Difference between revisions of "Waking Titan/Phase 4"

From Game Detectives Wiki
Jump to: navigation, search
[checked revision][checked revision]
(April 27-29th Access Grants: second London live drop and conclusion)
m (ಠ_ಠ)
Line 13: Line 13:
 
__TOC__
 
__TOC__
 
<div style="clear: both"></div>
 
<div style="clear: both"></div>
 
It is unclear whether Phase IV has officially begun, or whether these events are interstitial matter leading to a new phase.  For our purposes we refer to these events as "Phase IV" until contrary evidence is presented.
 
  
 
== Tenth Glyph ==
 
== Tenth Glyph ==
Line 37: Line 35:
 
The allusion to <code>10,000 passes</code> is likely a reference to the Level 4 Atlas passes that were promised to players as part of earlier phases.  The identity of "Gail" remained unknown.
 
The allusion to <code>10,000 passes</code> is likely a reference to the Level 4 Atlas passes that were promised to players as part of earlier phases.  The identity of "Gail" remained unknown.
  
=== Atlas Passes ===
+
== Atlas Passes ==
 
On January 17th, 2018, the first CSD user received their Atlas Pass. The passes were made from cardstock, with a textured pass printed on it. The front had the text <code>WAKING TITAN</code> printed, and below that the CSD category the user belonged in. On the very bottom, a series of hexadecimals reading <code>70686f656e6978</code> could be found, which, after decoding, translated to <code>PHOENIX</code>. On the back, the owner's CSD-ID was written, along with a serial number stating which pass out of 10,000 the user had, and a number at the top.
 
On January 17th, 2018, the first CSD user received their Atlas Pass. The passes were made from cardstock, with a textured pass printed on it. The front had the text <code>WAKING TITAN</code> printed, and below that the CSD category the user belonged in. On the very bottom, a series of hexadecimals reading <code>70686f656e6978</code> could be found, which, after decoding, translated to <code>PHOENIX</code>. On the back, the owner's CSD-ID was written, along with a serial number stating which pass out of 10,000 the user had, and a number at the top.
  
Line 49: Line 47:
 
<div style="clear: both"></div>
 
<div style="clear: both"></div>
  
=== Status Command Update ===
+
== Status Command Update ==
  
 
On January 20th at 5:44PM UTC, the output of the <code>STATUS</code> command began to update:
 
On January 20th at 5:44PM UTC, the output of the <code>STATUS</code> command began to update:
Line 89: Line 87:
 
</pre>
 
</pre>
  
=== Livedrop Memo ===
+
== Livedrop Memo ==
  
 
The text indicated a new livedrop would be occurring in the same location as the last one had.  However, due to the old Cafe Bene closing, the <code>Xxxxx XXX</code> part was added in the STATUS command update to warn players about the new venue, <code>Outro NYC</code>, which opened in the same place as the Cafe Bene had been located. The livedrop was intended to occur at 7PM EST (12:00AM UTC).  However, the first player from the community who set out for the drop was involved in a traffic mishap, delaying their arrival.  Anticipating missing the drop's time window, the community reached out to request a time extension, and the STATUS command, which had updated frequently throughout the confusion, was updated again to approve the community's request.
 
The text indicated a new livedrop would be occurring in the same location as the last one had.  However, due to the old Cafe Bene closing, the <code>Xxxxx XXX</code> part was added in the STATUS command update to warn players about the new venue, <code>Outro NYC</code>, which opened in the same place as the Cafe Bene had been located. The livedrop was intended to occur at 7PM EST (12:00AM UTC).  However, the first player from the community who set out for the drop was involved in a traffic mishap, delaying their arrival.  Anticipating missing the drop's time window, the community reached out to request a time extension, and the STATUS command, which had updated frequently throughout the confusion, was updated again to approve the community's request.
Line 117: Line 115:
  
 
=Solar Event=
 
=Solar Event=
On 26 March, 2018 at 05:25 UTC an event occurred.  The [http://www.myriad-70.com Myriad] site came online featuring indications of a solar event interfering with operations.  In addition, the status command on [http://wakingtitan.com Waking Titan] briefly displayed the following:
+
On 27 March, 2018 an event occurred.  The [http://www.myriad-70.com Myriad] site came online featuring indications of a solar event interfering with operations.  In addition, the status command on [http://wakingtitan.com Waking Titan] briefly displayed the following:
 
<pre>
 
<pre>
 
CODE -3
 
CODE -3
Line 139: Line 137:
 
</pre>
 
</pre>
  
This hexadecimal string was used to reference a connection the private key for an Ethereum cryptocurrency wallet related to an ostensibly "promotional" event for an upcoming product from [http://ware-tech.cloud/ V/RE].
+
Many attempts were made to decipher this string of hexadecimalNone have currently born fruit.  It is theorized that, due to the timing of the event, this string will be an argument for a future puzzle. Still, efforts continue to crack this mystery. Prior terms such as "mirror" have influenced the investigation. There are theories which suggest that the string must be transformed in some way in order to render a meaningful result. This investigation remains to be underway.
 
 
=Client 3597b=
 
 
 
At 1:11 AM, UTC, Myriad-70.com updated, and the updates included the following.
 
 
 
<pre>
 
Latest network diagnostic table:
 
- Network corruption detected
 
- Situation isolated to Client 3597b
 
- Process cannot be suspended due to critical conditions
 
--------------------------
 
-Beijing: 29.1Tb/s
 
--------------------------
 
MAJOR ISSUES:
 
Client 3597b
 
</pre>
 
 
 
 
 
Soon after, at 1:30 AM UTC, the Status command updated in the Terminal to say the following.
 
 
 
<pre>
 
> status
 
CODE -5
 
System Locked
 
e b 4 c 1 4 a 9 c 6 2 2 d f 7 1 6 6 f b e 0 d d 8 9 1 5 d b 0 2
 
--------------
 
Monarch Repository Status: Degraded
 
Conflict With
 
- Client 18d1a TRACERT 10.30.74.*
 
- Client 3597b TRACERT 54.91.155.*
 
- Client 351h TRACERT 6.128.214.*
 
- Client 0911a TRACERT 74.1.21.*
 
</pre>
 
 
 
Approximately 15 minutes later, clients began to disconnect, beginning with Client 0911a, second being Client 18d1a, and the last being Client 351h, who had an additional piece of text added, being <code>ID: 79657321</code>, which was translated as hex into <code> Yes! </code>
 
 
 
Then, at 2:15 AM UTC, the status command was updated again, stating <code> - Client 3597b - UNABLE TO DISCONNECT 54.91.155.209 NAT 52.2.248.*</code>
 
 
 
At 1:38 PM UTC, the status command updated once again, stating <code> - Client 3597b - UNABLE TO DISCONNECT 54.91.155.209 NAT 52.2.248.*:80\\</code>
 
 
 
At 10:30 PM UTC, March 30, the status updated again to say
 
<pre>
 
Latest network diagnostic table:
 
- Client 3597b is beyond allocated limits
 
- Process cannot be suspended due to critical conditions
 
- Tier 1, 2 and 3 clients are now all offline
 
</pre>
 
 
 
=Ware-tech.cloud=
 
Of the sites found in the 52.2.248 range, [http://52.2.248.6 52.2.248.6] was found. Using the metadata found in the HTML and searching on Google, the [http://www.ware-tech.cloud domain] and [http://twitter.com/warecloud Twitter] were located as well. The site is in Chinese, although Google Translate gives a good, readable translation.
 
 
 
On Twitter, under the Shipping Soon image, is a Hex string <code>77 61 6E 74 20 74 6F 20 6B 6E 6F 77 20 6D 6F 72 65</code> that, when converted to ascii reads <code>want to know more</code>. Under the #waretech hashtag on Twitter, there are three images shared by "Partner Companies" with the following code (and the ascii conversion):
 
 
 
<pre>
 
62 69 74 2E = bit.
 
6C 79 2F 77 = ly/w
 
61 72 65 32 = are2
 
</pre>
 
 
 
On the ware-tech website, if you subscribe, you receive an email with another 3 characters: <code>30 31 38</code>, which again in Ascii becomes <code>018</code>. Together this gave a bit.ly link that leads to the W/are Discord channel.
 
 
 
On Discord, we were informed of a community puzzle that was going on by the admin. Members of the W/ARE Discord had received tweets from another account, [https://twitter.com/w9rPQ45E https://twitter.com/w9rPQ45E], which had seven tweets with hex code in them:
 
<pre>
 
01 [ 74 78 2f 30 78 66 65 30 31 35 30 66 ]  
 
02 [ 62 33 30 32 61 38 62 36 64 34 30 38 ]
 
03 [ 35 37 32 32 64 61 61 31 64 30 37 37 35 ]
 
04 [ 38 33 31 38 35 30 38 36 39 31 30 61 31 ]
 
05 [ 61 38 32 34 38 63 65 32 34 38 30 64 ]
 
06 [ 32 65 33 38 37 33 31 ]
 
07 - Signal Lost [ 65 6e 64 20 6f 66 20 6c 69 6e 65 ]
 
</pre>
 
 
 
Translated into Ascii, these tweets give the following:
 
<pre>
 
tx/0xfe0150f
 
b302a8b6d408
 
5722daa1d0775
 
83185086910a1
 
a8248ce2480d
 
2e38731
 
</pre>
 
which references [https://etherscan.io/tx/0xfe0150fb302a8b6d4085722daa1d077583185086910a1a8248ce2480d2e38731 this Ethereum transaction]. The Twitter username, w9rPQ45E is also [http://pastebin.com/w9rPQ45E a Pastebin], providing the string <code>edb044c81d40a196c4672a2bd6f17f1f6</code>. In the Ethereum transaction, there is Input Data that, when converted to ascii, links to [http://pastebin.com/HNqKEUpS another Pastebin], providing another string: <code>b67fbb5e90ddcda8a921656d0b30a20</code>
 
 
 
Two things have been done with these strings. Together, they are the Private Key for the Ethereum account the money was transferred to. It has since been withdrawn to a different account. Second, if you put the two strings together and compare them with the string from Waking Titan's console, every odd character matches the strings from Pastebin.
 
<code>edb044c81d40a196c4672a2bd6f17f1f6b67fbb5e90ddcda8a921656d0b30a20</code>
 
 
 
<code>e b 4 c 1 4 a 9 c 6 2 2 d f 7 1 6 6 f b e 0 d d 8 9 1 5 d b 0 2&nbsp;</code>
 
The remaining characters are <code>d0 48 d0 16 47 ab 61 ff b7 b5 9d ca a2 66 03 a0</code>, however if this has any use is yet to be seen.
 
 
 
Three hours after the W/ARE Discord Admin let the community know about the puzzle, at 6:01 PM UTC they returned and said
 
<pre>That was it for today, good job on solving our community puzzle! You are good! :smiley:
 
Tomorrow one of our partners will have a giveaway for us! We will have more for you this weekend also!</pre>
 
 
 
=Mercury Project=
 
[[File:Sean-tweet.png|thumb|right]]
 
[[File:NMSNext.png|thumb|The announcement for No Man's Sky: NEXT]]
 
At 9:26 PM UTC, the <code> Mercury </code> command updated to say the following.
 
 
 
<pre>
 
Mercury process > Build XXXX
 
Ready to load branch version 1.5
 
Send Password Code in HEX to : Telegram MercuryHG80
 
</pre>
 
 
 
This puzzle required a user to solve the riddle shown below, convert the answer into hexdecimal, and send it to an official Telegram account run by one of the Puppet Masters.
 
 
 
The puzzle was as follows: <code> “Descended from Night, I share the blood of nightmares. Look forward to the gates of horn and ivory” </code>
 
 
 
This puzzle was solved by searching "The gates of horn and ivory", which resulted in dreams and nightmares of Greek mythology. After noting the capital N in "nightmares", users found the Greek god of night, Nyx, which led to one of her children, Morpheus, who was one of the Oneiroi, and the god of dreams. The name was then converted to hexdecimal and sent to the Telegram account, and the terminal accepted the password, resulting in the following command update.
 
 
 
<pre>
 
Processing "Morpheus" > ACCESS GRANTED
 
Downloading.......
 
</pre>
 
 
 
Then, at 9:54 UTC, the Mercury command updated again, and said the following.
 
<pre>
 
<Mercury process > Build XXXX
 
Ready to load branch version 1.5
 
Send Password Code in HEX to : Telegram MercuryHG80
 
--------------------------------
 
Process started by community - ETA 11:00 BST
 
https://bit.ly/2pLmadg
 
  </pre>
 
 
 
The shortened link redirected to a tweet from Sean Murray, which said <code> The cause is hidden. The effect is visible to all. #oneonebst </code>
 
 
 
The tweet also included a photo of someone, presumably Sean himself, holding a phone receiving a Telegram notification, which was Morpheus in hexdecimal. The hashtag spells out 11BST, or more precisely, 11:00 BST, or, 10:00 UTC. No updates were made at 10:00 PM, and was then confirmed to be counting to 10:00 AM.
 
 
 
 
 
Once the time came, at 10:00 AM UTC, Hello Games announced the next update for No Man's Sky, which was No Man's Sky NEXT, set with a launch date for Summer of 2018.
 
 
 
=Newsletter=
 
[[File:WareNewsletter1.png|thumb|left|120px|Screenshot of the W/ARE newsletter]]
 
On April 2 at around 23:30 UTC, user W/ARE came online in the W/ARE Discord to announce that the next giveaway would be sent out in a newsletter within the next hour.
 
They also mentioned the upcoming launch of their new translated English website, new extranet and the release of a "WARE cryptocoin", and asked users who are planning to be at PAX East to let them know at [email protected] with "PAX EAST - YES!" in the subject line.
 
 
 
At 00:30 UTC the newsletter started coming in via email. It announced that 25 winners were selected to receive Steam keys for games from W/ARE partners, such as The Shrouded Isle and Future Unfolding.
 
It also included a [https://ware2.typeform.com/to/HuBpCP link to an Application Form] for indie developers to apply for a Developer Kit of W/ARE tech. The best applications will be up for a public community vote to decide which games will be launched on the W/ARE platform.
 
 
 
Around the same time, the Status command in the Terminal updated to say the following:
 
 
 
<pre>
 
> status
 
CODE -5
 
Monarch Repository : Data Loss Imminent
 
Booting up Command.Center.v11
 
Pending approval by Monarch
 
</pre>
 
 
 
=PAX East Weekend=
 
==Website update==
 
On April 6, 2018 at 6 PM UTC the [https://ware-tech.cloud/ W/ARE website] updated with the new English translation and access to a Developer Area containing a sign-in form.
 
 
 
==Status command==
 
On April 8 at 01:19 AM, the Status command updated with the following output:
 
 
 
<pre>
 
CODE -5
 
Monarch Repository : Data Loss Imminent
 
Booting up Command.Center.v11
 
Pending approval by Monarch
 
Error - Unable to connect with repository
 
Memory Dump 2GzHGwu.jpg
 
</pre>
 
 
 
The filename leads to a [https://i.imgur.com/2GzHGwu.jpg corrupted image hosted on imgur], depicting a partial area map, a satellite, and the word "MYRIAD".
 
 
 
==Live Drop==
 
On April 8 around 00:49 UTC, players who previously sent emails to W/ARE about attending PAX East received the following response:
 
 
 
<pre>
 
Hello! We’ve heard from some attendees that our booth at PAX East is very difficult to find this year. To help you find the booth, we’ve enlisted the help of an Enforcer. Here is the information that our team at PAX has sent us to help you locate them:
 
 
 
HANDLE: EMU
 
PATH:
 
START
 
-997E
 
-1E
 
-1000E
 
+4S
 
+1000W
 
+1W
 
+1000W
 
-7N
 
REPEAT
 
 
 
You should be able to find them on their path between 12PM and 3PM local time.
 
 
 
- WARE
 
</pre>
 
 
 
The path of EMU was determined by searching for a specific range of clustered booth numbers on the floor plan. Assuming Down is East, starting at booth 17102 and subtracting 997 from that number gives us 16105, which is to the East directly next to booth 17102. Continuing this with the rest of the coordinates:
 
 
 
<pre>
 
17102 - 997E = 16105 - 1E = 16104 - 1000E = 15104 + 4S = 15108 + 1000W = 16108 + 1W = 16109 + 1000W = 17109 - 7N = 17102 (repeat)
 
</pre>
 
 
 
Ultimately creates this path between the eight booths:<br />
 
 
 
<center>[[File:Emu_path.png|frameless|The path of EMU]]</center>
 
 
 
 
 
Several users met with the contact between 4 and 7 PM UTC and were given a total of four USB drives. Each drive contained an image and a text file.
 
<center><gallery>
 
1-4.jpg|(ea87d58e-5775-47a9-a201-b7c7007f46d1.jpg)
 
2-4.jpg|(580cdc97-3e01-4902-83d6-7bc9e764dda2.jpg)
 
3-4.jpg|(e34d6e93-98f2-45a5-9899-694f93317e0b.jpg)
 
4-4.jpg|(f395ef03-f19c-4cb3-bc9c-5f80695ce7eb.jpg)
 
</gallery></center>
 
[[File:Jumbledwordsoverlay.jpg|thumb|200px|USB drive images overlayed]]
 
{| class="wikitable" border="1"
 
|-
 
! 1-4.txt
 
! 2-4.txt
 
! 3-4.txt
 
! 4-4.txt
 
|-
 
| A cornucopia of knowledge is in the mind of mankind, but it must be nurtured and hidden from the wrath of time. Time swallows all things, ends all beginnings, and leaves each of us devoured.
 
 
 
 
| A mind invisible is buried underground, but a mind of water carries no patterns. It is the mind, the wrist pointed to heaven, which allows us to dream. It is this hand on high that cast down our demons to the earth.
 
 
 
 
| Slumber in prison for eternity, lock away every great thing, but the spirit cannot be broken. A voice like ages rocks the very ground and with it’s call a rise to action of every terror.
 
 
 
 
| Of chaos swirls a terrible nothing, but pulled together without reason is reason born from chaos. A single note, another still, a symphony is creation where each piece follows the last no matter how the thread dances.
 
 
 
 
|}
 
 
 
The email address led to [http://www.philojeux.com/ philojeux.com], a website for a French indie game studio named Philo Jeux. Founded by Arnaud Lacours, it works on the philosophy-based game <code>Les tablettes de Mnémosyne</code> which was to be released on the WARE platform in July 2018.
 
 
 
Overlaying all four images highlighted the letters <code>f1orbiag55z1</code>. Using this as the password for the login form on [http://extranet.ware-tech.cloud/ extranet.ware-tech.cloud] and combining it with the email address from the text files as the username granted access to Arnaud Lacours' account for the Developer Area.
 
 
 
== WARE Developer Area ==
 
[[File:Arnaud_Profile.png|thumb|400px|Arnaud Lacours' WARE Developer Profile]]
 
Upon first access after the PAX event, the [http://extranet.ware-tech.cloud/ area] accessed using the credentials <code>[email protected] / f1orbiag55z1</code> contained a main page, a developer profile page and multiple inaccessible pages.  The main page presented an overview of user statistics and an empty main [https://etherscan.io/token/0x5b758a02d08efa566f3438775888866afd5d046c WARE token] wallet. Alongside the empty wallet were 12 wallets labelled Alpha-Lima in the NATO Phonetic alphabet, each containing 256 WARE. The [http://extranet.ware-tech.cloud/documents Documents] and [http://extranet.ware-tech.cloud/taskmanager Task Manager] pages were inaccessible due to Arnaud Lacours' account having an insufficient clearance level. The [http://extranet.ware-tech.cloud/supplyrequest Request Supplies] page was inaccessible due to insufficient funds (where funds are probably WARE tokens). Accessing the [http://extranet.ware-tech.cloud/profile developer profile page] while authenticated as Arnaud Lacours showed their information; including a phone number: <code>(514) 448-1493</code>. When this number was originally called, it led to a [https://clyp.it/p1lbsf3e voicemail message] in French, translated to English it said:
 
<pre>
 
Hi, I'm Arnaud Lacours, the CEO and founder of Philo Jeux. I'm not here at the moment. Please give me your contact details and I will call you back later. Thanks a lot, bye.
 
Voicemail System: Sorry, this voicemail is full. Please try again later. Thank you for calling, goodbye.
 
</pre>
 
On the 14th April at around 02:00 UTC, it was noted that the [https://clyp.it/cwdz4qxg voicemail message changed.] Again, the message was in French, roughly translating to:
 
<pre>
 
I'm Arnaud's girlfriend, thanks a lot for your wishes. Unfortunately Arnaud's condition got worse and he can't call you back and for now the company is closed.
 
</pre>
 
 
 
=Status & W/ARE Updates=
 
On April 14 at 18:37 UTC, the value of the Status command updated:
 
<pre>CODE -5
 
Monarch Repository : Data Loss Imminent
 
Booting up Command.Center.v11
 
Pending approval by Monarch
 
Rebooting...</pre>
 
 
 
 
 
At 19:51 UTC, players who had applied for a Developer Kit started receiving [https://mailchi.mp/062a86fa0c65/news-from-ware-1464925 emails with further details] on what kind of applications W/ARE were looking for. According to this email, the company had opened positions for five partnered studios, one of which would also receive a grand prize of $1,000 USD. The deadline for applications was April 28th.
 
 
 
 
 
Then, at 20:38 UTC, the Status command updated again with the following output:
 
<pre>CODE -5
 
Monarch Repository : Data Loss Imminent
 
Booting up Command.Center.v11
 
Pending approval by Monarch
 
Error- Unable to connect with repository
 
WARNING- MEMORY DUMP FAILED!
 
Biometric backup initiated…
 
http://bit.ly/2ITvMcW</pre>
 
 
 
The [http://bit.ly/2ITvMcW link] led to a recording of a female voice reading out a string of words:
 
<pre>Drunken - Disable - Geiger - Everyday - Hockey - Determine - Endow - Coherence - Freedom - Guitarist - Framework</pre>
 
[[File:Myriad_Interface_Distort.jpg|thumb|A still frame of the gif]]
 
These are words from a [https://en.wikipedia.org/wiki/PGP_word_list PGP Word List], also known as a '''Biometric''' Word List, as hinted at in the Status text. Each word corresponds to a hex value:
 
<pre>51 4B 6A 58 73 47 59 2E 67 69 66</pre>
 
 
 
When converted to ASCII this reads <code>QKjXsGY.gif</code>, which was the filename of an [https://i.imgur.com/QKjXsGY.gif animated gif on Imgur].
 
 
 
=Regular Statistics Updates=
 
On April 15, 2018 at 22:26 UTC, the [https://extranet.ware-tech.cloud/ Developer Dashboard] received an update to its Weekly Statistics, specifically the Total Sessions and Total Users counter. Another update followed at 13:19 the next day, after which the numbers continued to be updated 37 times over the next two days, once every hour at the 37th minute. The final update was recorded on April 18 at 1:37, 51 hours and 11 minutes after the very first update, and 36 hours after the first update at minute 37.
 
 
 
Another phase of continuous updates to the Statistics overview started on April 19 at 2:37 AM, this time at 30 minute intervals.
 
 
 
A record of all value changes can be found [https://docs.google.com/spreadsheets/d/1A8zODah54JUhO6ClFs8wNVvKLpLzWwm04lzOlS9mmAU/edit?usp=sharing here].
 
 
 
 
 
=Dev Kit Update #2=
 
On the 21st, at 4:17 PM UTC, all users subscribed to the W/ARE mailing list received a second Developer Kit Update, featuring 3 submitted projects so far, which are as follows:
 
 
 
*[https://www.youtube.com/watch?v=1c_682fRL8w DreamScape], a "user defined MMO where players can create their own worlds as they sleep", created by [http://www.edgewaregames.co.uk EdgeWare Games]
 
 
 
*[https://www.youtube.com/watch?v=pBRZxVZ5KKs Venture Unknown], a supposed "spiritual successor to No Man's Sky", made by [https://www.cjkproduction.com/ventureunknown CJK Production]
 
 
 
*[https://www.youtube.com/watch?v=qBxlref67wU The Drowned Tower], a "post-apocalyptic exploration game set in a dream-like world", made by [https://oceansmoke.wordpress.com OceanSmoke Games].
 
 
 
 
 
=April 27-29th Access Grants=
 
At 7:11 PM UTC on April 27, [http://extranet.ware-tech.cloud/documents the Documents portion] of the W/ARE extranet site, along with [http://extranet.ware-tech.cloud/taskmanager the Task Manager section] were unlocked. This started a series of tasks. Each new task was unlocked when funds were successfully transferred out of one of the developer sub-wallets. The wallet keys were received by sending the correct solution to the current task to <code>[email protected]</code>.
 
 
 
Under the introduction category, the link titled <code>2018 03 03</code> led to a corrupted image of what was discovered to be St. Basil's Cathedral in Moscow, Russia. [[File:Basil.jpg|thumb|200px|The corrupted image of St. Basil's Cathedral.]]
 
There were also two other images of interest, titled <code>Notes-on-locations-1_ldf82ng0.png</code> and <code>Notes-on-locations-2_pisj84n91.png</code>
 
Combined together, the contents of these 2 images read the following.
 
<pre>
 
1. THE MIDDLE OF THE INVERTED PENDULUM COULD FEED THE MOST LOGICAL MINDS
 
 
 
2. ITS SHAPE WILL LIGHT THE SPARK OF CREATIVITY
 
 
 
(049245)
 
 
 
3. IMPOSING SURROUNDINGS HELP IDEAS TO BE TAKEN SERIOUSLY
 
 
 
4. SURROUNDED BY WATER,
 
              EXHALING SERENITY
 
 
 
(AT THE JUNCTiON
 
BY THE LAKE)
 
</pre>
 
[[File:Train_Ticket.jpg|thumb|Mr. Zheng's Manchurian Railway Ticket]]
 
Another image was also found, entitled "Train ticket". It contains an image of a train and Cyrillic script that translates to "Manchurian Railway Ticket", "Moscow - Beijing" dated March 5, 2018.
 
 
 
==Alpha==
 
The Task Manager section revealed the first "Task" given to W/ARE employees, titled "Missing Employee", and that it was in progress. There was one description of what had happened, along with two update messages.
 
 
 
The original description read the following.
 
 
 
<pre>
 
IMPORTANT MESSAGE FROM WARE RESEARCH AND DEVELOPMENT TEAM. Attention to all developers. One of our colleagues, Mr. Zheng, has gone missing a month ago while on a R&D tour. Serious investigation inside the department has lead to nothing of interest, and we’re now asking for outside help. Please send any information concerning his potential whereabouts to [email protected].</pre>
 
 
 
The first and second update were as follows.
 
 
 
Update 1:
 
<pre>
 
All recent and potentially relevant documents found on Mr. Zheng’s computer have been translated and forwarded to the developer extranet. Our team is currently trying to use this information to retrace his last steps. We’re hoping that our combined efforts can bring light to this affair and bring Mr.Zheng back home safely. In the hope of attaining maximum reach and visibility, the R&D department also set up a Twitter account to serve as another relay of information.</pre>
 
(The twitter account in mention is [https://twitter.com/WARE_RDev @Ware_RDev])
 
 
 
Update 2:
 
<pre>
 
UPDATE ON R&D SEARCH. All information of interest sent to [email protected] will be rewarded with codes to our exclusive WARE wallets which can be used for special package purchases.
 
</pre>
 
 
 
Sending an email containing the keyword "Moscow" to [email protected] caused them to send the following reply, including a link to a map of Beijing's subway for a planned 7th conference: [[File:Conference_7_Possible_locations.png|thumb|Possible locations for Conference 7]]
 
<pre>
 
The WARE Research and Development team thanks you for your interest in the WARELearn initiative. The Russian Academy of Medical Science in Moscow’s conference on Art and Dreams is the last of a series of six conferences we hope will enlighten your mind. The WARE Team will review your application and get back to you as soon as possible!
 
 
 
Feedback from employees is fundamental in the development of the WARELearn initiative. As such, we’re asking you to give us your opinion on the ideal location for our next conference. If the location you picked is chosen by our committee, you may be given the chance to attend and meet the promoters of the event.
 
 
 
Our team has begun to pinpoint buildings that could be of interest. Feel free to inspire yourself and contact [email protected] to let us know about your suggestion.
 
 
Kind regards,
 
The WARELearn initiative
 
</pre>
 
 
 
Sending an email containing all the keywords "Moscow," "Beijing," and "049245" (from Notes on locations 1) triggered another response, this time containing the ALPHA sub-wallet key:
 
[[File:Sub-wallets.jpg|thumb|Empty sub-wallets]]<pre>
 
Dear informer,
 
 
 
To thank you for your recent help in Mr. Zheng’s case, WARE has provided you with a code to use on our internal cryptocurrency wallets. We promise that every significant clue provided to us will be rewarded as such.
 
 
 
Claim your reward with this code and stay alert for further updates on the situation : 4e47e152a5afaf95537c5dba73ef73d45c11fd6743ff5db9bfea3eca9282fda
 
 
 
Please withdraw the funds so that the main wallet can be updated. Note the updating process is not immediate.
 
 
 
Kind regards,
 
 
 
The R&D Team</pre>
 
The funds were withdrawn from the cryptocoin wallet, which led to an update to the Weekly Statistics page, where sub-wallet ALPHA was now displayed as empty.
 
 
 
==Beta==
 
A new message in the Task Manager followed:
 
<pre>
 
Most recent informations linked to the WARELearn services has confirmed our suspicions that despite boarding his train in Moscow, Mr. Zheng never arrived at Beijing and seems to have abandoned the train along the route. Any information, as small as a postal code, that you can find about the possible location locations he may have visited for an extended period - such as a hotel or hostel - would be of tremendous help.
 
</pre>
 
 
 
Using a map of the Trans-Manchurian Train route and the 4 hints from the Document files, players concluded that Mr. Zheng left the train in <code>Gostinyy Dom Chita, 672040</code>. Sending this information to the email address yielded another wallet key. Players were able to withdraw these funds from a cryptocurrency wallet, emptying sub-wallet BETA.
 
 
 
The following update was posted in the Task Manager:
 
<pre>
 
Thanks to dedicated informers, the investigation on Mr. Zheng is progressing and the tasks have been updated. We’ve been able to confirm that a stop was indeed made in Chita, after attending the Moscow conference on Art and Dreams. Please send any information concerning his potential whereabouts to [email protected], in addition to the updated task number.
 
</pre>
 
 
 
==Charlie==
 
A journal entry and a page of notes both written by Mr. Zheng were unlocked in the Documents section, along with an update in the Task Manager:
 
<center><gallery>
 
Journal_Academy.png|(Mr. Zheng's Journal)
 
Notes_on_Moscow.jpg|(Mr. Zheng's notes on Moscow)
 
</gallery></center>
 
 
 
<pre>
 
Attention to all teams. Documentation (copies and originals) coming from a source close to the missing employee have been recovered by W/ARE. There are a lot of files to organize and our database employees are still trying to get everything in order. Any information that could help us make sense of them will be most welcome.
 
</pre>
 
 
 
The image of "Notes on Moscow" contains 3 blanks and descriptions of 3 paintings. The blanks can be filled in with the subjects of the paintings. Sending these keywords, in addition to the updated task number - <code>a1028f, Montreal, 1.30pm. Meet me at the fountain in front of the Notre Dame Basilica.</code> - to the email, yielded the next wallet key. Again, players withdrew the funds from the wallet, emptying sub-wallet CHARLIE.
 
 
 
==Delta - Montreal Live Drop==
 
The Task Manager updated with an announcement of a live drop: [[File:Live_Drop_Montreal.jpg|thumb|200px|The note received at the Live Drop in Montreal]]
 
 
 
<pre>
 
Deploying a team for possible package seizure.
 
 
 
Once the location will be secured and package examined, onsite examination will be possible.
 
 
 
WARE will not allow package to leave location. Taking pictures will be permitted.
 
 
 
Confirmation of Location: Place d’Armes, Montreal, In front of the fountain
 
 
 
Confirmation of Time: Between 7pm and 9pm, local time
 
</pre>
 
 
 
At the drop location, players received the following note: <code>I came two years after the Ursuline nuns. Now set in stone, here is my legacy. G. Nadeau</code>
 
 
 
Investigations led to the French nurse Jeanne Mance, who arrived in New France two years after the Ursuline nuns came to Quebec and established Montreal's first hospital in 1642, the <code>Hôtel-Dieu de Montréal</code>. She is memorialized in statue at the foot of the Maisonneuve Monument. Sending this information to the email unlocked the next wallet key, and the withdrawal of the funds emptied sub-wallet DELTA.
 
 
 
==Echo==
 
[[File:Journal_HotelDieu.png|200px|thumb|Journal Hotel Dieu]] On April 28 at 2:32 AM, a new journal page was unlocked that highlighted two circled notes, <code>DON'T FORGET TO MOVE NOTES ON THE MEETING TO THE CLOUD</code> and <code>SECULAR VADER OF THE BIBLE</code>.
 
 
 
The new Task Manager update read:
 
<pre>
 
The search to find Mr. Zheng is still ongoing. New information is now connecting him to Montreal’s Hotel Dieu. Please send any information concerning his potential whereabouts to [email protected], in addition to an updated task number [t1029r].
 
 
 
We’ve tried to access Mr. Zheng's files in the R&D dropbox, but all access has been blocked.
 
</pre>
 
It contained a link to Mr. Zheng's password-locked [https://www.dropbox.com/sh/jz2nbdawcphki04/AACA83rODlh8qN4vuayLfgRya?dl=0 Dropbox]. Players determined the correct password was <code>Gutenberg</code>, who produced the first printed Bible.
 
 
 
The Dropbox contained 4 pdf files with printable hexaflexagon patterns. When folded, one of the sides on each hexaflexagon yielded a 13-digit number starting with 978. These were ISBN numbers for the following 3 books: <code>Nine Billion Names of God</code>, <code>The Paris Architect</code>, and <code>War and Peace</code>. Using the leftover numbers from each flexagon as a book cipher of the format page, line, and word, the phrase <code>unknown british soldier</code> was found. This points to the <code>Tomb of the Unknown Soldier</code>, which was the keyword to obtain the wallet code for sub-wallet ECHO.
 
 
 
==Foxtrot==
 
When assembled and put together, the three hexaflexagons revealed a shape resembling the river Seine in Paris in the area of the Louvre. Sending <code>Louvre</code> to the email address provided the code for sub-wallet FOXTROT and revealed a new journal document. [[File:Journal_Louvre.png|thumb|200px|Journal Louvre]]
 
 
 
On the journal page were 3 sentences, with certain words underlined. Ordering the words by the number of underlines and counting their position in each sentence resulted in the phone number <code>438-368-9126</code>. Upon calling this number a [https://clyp.it/bgakdxvc recorded message] gave a morse code that translated to <code>PASTEH9EBKEXGT</code>. This led to a [https://pastebin.com/H9EBKEXG Pastebin document] containing the following text:
 
 
 
<pre>
 
From the bottom of the crypt, at the feet of the Guardian, I ascend left
 
Pass the dignitary and follow the water
 
Go straight to the sun with open arms and turn right
 
Turn left when you arrive home
 
Go straight to the hand and head of the goddess and turn left to face the keeper
 
Follow the procession into the house of kings
 
Ignore the light and descend to your death
 
I am here and with me the seventh part of what you are searching for.
 
</pre>
 
 
 
==Golf - Paris Live Drop==
 
A new live drop was announced to be in Paris, France:
 
<pre>
 
Deploying a team for possible package seizure.
 
 
 
Once the location is secured and package examined, onsite examination will be possible.
 
 
 
WARE will not allow package to leave the location. Taking pictures will be permitted.
 
 
 
Confirmation of Location: At the entrance of the Passage du Souvenir, Near the stairs, Paris
 
 
 
Confirmation of Time: Between 1pm and 3pm, local time
 
</pre>[[File:Hexaflexagons river.jpg|thumb|The finished hexaflexagon map]]
 
At the Tomb of the Unknown Soldier, a monument in the Passage du Souvenir beneath the Arc de Triomphe de l'Étoile in Paris, players were given another hexaflexagon paper puzzle and told not to un-tape it. When aligned with the other three pieces, this revelead a location marked with an X at the Louvre.
 
 
 
The text from the Pastebin found in the Foxtrot stage were clues on the correct route to follow inside the Louvre. The rest of the path led players to the sarcophagus of Ramesses III, on the side of which they found a depiction of <code>The Book of Amduat</code>. Sending this to the email yielded the key to sub-wallet GOLF.
 
 
 
==Hotel==
 
The parchment in <code>The Book of Amduat</code> can be found in the <code>British Museum London</code>, which was the keyphrase that unlocked sub-wallet HOTEL.
 
 
 
The next Task Manager and Document updates read: [[File:Journal_London.png|thumb|Journal London]]
 
<pre>
 
Locked briefcase found in London, near the British Museum. Not yet confirmed if Mr. Zheng left it there willingly. Package currently under observation.
 
</pre>
 
<pre>
 
They were right.
 
It's all leading here.
 
 
 
I saw it at night.
 
i had it in my hands. All the missing parts. For the first time, I felt like all was finally put in place. Then, I felt a powerful force, ripping it from my hands. I dropped it and all the pages flew away in the wind.
 
 
 
I remember the morning that came after.
 
I was standing tall, pointing at the former naval person, longing for all this knowledge that got away.
 
 
 
I need to find its missing pieces.
 
</pre>
 
 
 
==India==
 
The phrase <code>former naval person</code> is the signature Winston Churchill used in his private correspondence with President Roosevelt. The text describes standing tall pointing at him. This was deduced to be Big Ben, which faces the Churchill statue in Parliament Square, London. Sending <code>Big Ben</code> to the email address provided the key to withdraw the funds from sub-wallet INDIA.
 
 
 
A third live drop was announced to be in London:
 
<pre>
 
Deploying a team for possible package seizure.
 
 
 
Once the location will be secured and package examined, onsite examination will be possible.
 
 
 
WARE will not allow package to leave the location. Taking pictures will be permitted.
 
 
 
Confirmation of Location: Statue of Winston Churchill, Parliament Square, London
 
 
 
Confirmation of Time: Between 1pm and 3pm, local time
 
</pre>
 
 
 
==Juliett - London Live Drop==
 
[[File:Thinker.jpg|thumb|The Thinker sculpture in Detroit]]
 
On April 29th at 1PM local time, players met with a W/ARE technician in London and were given a scrambled picture of the "The Thinker" sculpture by Auguste Rodin, displayed at the Detroit Institute of Arts Museum. The keyphrase <code>Henry Fuseli, The Nightmare, 1781</code>, a painting found at the same museum, provided the code for sub-wallet JULIETT.
 
 
 
This unlocked three new postcards in the Documents section.
 
<center><gallery>
 
Postcard1 jhlj039u.jpg |(Postcard 1)
 
Postcard2_kg8nao6.jpg|(Postcard 2)
 
Postcard3_tesaud636.jpg|(Postcard 3)
 
</gallery></center>
 
 
 
==Kilo==
 
The locations pictured on the postcards were in Mexico, Peru, and Morocco. Each postcard mentioned two numbers and two cardinal directions, and combining these led to a string of coordinates: <code>33N, 43E - 30N, 69E - 22N, 79E</code>, which were found to be in Iraq, Pakistan, and India. Connecting these six locations by lines pointed to Egypt.
 
 
 
The circled letters on the postcards spelled <code>monastery</code>, <code>king</code>, and <code>tonw</code>. Using these clues, players found <code>Deir el-Medina</code>, an Egyptian village whose name translates to "monastery of the kings". The village's name unlocked sub-wallet KILO.
 
 
 
At 2:38 PM a new Journal page was revealed:[[File:Nightmare.jpg|thumb|Nightmare journal page]]
 
<pre>
 
'Alights, and grinning
 
 
 
I saw it again.
 
 
 
Except this time, what snatched it from my hands was not a divine force but the unmistakable pull of this stippled incubus.
 
 
 
'Alights, and grinning
 
 
 
He glared at me,
 
as he ripped all the pages before my horrified eyes.
 
 
 
I felt his weight on my chest.
 
 
 
xxxx?
 
</pre>
 
It quotes excerpts from Ermasus Darwin's poem "Botanical Garden", which is an inscription found on the "The Nightmare" painting referenced in the JULIETT phase, engraved by Thomas Burke in 1783.
 
 
 
Then, the next Task Manager update announced another live drop:
 
<pre>
 
Briefcase found in London still locked but deemed safe by our experts. Once the location will be secured and package examined, onsite examination will be possible.
 
 
 
WARE will not allow package to leave the location. Taking pictures will be permitted.
 
 
 
Confirmation of Location: British Museum, London
 
 
 
Estimated Time : Between 6pm and 8pm, local time
 
</pre>
 
 
 
==Lima - 2nd Live Drop London==
 
[[File:Box01.jpg|thumb|The locked box]]At the second live drop in London, players were given a small box locked with a 4-digit code. The key was <code>1783</code>, the year "The Nightmare" was engraved.
 
 
 
Inside the box were three paper notes:
 
 
 
<center><gallery>
 
Box02.jpg|(arbu = irbu, seru = saru)
 
Box03.jpg|(Wolf = violent ennemy/Fox, the ennemy will not attack but will plot secretly)
 
Box04.jpg|(Vomiting gold/silver = ten months, Golden trees/ghosts/demons = nine months)
 
</gallery></center>
 
 
 
These notes reference ancient texts about dream interpretation. One of them is the Egyptian <code>Ramesside dream-book</code>, the code that unlocked sub-wallet LIMA.
 
 
 
==Conclusion==
 
[[File:Requestsupplies.jpg|thumb|The Request Supplies form]]At 5:18 PM the status command updated:
 
<pre>
 
CODE -5
 
Monarch Repository : Data Loss Imminent
 
ReBooting Command.Center.v12
 
</pre>
 
The [http://extranet.ware-tech.cloud/supplyrequest Request Supplies section] on the extranet was now accessible, revealing a "Specific Item Order Form". In addition to Arnaud Lacours' name, his employee ID <code>43617373696e69</code> was already filled in. Converted from HEX to ASCII this code translates to <code>Cassini</code>. Entering the ID into the console yields the following output:
 
<pre>
 
LOG RECOVERED :: ITERATION #4924A ::
 
The asteroid field was thick,
 
denser than any I'd seen before.
 
The ice, the dirt, the metal fragments…
 
my ship never stood a chance.
 
</pre>
 
[[File:Subject1.png|thumb|Subject1 image]]
 
 
 
Another Status update followed at 5:33 PM:
 
<pre>
 
CODE -5
 
Monarch Repository : Data Loss Imminent
 
ReBooting Command.Center.v12
 
------
 
Error, unable to start
 
https://i.imgur.com/Fnixw9t.png
 
------
 
New command updated
 
</pre>
 
It linked to an image with the headline <code>SUBJECT1</code> and a section named <code>MEMORY FRAGMENTS</code>.
 
 
 
 
 
 
 
 
 
The search for Mr. Zheng concluded with a message from the @WARE_RDev Twitter account:
 
[[File:WARE_Tweet_Zheng.jpg|thumb|center|400px|WARE_RDev Tweet]]
 
 
 
  
 
''This page is a work in progress, and will be updated as new developments emerge.''
 
''This page is a work in progress, and will be updated as new developments emerge.''
 
[[Category:Waking Titan]]
 
[[Category:Waking Titan]]

Revision as of 01:28, 30 April 2018

Waking Titan - Phase 4
Active since 2017-05-28
Project WT logo.png
Waking Titan was an ARG which led to the Atlas Rises update for No Man's Sky, and has been dormant untill 18-12-2017.
Type [[List_of_Investigations#Official|Official]]
Creator Alice & Smith & Hello Games
Discovered 2017-05-28

Main Page > List of Investigations > Waking Titan > Phase 4

Tenth Glyph

Beginning on December 28th, 2017, typing WHOIS on the Waking Titan website returned the following: #WHATIS1.5. In addition, the 10th glyph was made active, and linked to a Google Drive folder, which contained community-made pictures of the NMS logo in an infinite mirror.

The titles of the photos, when strung together (skipping the 00 (empty) ones), formed the hexadecimal code for moirrr, which was an anagram for mirror. Additionally, the hexadecimal code in the correct order for the word mirror could be found on the bottom of the Myriad website.

Also of note was the background of the tenth glyph, which read:

the background of the tenth glyph
Dear Elizabeth
We have finished processing 10,000 passes as per your requirements. You should
have them in time for the next phase. I really hope you will like the final product.

Kind regards,
Gail

The allusion to 10,000 passes is likely a reference to the Level 4 Atlas passes that were promised to players as part of earlier phases. The identity of "Gail" remained unknown.

Atlas Passes

On January 17th, 2018, the first CSD user received their Atlas Pass. The passes were made from cardstock, with a textured pass printed on it. The front had the text WAKING TITAN printed, and below that the CSD category the user belonged in. On the very bottom, a series of hexadecimals reading 70686f656e6978 could be found, which, after decoding, translated to PHOENIX. On the back, the owner's CSD-ID was written, along with a serial number stating which pass out of 10,000 the user had, and a number at the top.

It is strongly recommended to not cover up the hex underneath your signature, and to share the number above and below your CSD ID if you are in possession of a pass. Preferably with a picture of the front, as shown below. For a list of all the atlas passes currently known of, please refer to this spreadsheet. In the event you receive one of these, please share a picture of the front, and the numbers underneath and above your CSD-ID (censored bit) on the back.

Status Command Update

On January 20th at 5:44PM UTC, the output of the STATUS command began to update:

Downloading Data...: 19:44
1-                 : 20:16 (32 min)
1-8                : 20:27 (11 min)
1-80               : 20:39 (12 min)
1-800-             : 20:44 (5 min)
1-800-41           : 21:35 (51 min)

1-800-413-01       : 22:14 (39 min)
Xxxxx X            : New Line

1-800-413-011      : 22:15 (1 min)
Xxxxx XX           

1-800-413-0110     : 22:16 (1 min)
Xxxxx XXX

Calling the provided phone number yielded an SSTV transmission (pictured below) which, once decoded, provided meteorological data for various locations.

Players found they were to order the list of locations in the image alphabetically. This yielded a sequence where Index by Precipitation could be read off. Using the ordered text indexed by precipitation (in alma the second index is o) led to the following:

CAFE
BENE
NINETEEN
SAT

Livedrop Memo

The text indicated a new livedrop would be occurring in the same location as the last one had. However, due to the old Cafe Bene closing, the Xxxxx XXX part was added in the STATUS command update to warn players about the new venue, Outro NYC, which opened in the same place as the Cafe Bene had been located. The livedrop was intended to occur at 7PM EST (12:00AM UTC). However, the first player from the community who set out for the drop was involved in a traffic mishap, delaying their arrival. Anticipating missing the drop's time window, the community reached out to request a time extension, and the STATUS command, which had updated frequently throughout the confusion, was updated again to approve the community's request.

STAND BY: CSD CITIZEN NOT DETECTED
WARNING: CSD CITIZEN NOT DETECTED!
IT'S LONELY OUT HERE
TIME EXTENSION REQUESTED?
EXTENTION PROPOSED: 2H30 – AWAITING CSD APPROVAL
EXTENSION APPROVED, BE SAFE
Book case seen on the livedrop livestream is the same as one used in an earlier livedrop.

After the extension was approved, a second player from the community set out to the livedrop location on livestream and met with their A&S contact around 7:30PM EST (12:30AM UTC). During the meeting, the player was handed a memo from a mysterious case disguised as a book, pictured left. After some cryptic conversation, the contact asked if they were "getting enough sleep", stating that being well-rested would be very important. After the meeting, players who had attended the livedrop met in another location and showed off the memo, speculating about it's contents and even discovering the REM Sleep connection to the letters on the memo's back. After the livedrop, the community used the livestream to look over the memo, pictured below. On the back of the memo REMS is written. This clue, in combination with the strange question A&S asked at the rendezvous, led players to the password for the 10th Glyph, REM SLEEP.

Seventh question revealed on the bit.ly form when REMS or REM Sleep is entered for question six

Once the glyph was solved, the STATUS command updated to a bit.ly link to a form. Players discovered that on the sixth question on the form, entering REMS or REM Sleep (case sensitive) caused a seventh question, pictured right, to reveal itself, allowing CSD users to enter their email address to receive "left over materials" from something called Lab 319. Players remained unclear on what exactly Lab 319 was or what it's leftovers were, however signing up seemed integral given the input is only revealed after using the REM Sleep phrase.

Solar Event

On 27 March, 2018 an event occurred. The Myriad site came online featuring indications of a solar event interfering with operations. In addition, the status command on Waking Titan briefly displayed the following:

CODE -3
Unable to restart
.................
ERROR LOG SUMMARY
- Major malfunction
- Protect the monarch
- All tiers 2 and tiers 3 clients must be purged IMMEDIATELY
.................
TO ALL CSD
- Gather maximum EXTERNAL intel
- CSD should take time to regroup and get organized

Ten minutes elapsed before the Status command began to display the following:

CODE -5
System Locked
e b 4 c 1 4 a 9 c 6 2 2 d f 7 1 6 6 f b e 0 d d 8 9 1 5 d b 0 2

Many attempts were made to decipher this string of hexadecimal. None have currently born fruit. It is theorized that, due to the timing of the event, this string will be an argument for a future puzzle. Still, efforts continue to crack this mystery. Prior terms such as "mirror" have influenced the investigation. There are theories which suggest that the string must be transformed in some way in order to render a meaningful result. This investigation remains to be underway.

This page is a work in progress, and will be updated as new developments emerge.