Introduction permalink
These are my notes on the Waifu TCG ARG (“alternate reality game”). Please start here to catch up on everything that has happened thus far.
The primary rewards from the ARG are redeem codes. There are always two redeem codes: The first one is for the person who first discovers the redeem code. It awards a special card and a badge. The second one is for everybody else. It awards only a badge. This has changed starting with part 8.
The #tcg-arg-discussion channel is mentioned. It's part of the nepcord (use the !nepcord command to get an invite link). Then you need to request the Waifu-TCG role to get access.
Part 1: The Beginning permalink
The main website, waifus.de, contains the initial hint to join in the ARG.
The hint can be found in the code to NepBot's web parts.
This points us to https://waifus.de/teasing.
The <img> alt tag contains a base 64 encoded blob:
SGV5LCB5b3UgZm91bmQgbWUhIENvbmdyYXR1bGF0aW9ucyENCklmIHlvdSdyZSB0aGUgZmlyc3QsIHRh a2UgdGhpcyBwcmVzZW50LCB5b3Uga25vdyB3aGVyZSB0byByZWRlZW0gaXQ6IFBhcnROdW1lcm9Vbm8N ClNvLCBzb21lb25lIHdhcyBoZXJlIGJlZm9yZSB5b3UuIERvIHRha2UgdGhlIHNlY29uZGFyeSBwcmlj ZSwgYnV0IGRvbid0IHRlbGwgdGhlIG90aGVycyA7KTogUGFydE51bWVyb1Vub1lPVVJFVE9PU0xPVw0K DQpCdXQgc2luY2Ugd2UncmUgdGFsa2luZyB0ZWFzaW5nLCBoZXJlJ3MgdGhlIGdlbmVyYWwgZ2lzdDoN CkxhdGVyIHRvZGF5LCB3ZSB3aWxsIGFubm91bmNlIG91ciBuZXcgcmFyaXR5LCBteXRoaWNhbCwgb2Zm aWNpYWxseSEgVGhlcmUncyBhIGxvdCBtb3JlIGNvbWluZywgYnV0IHN0YXJ0aW5nIHdpdGggdGhlIG9m ZmljaWFsIGFubm91bmNlbWVudCwgIXByb21vdGUgd2lsbCBiZSBsb2NrZWQuDQpBcyB3ZSBpbnRyb2R1 Y2UgYSBuZXcgd2F5IHRvIHByb21vdGUgYW55IHdhaWZ1IHRvIHRoZSBuZXh0IHJhcml0eSwgeW91J2xs IGJlIGFibGUgdG8gaGF2ZSBhIHdhaWZ1IG5vdCBvbmx5IG9uIHRoZWlyIGJhc2UgcmFyaXR5LCBidXQg YWxzbyBwcm9tb3RlIGl0IHVwIHRoZSByYXJpdHkgbGFkZGVyLg0KDQpJdCdsbCBiZSBmdW4hDQoNCk9o IGFuZCByZW1lbWJlcjogSXQgYWluJ3Qgb3ZlciB1bnRpbCB0aGUgQ3JlZGl0cyByb2xsLg0KDQpZb3Un cmUgaGVyZSBhZ2Fpbj8gR29vZCEgVGhhdCdzIGdvb2QhIEJlIHNuZWFreSBhbmQgeW91IHdpbGwgbm90 IGxldCB0aGUgb3RoZXJzIGtub3d+DQpDaGVjayB0aG9zZSBtZXNzYWdlcyBpIHNlbnQuDQoNCkFuZCBy ZW1lbWJlcjogTm90IGV2ZXJ5dGhpbmcgbWF5IGJlIGNsZWFyIGZyb20gdGhlIGJlZ2lubmluZywgYnV0 IHdpdGggdGltZSwgeW91IHdpbGwgaGF2ZSBhbGwgdGhlIGNsdWVzLg==
Decoded, this reads:
Hey, you found me! Congratulations! If you're the first, take this present, you know where to redeem it: PartNumeroUno So, someone was here before you. Do take the secondary price, but don't tell the others ;): PartNumeroUnoYOURETOOSLOW
But since we're talking teasing, here's the general gist: Later today, we will announce our new rarity, mythical, officially! There's a lot more coming, but starting with the official announcement, !promote will be locked. As we introduce a new way to promote any waifu to the next rarity, you'll be able to have a waifu not only on their base rarity, but also promote it up the rarity ladder.
It'll be fun!
Oh and remember: It ain't over until the Credits roll.
You're here again? Good! That's good! Be sneaky and you will not let the others know~ Check those messages i sent.
And remember: Not everything may be clear from the beginning, but with time, you will have all the clues.
Part 2: Introducing the ARG (The second one) permalink
“Those messages i sent” refers to hints at the end of Marenthyu's streams using "streamlabs credits", eventually yielding the URL arg.waifus.de.
(If anyone has any details about this part, corrections would be appreciated!)
There is a password prompt for all of arg.waifus.de.
The prompt reads: “Missing Password. Retracing your steps will help find those missing things, if you just look in your head.”
In this case, head refers to the HTTP header:
If you check the HTTP response code for waifus.de/teasing, it's 200 naroHodo.
Leave the username field empty; the password for all of arg.waifus.de is naroHodo.
Successfully accessing https://arg.waifus.de/ yields the second redeem code.
Part 3: The Listener permalink
Later on, the third part was started with these two messages:
[1:54 AM] Marenthyu: there were no credits today, what a shame.
[1:54 AM] Marenthyu: Guess we'll just have to /continue with another listen to the Magic Key(edited)
Which Bananakin_Skywalker quickly figured out to refer to https://arg.waifus.de/continue.
On the /continue page, there are a number of items that can be dragged onto seven empty fields. These are meant to be filled with the following items sequence, taken from the lyrics to One-T Cool-T – The Magic Key. The correct sequence of items: 1, T, 9, T, male, T, me.
This yields a link to a PNG file, rather than a redeem code. The PNG file contains an embedded zip file, which unzip(1) on *NIX can unpack with no further work involved. 7-zip should be able to do the same on Windows.
Inside the zip file, there are files for a game made in Unity with C#/.NET.
Successfully finish the game to obtain a third redeem code.
The redeem code is stored in plaintext in RhythmXErynVersion_Data/level0.
There is also the following text stored there:
Welcome (back?) to ARSTOTZKA! You have come to visit Friend? Enter their number here: https://arg.waifus.de/glorytoarstotzka
Part 4: Morse (The Beeping Noise) permalink
https://arg.waifus.de/glorytoarstotzka requests that you enter a “number of your friend”. This is the prisoner number of the protagonist in Papers, Please: 918533-6124.
Entering this, you obtain a link to a sound file. The sound file contains a message in morse code. A decoding program exists. The message reads:
HTTPS://ARG.WAIFUS.DE/LASJDUHASDU8SAG76TF9347RFG954376G94756GT97G6R697F34E97R6FG93746GFFBSDKHJFBSDUHFBESD08F7HSDUZCHFV0D8F7GVFDPUBVHS0D987FVHEA9DS8FIHDS9FGBZV0PDSUFHVDSFVZUNSD0FGVU
Going to that website (uppercase past the slash matters!), we get:
..-. .. .-. ... - / .--. .-. .. -.-. . ---...
-- --- .-. ... . .- .. -. - .... .- .-. -.. -... .-. ---
... . -.-. --- -. -.. .- .-. -.-- ---...
-- --- .-. ... . .-- .- ... - --- --- .... .- .-. -.. ..-. --- .-. -- .
- .... . / .--. .-. . ... . -. - / .... .- ... / -. --- / .-. .. -... -... --- -. .-.-.-
-.-- --- ..- / -- .- -.-- / ..-. .. -. -.. / - .... .- - / -.-- --- ..- / --. . - / .-.. ..- -.-. -.- -.-- / .. ..-. / -.-- --- ..- / ... .-.. .- ... .... .. -. --. .-.. -.-- / .--. ..- - / .. - / -... . .... .. -. -.. / - .... . / - --- .--. / .-.. . ...- . .-.. .-.-.-
This is also encoded morse.
The <title> tag reads “GGWP”.
This one reads, decoded:
FIRST PRICE: MORSEAINTHARDBRO SECONDARY: MORSEWASTOOHARDFORME THE PRESENT HAS NO RIBBON.YOU MAY FIND THAT YOU GET LUCKY IF YOU SLASHINGLY PUT IT BEHIND THE TOP LEVEL.
Part 5: System Dump (EMERGENCY REQUEST) permalink
“The present has no ribbon.” is a hint that has not been figured out yet, but is probably just a double hint for “Get lucky” since it's part of that song's lyrics. “You may find that you get lucky if you slashingly put it behind the top level.” is hint to: https://arg.waifus.de/getlucky. That page contains a link to a zipfile, sysdump.zip. The file has been removed. It most likely no longer is part of the ARG.
Background for that: I downloaded sysdump.zip, which contained a sysdump.py file. The file is a Python script, obfuscated with Opy, which made the actual code difficult to read. The python script downloaded the actual data; it's not stored inside the script.
The intended route was:
Entering nepgear as username, then gehaburn as password.
Getting the part 4 redeem code could be found in /mnt/ngear with the command sequence cd mnt, cd ngear, cat EMERGENCY_NOTE.txt: GEHABURN_NEPUNEPU_HELP for the first prize and HOLYSWORD_CANDIDATE_XSA for everybody else.
The following easter eggs were implemented in the code:
- Username
marenthyu,monika,natsuki,yuri: Forever prints “Just Monika.” to the terminal. - Username
sayori: Prints “Just Monika.” to the terminal 60 times, then prints “Process Hung up.” - Username
root: Prints “root Access disabled by Administrator (nepgear). Please contact them if you think this is in error.” - Username
histoire: Prints “Password-based access disabled for this account. Please insert Hardware Key and try again.” - Username
neptune: Prints “MEMO:
SERIOUSLY, Sis!
I can't keep resetting your account just because you keep forgetting your password! Please just keep away from the Mainframe for now, you shouldn't have a need to access it anyway!
AND NO, PLAYING THOSE GRAPHICS HEAVY GAMES IS NOT A REASON TO USE THIS POWERFUL MACHINE!” - Username
if: Printf “Password-based access disabled for this account. Please insert Hardware Key and try again.”
However, it didn't take me long to write a deobfuscator, however, making it trivial to read out the data and obtain the fourth redeem code as well as all other data. I was awarded the “Security Breach” badge for doing so and reporting it; the badge is unique and cannot be normally obtained through the ARG. This changed the course of the ARG; quoting Marenthyu:
Okay to make this clear from my side as well: In the beginning, i wanted to continue with a sysdump update, yea. I scrapped that when xor broke in in an unintended way and made the messages for the "Security update". That was meant to hint at the SSL/TLS certificate. There is no other thing hinting at it and only after you found it i put up the next thing.
Mirror of the Python script: sysdump.py
Mirror of the data in the sysDump: sysdump.json
The sysdump.py script accesses https://arg.waifus.de/sysDump.
It requires a different username and password from usual (one valid combination is username 3821.3482672.-3482266 and password -2158865.-4353301.-565).
Accessing it with the correct credentials yields 200 NEPOK.
Part 6: The Midway Point permalink
Soon after the Security Breach happened, the following messages were sent to #tcg-arg-discussion from "[BOT] Planeptune Mainframe EmerSys":
April 7, 2018 8:13 am GMT
CRITICAL STATUS
SECURITY BREACH DETECTED. DETECTING VIOLATOR AND CREATING LVL 2 SECURITY....
Emergency Notification by the Planeptune Mainframe Emergency SystemApril 7, 2018 8:20 am GMT
CRITICAL STATUS
ERROR UPGRADING SECURITY. AWAITING MANUAL ADMIN INPUT. SYSTEM DUMP REMOVED. TARGET IDENTIFIED: http://t.fuelr.at/t5g
Emergency Notification by the Planeptune Mainframe Emergency SystemApril 7, 2018 10:58 pm GMT
SECURITY UPDATED.
UPDATING CONTENT. ETA: 25h
Emergency Notification by the Planeptune Mainframe Emergency System
The TLS certificate for arg.waifus.de was swapped out. It now contains entries for gamindustri.de in the subjectAltName. Visiting https://gamindustri.de/ yields an image. The image appears not to be special and contains the following text:
Formal Planeptune Emergency request
To whom it may concern:
If you acquire this notice, please IMMEADIATELY
send any help you can to us!Contact [e-mail stripped to prevent spam]
as soon as possible.Nepgear
Planeptune CPU Candidate
The corresponding e-mail account is operated manually. Do not expect real automated replies except possibly to the correct code.
The card 7543, which is a special card that was available for the first person to redeem the code from the previous part of the ARG, links to a different picture: https://share.marenthyu.de/jJGERcZz.gif. This one is a gif file. It hides on the first layer a base 64 blob. It needs to be manually transcribed. The base 64 blob contains an inner base 64 blob. Decoding the inner blob yields:
bbbbbbbwwbwwwwwbbwwbbbwbwwbbbbbbb bwwwwwbwbbwbbwwwwbbwwwbwbwbwwwwwb bwbbbwbwwbbbwwbwbwbwwbbwwwbwbbbwb bwbbbwbwbbwbwwwwwbwbbwbwbwbwbbbwb bwbbbwbwwwbwbbbbwwbbwwwbwwbwbbbwb bwwwwwbwbwbwwbbbbwbwwbwwbwbwwwwwb bbbbbbbwbwbwbwbwbwbwbwbwbwbbbbbbb wwwwwwwwwwwwbbwwbwwwwbwbwwwwwwwww bbbbbwbbbbbwbwbbbbwbwwbwbbwbwbwbw wwbbbbwbwbwwwwwwbwwbbwwbwwbwwwwwb bwwwwwbwwbwbbwwbbbbwbwbwbwbbwwbbw bwbwbwwwbbbbwwbbwwwwwbwwbwwwwbbww bbwwbwbbwbwbwwwbwbwbbbwbwwwbbbbbw bwbwwbwwbwbwbbbwbwwbwbbbbbbwwbwbb bwbbbwbbbbbwwbbbwwbwwbwwwwwwwbwbw bwwbwbwwwwwwbbwwbwwbbbwwbwwbbbbbw bbwwwbbbbbbwbwbbwbbbwbwbwbwwbwwbw wwbbwwwwbwbwwwwwbbwbbbbbbwbbwwbbb bbwbwwbbbbbbbwwbwwbwwbwwwbwwwbwbw bwwwbwwbbwwbwwbwwwwwwbwbbwwbwbbbw bbbbwbbbwbbbwwwbbbbbwwbwwwwbbwwww bwbwbbwwbwwwbbbwbwwbbbwbwbbwwbwwb bwbbbwbwbwbwwbbbwbbwbwwwbwbwbbwbw bwwwwbwbwwwwbbwbwwbbwwwwbbwbwbbbb bwbwwwbwwwbwbwbwwbbwbbwbbbbbbwwbb wwwwwwwwbwwwwwwwbbwbwbbwbwwwbbbbb bbbbbbbwbbbbbwwbbwbwwbbbbwbwbwbww bwwwwwbwwbbbwwbbbwbwwbwbbwwwbbbwb bwbbbwbwbwbbwwwbwbwbwbwwbbbbbwwbb bwbbbwbwbbwwbbbwbwwbbbbbwbwwbbbbw bwbbbwbwbwwwwbbbbbwwbwbbbwbwwbbww bwwwwwbwbbwwbbwwwwwwbbbwwbwwwwbww bbbbbbbwbwwwbwbbbbbwwwbbbwbwbbwbw
b stands for black, w stands for white.
This yields a QR code:
Decoding the QR code yields the string ?auth_code=sa9dh0d9fghs98fdghn0989eh3hn9h8rasq928w3ehrfaw.
This is to be appended to the base Gamindustri URL:
https://gamindustri.de/?auth_code=sa9dh0d9fghs98fdghn0989eh3hn9h8rasq928w3ehrfaw.
Players are given a choice to verify their intentions: peace or war.
The peace code is to be e-mailed to nepgear.planeptune@, the war code is to be e-mailed to arfoire@.
On May 9, 2018, all players who e-mailed Nepgear in some form received this e-mail:
Dear all,
The recent days have been rough. As you may have noticed, our communications have broken down. This was due to a clash between all of us accidentally destroying the main emergency system uplink.
As we further went on, we have come to a complete stalemate and decided to put an effort into repairing the uplink which luckily has succeeded.
Yet, the System remains a complete mystery to us all and all we can tell you is what it tells us. It says:
"There is a time and place you will have to look inside The Truth. Not all will be able to. Doesn't the Zoo have an amazing view to it?"
We've been struggling to figure out what it actually means, maybe you will be able to decipher the message.
You are still open to choose your side, but hose that chose should not change.
To give you an update on our current situation: As the fights have severly damaged Planeptune, we (Neptune, Histoire, IF, Compa and myself) have fled to the shelter of Leanbox. Vert is more than happy to have us (or me...?) around and we decided to make this our current base of operation, as well as have a new uplink for the emergency system here. We can't know how that affects your end, but you'll have to find out. Compa has been as lovely as ever, keeping us well fed. Just before the uplink broke down, she apparently also got a letter from another mouse confessing to her - It's weird how these seem to really like her. IF has been the helpful soul she's always been and helped me and Anonydeath repair the emergency system. (Though Noire was not at all happy we decided to cooperate with him. Which, i guess, is understandable.) Neptune... you'll be able to guess what she's doing.
Arfoire did not want to add anything here, so it has to be left empty.
That being said, i hope we can count on your further cooperation.
Sincerely,
~NG
~~R4
The “time and place” as well as the “Zoo” refer to Honbuk and Marenthyu meeting up in real life, near a station called Bahnhof Zoologischer Garten. Honbuk was given a physical The Truth card. The back of the physical card contains a message and some no longer usable redeem codes not related to the ARG. Pictures of the card: front, back, inside.
The message inside reads:
So you decided to crack me open, eh?
I hop you're not doing it while I'm still with you, so I hope you got some safe and sound and we had at least a bit of fun meeting up.
That being said, I hope you enjoy the outer reward. If you want to help crack the next Riddle, SOON™: leanbox.???.de
The back reads: “Secret hint: first letter”, which refers to the first e-mail (which is a kind of letter, after all).
This leads us to https://leanbox.gamindustri.de/.
The page only contains (Updated May 23, 2018):
“I hope you're only here because you looked inside The Truth.
285542556534197
2 4/test 5 5”
On May 22, 2018, the following conversation took place:
Marenthyu: 443 and 80 are boring. Let's start playing a game.
xorhash: Oh really now.
xorhash: 65535 tries fine with you or would you prefer a softer approach?Marenthyu: Searching for something that isn't ready won't get you far.
This suggests that the ARG will continue either on non-standard ports or even use protocols other than HTTP(S). However, “Searching for something that isn't ready” most likely means that this is just an announcement, before the rest of the content is written.
Shortly after, the following hints were dropped:
[8:45 PM] Marenthyu: 2285542556534197
[8:46 PM] Marenthyu: Tell me what you have and we may continue tomorrow.[8:48 PM] Pikadude9001: Its definitely not something i can solve
[8:48 PM] Pikadude9001: Lul[8:58 PM] Marenthyu: it is, though.
Combined with the new hint on leanbox.gamindustri.de, it was surmised that it might be a list of ports, with the number of digits matching the new hint (2 4/test 5 5): 22, 8554, 25565, 34197. The ports are as follows:
| Port | Service | Result |
|---|---|---|
| 22 | SSH | 1 - gre4ged |
| 8554 | RTSP (alt. port), path: /test | 3 - a525dh6 |
| 25565 | Minecraft | 2 - j9u80q2 |
| 34197 | Factorio | 4 - AFL82EC |
Following the completion of these parts, this was posted: “[9:15 PM] Marenthyu: congratulations. Keep collecting. You will know what it is for soon™”
On June 8, 2018, leanbox was updated again. It now also cotains a hint for port 21 (FTP). Connect using explicit FTP over TLS, user nepgear and password gehaburn. The files in music are password-protected. Their file names are song lyrics. The files in music/private refer to normal songs. The files in music/streammusic refer to songs Marenthyu regularly plays on his stream, mainly League of Legends parody songs. Each of the files in the music folder is a password-encrypted zip file. The password is the name of the song, all lowercase with no spaces. The contents of the zip files are text files. The text files, when joined together (ignoring 3.txt, which is bogus), form a base 64 string. Decoding the base 64, it reads:
It may have been a while now since we talked, but be assured: Time Dilation can be huge between dimensions and for you, it seems to be especially bad.
The fact that you are reading this means you are overcoming more and more riddles the Emergency System is giving you.
There are hints out there that have yet to get solutions, but they seem to be shrouded in ink anyway.
The war for us continues to be a stalemate and i don't know when it will come to a showdown, but it is inevitable to happen at some point.
Until then: Stay watchful.
itsbeenawhilesincewegaveyouareward
soletschangethatnow
The last two lines are redeem codes.
Part 7: Ultradimension permalink
Around August 10, 2018, new files were uploaded to the leanbox.gamindustri.de FTP server.
The new folder is /music/other/.
There is a file called note.txt;
it reads:
There is no direct reard this time and the "questions" are intentionally harder. There won't be any more hints. You have all you need. Work together.
Those that need to take action will know when to take action.
tatsu solved most of the zip files on there; the message, missing 2_unknown.zip, reads:
TRANSDIMENSIONAL TRANSMISSION INTERRUPTED
###############..............................
SEARCHING SOURCE................................
LOCATING.................................TARGET SOURCE LOCKED IN
RECEIVING INFORMATION
IMPORTING ___hash.lockout....
. . . . . DONETRAFFIC REDIRECTION ENABLED.
AWAITING CONFIRMATION.
426 UPGRADE REQUIRED
UPGRADE: IRC_CONFIRM_FREENODE
TARGET: LASTATION.DE
AWAITING INPUT.
After that, this series of messages followed; first from Planeptune Mainframe EmerSys, then from Mainframe Monitoring System.
[8:08 PM] Planeptune Mainframe EmerSys:
CRITICAL STATUS
CONNECTION LOST Emergency Notification by the Planeptune Mainframe Emergency System[8:09 PM] Planeptune Mainframe EmerSys:
SEARCHING FOR REPLACEMENT CONNECTION....
Emergency Notification by the Planeptune Mainframe Emergency System[8:10 PM] Planeptune Mainframe EmerSys:
SIGNAL FOUND. UPDATE IN PROGRESS...
Emergency Notification by the Planeptune Mainframe Emergency System[8:13 PM] [UPDATING...]:
[Establishing comlink...]
[Establishing comlink...][8:15 PM] Mainframe Monitoring System:
Connected.
Mainframe Message[8:16 PM] Mainframe Monitoring System:
Uploaded hash.lockout.
Confirmed.
Mainframe Message[8:18 PM] Mainframe Monitoring System: Critical error in operating system detected.
Please turn the computer off and on again.
If this error persists, please contact your local NepOS vendor representative.
More information can be found under /nepos/.
Players quickly figured out that this implied the URL https://lastation.de/nepos/. A note from Marenthyu soon followed:
Actual note: You'll be on your own from here on out, credit for future content goes to hash, for now at least. Depending on how much you... "solve", which may or may not be what you expect, we may or may not return to my Story line. That being said:
Good Luck. You'll need it.
On https://lastation.de/nepos/download.html, the following message is buried, followed by a link to a Windows executable file:
To whom it may concern:
If you acquire this notice, plea—
EMERGENCY DUMP CREATED. CORRUPTED DATA FOUND. PROCEED WITH CAUTION.
---
I suspect nobody's really going to care unless I spell it out.
In NewSysDump.exe, there are four flags.
Flags are surrounded by "flag{}".
"flag{}" is part of the flag.
Those flags double as redeem tokens.
The tokens yield:
a. 5,000 points,
b. 75,000 points,
c. 200,000 points.
Teamwork is encouraged:
The reward may be split if teamwork is proven and
Marenthyu is notified before the flag is redeemed.
A fourth flag exists.
If found and redeemed by a *single* person,
it is worth 1,000,000 points (one million points).
However, if at least three people cooperate,
each of them having a major impact on success,
*every TCG user* gets 20,000 points.
Good luck finding every flag.
A hint for all flags will appear here in two weeks.
Please also note that NewSysDump.exe runs in the Ultradimension,
far away from the mainline ARG.
What is canon here may not be canon there and vice-versa.
You have explicit permission to reverse engineer NewSysDump.exe.
It has been designed for Windows 8.1,
but has only been tested on Windows 10 and Wine on Linux.
Windows 7 *should* work.
Tab completion is broken on Wine.
Sincerely,
xorhash
Marenthyu
One of those four flags has been discovered by Enkidu.
It is located in /etc/.flag and reads:
“flag{TheOrpheanBeholderExpressesItsScaryDoubt}”.
The flag has been redeemed for 5000 points.
fusecavator solved the next two flags in quick succession.
/etc/%rootflag required getting root, which was achieved by patching:
0x1645C: replace 75 07 with 90 90,
0x16467: replace 75 6C with 90 90.
“flag{JohnTheRipperAnnihilatesColossalCaveAdventure}“
was individually redeemed for 75,000 points.
The license command required getting a valid license key,
but fusecavator instead just did more patching until the command gave the flag.
0xEF39: replace 0F 85 E7 00 00 00 with
90 90 90 90 90 90.
Then execute license CCCC-CCCC-CCCC-CCCC as root.
He discovered that there was a typo in /usr/src/doc/drm/licensekeys.md,
which made the specifications wrong.
“flag{IhavenotreallywatchedSneakers}”
was individually redeemed for 200,000 points.
The final flag is in a hidden, invisible file on the filesystem. Copious amounts of reverse engineering required; I'll spare you the irrelevant details. “flag{ElcrestTheLegendaryHeroAndEveMotherQualia}” was redeemed for only 250,000 points because otherwise the economy would have been wrecked.
Part 7a: 100 Memes permalink
On August 27, 2018, Marenthyu sent a message to #tcg-arg-discussion reading “Chirp Chirp”. It was found out to be a hint to look at his Twitter account, @Marenthyu. There, people found this conversation between @Marenthyu and @FelineEntity. In that conversation, the redeemable token “IgDtajdiSOON27gt5” can be found; it yields 100 points.
Part 8: 404 - Hash Not Found permalink
Marenthyu has confirmed that this part has no "first come, first serve"-bonus. On October 4, 2018, a number of messages were sent to #tcg-arg-discussion:
[9:03 PM] Mainframe Monitoring System: Switching Communications...
Mainframe Message
[9:04 PM] Mainframe Monitoring System: 404 - Hash Not Found. Ignoring. Continuing...
Mainframe Message
[9:03 PM] Planeptune Mainframe EmerSys: Connection restored. Moving on.
Emergency Notification by the Planeptune Mainframe Emergency System
[9:03 PM] Planeptune Mainframe EmerSys: Message received: "Oh there it is, my silly old universe. What soon will continue, the birds already know."
Emergency Notification by the Planeptune Mainframe Emergency System
[9:03 PM] Marenthyu: It's a treadmill.
Additionally, a chain of tweets was put up on the Twitter account @Marenthyu the same day:
I fear change. I really do.
But as someone very wise once said: "But times change, and so must I. [...] We all change, when you think about it, we're all different people; all throughout our lives, and that's OKAY, that's GOOD! You've gotta keep MOVING! (1/2)"So long as you remember all the people that you used to be. I will not forget one line of this, not one day, I swear." (2/2)
#gamindustri
I want the universe to sing me to sleep when i go.(as a reply to another reply)
Because there's more than what meets the eye.
Oh and remember sunday!
Enkidu notes that “[t]he quote is from Doctor Who, for those of you who aren't into it, and it's specifically from an episode from 2013; Time of the Doctor, which was Matt Smith's final episode as The Doctor. It aired Christmas Day 2013. I feel as though this might be relevant in some manner.” The left out part (“[...]”) in the quote is “I will always remember when The Doctor was me” in the actual Doctor Who episode. Enkidu further points out that Matt may have regretted being the Doctor.
On October 16, 2018, Marenthyu posted another message to #tcg-arg-discussion. He also added a text element reading “#HidingInPlainSight” to his stream. Another one on the stream reads “/doctorwho”. The mesage reads:
Our brain often makes us see things the way we want to see them, not how they actually are.
Even if there's more than what meets the eye, hiding in plain sight has proven to be effective.
Thank you.
In the following weeks, an additional number of cryptic messages were posted, hinting at Doctor Who and quoting various songs (Part of Me by Katy Perry, Immortals by Fall Out Boy, quotes attributed to Mark Twain):
[2018-10-31T20:18+0100] Marenthyu: The Time moves on, People change, People die.
But as much as i try, the memory stays around and i will always keep it. That's the Part of Me that nobody will ever take away from me.
Stick to your path, follow your goals. Never shut any doors - after all, twenty years from now, you will be more disappointed by the things you didn't do than the ones you did do. Throw off the bowlines, catch the wind in your sails. Dream, Explore, Discover.
All of Time and Relative Dimensions in Space are yours to uncover.[2018-11-08T20:19+0100] Marenthyu: "They say we are what we are, but we don't have to be."
But still, we can only become anew if we remember all the people we used to be. Some may call themselves the "watcher of the eternal flame", others prefer to stick to helping people in need - even if that's all they know of themselves!
Sheffield is a cool city - so are the things in the Black Archive cool; if only i could remember it![2018-11-09T?] (as reported by tatsu; message got removed) Marenthyu: Sometimes you just have to add 2 and 2 together
On November 11, 2018, Marenthyu sent the following to #tcg-arg-discusion:
[2018-11-11T18:30+0100] Marenthyu: I recently heard that Gamindustri is built right on top of a big dimensional time-rift and a blue box has been seen at occasions.
Some tachyon measurements especially show a high influx of temporal energy, with mentions of an unknown Dungeon called "Cardiff's Palace" being listed in ancient scribes.(edited)
On November 18, 2018, the following e-mail has been sent to at least one ARG player:
From: emergency@gamindustri.de
To: Nepgear <nepgear.planeptune@gamindustri.de>
Subject: -41 DAY TIMER EXPIRED : INITIALIZING FAILSAFE-Hi.
. . .
This is strange... Stranger than I expected.
I guess I'm supposed to write this in past tense, though I hardly feel like admitting it's possibly already over.
This is the Planeptune Emergency System, and if you're reading this, I'm facing serious issues.
This means no one has been able to solve my current security riddle recently. This is bad.
Time dilation is unpredictable, so even I cannot be sure how much time has passed for them, but as I am active, it must mean their situation is extremely dire.
This Failsafe is intended to open up a new route for you to collect information, as my algorithms are made to be sure that the riddles are solvable by the targets.
A failure to solve will result in chaos.
It’s your choice.
~g
TatsuK figured out that “/doctorwho” hidden on Marenthyu's stream referred to this URL: https://gamindustri.de/doctorwho. The page reads “Laugh hard. Run Fast. Be Kind... (blank)” – the password for that is “Doctor I let you go”
| Prompt | Answer | Found By |
|---|---|---|
| The impossible. | Clara Oswald | Stiltzkin |
| She waited. | Amelia Pond | Stiltzkin |
| Live. Wake Up. | And let the cloak of life cling to your bones | xorhash |
| Tick tock goes the clock | til river kills the doctor | tatsu |
| I will always remember: | when the doctor was me | Honbuk |
| Who da man?! | Matt Smith | tatsu |
| Don't ever do that again, please. Food. | fish fingers and custard | tatsu |
| Run you clever boy | and remember me | tatsu |
| A Town worth protecting. | Christmas | tatsu |
| You Are Not Alone. | yana | tatsu |
| Bad Wolf. | Rose Tyler | tatsu |
| Ten final words. | I dont want to go | Honbuk |
| No more. | gallifrey falls | Honbuk |
After that, this page is shown:
And Planeptune stands. For now.
As Times change, so must I.
StillNotGinger
“StillNotGinger” is a redeemable token. It redeems for 500 points.
Part 9: Let your spirit shine! permalink
On January 16, 2019, Marenthyu published this tweet: “Let your spirit shine, #gamindustri !” He also said this in #tcg-arg-discussion: “good night. have fun. There isn't far to go.”
The “The impossible.” prompt was changed to also contain “Please, hear my plea! Set me free!”
On July 4, 2019, NoLifeKing85 discovered that the /continue page from the “The Listener” part had been changed. It now contained the following text (hidden via CSS):
<?xml version="1.0" encoding="utf-8"?>
<ms2>
<melody>
<![CDATA[
t135v14c2fal2addl8&defgl2fecl4fab+2a+ad2l8&defgg1l2cf4a4addl8&defgl2fe
cl4fab+2a+ad2l8&defgf2l1.rrrrrrl2rcf4a4addl8&defgl2fecl4fab+2a+ad2l8&d
efgg1l2cf4a4addl8&defgl2fecl4fab+2a+ad2l8&defgf2l1rrrrl16<fgaa+aa+b>cd
4a+4.l8gfeb+4.a>frfed4d4.efgf1e2.
]]>
</melody>
This is a MapleStory 2 music file. tatsu converted this to an MP3 file and noted that it sounds like the Fire Emblem theme.
tatsu subsequently noticed that the /glorytoarstotzka page also got changed and contained new text: “WE HAVE RECENTLY HEARD RUMORS. ABOUT A LIGHT OF HOPE. FALLING CHAMPIONS.” This, along with “Let your spirit shine” and “Please, hear my plea! Set me free!” are parts of the lyrics to the Fire Emblem Heroes theme song.
tatsu figured out that These hints referring to Fire Emblem were meant to point to a new URL: https://gamindustri.de/fireemblem