Close

out of the blue

A project log for itanimulli code crackers

cracking the code of the itanimulli riddle

moritz-walterMoritz Walter 01/05/2016 at 23:308 Comments

Ok, so..

@Kenji Larsen had offered help, providing the missing text from the empty text file "0dfz7.txt", which, intentionally or unintentionally, got lost and wasn't retrievable. The text content of the file was:

pnlhcfpslerhzrgwpvyrvcspsxozrjwbeooakazviggsezhwihiheqgmtmlezwx
which was found to be a Vigenère Autokey chiffre text with the key
hint
and decodes to
ifyouarereadingthisyouaredoingitrightstoponeplustwoplusxisthree
"If you are reading this, you are doing it right."

"one plus two plus x is three"

So the chiffre contains a little helper text and the hint:

1 + 2 + x = 3

Your education system failed by definition if you don't feel the urge to.... gnnn arrr.. must..solve...

x = 3 - 2 - 1

This could be the missing hint to decrypting the FEZ code field from the waterfall image stego.

Reminder: There were some texts and haikus in the red and green channel, but not the blue one. Also, the channels were marked with numbers in the left upper corner, R=1, G=2, B=3

Together with the hint from the above chiffre, we can assume, that a hidden message (x) is revealed by subtracting channel 2 (G) and 1 (R) from channel 3 (B).

I had tried before to add and subtract various combinations of the channels by shifting the letters like in a Vigenère code, but without result. @Stuart Longland encouraged me to try it again, so here's the method:

  1. translate the FEZ symbol fields of all three channels to three letter fields, whereas the ambivalent KQ simply translates to K and the UV to V.
  2. map the letter fields to a number fields in the typical Vigenère style with A=0, B=1, ..., Z=25
  3. generate a fourth number field by the rule (3*26 + blue - green - red)mod26 (whereas 26 is the alphabet length)
  4. translate the fourth number field back into letters

I got this:

H, M, Y, L, K, F, Y, T, G, I, T, P, A, C, J, P, B, I, P, X, D, X, D, W, S, T, H, 
N, R, S, W, U, Y, K, U, O, M, G, P, N, G, T, P, U, H, S, Z, O, A, O, I, O, H, E, 
P, S, J, K, C, N, R, R, O, S, K, P, E, N, S, S, T, N, Y, K, T, N, T, Z, U, E, K, 
B, C, W, X, F, B, P, X, D, U, L, S, R, A, F, A, L, Q, W, K, A, E, Z, B, T, T, L, 
U, G, Q, O, M, H, K, W, L, R, G, Z, A, S, U, M, E, E, D, M, Q, A, H, M, H, E, O, 
Y, V, J, K, L, W, H, Q, U, E, S, W, M, S, N, H, E, Y, Y, G, E, L, O, Y, A, C, Z, 
Q, D, X, V, G, O, P, P, C, Y, Z, D, P, V, N, X, P, O, B, M, Q, H, U, U, L, O, M, 
M, X, S, N, W, U, Y, Y, K, O, R, A, L, M, Z, V, I, U, E, A, L, Q, Y, S, K, N, A, 
T, K, K, W, Z, D, O, V, Z, V, I, D, E, E, H, G, H, E, C, J, P, U, H, E, F, D, C, 
V, E, H, R, V, Y, W, M, V, A, D, R, A, W, O, Y, M, N, K, K, W, I, K, R, I, P, N, 
S, H, V, O, X, S, I, Z, P, G, D, U, L, H, D, B, I, J, S, A, R, D, Y, N, N, A, Z, 
X, N, H, Y, Y, A, B, W, C, L, L, G, L, E, M, N, N, O, D, Z, R, F, H, U, D, R, Q, 
F, U, S, X, Z, E, J, C, F, E, E, Y, T, R, U, X, D, Y, P, N, Q, R, N, M, A, T, F, 
N, R, X, P, S, L, V, G, Y, E, W, B, H, D, C, X, T, E, I, O, D, O, Y, E, W, U, T, 
B, F, X, C, K, J, V, C, Q, Z, A, K, E, T, H, M, H, D, V, V, S, M, D, Z, E, F, F, 
O, K, H, M, R, L, J, P, N, E, S, C, S, H, I, S, E, S, O, Y, L, A, N, M, C, Y, V, 
J, A, W, J, Z, W, E, S, Y, S, N, X, E, E, N, N, A, O, X, X, Q, F, R, M, S, O, J, 
G, R, F, P, L, X, B, H, T, R, U, F, P, R, F, G, L, R, Z, I, V, L, L, Y, H, U, W, 
P, Q, J, Q, M, Q, S, F, R, G, P, C, O, F, O, K, E, V, E, G, S, U, E, N, T, R, C, 
X, I, T, O, R, N, H, U, C, Y, E, R, S, I, R, Z, A, I, N, A, N, O, G, A, E, M, Q, 
M, P, U, W, Q, G, Z, S, G, P, A, K, T, S, M, Q, T, N, Y, F, O, T, B, M, Z, I, A, 
Q, E, I, Z, H, U, J, G, E, N, T, D, S, N, A, O, E, G, G, N, A, Z, L, E, M, S, Q, 
U, I, U, D, B, N, B, E, Z, D, X, G, C, O, T, Q, R, M, H, V, Q, J, P, I, X, S, M, 
G, Y, X, Q, P, I, Y, I, K, C, Z, Y, R, N, I, B, P, Z, M, G, K, W, C, S, T, I, N, 
Y, W, H, D, Q, Z, N, A, S, B, O, O, I, E, O, T, V, R, A, P, Y, X, R, Z, J, N, C, 
Q, F, L, D, K, Q, U, J, L, X, G, L, P, Z, N, Z, R, I, J, F, P, B, D, W, G, N, P, 
S, E, M, L, D, A, D, V, Q, N, O, X, T, W, H, M, P, D, U, N, J, N, X, H, S, I, D, 
J, Q, K, B, S, P, Y, B, M, N, T, J, Y, B, U, Q, U, C, X, W, K, O, G, J, K, T, Z, 
H, M, I, Z, P, Z, N, N, V, T, D, C, H, H, M, I, S, L, X, A, E, Q, N, O, U, A, D, 
I, X, I, D, C, E, I, G, L, E, D, Y, A, C, A, K, E, E, M, I, G, G, F, M, I, S, X, 
F, Y, L, O, Y, M, W, K, S, E, R, K, B, J, N, T, Z, M, F, O, J, Q, E, D, G, F, P, 
T, G, T, J, S, Q, O, U, F, X, L, X, E, J, S, R, Z, Z, F, Y, T, Z, R, T, C, O, C, 
S, B, Y, M, B, D, G, Q, B, T, V, N, N, Y, Y, Y, N, O, C, K, D, D, P, H, W, L, S, 
G, V, Y, U, J, E, T, H, P, V, U, P, O, I, L, Y, O, J, G, B, B, P, H, E, M, L, M, 
N, J, Y, L, G, W, D, W, Z, D, Q, B, D, W, Y, O, I, H, F, L, B, U, A, E, I, O, X, 
F, L, Y, E, E, K, F, Q, F, R, R, L, R, V, J, B, N, Y, T, Z, Y, K, H, R, O, X, C, 
N, I, H, B, C, K, K, K, D, T, E, G, U, A, V, M, Q, O, I, T, Y, P, H, S, S, S, P, 
M, S, T, I, P, R, U, N, X, J, Z, P, E, V, G, Z, J, P, B, O, G, E, V, W, B, F, U, 
V, H, L, P, B, J, B, C, R, T, C, X, R, K, A, K, M, T, N, Q, L, E, F, O, K, E, V, 
R, G, X, C, M, K, K, V, M, E, X, F, Z, A, V, L, Z, U, N, E, Q, M, W, O, N, B, M, 
And hey, even if it's not perfect, there's actually something in there:

So there are obviously flaws in the algorithm, but with a few more eyes on this I'm sure we can crack this!

Discussions

Manuel Andrés Vélez wrote 01/06/2016 at 20:35 point

X7C1-13 X168-4

rfjsl?B:A=B

zwromdqvmav

nfdgbrjzifvnqihi

  Are you sure? yes | no

MacGruber wrote 01/06/2016 at 05:36 point

the tricky part is when you have a QKVU in two or three files cause then you have have up to 8 different potential letters, and when a few of them go in a sequence like that then it get a little tricky, but this is what I got so far...

H E L L O A G A I N
T H E S E C O N D P A R T O F Y O U R M I S S I O N I S A S F O L L O W S
Y O U S H A L L F I N D A W E B S I T E
W I T H M Y U S E R N A M E A S M Y N A M E I S
D O T
X A N D A L I Q U I D F R O M A F R U I T
D O T
X
P S
I H O P E Y O U E N J O Y E D S O L V I N G M Y R I D D L E S
B U T K E E P I N M I N D T H E G R E A T E R P U R P O S E
P P S
I T S F U N N Y H O W M U C H I N F O R M A T I O N H U M A N S
C A N A S S U M E W H E R E T H E R E I S N O N E 

A N E X A M P L E A L L T H E S E P O S T S C R I P T S H A V E N O C L U E S
P P P S
T H E L A S T R I D D L E W A S T O O E A S Y
I M S U R E Y O U A G R E E
G O O D L U C K

  Are you sure? yes | no

Moritz Walter wrote 01/06/2016 at 06:46 point

Awesome work! I saw you also dedicated a project to the steg extraction! cool!

  Are you sure? yes | no

andyhull wrote 01/06/2016 at 15:11 point

http://www.snopes.com/politics/conspiracy/itanimulli.asp
The chances are the clue alludes to this.

  Are you sure? yes | no

Moritz Walter wrote 01/06/2016 at 16:33 point

I'm sure I've read something about "John Fenley" before in the comments somewhere here, probably because it seems to be the guy who decided to register itanimulli.com to nsa.gov - meanwhile even commerialized ^^ here's the whois info: https://who.is/whois/itanimulli.com/ but dunno if this has *anything* to do with this..

  Are you sure? yes | no

andyhull wrote 01/10/2016 at 02:27 point

"Juice" sounds too obvious, but I cant think of much else that is liquid from a fruit., perhaps AquaVitae, 

http://www.thesaurus.com/browse/aqua%20vitae ... and does the clue mean mynameisitanimulli.{domainuffix}{liquidfromafruit}.{domainsuffix} ... time to do some dig-ing I think. 

  Are you sure? yes | no

MacGruber wrote 01/06/2016 at 03:58 point

H E L L O A G A I N Z 
T H E S E C O N D P A R T O F Y O U R M I S S I O N I S A S F O L L O W S Z
Y O U S H A L L F I N D A W E B S I T E Z
W I T H M Y U S E R N A M E A S M Y N A M E I S Z

  Are you sure? yes | no