//CLASSIFIED//SECTION 3 DECODING CENTER//

FROM SEC3OP36516:
THIS THREAD IS NOT FOR GENERAL DISCUSSION, ONLY FOR WELL DOCUMENTED SECTION 3 SOLUTIONS.

/START FILE/

GREETINGS OPERATIVES

This is the primary thread for active documentation and work on Section 3 operations. It will be used to present and work through difficult challenges, and will also provide supplementary resources for operatives.

While the input of all OPs is valued, this thread is not a general discussion thread. In the interest of keeping this thread constructive for OP teamwork, posts which are not pertinent to operations may be moderated as necessary.

Also be aware that discussion is always ongoing in IRC:
http://client00.chat.mibbit.com/?server=irc.webchat.org&channel=#halo4arg

For key announcements and core information regarding Section 3 operations, please see the //SECTION 3 OPERATIONS CENTER//

For general, “free for all” discussion, please see the //SECTION 3 COMMS CENTER//

For interactions with the AI assisting with decoding, see the TETRARAI thread.

-OPDEVOLT

/END FILE/

//SUPPLEMENTARY DECODING RESOURCES

Reference sites:
Halo 4 ARG: ONI Section III - Info Tracker
Wikibruce - Halo 4 Bits

OP Designed/Provided Tools:
OPMIKER’S Field Manual
ONI.rb (Ruby decoding toolkit by SepheusIX)
Resource: OP-designed scripts and tools (direct links are currently broken, check midway down the page)
Resource: Primer on working with data in images (check midway down the page)
Resource: Spotting patterns (check near the bottom of the page)
Wikibruce crypto resource list
Wikibruce crypto multi-tool (hub)
Oni Field Assistants (Furiousn00b):

Third Party Tools:
http://everlost.nl/convert.php
notepad++
HxD Hex Editor
Sonic Visualiser
Spek – Acoustic Spectrum Analyser
Ascii Table

//SOLUTION TABLE OF CONTENTS

Phase I

??/11/2012: ping5
??/11/2012: HEX Ping
??/11/2012: FIR Ping
??/11/2012: LEAF Ping
??/11/2012: MASTIFF Ping
??/11/2012: NOIR Ping
??/11/2012: EDUVARD Ping
??/11/2012: VEHOOF Ping
??/11/2012: VEINSTUFF Ping
??/11/2012: SHERIFF Ping
??/11/2012: ELF Ping
??/11/2012: MIRROR Ping
??/11/2012: SELF Ping
??/11/2012: SOX Ping
??/11/2012: HALF Ping
??/11/2012: EXHALF Ping
??/11/2012: NUMV Ping
??/11/2012: VLEAF Ping
??/11/2012: WEIRDAL Ping
??/11/2012: YANU Ping (Part 1) *
??/11/2012: YANU Ping (Part 2) *
??/11/2012: SEMPEROCCULTOSEMPER: Pings Combined (Part 1)
??/11/2012: SEMPEROCCULTOSEMPER: Pings Combined (Part 2)
??/11/2012: PETRI: ping5 + SEMPEROCCULTOSEMPER
??/11/2012: GRANULARITY (Part 1)
??/11/2012: GRANULARITY (Part 2)
??/11/2012: GRANULARITY (Part 3)
??/11/2012: GRANULARITY (Part 4)

26/11/2012: PH7S2 3 (Part 1)
26/11/2012: PH7S2 3 (Part 2)
26/11/2012: PH7S2 3 (Part 3)

27/11/2012: REWARD Glyph *

28/11/2012: tetraRai Commands/Responses
28/11/2012: Locked NODES
28/11/2012: Node 0
28/11/2012: Node 1
28/11/2012: Node 2
29/11/2012: Node 3
29/11/2012: Combining Nodes *

29/11/2012: MEOW, MEOW

30/11/2012: Offensive Training
30/11/2012: CLEAR: Counter Hex
30/11/2012: PROTECTED: Protective Pipes
30/11/2012: PROTECTED: Conceptual Counter
30/11/2012: PROTECTED: Medusa
30/11/2012: PROTECTED: Earth Day
30/11/2012: PROTECTED: 3241
01/12/2012: LOCKED: Mario

30/11/2012: MIAU
30/11/2012: HENRY V

01/12/2012: Lamborghini
01/12/2012: Ludwig *
03/12/2012: Confusion *
03/12/2012: Data Corruption - Loop Hexercise 1
03/12/2012: Data Corruption - Loop Hexercise 2
05/12/2012: Data Corruption - Pattern Hexercise
05/12/2012: Data Corruption - Pattern Final (Part 1) *
05/12/2012: Data Corruption - Pattern Final (Part 2) *

05/12/2012: hydrAi - It Begins
05/12/2012: hydrAi - Ramping Up
05/12/2012: hydrAi - Full Swing

… Missing a few here - I will update soon.

Phase II

12/02/2013: I need a weapon
12/02/2013: Halo: Silentium *
13/02/2013: CONVERSIONS
13/02/2013: SLEIGHT
13/02/2013: NOISE *
14/02/2013: METAPHOR *
19/02/2013: MUNGE
20/02/2013: FRAGMENT 1
20/02/2013: FRAGMENT 0
20/02/2013: FRAGMENT 2
21/02/2013: Violet *
23/02/2013: Scout Fight *
24/02/2013: Scouts *
28/02/2013: FOUND INTEL *
28/02/2013: Shards *
09/03/2013: INJURY REPORT *
10/03/2013: FISHY *

17/03/2013: Dark Manor v8.4 #1
17/03/2013: Dark Manor v8.4 #2
17/03/2013: Dark Manor v8.4 #3
17/03/2013: Dark Manor v8.4 #4
17/03/2013: Dark Manor v8.4 #5

20/03/2013: Rebirth

  • Contains a new Glyph.
  • Contains avatar armor codes.

Original Post: DECRYPTING SECTION 3 (UPDATED 11.15)
Titled: REWARD Glyph

> | I HAVE A REWARD FOR YOU, OPERATIVES, IN THE FORM OF A NEW ENCRYPTED PUZZLE TO ENTICE YOU. THIS ONE IS NOT DIFFICULT, AS YOU MUST BE TIRED FROM YOUR EFFORTS. I AM REMINDED OF THE EFFORTS OF ALL THOSE REACH SPARTANS FOR THE TIME CAPSULE.
>
> WE EXTRACTED THIS DATA NODE FORM HYDRAI. IT WAS MUCH FURTHER AHEAD IN ITS RESEARCH THAN IT LET ON:
>
>
> <mark>?DQ0?DWR?DQ0bDQ1?DU0?DQ0Ojl/hIiMiGJ4hnWLeYY0?DQ0?DQ0VDQ1?DQ0?DQ0?D40?E13?DQ1aSZU/SV1rrh/?Dw0?DRI?Eg2?X+EQR15wjFiMCRKfk1FxyOGzTgRge2qJzBui7G+fIkS75FdtbJ/sV+uvYUyOYby1LGrLXA/GV/H3Jr6FXE7R2jUtC+it3Dffp3yyMVGFgp+irUpkUb?1LHvuejanFOSPb6HaEPLWTumf1?5Xa47/cXo3eS621l4dopFXVHopFvWZKU+iYRgtKD2tLGo5hfUgntGzbz7PpIyo0bToupqXUF557x5qzAdg7oYLw6Iwz9ZQGDIZ8phLv2ABKgLJVwfO/jVUzoSBirId/zoXZduhPT9d7av8a75qVCK6O/0KOK8lz+qjV15vJ9XqWj5iqoVXGhE+mO?5rUp5h9+3DahrC6EPoWbELSBrKubBEslzpyHzpXPT1peLSuFeyM8UamOgJ3d4ZHgnZMvyjg/+TyIg3pAVPc+lcwhiIyIYniGdYt5hjQ0?D40?E13?DQ1aSZU/SV1rrh/?Dw0?DRIODd/hA==</mark>

Repalce ? with N

> NDQ0NDWRNDQ0bDQ1NDU0NDQ0Ojl/hIiMiGJ4hnWLeYY0NDQ0NDQ0VDQ1NDQ0NDQ0ND40NE13NDQ1aSZU/SV1rrh/NDw0NDRINEg2NX+EQR15wjFiMCRKfk1FxyOGzTgRge2qJzBui7G+fIkS75FdtbJ/sV+uvYUyOYby1LGrLXA/GV/H3Jr6FXE7R2jUtC+it3Dffp3yyMVGFgp+irUpkUbN1LHvuejanFOSPb6HaEPLWTumf1N5Xa47/cXo3eS621l4dopFXVHopFvWZKU+iYRgtKD2tLGo5hfUgntGzbz7PpIyo0bToupqXUF557x5qzAdg7oYLw6Iwz9ZQGDIZ8phLv2ABKgLJVwfO/jVUzoSBirId/zoXZduhPT9d7av8a75qVCK6O/0KOK8lz+qjV15vJ9XqWj5iqoVXGhE+mON5rUp5h9+3DahrC6EPoWbELSBrKubBEslzpyHzpXPT1peLSuFeyM8UamOgJ3d4ZHgnZMvyjg/+TyIg3pAVPc+lcwhiIyIYniGdYt5hjQ0ND40NE13NDQ1aSZU/SV1rrh/NDw0NDRIODd/hA==

Decode Base64 (Hex)

> 34-34-34-34-35-91-34-34-34-6C-34-35-34-35-34-34-34-34-3A-39-7F-84-88-8C-88-62-78-86-75-8B-79-86-34-34-34-34-34-34-34-54-34-35-34-34-34-34-34-34-34-3E-34-34-4D-77-34-34-35-69-26-54-FD-25-75-AE-B8-7F-34-3C-34-34-34-48-34-48-36-35-7F-84-41-1D-79-C2-31-62-30-24-4A-7E-4D-45-C7-23-86-CD-38-11-81-ED-AA-27-30-6E-8B-B1-BE-7C-89-12-EF-91-5D-B5-B2-7F-B1-5F-AE-BD-85-32-39-86-F2-D4-B1-AB-2D-70-3F-19-5F-C7-DC-9A-FA-15-71-3B-47-68-D4-B4-2F-A2-B7-70-DF-7E-9D-F2-C8-C5-46-16-0A-7E-8A-B5-29-91-46-CD-D4-B1-EF-B9-E8-DA-9C-53-92-3D-BE-87-68-43-CB-59-3B-A6-7F-53-79-5D-AE-3B-FD-C5-E8-DD-E4-BA-DB-59-78-76-8A-45-5D-51-E8-A4-5B-D6-64-A5-3E-89-84-60-B4-A0-F6-B4-B1-A8-E6-17-D4-82-7B-46-CD-BC-FB-3E-92-32-A3-46-D3-A2-EA-6A-5D-41-79-E7-BC-79-AB-30-1D-83-BA-18-2F-0E-88-C3-3F-59-40-60-C8-67-CA-61-2E-FD-80-04-A8-0B-25-5C-1F-3B-F8-D5-53-3A-12-06-2A-C8-77-FC-E8-5D-97-6E-84-F4-FD-77-B6-AF-F1-AE-F9-A9-50-8A-E8-EF-F4-28-E2-BC-97-3F-AA-8D-5D-79-BC-9F-57-A9-68-F9-8A-AA-15-5C-68-44-FA-63-8D-E6-B5-29-E6-1F-7E-DC-36-A1-AC-2E-84-3E-85-9B-10-B4-81-AC-AB-9B-04-4B-25-CE-9C-87-CE-95-CF-4F-5A-5E-2D-2B-85-7B-23-3C-51-A9-8E-80-9D-DD-E1-91-E0-9D-93-2F-CA-38-3F-F9-3C-88-83-7A-40-54-F7-3E-95-CC-21-88-8C-88-62-78-86-75-8B-79-86-34-34-34-3E-34-34-4D-77-34-34-35-69-26-54-FD-25-75-AE-B8-7F-34-3C-34-34-34-48-38-37-7F-84

-52

> 00-00-00-00-01-5D-00-00-00-38-00-01-00-01-00-00-00-00-06-05-4B-50-54-58-54-2E-44-52-41-57-45-52-00-00-00-00-00-00-00-20-00-01-00-00-00-00-00-00-00-0A-00-00-19-43-00-00-01-35-F2-20-C9-F1-41-7A-84-4B-00-08-00-00-00-14-00-14-02-01-4B-50-0D-E9-45-8E-FD-2E-FC-F0-16-4A-19-11-93-EF-52-99-04-DD-4D-B9-76-F3-FC-3A-57-7D-8A-48-55-DE-BB-5D-29-81-7E-4B-7D-2B-7A-89-51-FE-05-52-BE-A0-7D-77-F9-3C-0B-E5-2B-93-A8-66-C6-E1-3D-07-13-34-A0-80-FB-6E-83-3C-AB-4A-69-BE-94-91-12-E2-D6-4A-56-81-F5-5D-12-99-A0-7D-BB-85-B4-A6-68-1F-5E-09-8A-53-34-0F-97-25-07-72-4B-1F-45-29-7A-07-C9-91-B4-A9-B0-86-A7-25-44-42-56-11-29-1D-B4-70-27-A2-30-71-0A-55-50-2C-80-6C-C2-80-7D-74-B2-E3-A0-4E-47-12-99-88-C7-0A-5E-FE-6F-12-9F-6E-B6-36-29-0D-45-B3-88-45-77-FC-E9-4F-86-E4-FB-DA-54-8F-0B-25-0C-2C-94-33-96-2D-FA-C9-4C-D0-74-D7-F1-28-EB-07-C4-A1-1F-06-DE-D2-F6-94-43-C8-B4-29-63-3A-50-C0-C9-43-82-7B-BD-7A-C5-75-1C-56-B4-BB-C0-F4-AE-88-63-0B-76-59-29-45-88-6B-23-75-34-C5-56-76-E1-28-34-10-C6-2F-59-B2-81-F5-B2-EB-4A-A8-02-6D-78-FA-50-0A-51-67-DC-80-4D-78-77-67-D0-17-F1-9A-68-53-9A-61-9B-1B-26-2A-F9-F7-51-47-EF-08-1D-75-5A-4C-69-A9-AD-5D-AC-69-5F-FB-96-04-0B-C5-08-54-4F-46-0C-20-C3-0A-61-98-ED-54-58-54-2E-44-52-41-57-45-52-00-00-00-0A-00-00-19-43-00-00-01-35-F2-20-C9-F1-41-7A-84-4B-00-08-00-00-00-14-04-03-4B-50

Reverse Word

> 50-4B-03-04-14-00-00-00-08-00-4B-84-7A-41-F1-C9-20-F2-35-01-00-00-43-19-00-00-0A-00-00-00-52-45-57-41-52-44-2E-54-58-54-ED-98-61-0A-C3-20-0C-46-4F-54-08-C5-0B-04-96-FB-5F-69-AC-5D-AD-A9-69-4C-5A-75-1D-08-EF-47-51-F7-F9-2A-26-1B-9B-61-9A-53-68-9A-F1-17-D0-67-77-78-4D-80-DC-67-51-0A-50-FA-78-6D-02-A8-4A-EB-B2-F5-81-B2-59-2F-C6-10-34-28-E1-76-56-C5-34-75-23-6B-88-45-29-59-76-0B-63-88-AE-F4-C0-BB-B4-56-1C-75-C5-7A-BD-7B-82-43-C9-C0-50-3A-63-29-B4-C8-43-94-F6-D2-DE-06-1F-A1-C4-07-EB-28-F1-D7-74-D0-4C-C9-FA-2D-96-33-94-2C-0C-25-0B-8F-54-DA-FB-E4-86-4F-E9-FC-77-45-88-B3-45-0D-29-36-B6-6E-9F-12-6F-FE-5E-0A-C7-88-99-12-47-4E-A0-E3-B2-74-7D-80-C2-6C-80-2C-50-55-0A-71-30-A2-27-70-B4-1D-29-11-56-42-44-25-A7-86-B0-A9-B4-91-C9-07-7A-29-45-1F-4B-72-07-25-97-0F-34-53-8A-09-5E-1F-68-A6-B4-85-BB-7D-A0-99-12-5D-F5-81-56-4A-D6-E2-12-91-94-BE-69-4A-AB-3C-83-6E-FB-80-A0-34-13-07-3D-E1-C6-66-A8-93-2B-E5-0B-3C-F9-77-7D-A0-BE-52-05-FE-51-89-7A-2B-7D-4B-7E-81-29-5D-BB-DE-55-48-8A-7D-57-3A-FC-F3-76-B9-4D-DD-04-99-52-EF-93-11-19-4A-16-F0-FC-2E-FD-8E-45-E9-0D-50-4B-01-02-14-00-14-00-00-00-08-00-4B-84-7A-41-F1-C9-20-F2-35-01-00-00-43-19-00-00-0A-00-00-00-00-00-00-00-01-00-20-00-00-00-00-00-00-00-52-45-57-41-52-44-2E-54-58-54-50-4B-05-06-00-00-00-00-01-00-01-00-38-00-00-00-5D-01-00-00-00-00

Save as REWARD.ZIP

Extract contetns

> - REWARD.TXT

Hex to Text

> GLYPH.TXT

Resource: OP-designed scripts and tools
(moved from original post so I can continue with updates)

As the data we crack becomes more complex, so do the tools. I wanted to put together a compilation of some of the scripts and utilities that have made decryption easier - or possible at all. I will try to update this post regularly.

// Web-based utilities

Now tracked in this post.

// Adobe AIR apps

MrToasty created another sleuth breaker, this one is downloadable and requires a current version of Adobe Air. This version is recommended for larger decrypts, since that can be too much for the web tools.
OPDecrypter.air

// Ruby Scripts

The following scripts are all based on Ruby. To run them you will need to install the latest version of Ruby: Download here, or use the installer for Windows. Scripts that work on PNGs require the ChunkyPNG package - to install, go to the command line and type ‘gem install chunky_png’.

To use these scripts, copy them from pastebin and save them as <scriptname>.rb

General Purpose:

Extract PNG Channels (SepheusIX)
As mentioned now in my image primer, this script will extract the color and alpha channels from any PNG. Place the png in the same folder as the script and rename it to “source.png” before running.
Input: source.png
Output: Alpha.raw, Red.raw, Green.raw, and Blue.raw

Hex to Bin conversion (SepheusIX)
This will take a text file of hyphen delineated HEX and output the binary file it represents. Great for large conversions!
Input: hex.txt
Output: output.bin

Text Mapping (SepheusIX)
A simple script for testing out different word substitutions for word puzzles. Provide a space delineated version of your text, and change/add substitutions in the script to try different solutions.
Input: text-split.txt
Output: output.txt

Extract Channel MSB (SepheusIX)
A script for extracting the MSBs (most significant bits) of each channel of a PNG and writing it out in a binary file.
Input: source.png
Output: alpha_bitplane.bin, red_bitplane.bin, green_bitplane.bin and blue_bitplane.bin

“OR” Channel MSBs (SepheusIX)
Takes the output from the previous script and combines them by doing a bitwise “OR” on all channels. Sharp eyes will notice the code “((n+0) %256)”, which doesn’t really do anything. This is a placeholder - you can change the +0 to do an addition offset to the hex if you want when writing it to the file.
Input: alpha_bitplane.bin, red_bitplane.bin, green_bitplane.bin and blue_bitplane.bin
Output: combined.bin

Pattern Shift (SepheusIX)
Takes a text file of hex, and a pattern file with comma separated decimal values (i.e. 3,1,4,5,9), and outputs a pair of binary files, created by repeating shifts by that pattern through the file. One file is from addition of the pattern, the other subtraction. The output files are binary, but named as text to easily see if the output is readable.
Input: hex.txt, pattern.txt
Output: output_added.txt, output_subbed.txt

Specific to certain decodes (can be edited and re-purposed):

Yanu.png converter (SepheusIX)
This script takes the input image, extracts the LSB (least significant bit) from each pixel on each channel, and then interleaves the bits to get the final hex
Input: YANU.png

Extract SOS (SepheusIX)
The same as Extract PNG Channels, except it rotates the image 180 degrees first to reverse the byte order.
Input: SOS.png
Output: Alpha.raw, Red.raw, Green.raw, and Blue.raw

Resource: Primer on working with data in images
(moved from original post so I can continue with updates)

I wanted to give a quick primer on what we’ve learned about pulling data from images in photoshop (or other image application), as I don’t think that’s been covered well and many people get stuck there.

Note: I am currently using Photoshop CS5

EDIT/NOTE Nov 24 Recent puzzles have had data in both the alpha layers and color channels. This is causing issues for those (like myself) who have been using imaging software to get at the data. I’m leaving the original information below in case we need it, but adding a Part 4 below for extracting the channels directly.

// Part 1: The goal (RAW)

For those who understand the rest already, let’s start here. If you don’t, just note that this is the final step most of the time.

To get binary data for some other format that’s embedded in an image, ultimately we are trying to get an 8-bit, grayscale image (or multiple channels of grayscale data in one case here, more on that later) of the data portion of the image (usually “noise”). Once you have that, all those grayscale values correspond to a number between 0 and 255 (00-FF hex). Perfect for a binary file.

To get this into a file, you want to save it as a Photoshop RAW file (.raw). If you are dealing with only one channel or using the alpha layer, you usually want to be in grayscale mode (Image > Mode > Grayscale) before you actually save.

Once you have done this, you will need to open the raw file in a hex editor to determine what type of file it is, and remove any padding left over from the original image.

If it looks like the file is backwards, go back to the image and rotate it 180 degrees (common). If it still looks like garbage, don’t forget to try inverting your grayscale image before saving it (black <> white)

// Part 2: Alpha (Transparency) Layer

The first image found in this package is a good example: concatenate.png

Note that it’s a png, which is a lossless image compression format. This isn’t going to work with a “lossy” compressed image like most jpgs because the compression would corrupt the information.

To get the alpha layer out in photoshop, this is the techinque most of us have used. There may be better options in this and other programs:

  1. Load the transparency information a selection: Select > Load Selection > Layer 1 Transparency as new Selection
  2. Create a new Layer
  3. Fill the selection with White
  4. Select the whole layer and copy
  5. Create a new image, it should default to the dimensions of what you copied. Set the background as black or fill it after.
  6. Paste your selected information as a new layer

This should give you black and white noise.

  1. Flatten the image
  2. In the case of this image rotate it 180 degrees
  3. Make sure you are in 8-bit Grayscale mode
  4. Save as RAW per above

// Part 3: Color Channels

The next image found contained data in the color channels: alpha_channel_180_rotate.png

This has information in two channels and a hint the third (sheesh) but for now let’s assume there is only one to deal with.

To determine which channel has the data, go to the channels pane and make sure only one channel is visible and selected. Then:

  1. Delete the other channels you are not interested in.
  2. Convert the remaining channel to grayscale
  3. Crop as close to the data as you can. You will probably have a line with some data, and some of the original image.
  4. Select the image portion of the line and fill it with Black so you can identify it as padding (zeros) later. If you have trouble figuring out where the data stops, you can go back to the original color image and do it at that point.
  5. Save as RAW per above

Alternatively, and faster:

  1. Crop and fill image padding with black first
  2. Delete the two channels you are not interested in
  3. Save as RAW at this point

Now, for the image above it gets more confusing. The data was interleaved in two channels, red and green. The hint was in the blue channel - 7 bytes at the end that spelled SHUFFLE if you rotated the image 180 degrees. So there were two hints here:

A) Rotate the image 180 first
B) Interleave the data of the two channels.

Props to Furious for figuring out how to do (B). I had no idea this could be done. Here are the steps for this image:

  1. Crop and fill the padding with black while you are still looking at the RGB image.
  2. Rotate 180 degrees if you haven’t already
  3. Delete the blue channel
  4. Save as RAW, but don’t convert to grayscale, and since you have two channels, it will give you the option to interleave them. Do so, and you will get the RAW file you need.

// Part 4: Direct extraction of the RAW channels

Since photoshop and other applications integrate the transparency information into the individual color channels, this can effectively corrupt your RAW output, because the color channel is offset by the values of the alpha channel. In some cases you can correct for this, but generally it’s a big headache.

Huge thanks go to SepheusIX for the following.

You can extract original RAW versions of all four channels of the PNG with a Ruby script and an additional module called ChunkyPNG. To get this set up:

  • Install Ruby: Ruby Programming Language
    If you are on Windows the latest installer can be found here: http://rubyinstaller.org/
    Note: for the Windows installer, to make your life easier, choose to add ruby excutables to your PATH and associate ruby file types.
  • Install the ChunkyPNG module:
    Go to the command line and type ‘gem install chunky_png’
  • Save the ruby script for extracting channels:
    The script can be found here: http://pastebin.com/WwpM3KNh
    Save the script as something like extractchannels.rb
  • Place the png you want to process in the same folder as the script and rename it to ‘source.png’
  • Run the script. In Windows, if you associated .rb files with ruby during install, you can just run it from explorer
  • It should chug on the file for a little bit and output four raw files in the same folder for alpha, red, green and blue in raw format.

// Side Note

You can use Photoshop like this in reverse when you are trying to look at data and see patterns in the data. Open a binary file in photoshop as a raw file (you’ll have to pick some dimensions, something equal or smaller than what the file could be were it a real image). Looking at the lines of gray, sometimes you can pick out patterns in the values - solid grey for consistent data, repeating patterns, sudden changes.


Many thanks to all those who have provided help and instruction along the way.

In the most recent events, we were given the new AI thread.

Tetrarai

In the first post there is a 29x58 image (blue/red oni symbol missing dots). I went through last night and worked up a few different setups of this image and came up with a few more this morning.

A simple scatter of the missing colors as “x” on a field of “*”
Scatter
*a reduction of the scatter, possibly check against constellations as we have been asked to look to the stars more than once in the past
Scatter Reduction

A layout of the image using “P” for black, “B” for blue, “R” for red, and “x” for missing colors.
Colormap

And a link to a color option thanks to Furiousn00b
Orginal color image

A few thoughts on the matter as I have classes most of the day.

-As mentioned a few times in irc last night, try an overlay of the 2 halves of the image. Make this output purple with the holes in the blue showing up red, and the holes in the red showing up blue, any coincidences show as black. Forward, reverse and upside down of those options.

-If split into halves, the two resulting images are square, 29x29, try to represent them as such, maybe not useful, but we don’t know yet.

-The image could serve as an old style decoder, where it is used to cover up a message either 29x58 or in the arrangement of the oni symbol where the holes denote the information we actually need. This could be applied to text or hex/base64/etc.

> Sorry, i thought that there where two more left because they where bruteforced, so i thought it would be helpfull if i find them ingame.

if those are the two that were brute forced it is good intel to know they were in spops as well and that will ease confusion if they are discovered again.

Links for node 0-3.lck on skydrive given by tetraRai

Node 0.lck

Node 1.lck

Node 2.lck

Node 3.lck

tetraRai Commands/Responses

> BINARY FORMAT: ???
>
> FIRST FOUR ARE THE COMMAND:
> 0100 → LIST A SPECIFIC FILE OR DIRECTORY
> 1000 → CHANGE DIRECTORY
> 1100 → EXECUTE (RUN)
> 0110 → LIST ALL FILES OR DIRECTORIES
>
> 11000000 → CLEAR ALL COMMS AND LOCK AI
> 11000011 → SWITCH COMM TO ENGLISH
>
> NEXT FOUR REFER TO THE DATA.

https://forums.halowaypoint.com/yaf_postsm1871390_tetraRai.aspx#post1871390
01001001 - NO DIRECTORY 1001 FOUND

https://forums.halowaypoint.com/yaf_postsm1871513_tetraRai.aspx#post1871513
01000001 - STAT SCANS

https://forums.halowaypoint.com/yaf_postsm1871662_tetraRai.aspx#post1871662
01000010 - DOSSIERS

https://forums.halowaypoint.com/yaf_postsm1871689_tetraRai.aspx#post1871689
01001110 - NO DIRECTORY 1110 FOUND

https://forums.halowaypoint.com/yaf_postsm1871697_tetraRai.aspx#post1871697
01000101 - NO DIRECTORY 101 FOUND

https://forums.halowaypoint.com/yaf_postsm1871741_tetraRai.aspx#post1871741
10000000 - CHANGED DIR TO ROOT

https://forums.halowaypoint.com/yaf_postsm1871746_tetraRai.aspx#post1871746
01000000 - NO DIRECTORY 0000 FOUND

https://forums.halowaypoint.com/yaf_postsm1871845_tetraRai.aspx#post1871845
01000100 - JUNK

https://forums.halowaypoint.com/yaf_postsm1871909_tetraRai.aspx#post1871909
01000001 - STAT SCANS

https://forums.halowaypoint.com/yaf_postsm1871924_tetraRai.aspx#post1871924
01001000 - NO DIRECTORY 1000 FOUND

https://forums.halowaypoint.com/yaf_postsm1871973_tetraRai.aspx#post1871973
01001111 - NO DIRECTORY 1111 FOUND

https://forums.halowaypoint.com/yaf_postsm1872119_tetraRai.aspx#post1872119
01001011 - NO DIRECTORY 1111 FOUND

https://forums.halowaypoint.com/yaf_postsm1872204_tetraRai.aspx#post1872204
01000011 - DATA NODES

https://forums.halowaypoint.com/yaf_postsm1872415_tetraRai.aspx#post1872415
10000011 - CHANGE DIR TO DATA NODES

https://forums.halowaypoint.com/yaf_postsm1872574_tetraRai.aspx#post1872574
01001011 - NO DIRECTORY 1011 FOUND

https://forums.halowaypoint.com/yaf_postsm1872700_tetraRai.aspx#post1872700
01000110 - NO DIRECTORY FOUND

https://forums.halowaypoint.com/yaf_postsm1872709_tetraRai.aspx#post1872709
01000101 - NO DIRECTORY FOUND

https://forums.halowaypoint.com/yaf_postsm1872737_tetraRai.aspx#post1872737
01000111 - NO DIRECTORY FOUND

https://forums.halowaypoint.com/yaf_postsm1872840_tetraRai.aspx#post1872840
10000100 - CHANGE DIR TO JUNK

https://forums.halowaypoint.com/yaf_postsm1874689_tetraRai.aspx#post1874689
10000000 - CHANGED DIR TO ROOT

https://forums.halowaypoint.com/yaf_postsm1874706_tetraRai.aspx#post1874706
10000010 - CHANGED DIR TO DOSSIERS

https://forums.halowaypoint.com/yaf_postsm1874757_tetraRai.aspx#post1874757
10000100 - CHANGED DIR TO JUNK

https://forums.halowaypoint.com/yaf_postsm1874790_tetraRai.aspx#post1874790
01000100 - NO DIRECTORY 0100 FOUND

https://forums.halowaypoint.com/yaf_postsm1874863_tetraRai1aspx#post1874863
10000000.10000100.01100000 - junkfile0

https://forums.halowaypoint.com/yaf_postsm1874918_tetraRai.aspx#post1874918
11000001 - HORSE MEN DASHING TO END IT ALL

https://forums.halowaypoint.com/yaf_postsm1874938_tetraRai.aspx#post1874938
10000000.01100000 - STATS SCAN, DOSSIERS, DATA NODES, JUNK

https://forums.halowaypoint.com/yaf_postsm1874960_tetraRai.aspx#post1874960
10000010.01100000 - tetraRai

Original Posts: - https://forums.halowaypoint.com/yaf_postsm1873155_tetraRai.aspx#post1873155

> http://sdrv.ms/Tl1peH
> http://sdrv.ms/Y26gJi
> http://sdrv.ms/TjQZfM
> http://sdrv.ms/TsEIYS

Mirror:
node0.lck
node1.lck
node2.lck
node3.lck

The Hint:

> /HMM, IT SEEMS LIKE A NESTED LOCKED SET. IT LIKELY USED A CLEAN VERSION OF ITSELF AS THE FIRST KEY. /

28/11/2012: Node 0
28/11/2012: Node 1
28/11/2012: Node 2
29/11/2012: Node 3
29/11/2012: Combining Nodes

//DECODING SITREP

> OP36516| /OK, SO LET ME EXPLAIN WHAT WE ARE DOING HERE. SOMEONE FEEL FREE TO ECHO BACK TO THE MAIN CHANNELS.
> OP36516| /TETRA IS GOING TO HELP US DIG THROUGH THE DATA THAT HYDRAI HAD ALREADY PROCESSED
> OP36516| /AND ANALYZE WHATEVER WAS LEFT (I AM WORRIED ABOUT THAT LAST PART)
> OP36516| /THIS MUST BE THE FIRST DATA NODE SET THAT TETRA HAS PROCESSED, BUT AS USUAL, IT IS HIGHLY ENCRYPTED, AND LIKELY BOOBIE TRAPPED BY HYDRAI TO GIVE US JUNK IF THE STEPS ARE NOT EXACTLY FOLLOWED.
> OP36516| / THE FIRST LAYER OF ENCRYPTION IS TETRA’S DOING, HOWEVER, TO PROTECT THE DATA.
> OP36516| /THE JUNK FILE WAS LIKELY FOUND ALONG WITH THE DATA, BUT IT MAY INDEED BE JUST JUNK.
> OP36516| /AS I MENTIONED BEFORE, THIS FIRST LEVEL OF ENCRYPTION LOOKS LIKE A NESTED LOCK AND KEY
> OP36516| THE FOUR PIECES SHOULD EVENTUALLY CONNECT, BUT YOU WILL NEED TO GET THEM TO A STATE WHERE THEY CAN CONNECT.
> OP36516| /

Node 0

> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> **********************************************************
> ***********************************

BBCode (Sleuth key #1)

> http://pastebin.com/raw.php?i=8F0MamkH

Sleuth using node0.lck and Sleuth Key #1.

> http://pastebin.com/raw.php?i=qKhctmhU

Save Hex as NODE0.zip

Extract contents

> NODE_0.TXT

> /TO “REALLY” TALK, SHOUT, SNEEZE, SING, WHISPER, COUGH, YOU NEED A MOUTH AND AIR GOING OUT FROM IT
> /YOU DO NOT NEED THIS TO LEARN, PACIFY, HEAL, TASTE, PRAISE, OR INSULT

Replace TALK, SHOUT, SNEEZE, SING, WHISPER and COUGH with 1.
Replace LEARN, PACIFY, HEAL, TASTE, PRAISE and INSULT with 0.

> http://pastebin.com/raw.php?i=YcZADCh3

Binary to Hex (Sleuth key #2)

> http://pastebin.com/raw.php?i=4RMy7JV8

Node 1

Sleuth using node1.lck and Sleuth Key #2.

> http://pastebin.com/raw.php?i=w1JNiafg

Save Hex as NODE1.ZIP

Extract Contents

> - NODE_1.TXT

Replace HELL with 0
Replace CURIOUS with 1
Replace HALSEY with 2
Replace CLASSIFIED with 3
Replace CONSCRIPTED with 4
Replace EDGE with 5
Replace PSYCHOLOGICAL with 6
Replace CAPABLE with 7
Replace TRUTH with 8
Replace COPERNICUS with 9
Replace ARMY with D
(This is the order of the words as they are mentioned in the Spartan Ops 4 Cinematic)

> http://pastebin.com/raw.php?i=4M1jJGx9

Hex to Text (Sleuth Key #3)

> http://pastebin.com/raw.php?i=JzTQXnpR

Node 2

Sleuth using node2.lck and Sleuth Key #3.

> http://pastebin.com/raw.php?i=Tuz1A5fs

Save Hex as NODE2.ZIP

Extract Contents

> - NODE_2.TXT

Replace pythagoras, niepce, newton, copernicus, pascal, edison, archimedes, einstein, kepler and tagore with 1 (Names that are an even length)
Replace sagan, lorentz, julia, tesla, riemann, sierpinski, galileo, laplace, morse and ptolemy with 0 (Names that are an odd length)

> http://pastebin.com/raw.php?i=dmcx51GH

Binary to Text (Sleuth Key #4)

> http://pastebin.com/raw.php?i=17cGYEh4

Information moved to post above.

Information moved to post below.

Node 3

Sleuth using node3.lck and Sleuth Key #4.

> http://pastebin.com/raw.php?i=Yt7qyqQK

Save Hex as NODE3.ZIP

Extract Contents

> - NODE_3.TXT

Calendar Cipher

> http://pastebin.com/raw.php?i=S1ETxLen

Combining Node 0, Node 1, Node 2 and Node 3

Combine the hex from the nodes

> http://pastebin.com/raw.php?i=rcdVtH4Y

Reverse Hex

> http://pastebin.com/raw.php?i=9qUHysdu

Save Hex as NODES.PNG

Extract raw channels: (http://www.furiousn00b.com/halo4arg/PUZZLES/NODES/RED.raw), GREEN, (http://www.furiousn00b.com/halo4arg/PUZZLES/NODES/BLUE.raw), ALPHA.

Get the Eighth Bit Plane (MSB) for each.

> http://pastebin.com/raw.php?i=3LDWEPxk

Inclusive OR the four Bit Planes.

> http://pastebin.com/raw.php?i=8AkSApVs

Binary to Hex

> http://pastebin.com/raw.php?i=L7CS6JFz

-4

> http://pastebin.com/raw.php?i=hJcyKgsP

Base64 encoded hex.

> http://pastebin.com/raw.php?i=7d4MwkTG

Reverse Base64

> http://pastebin.com/raw.php?i=ih0i22xg

Decode Base64 (Hex)

> http://pastebin.com/raw.php?i=Zx09Jd1y

Save Hex as NODESGLYPH.PNG

Flip NODESGLYPH.PNG horizontally. Save as NODESGLYPHFLIP.PNG

> /I HAD TWO THOUGHTS: 1. PERHAPS THE INTEL IN JUNK WAS NOT MEANINGLESS?
>
> /2ND THOUGHT: DEPENDING ON WHERE THAT TAKES YOU, KNOWING HYDRAI, IT STILL MAY LOOK LIKE A DEAD END. YOU MAY NEED TO THINK BACKWARDS IN YOUR PROCESS AT THAT POINT

//DATANODE COMPLETE

> 17:57 OP36516| /OK, BECAUSE WE WILL NEED STEEL COURSING THROUGH OUR VEINS TO FACE HYDRAI, IN A CLOSED, OPEN, HIDDEN OR WHATEVER NETWORK
> 17:57 OP36516| /FAILURE IS NOT AN OPTION
> 17:57 OP36516| /WE WILL GET HER BACK
> 17:58 OP36516| /I LEAVE YOU WITH THIS THOUGHT: IF THE FA15E STRAND WAS ABLE TO TAKE DOWN PART OF BRANCH B, PERHAPS THERE IS AN ANSWER AND HOPE THERE FOR US.
> 17:59 OP36516| /IN THAT… MECHANISM.
> 17:59 OP36516| /SO LONG FOR NOW. TAKE CARE, OPERATIVES, GREAT WORK TODAY!!/
> 17:59 OP36516| /…/