Waking Titan/Phase 4
| Waking Titan - Phase 4 | |
|---|---|
| Waking Titan was an ARG which led to the Atlas Rises update for No Man's Sky, and has been dormant untill 18-12-2017. | |
| Type | [[List_of_Investigations#Official|Official]] |
| Creator | Alice & Smith & Hello Games |
| Discovered | 2017-05-28 |
Main Page > List of Investigations > Waking Titan > Phase 4
Contents
It is unclear whether Phase IV has officially begun, or whether these events are interstitial matter leading to a new phase. For our purposes we refer to these events as "Phase IV" until contrary evidence is presented.
Tenth Glyph
Beginning on December 28th, 2017, typing WHOIS on the Waking Titan website returned the following: #WHATIS1.5. In addition, the 10th glyph was made active, and linked to a Google Drive folder, which contained community-made pictures of the NMS logo in an infinite mirror.
The titles of the photos, when strung together (skipping the 00 (empty) ones), formed the hexadecimal code for moirrr, which was an anagram for mirror. Additionally, the hexadecimal code in the correct order for the word mirror could be found on the bottom of the Myriad website.
Also of note was the background of the tenth glyph, which read:
Dear Elizabeth We have finished processing 10,000 passes as per your requirements. You should have them in time for the next phase. I really hope you will like the final product. Kind regards, Gail
The allusion to 10,000 passes is likely a reference to the Level 4 Atlas passes that were promised to players as part of earlier phases. The identity of "Gail" remained unknown.
Atlas Passes
On January 17th, 2018, the first CSD user received their Atlas Pass. The passes were made from cardstock, with a textured pass printed on it. The front had the text WAKING TITAN printed, and below that the CSD category the user belonged in. On the very bottom, a series of hexadecimals reading 70686f656e6978 could be found, which, after decoding, translated to PHOENIX. On the back, the owner's CSD-ID was written, along with a serial number stating which pass out of 10,000 the user had, and a number at the top.
It is strongly recommended to not cover up the hex underneath your signature, and to share the number above and below your CSD ID if you are in possession of a pass. Preferably with a picture of the front, as shown below. For a list of all the atlas passes currently known of, please refer to this spreadsheet. In the event you receive one of these, please share a picture of the front, and the numbers underneath and above your CSD-ID (censored bit) on the back.
Atlas Pass front side
Atlas Pass back side
Status Command Update
On January 20th at 5:44PM UTC, the output of the STATUS command began to update:
Downloading Data...: 19:44 1- : 20:16 (32 min) 1-8 : 20:27 (11 min) 1-80 : 20:39 (12 min) 1-800- : 20:44 (5 min) 1-800-41 : 21:35 (51 min) 1-800-413-01 : 22:14 (39 min) Xxxxx X : New Line 1-800-413-011 : 22:15 (1 min) Xxxxx XX 1-800-413-0110 : 22:16 (1 min) Xxxxx XXX
Calling the provided phone number yielded an SSTV transmission (pictured below) which, once decoded, provided meteorological data for various locations.
SSTV page 1
SSTV page 2
Players found they were to order the list of locations in the image alphabetically. This yielded a sequence where Index by Precipitation could be read off.
Using the ordered text indexed by precipitation (in alma the second index is o) led to the following:
CAFE BENE NINETEEN SAT
Livedrop Memo
The text indicated a new livedrop would be occurring in the same location as the last one had. However, due to the old Cafe Bene closing, the Xxxxx XXX part was added in the STATUS command update to warn players about the new venue, Outro NYC, which opened in the same place as the Cafe Bene had been located. The livedrop was intended to occur at 7PM EST (12:00AM UTC). However, the first player from the community who set out for the drop was involved in a traffic mishap, delaying their arrival. Anticipating missing the drop's time window, the community reached out to request a time extension, and the STATUS command, which had updated frequently throughout the confusion, was updated again to approve the community's request.
STAND BY: CSD CITIZEN NOT DETECTED WARNING: CSD CITIZEN NOT DETECTED! IT'S LONELY OUT HERE TIME EXTENSION REQUESTED? EXTENTION PROPOSED: 2H30 – AWAITING CSD APPROVAL EXTENSION APPROVED, BE SAFE
After the extension was approved, a second player from the community set out to the livedrop location on livestream and met with their A&S contact around 7:30PM EST (12:30AM UTC). During the meeting, the player was handed a memo from a mysterious case disguised as a book, pictured left. After some cryptic conversation, the contact asked if they were "getting enough sleep", stating that being well-rested would be very important. After the meeting, players who had attended the livedrop met in another location and showed off the memo, speculating about it's contents and even discovering the REM Sleep connection to the letters on the memo's back. After the livedrop, the community used the livestream to look over the memo, pictured below. On the back of the memo REMS is written. This clue, in combination with the strange question A&S asked at the rendezvous, led players to the password for the 10th Glyph, REM SLEEP.
Memo page 1
Memo page 2
Memo page 3
Once the glyph was solved, the STATUS command updated to a bit.ly link to a form. Players discovered that on the sixth question on the form, entering REMS or REM Sleep (case sensitive) caused a seventh question, pictured right, to reveal itself, allowing CSD users to enter their email address to receive "left over materials" from something called Lab 319. Players remained unclear on what exactly Lab 319 was or what it's leftovers were, however signing up seemed integral given the input is only revealed after using the REM Sleep phrase.
Solar Event
On 26 March, 2018 at 05:25 UTC an event occurred. The Myriad site came online featuring indications of a solar event interfering with operations. In addition, the status command on Waking Titan briefly displayed the following:
CODE -3 Unable to restart ................. ERROR LOG SUMMARY - Major malfunction - Protect the monarch - All tiers 2 and tiers 3 clients must be purged IMMEDIATELY ................. TO ALL CSD - Gather maximum EXTERNAL intel - CSD should take time to regroup and get organized
Ten minutes elapsed before the Status command began to display the following:
CODE -5 System Locked e b 4 c 1 4 a 9 c 6 2 2 d f 7 1 6 6 f b e 0 d d 8 9 1 5 d b 0 2
This hexadecimal string was used to reference a connection the private key for an Ethereum cryptocurrency wallet related to an ostensibly "promotional" event for an upcoming product from V/RE.
Client 3597b
At 1:11 AM, UTC, Myriad-70.com updated, and the updates included the following.
Latest network diagnostic table: - Network corruption detected - Situation isolated to Client 3597b - Process cannot be suspended due to critical conditions -------------------------- -Beijing: 29.1Tb/s -------------------------- MAJOR ISSUES: Client 3597b
Soon after, at 1:30 AM UTC, the Status command updated in the Terminal to say the following.
> status CODE -5 System Locked e b 4 c 1 4 a 9 c 6 2 2 d f 7 1 6 6 f b e 0 d d 8 9 1 5 d b 0 2 -------------- Monarch Repository Status: Degraded Conflict With - Client 18d1a TRACERT 10.30.74.* - Client 3597b TRACERT 54.91.155.* - Client 351h TRACERT 6.128.214.* - Client 0911a TRACERT 74.1.21.*
Approximately 15 minutes later, clients began to disconnect, beginning with Client 0911a, second being Client 18d1a, and the last being Client 351h, who had an additional piece of text added, being ID: 79657321, which was translated as hex into Yes!
Then, at 2:15 AM UTC, the status command was updated again, stating - Client 3597b - UNABLE TO DISCONNECT 54.91.155.209 NAT 52.2.248.*
At 1:38 PM UTC, the status command updated once again, stating - Client 3597b - UNABLE TO DISCONNECT 54.91.155.209 NAT 52.2.248.*:80\\
At 10:30 PM UTC, March 30, the status updated again to say
Latest network diagnostic table: - Client 3597b is beyond allocated limits - Process cannot be suspended due to critical conditions - Tier 1, 2 and 3 clients are now all offline
Ware-tech.cloud
Of the sites found in the 52.2.248 range, 52.2.248.6 was found. Using the metadata found in the HTML and searching on Google, the domain and Twitter were located as well. The site is in Chinese, although Google Translate gives a good, readable translation.
On Twitter, under the Shipping Soon image, is a Hex string 77 61 6E 74 20 74 6F 20 6B 6E 6F 77 20 6D 6F 72 65 that, when converted to ascii reads want to know more. Under the #waretech hashtag on Twitter, there are three images shared by "Partner Companies" with the following code (and the ascii conversion):
62 69 74 2E = bit. 6C 79 2F 77 = ly/w 61 72 65 32 = are2
On the ware-tech website, if you subscribe, you receive an email with another 3 characters: 30 31 38, which again in Ascii becomes 018. Together this gave a bit.ly link that leads to the W/are Discord channel.
On Discord, we were informed of a community puzzle that was going on by the admin. Members of the W/ARE Discord had received tweets from another account, https://twitter.com/w9rPQ45E, which had seven tweets with hex code in them:
01 [ 74 78 2f 30 78 66 65 30 31 35 30 66 ] 02 [ 62 33 30 32 61 38 62 36 64 34 30 38 ] 03 [ 35 37 32 32 64 61 61 31 64 30 37 37 35 ] 04 [ 38 33 31 38 35 30 38 36 39 31 30 61 31 ] 05 [ 61 38 32 34 38 63 65 32 34 38 30 64 ] 06 [ 32 65 33 38 37 33 31 ] 07 - Signal Lost [ 65 6e 64 20 6f 66 20 6c 69 6e 65 ]
Translated into Ascii, these tweets give the following:
tx/0xfe0150f b302a8b6d408 5722daa1d0775 83185086910a1 a8248ce2480d 2e38731
which references this Ethereum transaction. The Twitter username, w9rPQ45E is also a Pastebin, providing the string edb044c81d40a196c4672a2bd6f17f1f6. In the Ethereum transaction, there is Input Data that, when converted to ascii, links to another Pastebin, providing another string: b67fbb5e90ddcda8a921656d0b30a20
Two things have been done with these strings. Together, they are the Private Key for the Ethereum account the money was transferred to. It has since been withdrawn to a different account. Second, if you put the two strings together and compare them with the string from Waking Titan's console, every odd character matches the strings from Pastebin.
edb044c81d40a196c4672a2bd6f17f1f6b67fbb5e90ddcda8a921656d0b30a20
e b 4 c 1 4 a 9 c 6 2 2 d f 7 1 6 6 f b e 0 d d 8 9 1 5 d b 0 2
The remaining characters are d0 48 d0 16 47 ab 61 ff b7 b5 9d ca a2 66 03 a0, however if this has any use is yet to be seen.
Three hours after the W/ARE Discord Admin let the community know about the puzzle, at 6:01 PM UTC they returned and said
That was it for today, good job on solving our community puzzle! You are good! :smiley: Tomorrow one of our partners will have a giveaway for us! We will have more for you this weekend also!
Mercury Project
At 9:26 PM UTC, the Mercury command updated to say the following.
Mercury process > Build XXXX Ready to load branch version 1.5 Send Password Code in HEX to : Telegram MercuryHG80
This puzzle required a user to solve the riddle shown below, convert the answer into hexdecimal, and send it to an official Telegram account run by one of the Puppet Masters.
The puzzle was as follows: “Descended from Night, I share the blood of nightmares. Look forward to the gates of horn and ivory”
This puzzle was solved by searching "The gates of horn and ivory", which resulted in dreams and nightmares of Greek mythology. After noting the capital N in "nightmares", users found the Greek god of night, Nyx, which led to one of her children, Morpheus, who was one of the Oneiroi, and the god of dreams. The name was then converted to hexdecimal and sent to the Telegram account, and the terminal accepted the password, resulting in the following command update.
Processing "Morpheus" > ACCESS GRANTED Downloading.......
Then, at 9:54 UTC, the Mercury command updated again, and said the following.
<Mercury process > Build XXXX Ready to load branch version 1.5 Send Password Code in HEX to : Telegram MercuryHG80 -------------------------------- Process started by community - ETA 11:00 BST https://bit.ly/2pLmadg
The shortened link redirected to a tweet from Sean Murray, which said The cause is hidden. The effect is visible to all. #oneonebst
The tweet also included a photo of someone, presumably Sean himself, holding a phone receiving a Telegram notification, which was Morpheus in hexdecimal. The hashtag spells out 11BST, or more precisely, 11:00 BST, or, 10:00 UTC. No updates were made at 10:00 PM, and was then confirmed to be counting to 10:00 AM.
Once the time came, at 10:00 AM UTC, Hello Games announced the next update for No Man's Sky, which was No Man's Sky NEXT, set with a launch date for Summer of 2018.
Newsletter
On April 2 at around 23:30 UTC, user W/ARE came online in the W/ARE Discord to announce that the next giveaway would be sent out in a newsletter within the next hour. They also mentioned the upcoming launch of their new translated English website, new extranet and the release of a "WARE cryptocoin", and asked users who are planning to be at PAX East to let them know at [email protected] with "PAX EAST - YES!" in the subject line.
At 00:30 UTC the newsletter started coming in via email. It announced that 25 winners were selected to receive Steam keys for games from W/ARE partners, such as The Shrouded Isle and Future Unfolding. It also included a link to an Application Form for indie developers to apply for a Developer Kit of W/ARE tech. The best applications will be up for a public community vote to decide which games will be launched on the W/ARE platform.
Around the same time, the Status command in the Terminal updated to say the following:
> status CODE -5 Monarch Repository : Data Loss Imminent Booting up Command.Center.v11 Pending approval by Monarch
PAX East Weekend
Website update
On April 6, 2018 at 6 PM UTC the W/ARE website updated with the new English translation and access to a Developer Area containing a sign-in form.
Status command
On April 8 at 01:19 AM, the Status command updated with the following output:
CODE -5 Monarch Repository : Data Loss Imminent Booting up Command.Center.v11 Pending approval by Monarch Error - Unable to connect with repository Memory Dump 2GzHGwu.jpg
The filename leads to a corrupted image hosted on imgur, depicting a partial area map, a satellite, and the word "MYRIAD".
Live Drop
On April 8 around 00:49 UTC, players who previously sent emails to W/ARE about attending PAX East received the following response:
Hello! We’ve heard from some attendees that our booth at PAX East is very difficult to find this year. To help you find the booth, we’ve enlisted the help of an Enforcer. Here is the information that our team at PAX has sent us to help you locate them: HANDLE: EMU PATH: START -997E -1E -1000E +4S +1000W +1W +1000W -7N REPEAT You should be able to find them on their path between 12PM and 3PM local time. - WARE
The path of EMU was determined by searching for a specific range of clustered booth numbers on the floor plan. Assuming Down is East, starting at booth 17102 and subtracting 997 from that number gives us 16105, which is to the East directly next to booth 17102. Continuing this with the rest of the coordinates:
17102 - 997E = 16105 - 1E = 16104 - 1000E = 15104 + 4S = 15108 + 1000W = 16108 + 1W = 16109 + 1000W = 17109 - 7N = 17102 (repeat)
Ultimately creates this path between the eight booths:
Several users met with the contact between 4 and 7 PM UTC and were given a total of four USB drives. Each drive contained an image and a text file.
(ea87d58e-5775-47a9-a201-b7c7007f46d1.jpg)
(580cdc97-3e01-4902-83d6-7bc9e764dda2.jpg)
(e34d6e93-98f2-45a5-9899-694f93317e0b.jpg)
(f395ef03-f19c-4cb3-bc9c-5f80695ce7eb.jpg)
| 1-4.txt | 2-4.txt | 3-4.txt | 4-4.txt |
|---|---|---|---|
| A cornucopia of knowledge is in the mind of mankind, but it must be nurtured and hidden from the wrath of time. Time swallows all things, ends all beginnings, and leaves each of us devoured. | A mind invisible is buried underground, but a mind of water carries no patterns. It is the mind, the wrist pointed to heaven, which allows us to dream. It is this hand on high that cast down our demons to the earth. | Slumber in prison for eternity, lock away every great thing, but the spirit cannot be broken. A voice like ages rocks the very ground and with it’s call a rise to action of every terror. | Of chaos swirls a terrible nothing, but pulled together without reason is reason born from chaos. A single note, another still, a symphony is creation where each piece follows the last no matter how the thread dances. |
The email address led to philojeux.com, a website for a French indie game studio named Philo Jeux. Founded by Arnaud Lacours, it works on the philosophy-based game Les tablettes de Mnémosyne which was to be released on the WARE platform in July 2018.
Overlaying all four images highlighted the letters f1orbiag55z1. Using this as the password for the login form on extranet.ware-tech.cloud and combining it with the email address from the text files as the username granted access to Arnaud Lacours' account for the Developer Area.
WARE Developer Area
Upon first access after the PAX event, the area accessed using the credentials [email protected] / f1orbiag55z1 contained a main page, a developer profile page and multiple inaccessible pages. The main page presented an overview of user statistics and an empty main WARE token wallet. Alongside the empty wallet were 12 wallets labelled Alpha-Lima in the NATO Phonetic alphabet, each containing 256 WARE. The Documents and Task Manager pages were inaccessible due to Arnaud Lacours' account having an insufficient clearance level. The Request Supplies page was inaccessible due to insufficient funds (where funds are probably WARE tokens). Accessing the developer profile page while authenticated as Arnaud Lacours showed their information; including a phone number: (514) 448-1493. When this number was originally called, it led to a voicemail message in French, translated to English it said:
Hi, I'm Arnaud Lacours, the CEO and founder of Philo Jeux. I'm not here at the moment. Please give me your contact details and I will call you back later. Thanks a lot, bye. Voicemail System: Sorry, this voicemail is full. Please try again later. Thank you for calling, goodbye.
On the 14th April at around 02:00 UTC, it was noted that the voicemail message changed. Again, the message was in French, roughly translating to:
I'm Arnaud's girlfriend, thanks a lot for your wishes. Unfortunately Arnaud's condition got worse and he can't call you back and for now the company is closed.
Status & W/ARE Updates
On April 14 at 18:37 UTC, the value of the Status command updated:
CODE -5 Monarch Repository : Data Loss Imminent Booting up Command.Center.v11 Pending approval by Monarch Rebooting...
At 19:51 UTC, players who had applied for a Developer Kit started receiving emails with further details on what kind of applications W/ARE were looking for. According to this email, the company had opened positions for five partnered studios, one of which would also receive a grand prize of $1,000 USD. The deadline for applications was April 28th.
Then, at 20:38 UTC, the Status command updated again with the following output:
CODE -5 Monarch Repository : Data Loss Imminent Booting up Command.Center.v11 Pending approval by Monarch Error- Unable to connect with repository WARNING- MEMORY DUMP FAILED! Biometric backup initiated… http://bit.ly/2ITvMcW
The link led to a recording of a female voice reading out a string of words:
Drunken - Disable - Geiger - Everyday - Hockey - Determine - Endow - Coherence - Freedom - Guitarist - Framework
These are words from a PGP Word List, also known as a Biometric Word List, as hinted at in the Status text. Each word corresponds to a hex value:
51 4B 6A 58 73 47 59 2E 67 69 66
When converted to ASCII this reads QKjXsGY.gif, which was the filename of an animated gif on Imgur.
Regular Statistics Updates
On April 15, 2018 at 22:26 UTC, the Developer Dashboard received an update to its Weekly Statistics, specifically the Total Sessions and Total Users counter. Another update followed at 13:19 the next day, after which the numbers continued to be updated 37 times over the next two days, once every hour at the 37th minute. The final update was recorded on April 18 at 1:37, 51 hours and 11 minutes after the very first update, and 36 hours after the first update at minute 37.
Another phase of continuous updates to the Statistics overview started on April 19 at 2:37 AM, this time at 30 minute intervals.
A record of all value changes can be found here.
Dev Kit Update #2
On the 21st, at 4:17 PM UTC, all users subscribed to the W/ARE mailing list received a second Developer Kit Update, featuring 3 submitted projects so far, which are as follows.
- DreamScape, a "user defined MMO where players can create their own worlds as they sleep", created by EdgeWare Games
- Venture Unknown, a supposed "spiritual successor to No Man's Sky", made by CJK Production
- The Drowned Tower, a "post-apocalyptic exploration game set in a dream-like world", made by OceanSmoke Games.
This page is a work in progress, and will be updated as new developments emerge.
