FANDOM


XOR? OR NOT XOR?

Since string on Onion no 2 is growing; we expect it is like it was reddit in 2012 and twitter in 2013.

Most agree that XOR Would be good guess


Documented effort:

- http://codeseekah.com/cicada/zN4h51m.file.txt [300kb] (approx. 20 bytes, fed through file(1), nothing interesting it seems)

- http://codeseekah.com/cicada/3301.file.txt - 2mb of file(1) output scavange away, nothing interesting it seems, please check closer



Tool for XORing:

http://codeseekah.com/cicada/xor.html



List of strings to look for:





LIST OF THINGS THAT HAD BEEN XORDED AND RESULTED STRINGS

(please keep that link in order to keep on track with the recent process)

FLASHBACK FROM THE PAST

Blackpit73 zip file of binnaries from 3301 2014

[00:29] <blackpit73> ok, I did upload a large mega_xor.zip now, containing 2186 files generated by all current binaries xoring them together in all permutations with each file either: ignored, xored or the reverse xored. and one of the files included is ff.bin, that is a file containing only 0xFF, i.e. XORing the complete result.
[00:29] <blackpit73> the ZIP is 63MB... so have a lot of fun analyzing the hell out of it -- but when that is done, we can surely say that file-xoring does not deliver results -- or maybe we find the jackpot ;-)
[00:29] <blackpit73> https://www.dropbox.com/s/o4kaxnyoumd46p6/mega_xor.zip
[00:29] <blackpit73> I'll have to go offline now (GMT+1...), in case of questions I'll be here tomorrow, or you can also write to me an gmail


Lurkers hidden string in onion 3 "57" version of mirrored image

Afer  11.1.2014 22:22 .onion 3 page was updated with different string than few minutes before

  • source code contained two interesting things, the < !---3301---> html comment, and the number 57 in last line.
  • first image was same as previously
  • second image was corrupt http://prntscr.com/2irn86
http://prntscr.com/2irc8q first different byte, in mirrored jpg that was mirored alredy
http://prntscr.com/2irdbi  last different byte, in mirrored jpg that was mirrored alredy
Here is hexdump of filediference (1.00 MB (1,055,041 bytes):
https://infotomb.com/4l8ku# (from original, not mirrored)
https://infotomb.com/tr3d1# (mirrored, same order as it would be if that would be bottom jpg)
here is 7z file of both strings, 4jpgs, 3 outgueesed msgs, and hidden string (mirr and notrmal)

Add more files

Add more files

XOR2
May the enlightening field upon all of you.

-3301











Progress of PUZZLE is above this title


Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.