Laffe the Fox - Left Alone in Outer Space-3rysbn9bZ54.mp4

9356135-7209006 = 2147129, which is the number found in Number.txt

So, there are 2147129 bytes of additional data besides the audio and video streams in Space.mp4

Edit: extract the extra data with this:

Code:

dd bs=1 skip=7209006 if=Space.mp4 of=binary

The sha256sum of the extra data is cbd47112ad2b9f3661e6506c7999afabd0f468b3a4acec81e0618ef98cb24bf3

S4VV4S

hero member

Activity: 1582

Merit: 502

http://en.wikipedia.org/wiki/Odysseus

In Greek: http://el.wikipedia.org/wiki/%CE%9F%CE%B4%CF%85%CF%83%CF%83%CE%AD%CE%B1%CF%82

Prospero

full member

Activity: 194

Merit: 100

Number.txt: 2147129

S4VV4S

hero member

Activity: 1582

Merit: 502

Quote from: Timmmaahh on July 02, 2014, 05:54:21 PM

Quote from: S4VV4S on July 02, 2014, 05:52:59 PM

this is related: https://ru-ru.facebook.com/8081netlabel

OP, what up with the Russian 8Bit video games?

I do speak a bit of Russian just so I know

yee, but what has this to do with this this weird 247... number?

24/7?

Timmmaahh

member

Activity: 98

Merit: 10

Quote from: S4VV4S on July 02, 2014, 05:52:59 PM

this is related: https://ru-ru.facebook.com/8081netlabel

OP, what up with the Russian 8Bit video games?

I do speak a bit of Russian just so I know

yee, but what has this to do with this this weird 247... number?

S4VV4S

hero member

Activity: 1582

Merit: 502

this is related: https://ru-ru.facebook.com/8081netlabel

OP, what up with the Russian 8Bit video games?

I do speak a bit of Russian just so I know

Topic: ARG Puzzle with 3.5 BTC Private Key Prize, Game Over - page 43. (Read 99538 times)