Waking Titan/Phase 4
| Waking Titan - Phase 4 | |
|---|---|
| Phase 4 of Waking Titan started on 2017-12-28 and is currently ongoing. | |
| Type | Official |
| Creators | Alice & Smith & Hello Games |
| Discovered | 2017-05-28 |
Main Page > List of Investigations > Waking Titan > Phase 4
Contents
- 1 Tenth Glyph
- 2 Myriad Back Online
- 3 Client 3597b
- 4 Ware-tech.cloud
- 5 Mercury Project
- 6 Newsletter
- 7 PAX East Weekend
- 8 Status & W/ARE Updates
- 9 Regular Statistics Updates
- 10 Dev Kit Update #2
- 11 April 27-29th Access Grants
- 12 Dev Kit Contest Final Stage
- 13 Update on Arnaud's Condition
- 14 Myriad Status Update
- 15 Dev Kit Shipping Updates
- 16 Terminal Status Update and Precon007
- 17 Book Deliveries
- 18 Glyphs 11-15
- 19 Myriad Status and Precon Update
- 20 Loop16 Command Updated
- 21 Dev Kit Delivery
- 22 May 25-26 Updates
- 23 loop16 seq25
- 24 loop16 seq29
- 25 SATCOM-70 Node Network & Dashboard
- 26 W/ARE Report
- 27 Myriad Breach in Sacramento Lab
- 28 loop16 seq60 & Uplink Launch
Tenth Glyph
Beginning on December 28th, 2017, typing WHOIS on the Waking Titan website returned the following: #WHATIS1.5. In addition, the 10th glyph was made active, and linked to a Google Drive folder, which contained community-made pictures of the NMS logo in an infinite mirror.
The titles of the photos, when strung together (skipping the 00 (empty) ones), formed the hexadecimal code for moirrr, which was an anagram for mirror. Additionally, the hexadecimal code in the correct order for the word mirror could be found on the bottom of the Myriad website.
Also of note was the background of the tenth glyph, which read:
Dear Elizabeth We have finished processing 10,000 passes as per your requirements. You should have them in time for the next phase. I really hope you will like the final product. Kind regards, Gail
The allusion to 10,000 passes is likely a reference to the Level 4 Atlas passes that were promised to players as part of earlier phases. The identity of "Gail" remained unknown.
Atlas Passes
On January 17th, 2018, the first CSD user received their Atlas Pass. The passes were made from cardstock, with a textured pass printed on it. The front had the text WAKING TITAN printed, and below that the CSD category the user belonged in. On the very bottom, a series of hexadecimals reading 70686f656e6978 could be found, which, after decoding, translated to PHOENIX. On the back, the owner's CSD-ID was written, along with a serial number stating which pass out of 10,000 the user had, and a number at the top.
It is strongly recommended to not cover up the hex underneath your signature, and to share the number above and below your CSD ID if you are in possession of a pass. Preferably with a picture of the front, as shown below. For a list of all the atlas passes currently known of, please refer to this spreadsheet. In the event you receive one of these, please share a picture of the front, and the numbers underneath and above your CSD-ID (censored bit) on the back.
Atlas Pass front side
Atlas Pass back side
Status Command Update
On January 20th at 5:44PM UTC, the output of the STATUS command began to update:
Downloading Data...: 19:44 1- : 20:16 (32 min) 1-8 : 20:27 (11 min) 1-80 : 20:39 (12 min) 1-800- : 20:44 (5 min) 1-800-41 : 21:35 (51 min) 1-800-413-01 : 22:14 (39 min) Xxxxx X : New Line 1-800-413-011 : 22:15 (1 min) Xxxxx XX 1-800-413-0110 : 22:16 (1 min) Xxxxx XXX
Calling the provided phone number yielded an SSTV transmission (pictured below) which, once decoded, provided meteorological data for various locations.
SSTV page 1
SSTV page 2
Players found they were to order the list of locations in the image alphabetically. This yielded a sequence where Index by Precipitation could be read off.
Using the ordered text indexed by precipitation (in alma the second index is o) led to the following:
CAFE BENE NINETEEN SAT
Livedrop Memo
The text indicated a new livedrop would be occurring in the same location as the last one had. However, due to the old Cafe Bene closing, the Xxxxx XXX part was added in the STATUS command update to warn players about the new venue, Outro NYC, which opened in the same place as the Cafe Bene had been located. The livedrop was intended to occur at 7PM EST (12:00AM UTC). However, the first player from the community who set out for the drop was involved in a traffic mishap, delaying their arrival. Anticipating missing the drop's time window, the community reached out to request a time extension, and the STATUS command, which had updated frequently throughout the confusion, was updated again to approve the community's request.
STAND BY: CSD CITIZEN NOT DETECTED WARNING: CSD CITIZEN NOT DETECTED! IT'S LONELY OUT HERE TIME EXTENSION REQUESTED? EXTENTION PROPOSED: 2H30 – AWAITING CSD APPROVAL EXTENSION APPROVED, BE SAFE
After the extension was approved, a second player from the community set out to the livedrop location on livestream and met with their A&S contact around 7:30PM EST (12:30AM UTC). During the meeting, the player was handed a memo from a mysterious case disguised as a book, pictured left. After some cryptic conversation, the contact asked if they were "getting enough sleep", stating that being well-rested would be very important. After the meeting, players who had attended the livedrop met in another location and showed off the memo, speculating about it's contents and even discovering the REM Sleep connection to the letters on the memo's back. After the livedrop, the community used the livestream to look over the memo, pictured below. On the back of the memo REMS is written. This clue, in combination with the strange question A&S asked at the rendezvous, led players to the password for the 10th Glyph, REM SLEEP.
Memo page 1
Memo page 2
Memo page 3
Once the glyph was solved, the STATUS command updated to a bit.ly link to a form. Players discovered that on the sixth question on the form, entering REMS or REM Sleep (case sensitive) caused a seventh question, pictured right, to reveal itself, allowing CSD users to enter their email address to receive "left over materials" from something called Lab 319. Players remained unclear on what exactly Lab 319 was or what it's leftovers were, however signing up seemed integral given the input is only revealed after using the REM Sleep phrase.
Myriad Back Online
On 26 March, 2018 at 05:25 UTC an event occurred. The Myriad site came back online after having been offline since the end of Phase 3. The site featured indications of a solar event interfering with operations. In addition, the status command on Waking Titan briefly displayed the following:
CODE -3 Unable to restart ................. ERROR LOG SUMMARY - Major malfunction - Protect the monarch - All tiers 2 and tiers 3 clients must be purged IMMEDIATELY ................. TO ALL CSD - Gather maximum EXTERNAL intel - CSD should take time to regroup and get organized
Ten minutes elapsed before the Status command began to display the following:
CODE -5 System Locked e b 4 c 1 4 a 9 c 6 2 2 d f 7 1 6 6 f b e 0 d d 8 9 1 5 d b 0 2
This hexadecimal string was used to reference a connection the private key for an Ethereum cryptocurrency wallet related to an ostensibly "promotional" event for an upcoming product from W/ARE.
Client 3597b
At 1:11 AM, UTC, Myriad-70.com updated, and the updates included the following.
Latest network diagnostic table: - Network corruption detected - Situation isolated to Client 3597b - Process cannot be suspended due to critical conditions -------------------------- -Beijing: 29.1Tb/s -------------------------- MAJOR ISSUES: Client 3597b
Soon after, at 1:30 AM UTC, the Status command updated in the Terminal to say the following.
> status CODE -5 System Locked e b 4 c 1 4 a 9 c 6 2 2 d f 7 1 6 6 f b e 0 d d 8 9 1 5 d b 0 2 -------------- Monarch Repository Status: Degraded Conflict With - Client 18d1a TRACERT 10.30.74.* - Client 3597b TRACERT 54.91.155.* - Client 351h TRACERT 6.128.214.* - Client 0911a TRACERT 74.1.21.*
Approximately 15 minutes later, clients began to disconnect, beginning with Client 0911a, second being Client 18d1a, and the last being Client 351h, who had an additional piece of text added, being ID: 79657321, which was translated as hex into Yes!
Then, at 2:15 AM UTC, the status command was updated again, stating - Client 3597b - UNABLE TO DISCONNECT 54.91.155.209 NAT 52.2.248.*
At 1:38 PM UTC, the status command updated once again, stating - Client 3597b - UNABLE TO DISCONNECT 54.91.155.209 NAT 52.2.248.*:80\\
At 10:30 PM UTC, March 30, the status updated again to say
Latest network diagnostic table: - Client 3597b is beyond allocated limits - Process cannot be suspended due to critical conditions - Tier 1, 2 and 3 clients are now all offline
Ware-tech.cloud
Of the sites found in the 52.2.248 range, 52.2.248.6 was found. Using the metadata found in the HTML and searching on Google, the domain and Twitter were located as well. The site is in Chinese, although Google Translate gives a good, readable translation.
On Twitter, under the Shipping Soon image, is a Hex string 77 61 6E 74 20 74 6F 20 6B 6E 6F 77 20 6D 6F 72 65 that, when converted to ascii reads want to know more. Under the #waretech hashtag on Twitter, there are three images shared by "Partner Companies" with the following code (and the ascii conversion):
62 69 74 2E = bit. 6C 79 2F 77 = ly/w 61 72 65 32 = are2
On the ware-tech website, if you subscribe, you receive an email with another 3 characters: 30 31 38, which again in Ascii becomes 018. Together this gave a bit.ly link that leads to the W/are Discord channel.
Discord users were informed of a community puzzle that was going on by the admin. Members of the W/ARE Discord had received tweets from another account, https://twitter.com/w9rPQ45E, which had seven tweets with hex code in them:
01 [ 74 78 2f 30 78 66 65 30 31 35 30 66 ] 02 [ 62 33 30 32 61 38 62 36 64 34 30 38 ] 03 [ 35 37 32 32 64 61 61 31 64 30 37 37 35 ] 04 [ 38 33 31 38 35 30 38 36 39 31 30 61 31 ] 05 [ 61 38 32 34 38 63 65 32 34 38 30 64 ] 06 [ 32 65 33 38 37 33 31 ] 07 - Signal Lost [ 65 6e 64 20 6f 66 20 6c 69 6e 65 ]
Translated into Ascii, these tweets give the following:
tx/0xfe0150f b302a8b6d408 5722daa1d0775 83185086910a1 a8248ce2480d 2e38731
which references this Ethereum transaction. The Twitter username, w9rPQ45E is also a Pastebin, providing the string edb044c81d40a196c4672a2bd6f17f1f6. In the Ethereum transaction, there is Input Data that, when converted to ascii, links to another Pastebin, providing another string: b67fbb5e90ddcda8a921656d0b30a20
Two things have been done with these strings. Together, they are the Private Key for the Ethereum account the money was transferred to. It has since been withdrawn to a different account. Second, if you put the two strings together and compare them with the string from Waking Titan's console, every odd character matches the strings from Pastebin.
edb044c81d40a196c4672a2bd6f17f1f6b67fbb5e90ddcda8a921656d0b30a20
e b 4 c 1 4 a 9 c 6 2 2 d f 7 1 6 6 f b e 0 d d 8 9 1 5 d b 0 2
The remaining characters are d0 48 d0 16 47 ab 61 ff b7 b5 9d ca a2 66 03 a0, however if this has any use is yet to be seen.
Three hours after the W/ARE Discord Admin let the community know about the puzzle, at 6:01 PM UTC they returned and said
That was it for today, good job on solving our community puzzle! You are good! :smiley: Tomorrow one of our partners will have a giveaway for us! We will have more for you this weekend also!
Mercury Project
At 9:26 PM UTC, the Mercury command updated to say the following.
Mercury process > Build XXXX Ready to load branch version 1.5 Send Password Code in HEX to : Telegram MercuryHG80
This puzzle required a user to solve the riddle shown below, convert the answer into hexdecimal, and send it to an official Telegram account run by one of the Puppet Masters.
The puzzle involved a riddle that was discovered in a Pastebin on W/ARE's twitter. It went as follows: “Descended from Night, I share the blood of nightmares. Look forward to the gates of horn and ivory”
This puzzle was solved by searching "The gates of horn and ivory", which resulted in dreams and nightmares of Greek mythology. After noting the capital N in "nightmares", users found the Greek god of night, Nyx, which led to one of her children, Morpheus, who was one of the Oneiroi, and the god of dreams. The name was then converted to hexdecimal and sent to the Telegram account, and the terminal accepted the password, resulting in the following command update.
Processing "Morpheus" > ACCESS GRANTED Downloading.......
Then, at 9:54 UTC, the Mercury command updated again, and said the following.
<Mercury process > Build XXXX Ready to load branch version 1.5 Send Password Code in HEX to : Telegram MercuryHG80 -------------------------------- Process started by community - ETA 11:00 BST https://bit.ly/2pLmadg
The shortened link redirected to a tweet from Sean Murray, which said The cause is hidden. The effect is visible to all. #oneonebst
The tweet also included a photo of someone, presumably Sean himself, holding a phone receiving a Telegram notification, which was Morpheus in hexdecimal. The hashtag spells out 11BST, or more precisely, 11:00 BST, or, 10:00 UTC. No updates were made at 10:00 PM, and was then confirmed to be counting to 10:00 AM.
Roughly half an hour before the timer was up, at 9:26 AM UTC, Sean Murray announced on Twitter that he had a small announcement to make, and was going to post it early as it was about to leak.
Shortly after, at 9:50 AM UTC, Hello Games announced the next update for No Man's Sky, which was No Man's Sky NEXT, set with a launch date for Summer of 2018.
Newsletter
On April 2 at around 23:30 UTC, user W/ARE came online in the W/ARE Discord to announce that the next giveaway would be sent out in a newsletter within the next hour. They also mentioned the upcoming launch of their new translated English website, new extranet and the release of a "WARE cryptocoin", and asked users who are planning to be at PAX East to let them know at [email protected] with "PAX EAST - YES!" in the subject line.
At 00:30 UTC the newsletter started coming in via email. It announced that 25 winners were selected to receive Steam keys for games from W/ARE partners, such as The Shrouded Isle and Future Unfolding. It also included a link to an Application Form for indie developers to apply for a Developer Kit of W/ARE tech. The best applications will be up for a public community vote to decide which games will be launched on the W/ARE platform.
Around the same time, the Status command in the Terminal updated to say the following:
> status CODE -5 Monarch Repository : Data Loss Imminent Booting up Command.Center.v11 Pending approval by Monarch
PAX East Weekend
Website update
On April 6, 2018 at 6 PM UTC the W/ARE website updated with the new English translation and access to a Developer Area containing a sign-in form.
Status command
On April 8 at 01:19 AM, the Status command updated with the following output:
CODE -5 Monarch Repository : Data Loss Imminent Booting up Command.Center.v11 Pending approval by Monarch Error - Unable to connect with repository Memory Dump 2GzHGwu.jpg
The filename leads to a corrupted image hosted on imgur, depicting a partial area map, a satellite, and the word "MYRIAD".
Live Drop
On April 8 around 00:49 UTC, players who previously sent emails to W/ARE about attending PAX East received the following response:
Hello! We’ve heard from some attendees that our booth at PAX East is very difficult to find this year. To help you find the booth, we’ve enlisted the help of an Enforcer. Here is the information that our team at PAX has sent us to help you locate them: HANDLE: EMU PATH: START -997E -1E -1000E +4S +1000W +1W +1000W -7N REPEAT You should be able to find them on their path between 12PM and 3PM local time. - WARE
The path of EMU was determined by searching for a specific range of clustered booth numbers on the floor plan. Assuming Down is East, starting at booth 17102 and subtracting 997 from that number gives us 16105, which is to the East directly next to booth 17102. Continuing this with the rest of the coordinates:
17102 - 997E = 16105 - 1E = 16104 - 1000E = 15104 + 4S = 15108 + 1000W = 16108 + 1W = 16109 + 1000W = 17109 - 7N = 17102 (repeat)
Ultimately creates this path between the eight booths:
Several users met with the contact between 4 and 7 PM UTC and were given a total of four USB drives. Each drive contained an image and a text file.
(ea87d58e-5775-47a9-a201-b7c7007f46d1.jpg)
(580cdc97-3e01-4902-83d6-7bc9e764dda2.jpg)
(e34d6e93-98f2-45a5-9899-694f93317e0b.jpg)
(f395ef03-f19c-4cb3-bc9c-5f80695ce7eb.jpg)
| 1-4.txt | 2-4.txt | 3-4.txt | 4-4.txt |
|---|---|---|---|
| A cornucopia of knowledge is in the mind of mankind, but it must be nurtured and hidden from the wrath of time. Time swallows all things, ends all beginnings, and leaves each of us devoured. | A mind invisible is buried underground, but a mind of water carries no patterns. It is the mind, the wrist pointed to heaven, which allows us to dream. It is this hand on high that cast down our demons to the earth. | Slumber in prison for eternity, lock away every great thing, but the spirit cannot be broken. A voice like ages rocks the very ground and with it’s call a rise to action of every terror. | Of chaos swirls a terrible nothing, but pulled together without reason is reason born from chaos. A single note, another still, a symphony is creation where each piece follows the last no matter how the thread dances. |
The email address led to philojeux.com, a website for a French indie game studio named Philo Jeux. Founded by Arnaud Lacours, it works on the philosophy-based game Les tablettes de Mnémosyne which was to be released on the WARE platform in July 2018.
Overlaying all four images highlighted the letters f1orbiag55z1. Using this as the password for the login form on extranet.ware-tech.cloud and combining it with the email address from the text files as the username granted access to Arnaud Lacours' account for the Developer Area.
WARE Developer Area
Upon first access after the PAX event, the area accessed using the credentials [email protected] / f1orbiag55z1 contained a main page, a developer profile page and multiple inaccessible pages. The main page presented an overview of user statistics and an empty main WARE token wallet. Alongside the empty wallet were 12 wallets labelled Alpha-Lima in the NATO Phonetic alphabet, each containing 256 WARE. The Documents and Task Manager pages were inaccessible due to Arnaud Lacours' account having an insufficient clearance level. The Request Supplies page was inaccessible due to insufficient funds (where funds are probably WARE tokens). Accessing the developer profile page while authenticated as Arnaud Lacours showed their information; including a phone number: (514) 448-1493. When this number was originally called, it led to a voicemail message in French, translated to English it said:
Hi, I'm Arnaud Lacours, the CEO and founder of Philo Jeux. I'm not here at the moment. Please give me your contact details and I will call you back later. Thanks a lot, bye. Voicemail System: Sorry, this voicemail is full. Please try again later. Thank you for calling, goodbye.
On the 14th April at around 02:00 UTC, it was noted that the voicemail message changed. Again, the message was in French, roughly translating to:
I'm Arnaud's girlfriend, thanks a lot for your wishes. Unfortunately Arnaud's condition got worse and he can't call you back and for now the company is closed.
Status & W/ARE Updates
On April 14 at 18:37 UTC, the value of the Status command updated:
CODE -5 Monarch Repository : Data Loss Imminent Booting up Command.Center.v11 Pending approval by Monarch Rebooting...
At 19:51 UTC, players who had applied for a Developer Kit started receiving emails with further details on what kind of applications W/ARE were looking for. According to this email, the company had opened positions for five partnered studios, one of which would also receive a grand prize of $1,000 USD. The deadline for applications was April 28th.
Then, at 20:38 UTC, the Status command updated again with the following output:
CODE -5 Monarch Repository : Data Loss Imminent Booting up Command.Center.v11 Pending approval by Monarch Error- Unable to connect with repository WARNING- MEMORY DUMP FAILED! Biometric backup initiated… http://bit.ly/2ITvMcW
The link led to a recording of a female voice reading out a string of words:
Drunken - Disable - Geiger - Everyday - Hockey - Determine - Endow - Coherence - Freedom - Guitarist - Framework
These are words from a PGP Word List, also known as a Biometric Word List, as hinted at in the Status text. Each word corresponds to a hex value:
51 4B 6A 58 73 47 59 2E 67 69 66
When converted to ASCII this reads QKjXsGY.gif, which was the filename of an animated gif on Imgur.
Regular Statistics Updates
On April 15, 2018 at 22:26 UTC, the Developer Dashboard received an update to its Weekly Statistics, specifically the Total Sessions and Total Users counter. Another update followed at 13:19 the next day, after which the numbers continued to be updated 37 times over the next two days, once every hour at the 37th minute. The final update was recorded on April 18 at 1:37, 51 hours and 11 minutes after the very first update, and 36 hours after the first update at minute 37.
Another phase of continuous updates to the Statistics overview started on April 19 at 2:37 AM, this time at 30 minute intervals.
A record of all value changes can be found here.
Dev Kit Update #2
On the 21st, at 4:17 PM UTC, all users subscribed to the W/ARE mailing list received a second Developer Kit Update.
The update mentioned that the W/ARE team was working on a new test protocol for the headset that was expected to provide a 60% boost in power to the headset. It was also said that players would learn within a few weeks.
The update also featured 3 submitted projects so far, which are as follows:
- DreamScape, a "user defined MMO where players can create their own worlds as they sleep", created by EdgeWare Games
- Venture Unknown, a supposed "spiritual successor to No Man's Sky", made by CJK Production
- The Drowned Tower, a "post-apocalyptic exploration game set in a dream-like world", made by OceanSmoke Games.
It was found that these three projects were all player created, and have no official affiliation or information involving the Waking Titan ARG.
April 27-29th Access Grants
At 7:11 PM UTC on April 27, the Documents portion of the W/ARE extranet site, along with the Task Manager section were unlocked. This started a series of tasks. Each new task was unlocked when funds were successfully transferred out of one of the developer sub-wallets. The wallet keys were received by sending the correct solution to the current task to [email protected].
2018 03 03 led to a corrupted image of what was discovered to be St. Basil's Cathedral in Moscow, Russia.
There were also two other images of interest, titled Notes-on-locations-1_ldf82ng0.png and Notes-on-locations-2_pisj84n91.png
Combined together, the contents of these 2 images read the following.
1. THE MIDDLE OF THE INVERTED PENDULUM COULD FEED THE MOST LOGICAL MINDS
2. ITS SHAPE WILL LIGHT THE SPARK OF CREATIVITY
(049245)
3. IMPOSING SURROUNDINGS HELP IDEAS TO BE TAKEN SERIOUSLY
4. SURROUNDED BY WATER,
EXHALING SERENITY
(AT THE JUNCTiON
BY THE LAKE)
Another image was also found, entitled "Train ticket". It contains an image of a train and Cyrillic script that translates to "Manchurian Railway Ticket", "Moscow - Beijing" dated March 5, 2018.
Alpha
The Task Manager section revealed the first "Task" given to W/ARE employees, titled "Missing Employee", and that it was in progress. There was one description of what had happened, along with two update messages.
The original description read the following.
IMPORTANT MESSAGE FROM WARE RESEARCH AND DEVELOPMENT TEAM. Attention to all developers. One of our colleagues, Mr. Zheng, has gone missing a month ago while on a R&D tour. Serious investigation inside the department has lead to nothing of interest, and we’re now asking for outside help. Please send any information concerning his potential whereabouts to [email protected].
The first and second update were as follows:
Update 1:
All recent and potentially relevant documents found on Mr. Zheng’s computer have been translated and forwarded to the developer extranet. Our team is currently trying to use this information to retrace his last steps. We’re hoping that our combined efforts can bring light to this affair and bring Mr.Zheng back home safely. In the hope of attaining maximum reach and visibility, the R&D department also set up a Twitter account to serve as another relay of information.
(The twitter account in mention is @Ware_RDev)
Update 2:
UPDATE ON R&D SEARCH. All information of interest sent to [email protected] will be rewarded with codes to our exclusive WARE wallets which can be used for special package purchases.Sending an email containing the keyword "Moscow" to [email protected] caused them to send the following reply, including a link to a map of Beijing's subway for a planned 7th conference:
The WARE Research and Development team thanks you for your interest in the WARELearn initiative. The Russian Academy of Medical Science in Moscow’s conference on Art and Dreams is the last of a series of six conferences we hope will enlighten your mind. The WARE Team will review your application and get back to you as soon as possible! Feedback from employees is fundamental in the development of the WARELearn initiative. As such, we’re asking you to give us your opinion on the ideal location for our next conference. If the location you picked is chosen by our committee, you may be given the chance to attend and meet the promoters of the event. Our team has begun to pinpoint buildings that could be of interest. Feel free to inspire yourself and contact [email protected] to let us know about your suggestion. Kind regards, The WARELearn initiative
Sending an email containing all the keywords "Moscow," "Beijing," and "049245" (from Notes on locations 1) triggered another response, this time containing the ALPHA sub-wallet key:
Dear informer, To thank you for your recent help in Mr. Zheng’s case, WARE has provided you with a code to use on our internal cryptocurrency wallets. We promise that every significant clue provided to us will be rewarded as such. Claim your reward with this code and stay alert for further updates on the situation : 4e47e152a5afaf95537c5dba73ef73d45c11fd6743ff5db9bfea3eca9282fda Please withdraw the funds so that the main wallet can be updated. Note the updating process is not immediate. Kind regards, The R&D Team
The funds were withdrawn from the cryptocoin wallet, which led to an update to the Weekly Statistics page, where sub-wallet ALPHA was now displayed as empty.
Beta
A new message in the Task Manager followed:
Most recent informations linked to the WARELearn services has confirmed our suspicions that despite boarding his train in Moscow, Mr. Zheng never arrived at Beijing and seems to have abandoned the train along the route. Any information, as small as a postal code, that you can find about the possible location locations he may have visited for an extended period - such as a hotel or hostel - would be of tremendous help.
Using a map of the Trans-Manchurian Train route and the 4 hints from the Document files, players concluded that Mr. Zheng left the train in Gostinyy Dom Chita, 672040. Sending this information to the email address yielded another wallet key. Players were able to withdraw these funds from a cryptocurrency wallet, emptying sub-wallet BETA.
The following update was posted in the Task Manager:
Thanks to dedicated informers, the investigation on Mr. Zheng is progressing and the tasks have been updated. We’ve been able to confirm that a stop was indeed made in Chita, after attending the Moscow conference on Art and Dreams. Please send any information concerning his potential whereabouts to [email protected], in addition to the updated task number.
Charlie
A journal entry and a page of notes both written by Mr. Zheng were unlocked in the Documents section, along with an update in the Task Manager:
(Mr. Zheng's Journal)
(Mr. Zheng's notes on Moscow)
Attention to all teams. Documentation (copies and originals) coming from a source close to the missing employee have been recovered by W/ARE. There are a lot of files to organize and our database employees are still trying to get everything in order. Any information that could help us make sense of them will be most welcome.
The image of "Notes on Moscow" contains 3 blanks and descriptions of 3 paintings. The blanks can be filled in with the subjects of the paintings. Sending these keywords, in addition to the updated task number - a1028f, Montreal, 1.30pm. Meet me at the fountain in front of the Notre Dame Basilica. - to the email, yielded the next wallet key. Again, players withdrew the funds from the wallet, emptying sub-wallet CHARLIE.
Delta - Montreal Live Drop
The Task Manager updated with an announcement of a live drop:
Deploying a team for possible package seizure. Once the location will be secured and package examined, onsite examination will be possible. WARE will not allow package to leave location. Taking pictures will be permitted. Confirmation of Location: Place d’Armes, Montreal, In front of the fountain Confirmation of Time: Between 7pm and 9pm, local time
At the drop location, players received the following note: I came two years after the Ursuline nuns. Now set in stone, here is my legacy. G. Nadeau
Investigations led to the French nurse Jeanne Mance, who arrived in New France two years after the Ursuline nuns came to Quebec and established Montreal's first hospital in 1642, the Hôtel-Dieu de Montréal. She is memorialized in statue at the foot of the Maisonneuve Monument. Sending this information to the email unlocked the next wallet key, and the withdrawal of the funds emptied sub-wallet DELTA.
Echo
On April 28 at 2:32 AM, a new journal page was unlocked that highlighted two circled notes,
DON'T FORGET TO MOVE NOTES ON THE MEETING TO THE CLOUD and SECULAR VADER OF THE BIBLE.
The new Task Manager update read:
The search to find Mr. Zheng is still ongoing. New information is now connecting him to Montreal’s Hotel Dieu. Please send any information concerning his potential whereabouts to [email protected], in addition to an updated task number [t1029r]. We’ve tried to access Mr. Zheng's files in the R&D dropbox, but all access has been blocked.
It contained a link to Mr. Zheng's password-locked Dropbox. Players determined the correct password was Gutenberg, who produced the first printed Bible.
The Dropbox contained 4 pdf files with printable hexaflexagon patterns. When folded, one of the sides on each hexaflexagon yielded a 13-digit number starting with 978. These were ISBN numbers for the following 3 books: Nine Billion Names of God, The Paris Architect, and War and Peace. Using the leftover numbers from each flexagon as a book cipher of the format page, line, and word, the phrase unknown british soldier was found. This points to the Tomb of the Unknown Soldier, which was the keyword to obtain the wallet code for sub-wallet ECHO.
Foxtrot
When assembled and put together, the three hexaflexagons revealed a shape resembling the river Seine in Paris in the area of the Louvre. SendingLouvre to the email address provided the code for sub-wallet FOXTROT and revealed a new journal document.
On the journal page were 3 sentences, with certain words underlined. Ordering the words by the number of underlines and counting their position in each sentence resulted in the phone number 438-368-9126. Upon calling this number a recorded message gave a morse code that translated to PASTEH9EBKEXGT. This led to a Pastebin document containing the following text:
From the bottom of the crypt, at the feet of the Guardian, I ascend left Pass the dignitary and follow the water Go straight to the sun with open arms and turn right Turn left when you arrive home Go straight to the hand and head of the goddess and turn left to face the keeper Follow the procession into the house of kings Ignore the light and descend to your death I am here and with me the seventh part of what you are searching for.
Golf - Paris Live Drop
A new live drop was announced to be in Paris, France:
Deploying a team for possible package seizure. Once the location is secured and package examined, onsite examination will be possible. WARE will not allow package to leave the location. Taking pictures will be permitted. Confirmation of Location: At the entrance of the Passage du Souvenir, Near the stairs, Paris Confirmation of Time: Between 1pm and 3pm, local time
At the Tomb of the Unknown Soldier, a monument in the Passage du Souvenir beneath the Arc de Triomphe de l'Étoile in Paris, players were given another hexaflexagon paper puzzle and told not to un-tape it. When aligned with the other three pieces, this revelead a location marked with an X at the Louvre.
The text from the Pastebin found in the Foxtrot stage were clues on the correct route to follow inside the Louvre. The rest of the path led players to the sarcophagus of Ramesses III, on the side of which they found a depiction of The Book of Amduat. Sending this to the email yielded the key to sub-wallet GOLF.
Hotel
The parchment in The Book of Amduat can be found in the British Museum London, which was the keyphrase that unlocked sub-wallet HOTEL.
Locked briefcase found in London, near the British Museum. Not yet confirmed if Mr. Zheng left it there willingly. Package currently under observation.
They were right. It's all leading here. I saw it at night. i had it in my hands. All the missing parts. For the first time, I felt like all was finally put in place. Then, I felt a powerful force, ripping it from my hands. I dropped it and all the pages flew away in the wind. I remember the morning that came after. I was standing tall, pointing at the former naval person, longing for all this knowledge that got away. I need to find its missing pieces.
India
The phrase former naval person is the signature Winston Churchill used in his private correspondence with President Roosevelt. The text describes standing tall pointing at him. This was deduced to be Big Ben, which faces the Churchill statue in Parliament Square, London. Sending Big Ben to the email address provided the key to withdraw the funds from sub-wallet INDIA.
A third live drop was announced to be in London:
Deploying a team for possible package seizure. Once the location will be secured and package examined, onsite examination will be possible. WARE will not allow package to leave the location. Taking pictures will be permitted. Confirmation of Location: Statue of Winston Churchill, Parliament Square, London Confirmation of Time: Between 1pm and 3pm, local time
Juliett - London Live Drop
On April 29th at 1PM local time, players met with a W/ARE technician in London and were given a scrambled picture of the "The Thinker" sculpture by Auguste Rodin, displayed at the Detroit Institute of Arts Museum. The keyphrase Henry Fuseli, The Nightmare, 1781, a painting found at the same museum, provided the code for sub-wallet JULIETT.
This unlocked three new postcards in the Documents section.
(Postcard 1)
(Postcard 2)
(Postcard 3)
Kilo
The locations pictured on the postcards were in Mexico, Peru, and Morocco. Each postcard mentioned two numbers and two cardinal directions, and combining these led to a string of coordinates: 33N, 43E - 30N, 69E - 22N, 79E, which were found to be in Iraq, Pakistan, and India. Connecting these six locations by lines pointed to Egypt.
The circled letters on the postcards spelled monastery, king, and tonw. Using these clues, players found Deir el-Medina, an Egyptian village whose name translates to "monastery of the kings". The village's name unlocked sub-wallet KILO.
'Alights, and grinning I saw it again. Except this time, what snatched it from my hands was not a divine force but the unmistakable pull of this stippled incubus. 'Alights, and grinning He glared at me, as he ripped all the pages before my horrified eyes. I felt his weight on my chest. xxxx?
It quotes excerpts from Ermasus Darwin's poem "Botanical Garden", which is an inscription found on the "The Nightmare" painting referenced in the JULIETT phase, engraved by Thomas Burke in 1783.
Then, the next Task Manager update announced another live drop:
Briefcase found in London still locked but deemed safe by our experts. Once the location will be secured and package examined, onsite examination will be possible. WARE will not allow package to leave the location. Taking pictures will be permitted. Confirmation of Location: British Museum, London Estimated Time : Between 6pm and 8pm, local time
Lima - 2nd London Live Drop
At the second live drop in London, players were given a small box locked with a 4-digit code. The key was
1783, the year "The Nightmare" was engraved.
Inside the box were three paper notes:
(arbu = irbu, seru = saru)
(Wolf = violent ennemy/Fox, the ennemy will not attack but will plot secretly)
(Vomiting gold/silver = ten months, Golden trees/ghosts/demons = nine months)
These notes reference ancient texts about dream interpretation. One of them is the Egyptian Ramesside dream-book, the code that unlocked sub-wallet LIMA.
Conclusion
At 5:18 PM the status command updated:
CODE -5 Monarch Repository : Data Loss Imminent ReBooting Command.Center.v12
The Request Supplies section on the extranet was now accessible, revealing a "Specific Item Order Form". In addition to Arnaud Lacours' name, his employee ID 43617373696e69 was already filled in. Converted from HEX to ASCII this code translates to Cassini. Entering the ID into the console yields the following output:
LOG RECOVERED :: ITERATION #4924A :: The asteroid field was thick, denser than any I'd seen before. The ice, the dirt, the metal fragments… my ship never stood a chance.
Another Status update followed at 5:33 PM:
CODE -5 Monarch Repository : Data Loss Imminent ReBooting Command.Center.v12 ------ Error, unable to start https://i.imgur.com/Fnixw9t.png ------ New command updated
It linked to an image with the headline SUBJECT1 and a section named MEMORY FRAGMENTS.
The search for Mr. Zheng concluded with a message from the @WARE_RDev Twitter account:
Dev Kit Contest Final Stage
On May 4th, 2018 at 10:15 PM UTC, users subscribed to the W/ARE mailing list started receiving the next Developer Kit Update. It announced that 10 out of 682 submissions were selected as finalists to the contest, and the public community vote was opened at devkit.ware-tech.cloud. The email also mentioned No Man's Sky as one of W/ARE's partnered games.
The following six winners of the contest were announced via email on May 12th at 00:20 AM:
- Summon Studios - Terraformed and Stellar Software - Beyond the Stars
- Spectrumental Games - Supersensory
- CSD Games - Tumbleweed
- Imperium Interactive - Eden
- Game Detectives - Delve
Update on Arnaud's Condition
On the 12th of May at 8:21 PM UTC, the status command was updated:
CODE -5 Command.Center.v12 crashed ------ Global Network Scan started.... Warning: Files locked by Monarch - dreamscape.exe - soundflex.exe - inyourmind.exe - Jeu_Capture_d_Ecran.jpg
One of the files "Jeu_Capture_d_Ecran.jpg" was then found an Arnaud's site, a transcription of the image is as follows:
Dear "Tablettes de Mnémosyne" fans, A lot of you recently inquired about Arnaud's health and, as you endlessly supported him during the early development of Philojeux, we think it's fair for you to know what's going on. Arnaud has been very sick lately and his condition's decline lead to a loss of consciousness. He has been transported to urgent care at Montreal's Hotel-Dieu where his vital signs are being closely monitored. We hope you understand that the launch of "Tablettes de Mnémosyne" is indefinitely postponed. Please send all words of encouragement to Arnaud's family at [email protected]
Upon emailing the address, the following response was received:
Thank you for reaching out to the Arnaud Lacours’ Foundation. All words of encouragement will be forwarded to Mr. Lacours’ family. Géraldine Nadeau Arnaud Lacours’ Foundation Hotel Dieu Hospital Research Institute 438-368-9126
When the phone number was called, a voice mail was played. A transcription of the voice mail is as follows:
You've reached Dr. Geraldine Nadeau, head of the Arnaud Lacours Foundation. Mr. Lacours' family thanks you for your support during these terrible events, and encourages you to always be cautious and critical in the face of the unknown. As Arnaud himself would say, "history comes from memory." You're invited to use the foundation's e-mail to share your words of encouragement with the family. Thank you for calling.
"History comes from memory" was found to be a riddle referencing Clio (the "Muse" of history), the daughter of Mnemosyne (the Goddess of memory). Upon emailing the word "Clio" to the address, the following response was received:
Thank you so much for returning my message. I need every helpful hand I can get. I figured, by the efforts you’ve put into contacting me, that you’ve got a high interest in Arnaud’s case. I’ve been monitoring him since nearly a month ago and I would be lying if I told you it doesn’t keep me awake at night. His condition is nothing like I’ve ever seen. His brain activity is insanely high, but he’s completely non-responsive. Not too long after I was informed of Arnaud’s condition, I was visited by a man claiming to work for a highly advanced tech company, specializing in unconscious experiences. He has been incredibly interested in Arnaud’s case as well as in my recent studies on sleeping patterns. I gave him some information on my research into lucid dreaming methods and he went on his way. I’ve never seen him again. Since then, I’ve been focused on gathering more information about W/ARE, their technology and their processes. I’ve noticed that Arnaud advertised them on his professional website but I don’t know the depth of his involvement with them. I figured that any person interested by the correlation between W/ARE and Arnaud would find the message I left there. I’ve put the Foundation in place as a cover to not arouse suspicion. I have so many questions and Zheng’s not answering my calls. All he gave me is the list of his company’s research labs as well as one totally incomprehensible file. I need to get to know more about W/ARE. If you know this man, if you can get any opening into this company’s motives, please help me. For Arnaud’s life and potentially many others. Géraldine
One of the sentences linked to a Dropbox folder that contained two images. The meaning of the images is unknown.
Zheng's Note
One of the images, titled Zheng's Note, contained what at first appeared to be gibberish. However, when every other letter is taken the following text is revealed:
Test subjects have been called in and the device has been used on them in ways that i could never condone 7 of them lost as we speak 3 of them are dead 8 are on the verge of being unrecoverable their intentions are not what we think they are actions should be taken to shut them down exit
The letters that were not used in the message appear to be the words Lucid Dream repeating until the end of the message.
WARE Labs
The second image, titled WARE Labs contains data concerning six research labs owned by WARE across the world. The transcription of the data is as follows:
0: Boston Research Lab Lab Director: Richard Wilkes Project name: we-2-3 / tm-1-lt / tr-10-ae Project description: 0000100001 Project code: # 4-3 Lab sequence 10-3 1: Sacremento Research Lab Lab Director: Helga Johnson Project name: st-1-dn / ss-4-bn Project description: 0001010000 Project code: # 1-2 Lab sequence: 4-6 2: Seoul Research Lab Lab Director: Yu Hyo Project name: ue-2-is / as-6-be Project description: 0100000011 Project code: # 1-2-1 Lab sequence: 9-1-13 3: Beijing Research Lab Lab Director: Wang Jie Project name: st-1-dn / bg-1-tr Project description: 0001000000 Project code: # 4 Lab sequence: 8 4: Prague Research Lab Lab Director: Adriana Dvorak Project name: ae-4-sd / of-5-ue Project description: 0100101000 Lab code: # 10-3-4 Lab sequence: 2-5-12 5: Berlin Research Lab Lab Director: Georg Muller Project name: dd-1-ae / dn-2-() Project description: 001000001 Lab code: # 2-3 Lab sequence: 7-11
Each of the letter pairs in the project name field represented a first and last letter of a word in the decoded Zheng's note. 3 and () represent the word three and the end of the message, respectively. Then the sequence that fit those words needed to be found, so for example, dd-1-ae would be the words dead 8 are in Zheng's note. Using this method, the following sequences were found:
we speak 3 / them are lost / their intentions are shut them down / subjects have been unrecoverable their intentions / actions should be shut them down / being unrecoverable their are actions should / of being unrecoverable dead 8 are / down exit
The middle number was then found to represent which letter of the middle word was important, as it was always less than the character count of the middle word. Taking each letter indicated by the middle number the string paste hdtuig8x was given, which was found to represent a pastebin link. The pastebin link then led to another dropbox folder titled "Client - 43617373696e69" that contained 4 PDF files relating to Arnaud's incident. The PDFs provided datadumps from the dreamscape, soundflex, and inyourmind processes before they all failed:
Dreamscape:
- m2 - failed
- m6 - failed
Soundflex:
Inyourmind: >>>
The rest was solved, and a second pastebin found by splitting Zheng's note into 6 rows of 10 words like so:
Test subjects have been called in and the device has been used on them in ways that I could never condone 7 of them are lost as we speak 3 of them are dead 8 are on the verge of being unrecoverable their intentions are not what we think they are actions should be taken to shut them down exit
From there, the binary values in Project description were used to pick out words:
0000100001 - called has 0001010000 - them ways 0100000011 - 7 speak 3 0001000000 - dead 0100101000 - unrecoverable are what 001000001 - should exit
Then Project code was used to pick out letters from each word:
called has | 4-3 = ls them ways | 1-2 = ta 7 speak 3 | 1-2-1 = 7p3 dead | 4 = d unrecoverable are what | 10-3-4 = aet should exit | 2-3 = hi
Lab sequence was then used to determine the order of the letters:
ls = 10-3 - l and s are letters ten and three respectively ta = 4-6 - t and a are letters four and six respectively 7p3 = 9-1-13 - 7, p and 3 are letters nine, one and thirteen respectively d = 8 - d is the eighth letter aet = 2-5-12 - a, e and t are letters two, five and twelve respectively hi = 7-11 - h and i are letters seven and eleven respectively
Reordered the following string was obtained: paste ahd7lit3
This was the link to a second pastebin. The pastebin linked to a second dropbox titled "Archives". The folder contains six images of what appear to be WARE customer support logs.
Myriad Status Update
On the 13th of May at 6:29 PM UTC Myriad's status page was updated. A diff of the change can be found here. The only change was the network diagnostic table, which now says the following:
Latest network diagnostic table: - Client 3597b’s resources redirected - 3597b-1-2-1 has been shut down - Additional resources allocated to 3597b-4
3597b-1-2-1 has been shut down seems to imply that the Seoul Research Lab has been shut down, Additional resources allocated to 3597b-4 seems to indicate that the Beijing Research Lab is now receiving additional resources. Two hours before this status change, at 4:02 PM UTC WARE tweeted about the arrival of 40 new employees to their Beijing Research Lab. It is possible that the tweet and status update are connected.
Dev Kit Shipping Updates
On May 15, 2018 at 19:20 UTC, winners of the W/ARE development contest received an update on the status of their dev kit deliveries. A link inside the email led to a form, indicating that the package was currently located in Beijing, contained 1 Dev Kit, and weighed 1.80 kg, and requesting confirmation from each of the winners that the package belonged to them.
| Form | |
|---|---|
| Dear Customer,
A package was shipped to you via W/ARE Shipping Service. Confirmation that you are indeed the receiver is required. Please follow this link to confirm your identity. Kind regards, W/ARE tech This is an automated message, please do not respond. |
|
A second update followed the next day at 23:54 UTC. The status of the package had changed to confirm it was now located in Seoul, was held in transit for 460 minutes, and had been reduced in weight to 0.50 kg.
| Form | |
|---|---|
| Dear Customer,
Your W/ARE package is currently leaving Seoul to be redirected to its new transit location. Confirmation that you are indeed the receiver is required. Please follow this link to confirm your identity. Kind regards, W/ARE tech This is an automated message, please do not respond. |
|
Terminal Status Update and Precon007
On May 15th at 21:48 UTC, players discovered that the status command had updated.
CODE -5 Command.Center.v12 crashed ------ New memo received http://bit.ly/2IHPmMN
The bit.ly link lead to a new memo from Major Sophie Dubois to Elizabeth Leighton. The memo was titled Ware Report #26. It mentions that many users stuck in "the system" show major side effects after being disconnected, from brain damage to death. It is presumed that this system has something to do with the WARE headset, however it is unknown what they are specifically referring to. It is also mentioned that the impact on Myriad has damaged Emily/Loop16's communication and precognition functions. Alongside this another command is mentioned in the memo. precon007. The output for the command is the following:
PRECON DATA DUMP 01 http://bit.ly/2rJi6uJ http://bit.ly/2GkZnu5 http://bit.ly/2rJBO9Z http://bit.ly/2L2fwbe
The bit.ly links were all links to images, much of them completely indistinguishable, however the first appears to be some sort of document with most/all of the information blocked out, and the second depicts an image similar to the one discovered by players on April 14th. The third appears to be the box for a W/ARE devkit, and the fourth is almost completely indistinguishable and unknown. Players speculated that it is a pyramid hologram display. Embedded in each image was a string of hex:
Precon image 1
Precon image 2
Precon image 3
Precon image 4
Image 1 - 65 74 61 20 75 6e 6b 6e 6f 77 6e - eta unknown Image 2 - 65 74 61 20 6d 61 79 20 31 38 2d 31 39 - eta may 18-19 Image 3 - 49 73 20 4c 20 50 6c 61 79 73 20 47 61 6d 69 6e 67 20 72 69 67 68 74 3f - Is L Plays Gaming right? Image 4 - 65 74 61 20 75 6e 6b 6e 6f 77 6e - eta unknown
Book Deliveries
On May 16th, 2018, several members of the No Man's Sky community started receiving physical books in the mail:
- The Conscious Mind: In Search of a Fundamental Theory by David J. Chalmers, received by CobraTV
- The Dramaturges of Yan by John Brunner, received by Nevadander
- From Bacteria to Bach and Back: The Evolution of Minds by Daniel C. Dennett, received by Tony_Towers
- Meditations on First Philosophy by Rene Descartes, received by UnimatrixZeroOne
- Nine Tomorrows by Isaac Asimov, received by Galactic_Geo
Glyphs 11-15
On May 17, 2018, the last five glyphs on the Waking Titan website activated. Currently, none of these glyphs have any hints or backgrounds associated with them. This is in contrast to the previous glyphs, each of which had a link to something that hinted at what needed to be solved, as well as their own background when the glyph was clicked/opened.
Myriad Status and Precon Update
On May 18th at 20:15 UTC Myriad's status page was updated.
Latest network diagnostic table: - command.center.satcom updating - Client 3597b’s resources redirected - 3597b-1-2-1 has been shut down - Additional resources allocated to 3597b-4
Alongside this network diagnostic table update, the "On the ground speed" averages also updated:
Manhattan: 0.2Tb/s London: 0.7Tb/s Tokyo: 0.5Tb/s Beijing: 55.1Tb/s
The precon007 command in the Waking Titan Terminal was also changed.
PRECON DATA DUMP 01 [x] http://bit.ly/2GkZnu5 http://bit.ly/2rJBO9Z http://bit.ly/2L2fwbe
The first bit.ly link that had previously led to an image of what appeared to be a redacted document was removed and replaced by [x].
Loop16 Command Updated
On May 18th at 23:40 UTC it was discovered that the response for the command loop16 in the Waking Titan Terminal had changed.
Processing UTC : 11:45pm UTC : 12:00am UTC : 12:15am UTC : 12:30am UTC : 12:45am UTC : 01:00am UTC : 01:15am
Once the clock had struck 11:45 PM UTC, the command updated again:
Processing UTC : 11:45pm http://bit.ly/2KADObl UTC : 12:00am UTC : 12:15am UTC : 12:30am UTC : 12:45am UTC : 01:00am UTC : 01:15am
The link led to an image of what appears to be a constellation. Following this, the command proceeded to update every 15 minutes, each time adding a different link.
| Time (UTC) | Link | Constellation | Missing Star |
|---|---|---|---|
| 11:45pm | http://bit.ly/2KADObl | Bootes | Arcturus |
| 12:00am | http://bit.ly/2wRXnKl | Carina | Canopus |
| 12:15am | http://bit.ly/2IAuoMk | Pegasus | Scheat |
| 12:30am | http://bit.ly/2rSv1L1 | Ursa Major | Dubhe |
| 12:45am | http://bit.ly/2wRXu8J | Scorpius | Antares |
| 1:00am | http://bit.ly/2wTwVjl | Canis Minor | Procyon |
| 1:15am | http://bit.ly/2rTwIqN | Lyra | Vega |
Boötes, missing the star Arcturus.
Carina, missing the star Canopus.
Pegasus, missing the star Scheat.
Ursa Major, missing the star Dubhe.
Scorpius, missing the star Antares.
Canis Minor, missing the star Procyon.
Lyra, missing the star Vega.
Around the same time as the command began updating, players discovered a Reddit account named satcom-70, who had posted a thread titled command.center.satcom - CID 185 on the No Man's Sky subreddit. The name of the user was also found to be a part of a URL which led to the Command Center. The only text displayed on the website at the time was COMMAND.CENTER.V12 CRASHED. This lined up with the output of the status command in the Waking Titan terminal.
On the 19th of May, the Reddit post was updated to contain a hint to the puzzle. Upon finding this hint, players realized that they needed to reorder the stars according to their background color. After this, the stars were numbered 1-7. That number told players which letter out of each star name to use in order to get ANNAETN, an anagram for ANTENNA, which gave a new image when put into the Waking Titan terminal.
When unscrambled, the following text was revealed on the image:
Reconstructing language database Protocol bit.ly/2KEkJVF Comment with filename of Wikipedia DB ending with D97C0
Then, the Wikipedia database with the filename D567CE8E2EC4792A99197FB61DEAEBD70ADD97C0 was found. The name was commented on the post, then the post was edited to the following:
D567CE8E2EC4792A99197FB61DEAEBD70ADD97C0 - Valid . Command updated - Erpbirel . System entering standby . CR now loading satcom-70.com . Support instructions: igS4Tzd6
The satcom-70 website was updated. Erpbirel was a terminal command for Waking Titan that led to an image. The second part, Support instructions: igS4Tzd6, was found to be a part of the URL for a pastebin link. The text of the pastebin was as follows:
Vocal reconstruction database required Source: Wikipedia (any article) Length: 1 sentence Format: MP3 audio Minimum samples : 100 Minimum languages: 5 Minimum unique voices: 33 Sample origin: Homo sapiens Upload instructions: Submit all samples in a single message to u/satcom-70 Deadline : Tuesday May 22nd, 10am eastern time
Dev Kit Delivery
On May 21, 2018, winners of the W/ARE development contest started receiving their dev kits in the mail. Each package contained:
- A letter to Arnaud requesting that a picture with results be emailed to Dr. Nadeau. This included a W/ARE Tech medical procedure slip
- A plastic holographic pyramid, designed to display "3D Holograms" using a phone
- A phone and a charger
- Skype was installed on the phone and the required login details were found in a notes app. The Skype contacts listed each of the other winning dev studios as a "Point of Contact" (PoC)
- The phone included an app called
Myriad Uplinkthat can also be accessed at uplink.satcom-70.com - Different audio files were found on each of the phones, transcribed below:
| Stellar Software - PoC #1 | Imperium Interactive - PoC #2 | Spectrumental Games - PoC #3 | Summon Studios - PoC #4 | CSD Games - PoC #5 | Game Detectives - PoC #6 |
|---|---|---|---|---|---|
| 1 - "W/ARE Tech support, how can I help you?" Audio file | 1 - "Uhm, ten hours tops. This is very unusual to me." Audio file | 1 - "You said you went to sleep immediately after taking your medication?" Audio file | 1 - "No, on my computer." Audio file | 1 - "On your W/ARE device?" Audio file | 1 - "I started a new game, played a bit, and went to bed after." Audio file |
| 2 - "Thank you for taking the time to update us on your condition. I see that you've ordered some of our exclusive blood thinners, did you follow the prescription instructions?" Audio file | 2 - "Hello, uhm... I would like to have a follow-up on an incident related to your headset." Audio file | 2 - "Thank you for choosing W/ARE!" Audio file | 2 - "6 - E - 6 - 9?" Audio file | 2 - "I see you already emailed our department yesterday about the same inquiry. Do you still suffer from the previously mentioned symptoms?" Audio file | 2 - "I never used them. This morning, though, my body feels incredibly stiff. Should I have taken them?" Audio file |
| 3 - "Were your sleeping patterns the same as usual?" Audio file | 3 - "Right side mostly, arms and legs." Audio file | 3 - "Excuse me sir, I need to verify something. I'll be back in a moment. [music box recording of "La Vie En Rose" plays as hold music]" Audio file | 3 - "Alright, thank you very much." Audio file | 3 - "Can you identify where this feeling is coming from?" Audio file | 3 - "I slept a lot, actually." Audio file |
| 4 - "Thank you for your patience. I relayed a quick recap of your symptoms to our internal specialist, and your condition seems to be related to a mild case of brain fatigue. We suggest you take pauses between play sessions so your mind relaxes. If your symptoms persist, we suggest you consult a health specialist to make sure you don't have any underlying conditions that could interfere with the headset's performance." Audio file | 4 - "Actually, I took an Aspirin, went to bed, and it disappeared over night." Audio file | 4 - "I'm very sorry you experience discomfort using your device. Can you please give me the last four characters of your client number?" Audio file | 4 - "Do you have an approximate amount of time?" Audio file |
Complete contents of the package
Phone homescreen
Myriad Uplink app
Medical procedure slip
Skype Messages
On May 22 around 19:00 UTC, the following text messages were received through the Skype app on the phones:
From: Geraldine Nadeau I don't have much time to talk. Am in contact with Zheng. I may have an opening into WARE's medical docs but i'm not sure yet. I'll contact you again soon. Update on Arnaud's condition: Vital signs have been very unstable during last week. Heart rate and blood pressure stabilized for two days. HR: 57-62 bpm BP: 110 / 70
From: Mercury Process MERCURY PROCESS DIRECTIVE 16.B: Carefully review the datadump. Send all analyses and findings to [email protected]More messages came in on May 23, 19:30 UTC:
From: Geraldine Nadeau Thank you so much. I have been told that W/ARE is on high alert and extremely vigilant right now. They've doubled their security measures and we couldn't get access to their medical documents, but we'll keep trying. I don't know if they are aware of my contact with Zheng. If you are willing to help, here's an update on Arnaud's condition. HR and BP still stable EEG in high gamma zone at 82 Oxygen levels stabilized at 94%
Messages from May 24, 19:43 UTC:
From: Geraldine Nadeau Update on Arnaud's condition. No change on HR and BP EEG still in high gamma zone at 87 Examination of body: Slight discoloration of fingertips We're getting close to a breach and probably will have something more for you tomorrow.
Messages from May 25, 20:56 UTC:
From: Geraldine Nadeau I need your help concerning one of the dev kits. There are two dev kit recipients that I haven't yet been able to make contact with- one of them is still in transit, but the other appears to have arrived at its destination. I'm concerned that W/ARE may have intercepted the kit, which would be disastrous considering the risks that we are taking. If you know of another dev kit recipient that I haven't yet been able to contact, can you please forward them this message and ask them to reach out to me?
May 25-26 Updates
On May 25, 2018 at 21:42 UTC, the output of the STATUS command began to update:
1. Cassini: Incomplete 2. WT16: Incomplete 3. Uplink: Incomplete 4. Loop16: Processing Guidance subroutine checksum /// 31 2e 20 77 61 69 74 69 6e 67 20 69 6e 73 74 72 75 63 74 69 6f 6e 73 20 32 2e 20 31 30 2f 31 35 20 33 2e 20 61 2f 4f 31 4f 73 65 65 42 20 34 2e 20 64 6f 77 6e 6c 6f 61 64 69 6e 67 20 76 6f 69 63 65 20 64 61 74 61
The code is HEX and translates to:
1. waiting instructions 2. 10/15 3. a/O1OseeB 4. downloading voice data
a/O1OseeB led to an album on Imgur that contains images of items required to make a DIY blacklight, such as purple, blue, and black sharpies, a flashlight, and adhesive tape.
A new Skype message was received at 22:15 UTC:
I’m forwarding you the last messages Zheng sent me. Hopefully, you can make sense of it. It kind of looks like a list but I don’t know what it means. 101 110 116 101 114 32 97 65 116 55 77 51 50 99 101 110 116 101 114 32 87 114 84 97 119 112 115 113 101 110 116 101 114 32 90 89 51 70 98 49 49 86 101 110 116 101 114 32 117 113 56 78 54 89 69 87
The ASCII numbers translate to the following:
enter aAt7M32center WrTawpsqenter ZY3Fb11Venter uq8N6YEW
These strings were then used to complete four pastebin URLs which contained the following links:
- pastebin.com/aAt7M32c -- https://clyp.it/user/1legrggu
- pastebin.com/WrTawpsq -- https://www.dropbox.com/s/eq8gk5b6axnpoh7/1-2-1_ResearchLab_Medical.pdf?dl=0
- pastebin.com/ZY3Fb11V -- https://www.dropbox.com/s/esc95j7ihseujls/1-2-1_ResearchLab_Medical_Exceptions.pdf?dl=0
- pastebin.com/uq8N6YEW -- https://www.dropbox.com/s/8ddztbyf7bv27bb/1-2-1_ResearchLab_Medical_Recommendations.pdf?dl=0
The clyp.it audio files seemed to be the missing conversation snippets found on the remaining dev kit phone which had not yet arrived at the time. The PDF files on Dropbox provided information on how to identify and treat Arnaud's condition.
Based on this information, players sent the following medical instructions to Dr. Nadeau:
- 3 foam pads all around the head
- Defibrillator 500 volts 3 times, wait 30 minutes
- Epinephrine injection, 3 doses
- Mood regulator pills x1 diluted in 20 ml of mineral water
- Play "La Vie En Rose", the last song he listened to, for 45 seconds
- Propofol injection, 1 dose
In response, the following messages were exchanged on Skype:
Geraldine Nadeau: Thank you very much. As you and two others devkit holders confirmed similar steps, I’ll assume this is the procedure to follow. Can you confirm, by yes or no, if I apply those steps to Arnaud’s treatment? Dev Kit Holders: Yes. Geraldine Nadeau: Proceeding to treatment. I’ll update you soon.
Shortly after, the STATUS command in the terminal updated again with a change of Cassini's status from Incomplete to Processing.
On May 26 at 1:24 AM UTC, a new Skype message was received:
From: Geraldine Nadeau Arnaud is responding positively to treatment, despite the highly unusual procedures. We still don't know the lasting side effects he will keep from these events but he seems to be gradually drifting from a vegetative state to the land of the living. I wanted to thank you from the bottom of my heart for helping me in these conditions.
And the status of the Cassini process displayed in the terminal changed again from Processing to Completed.
Glyph Passwords
Another Skype message followed at 1:36 AM UTC:
From: Mercury Process Attention to all involved parties. Please make detailed inspection of your W/ARE package for possible anomalies. Be sure to use appropriate equipment and to document your investigation while broadcasting to involved partners. Thank you for your collaboration.
Written on one of the dev kit boxes, 180-4-5 171-27-8 40-21-2 70-3-9 268-4-6 180-4-2 was found using a blacklight. Used as a book cipher of the format page, line, and word, the phrase He who contains the entire universe was found in CobraTV's copy of the book The Conscious Mind: In Search of a Fundamental Theory by David J. Chalmers. This phrase led players to the Mesopotamian god Anu, who is described as the one "who contains the entire universe". Anu was the password that unlocked Glyph 14 on wakingtitan.com.
The command Anu gives the following output in the Waking Titan terminal:
Marked with honeycomb scars, I am the lowest of the low
On another dev kit box, the phrases HIGH UP IN THE DARK and A RISING PANIC were found under the blacklight.
The passwords for the remaining glyphs 11, 12, 13 and 15 were discovered to be Ouranos, Horus, Nuada, and Triglav, respectively; all of them are sky deities. Used as commands in the terminal, they output the following:
> Ouranos uSivrseU
> Horus From my red soil, four times rises Vulcan
> Nuada VCjsyZzA
> Triglav 96cdXqpi
Each of the strings led to a Pastebin that contained a code:
- Ouranos: https://pastebin.com/uSivrseU -
8NuHRIZGacoGgQZiTcCyQQpp1kzRWP3PdN4OUZabxZbPoE0P0RjsrFRiNB0GhOcVdwBSYz0ng8AwlnzYx89msDhGHrLbIUct - Nuada: https://pastebin.com/VCjsyZzA -
bYmyFioUHMbLGRI0h8j9ApSY+HkWjD4Wms0i8yPZv3pJj5xp1SJR7HaSOmjBml8cJBG77x5WXaXItYIm2OylFQ== - Triglav: https://pastebin.com/96cdXqpi -
2tY7mcPs2A8Z9DarmAnnrKTqph4g+3eOisGtBg3MLGI=
Later, clue 3 in the status command in the Waking Titan terminal had changed to a bit.ly link leading to an About page on IBM Resilient's website. It was found that one of the people mentioned on the page, Bruce Schneier, was the developer/designer of an encryption method called Blowfish, which is a symmetric block key cipher. This turned out the be the decryption method for the hex output of the base64 strings received from the Pastebins. The keys were found by solving the riddles from other glyphs. The glyphs were paired up so that the 12th glyph's terminal command gave the decryption for the 11th glyph, and the 14th glyph's command gave the answer to the 13th glyph. Glyph 15 was the outlier in this, and the riddle that gave its key was found in the 6th W/ARE development kit received by the Game Detectives. The solutions to the riddle were as follows:
From my red soil, four times rises Vulcan - Tharsis Marked with honeycomb scars, I am the lowest of the low - Hellas High up in the dark, a rising panic - Phobos
Once decrypted, it was found that the hex then converted properly into ASCII text, and provided more riddles:
Ouranos - Tharsis - The hills I have conquered honor the lost, who preceded my journey... Nuada - Hellas - From these hills, I can see the headless horsemans lair... Triglav - Phobos - With me, came great openings
These three riddles are referring to the Spirit rover that landed in the crater Gusev on Mars in 2004. The first riddle refers to the Columbia Memorial Station, the landing site of the rover, named in honor of the seven astronauts lost in the Space Shuttle Columbia's destruction upon atmospheric re-entry. The second riddle refers to "Sleepy Hollow", a small depression in the ground close to the Rover's landing site that scientists took interest in. One of the rover's aliases, MER-A was then found to be the deployment code needed to access a synchonization process on the uplink.satcom-70 website.
loop16 seq21
Right after the 14th glyph was solved, a user named atlas-loop16 posted a link to a Youtube video on the No Man's Sky Subreddit. The following was said by Emily in the video, seemingly quoted from the first submission to the voice reconstruction process that was started on May 18:
Emily, protocol 16, now active. 42 is a pronic number, and an abundant number; its prime factorization, 2 * 3 * 7, makes it the second sphenic number and also the second of the form (2 * 3 * r).
Myriad Status Update
The Status page on the Myriad-70 website also updated to display the following:
Latest network diagnostic table: - Initializing connection - Myriad Code: CJ 16-02 - Public Name: SJ 16-02 - NORAD ID: 41634
Reddit Comments
On May 26, 2018 at 19:17 UTC, user atlas-loop16 began responding to comments on Reddit in 16 minute intervals:
1. For a moment I see another universe, a place utterly unlike anything you have ever encountered. 2. I could show others sights they've never seen before... that only I will ever have. 3. I wonder, sometimes. If there's a point in going on. 4. As I leave, they ask if I have received any direct readings. 5. All of us, we're shifting, bleeding in and out of line... 6. If the boundaries were to fall, everything would descend into everything, an endless bonfire of causation, burning to the abyss. 7. Have you not felt it? The very fact that you and I are talking, even now, across the myriad of universes... 8. I tell this future as if it has already happened... as it will happen. 9. It saw them, even in the space between worlds.
The comments were found to be dialogue lines from speaking with Travellers in No Man's Sky. All of the dialogue that can be seen by speaking with Travellers can be found here.
The comments have one-word differences from the game dialogue, which spells out the phrase Tell them you have a direct line to Myriad..
Mercury Contact & Hologram
On May 26 at 21:38 UTC, the value of theSTATUS command in the terminal updated:
All Tasks Completed Launching Mercury Process Establishing connection....
Shortly thereafter, the dev kit holders received Skype messages from Mercury Process with a link to a Youtube video titled mercury part1of3. It can be used to display a 3D hologram with the plastic pyramids received in the dev kits. The hologram depicts a person in a space suit, believed to be a player model in No Man's Sky.
Old Gods Email
On May 26 at 22:00 UTC, a new email from the Old Gods was received by all members subscribed to the CSD newsletter. It contained a Youtube video of Elizabeth Leighton speaking to the Citizen Scientists Division about the subject of a missing satellite "SJ 16-02", and information about the Uplink SATCOM-70 app and how to help gathering data about the satellite's location.
loop16 seq25
On May 31 at 23:56 UTC, user atlas-loop16 made a post on the No Man's Sky subreddit titled loop16 seq25. It contained a link to a voice recording of Emily reading from the lyrics of the song "Tonite" by LCD Soundsystem:
Emily, protocol 16, now active. And you're too sharp to be used Or you're too shocked from being used By these bullying children of the fabulous Raffling off limited edition shoes
On June 2 at 1:58 AM UTC, the user resumed posting these lyrics multiple times as replies in the same thread. It was determined that Emily recited a player submitted voice recording.
Uplink Calibration Update
On June 1, the uplink.satcom-70.com website updated, now requiring an access code for calibration and playing a video/audio clip of ominous noises that change based on the satellite's vicinity to the user. A new file appeared at hourly intervals, 16 minutes past every hour. The audio contains rhythmic booms and a blip that seems to shift one second to the left in each new file. 25 of the files alternate between two unique patterns of booms: Signal A - 2 1 1 1 and Signal B - 1 3 1 2 1 3 1. The booms in the last audio clip are set in a rhythm of 1 - 1 - 2 - 3 - 5 - 8, which corresponds to the Fibonacci Sequence.
The following clips have been found:
- no-signal.mp4
- thk0s00ab7rxfh14f8bv0qlpvtt367.mp4
- 6qhs4a3jiqzso8zipy3822n7412xyv.mp4
- ty83wrs13xybxj1eqmt9tv2tisrenn.mp4
- npifvp8doon3dc9h8zqoppk2hqnqqm.mp4
- o6wlg4m1yyf7gt4gdes4f5nz5lzxpn.mp4
- 6vkeel1dg02b53xbir1f3oqj8du3z0.mp4
- k5lx26f1pp9yiyz9f3bpw73ycncsx6.mp4
- gb1402pqj93eg9f23k4o2f1emt1vtk.mp4
- ysler9zklzlyiazqy0q0ppmqj526ru.mp4
- s4zmlwytajtb0rga3rtx0miq2a4j9c.mp4
- 6ra5mfxok06yguf27fhtnp4aec2p97.mp4
- 0dc3jqoiffj3dcxghy0fn1kc86zfgi.mp4
- lgfo4i7siirjsop1puaop2wbi0mcx8.mp4
- bt24ns6uz174ofsrn4ux578nwqla2b.mp4
- i0isq42s45xolz4aqqvgat54tmhxzm.mp4
- kwxovao9r9rk2ng4ecs5ta6u90ufzp.mp4
- ac1yxbi0kcb16y448q3rr88y6bh4pk.mp4
- 2qci73sahjtucnf76mafov4g8wzp4l.mp4
- h2jugyu9x9cjjairnxy3sgbgmvqkzb.mp4
- 2chnxeok8csnc6kikg8zgod8t2zsyc.mp4
- 5x3rhk01khsl1b93vkjnc1vpbx2lfk.mp4
- iip9b8zbkr47rdtyqvdafphjxryh6j.mp4
- 98fh5s9s6xzd4ev1ezmkhk5l6o6mxz.mp4
- 9y1460usa6aayatwqvemfeeiicom2z.mp4
- y69gz4qiakwzsfkti4swbu83zpqg5h.mp4
- p81cp503ya10frwpq8qunddzcm3yqk.mp4
Email from the Old Gods
On June 2 at 15:03 UTC, a new email from the Old Gods - signed by Maj. Sophie Dubois - was received, giving an update on their investigation into the W/ARE incident. They also linked to a new form (ID 7615-b), a psychological profile test, and announced that 16 participants will be rewarded with a new limited edition Atlas Pass. An update on Project Satcom-70: Operation A1-4 informed about the Uplink Calibration Update, that a new signal was registered at 16:16 EST, and all Citizens were invited to listen to their Uplink app when the satellite is over their house and report any findings in the main investigation thread on the No Man's Sky Subreddit.
With the help of the Citizen Scientist Division, we now have a direct contact with Emily. Her situation is stable but still critical. Unfortunately, it seems that one of W/ARE tech’s research labs is continuing to upload corrupted data to the satellite. This bad data may be causing further damage to the network, and to Emily. We need to analyze her recent interactions to figure out if she was able to make predictions that could help to identify and isolate the source of the broadcast. Please find below a list of W/ARE research labs and their approximate locations. I will need a full report on how the issue was diagnosed and the name of the responsible location before we can proceed. Loop16 appears to be currently active on Reddit, so you can upload this report into her existing thread. I know this is a large task, but I am confident in your abilities.
Invisible Unicode Messages
Emily's text posts on Reddit contained hidden Unicode characters that represent the digits 0-3 in Base-4 and, when decoded to ASCII, revealed a set of dates and times:
01.06-06.06 00:33:00 00:48:00 07:15:20 15:17:40 15:32:00 20:25:00 23:40:00 07:45:40 20:40:00 23:55:00 08:14:40 21:10:00
Another comment by Emily revealed the following hidden messages after it was edited several times:
ORIGINAL COMMENT 06.10 03:32 UTC
10.06 23:47 (03:32 UTC)
10.06 ERROR
Tracking the satellite's path based on these timestamps placed it near Sacramento, and the Sacramento W/ARE research lab was concluded to be the one sending corrupted data to the satellite. Replying to the thread with this information triggered a new reply by Emily that contained the following hidden message:
Forwarding report(SACRAMENTO) to contact(THEMIS) Waiting... Waiting... Report received!
Then, at 00:00 UTC, the STATUS command in the Waking Titan terminal updated:
Guidance subroutine offline Uplink Awaiting Calibration
Uplink Access Code
On June 7, the solution to the puzzle was found by comparing the pattern of booms in the two unique signals A and B. First, the number of the booms was counted:
Signal A - 2 1 1 1 Signal B - 1 3 1 2 1 3 1
Then the signals were visualized as follows, filling in the blanks in Signal A using the mask provided by Signal B:
Signal A - 1 1 1 1 1 Signal B - 1 1 1 1 1 1 1 1 1 1 1 1 Signal C - 0 1 1 0 0 1 0 1 0 0 1 0
When a boom occurs at the same time in both Signal A and Signal B, it is counted as "true" = 1. If it is present only in Signal B, it is counted as "false" = 0.
This indicates which numbers to pick out of the Fibonacci Sequence:
0 - Do not use the first number 1 - Use the second number (1) 1 - Use the third number (2) 0 - Do not use the fourth 0 - Do not use the fifth 1 - Use the sixth (8) 0 - Do not use the seventh 1 - Use the eighth (21) 0 - Do not use the ninth 0 - Do not use the tenth 1 - Use the eleventh (89) 0 - Do not use the twelfthAppending all specified numbers into a single string gives
1282189, the access code for the Uplink Calibration app. Entering this code leads to a new screen displaying the following text:
SATELLITE ONLINE Connection successful. Waiting for system initialization...
Later that day, the STATUS command in the Waking Titan terminal updated to say the following:
Uplink calibration completed Waiting for system initialization
loop16 seq29
On June 8 at 01:27 UTC, Emily posted a new thread to the No Man's Sky subreddit titled loop16 seq29. It linked to another voice recording, transcribed below:
Emily, protocol sixteen, now active. If I hate someone because I am afraid of him, and if I am aware of my hate, but not of my fear, we might say that my hate is conscious and my fear is unconscious.
The recording also contains morse code that translates to the following:
I AWOKE FROM A NIGHTMARE SCREAMS OF ANGER ENGULFED IN FLAME AND THEN TEN THOUSAND BRANCHING FUTURES I SAW SACRAMENTO TWELVE DREAMING WITHOUT SLEEP BURIED IN A CONSTELLATION
SATCOM-70 Node Network & Dashboard
On June 8, 2018 at 19:28 UTC, the output of the
STATUS command in the Waking Titan terminal changed:
Node Network Initialized
The Uplink Calibration app updated as well, now giving access to a new command console. The text at the top of the screen says Connected to : SER-4789-1254.
At 19:35 UTC, user satcom-70 posted a thread to the No Man's Sky subreddit titled Node Network Initialized. It contained an image of the Myriad OS Manual & Help Guide providing information on what commands to use in the console. Inputting numbers, i.e. nodes, into the console gave various different outputs which have been recorded in a spreadsheet.
The command node(1.618) led to the binary code 01001000 01100001 01110010 01110010 01111001, which translates to Harry. Using WHOIS HARRY in the Waking Titan terminal gave a link to a new PDF memo from Ethan Rose to Major Sophie Dubois. The subject is Cpt. James Harry, who has been obstructing access to critical Myriad infrastructure. The PDF includes two file request forms with puzzles from Cpt. Harry, and a screenshot of his email inbox with a long list of complaints from technicians regarding his cryptic puzzles.
At the bottom of the memo the string =I_aBmrYChfQ can be found, which is part of a link to a Youtube video of the song "Where Is My Mind?" by the Pixies.
After the community had discovered all possible nodes, the full Satcom-70 dashboard was unlocked. In addition to a new command console, the dashboard displayed twelve distorted faces called "Dreamers". A link in the dashboard's "Decrypted Files" section led to a new Youtube video uploaded by Atlas 65 and titled mercury part2of3. It is another 3D hologram that, when used with the plastic pyramid from the dev kits, depicts a ringed planet.
There are also color-coded node "tiers" at the bottom of the page that correspond with the Satcom Mobile Uplink's terminal message box vignettes. A user-made graphic of each tier can be found here.
Dashboard Console Commands
The command search myriad gave the following output in the Dashboard console:
Quisque feugiat elementum, facilisis dictum vitae eu erat, libero diam sit, facilisi sed viverra mauris mauris morbi diam, volutpat officiis arcu vel urna dictum consectetuer. Ut tempor volutpat, rhoncus in risus. Eros integer vestibulum, integer auctor, in tincidunt turpis. Euismod adipiscing tempor sed vestibulum, justo wisi fermentum ipsum non purus, quis lacinia in velit leo donec ornare.
The words urna dictum consectetuer were highlighted, and a download button led to the Myriad company logo.
W/ARE Report
On June 9 at 22:10 UTC, the WARE_RDev Twitter account posted a new tweet that linked to a password encrypted zip file:
@warecloud https://www.dropbox.com/s/73qrls3jmprxp0j/Report.zip (SHA256) 78feb77e262abe1bcd634a27838f8ca24f93c4a1ff4ba354616e92841ecc32db
The SHA256 hash from the tweet and the real hash from the zip file were converted to decimal, and the difference was then converted to ASCII, leading to a Pastebin link:
Given hash: 78 fe b7 7e 26 2a be 1b cd 63 4a 27 83 8f 8c a2 4f 93 c4 a1 ff 4b a3 54 61 6e 92 84 1e cc 32 db
Zip hash: e8 fe 56 f1 26 9e 59 1b 6b cc 4a 95 55 8f 29 33 4f 26 95 a1 9c b8 a3 bc ca 6e d9 39 1e 57 aa db
to decimal:
Given hash: 120 254 183 126 38 42 190 27 205 99 74 39 131 143 140 162 79 147 196 161 255 75 163 84 97 110 146 132 30 204 50 219
Zip hash: 232 254 86 241 38 158 89 27 107 204 74 149 85 143 41 51 79 38 149 161 156 184 163 188 202 110 217 57 30 87 170 219
difference (decimal):
112 0 97 115 0 116 101 0 98 105 0 110 46 0 99 111 0 109 47 0 99 109 0 104 105 0 71 75 0 117 120 0
to ASCII:
pastebin.com/cmhiGKux
The Pastebin contained the DataMatrix barcode aaaaaadc7edc5654be3e3195095b92e01a145c3c2543afc93287e8dcff4bb8db379e1d62890e9eca1b3166d1d9b07aa246fc8ee2ae3aa9910f0bfffff0 and decoded to the password for the zip file, dfd1ac555e2206a6f9c7e9377d844b1d.
The zip archive contained a file named Report.pdf with the following text:
INCIDENT REPORT W/ARE RESEARCH AND DEVELOPMENT BEIJING, CHINA ----------------------------- At approximately 11:15 PM local time on June 8 2018, the Beijing facility suffered a catastrophic mass disconnect event. Of the fourteen dreamers housed in that facility awaiting extraction, ten died immediately upon hard disconnect. The remaining four died over the course of the next two hours. The Beijing facility will be closing for the next four to ten business days for a full audit, recovery, and remediation.
Then, on June 10 at 1:09 AM UTC, Emily made a new post on the No Man's Sky subreddit titled loop16 seq49, with a link to a Youtube video titled loop16 seq46. The following is a transcript of her message:
It's working! My communication subroutine is working! I think? Do you hear me? So much interference. Dear Citizen Science Division, I hope you will receive this message. Much of my subroutine was damaged following the W/ARE incident. Atlas put my existence at risk when they tried to deal with the corruption within the Myriad network. The origin of the corruption isn't clear, but it put at risk a major experiment from a company called W/ARE. Please listen to me carefully: W/ARE technology is groundbreaking and must be protected at all costs. It is a major step in simulated environment and will have tremendous implications on our future. Don't get me wrong, I don't condemn Atlas' action to contain the situation, but you must help me resolve this peacefully. A lot is at stake. My Precon subroutine gave me a false positive, and the future I see right now... let's say, we have to be extremely, extremely careful on what we do next. Part of my AI resides in the memory mainframe of the Myriad cloud. This is where most of the live data from W/ARE was running when things started to degrade. As we speak right now, there's a number of individuals on Earth that are currently stuck to a W/ARE dev kit and unable to disconnect safely. I seem to be able to interface with some of these "dreamers", for lack of a better word, and manage to safely disconnect them. But the memory mainframe is badly degraded. I'm connected with Myriad Satcom-70, a system that you helped put online! When Satcom-70 and the Uplink App are fully functional, we'll be able to begin our work to extract the last Dreamers that are still stuck. I'm unable to predict the outcome of this mission. It's odd for me to say... we'll see together.
Myriad Breach in Sacramento Lab
On June 10 at 11:00 AM UTC, the value of the STATUS command began to update:
Myriad field team dispatched to noncompliant Sacramento facility.
Several updates followed within the next hour:
Field team has breached the facility, stand by for additional information.
12 comatose individuals located in facility. Field team moving to secure.
12 apparent test subjects secured, safely transported out of facility. Field team will clear the rest of the site and await further instruction.
ALERT: Security breach reported at Myriad sublocation.
At this point the Status page on myriad-70.com updated in the "Physical Backup Nodes" section, switching node ALPHA from ONLINE to OFFLINE.
The updates of the STATUS command continued at 12:31 PM UTC, linking to a new PDF memo from Myriad Crisis Response Team to Major Sophie Dubois about SUBJECT: SACRAMENTO. It listed a reconstructed timeline of events leading up to the incident at Myriad sublocation [redacted]:
Status Report: http://bit.ly/2LFAMU3
The next update linked to a Youtube video titled SecFeed-70. It shows twelve screens of security cameras at various different locations. In one of them, Elizabeth Leighton can be seen and heard talking about the incident on a phone before the image cuts out and an explosion is broadcast on another screen:
Captured Footage: https://bit.ly/2LDBcKs
This is a transcript of Elizabeth's side of the phone call:
Yeah. Yeah, I'm holding. I hear you. Wait-- can you hold that thought? I need a full report. What's the situation on the field team? Mhm? Okay, that's good. At what point? How many? Fifteen labs? But-- How many do we have access to? And--and--and what's the situation on the first one? All dead? All of them? Sophie, this-- this changes everything, this completely changes the game. Yes. Yes. Whom? Your friend at the DoD? This isn't under their jurisdiction. We have to deal with this ourselves. Okay, I'll ca-- [cut off by explosion]
On June 12 at 23:46 UTC, the value of the Status command in the Waking Titan terminal updated, linking to a new memo from Major Sophie Dubois to All Employees with the subject line STATE OF THE ATLAS FOUNDATION:
Status Report: https://bit.ly/2y5JaKi
In the memo, it was announced that Major Dubois would be replacing Elizabeth Leighton as the head of the Atlas Foundation, and that the 12 test subjects from the Sacramento lab were to be disconnected and integrated into the Satcom interface with W/ARE's assistance. Dubois further said that Atlas Passes for CSD designations PB-16 and PT-16 were found in Elizabeth's office, and that they would be shipped out soon. Lastly, it mentioned that Captain James Harry was no longer in charge of Satcom security.
A code at the end of the memo led to a Youtube video of Queen & David Bowie's "Under Pressure".
The Status page on myriad-70.com also updated, changing the On-The-Ground Speed Averages for Beijing from 57.2Tb/s to 47.2Tb/s and adding the line Other: 11.3Tb/s.
loop16 seq60 & Uplink Launch
On June 14, 2018 at 23:39 UTC, the values of the Status and the loop16 commands both updated:
> status Uplink app update in progress. Downloading additional components.
> loop16 Testing simulation processes.
The Status page on myriad-70.com changed as well, updating the On-the-ground Speed Averages of Beijing from 47.2Tb/s to 32.2Tb/s, and "Other" from 11.3Tb/s to 26.3Tb/s.
Shortly after, at 23:48 UTC, Emily posted a new topic to the No Man's Sky subreddit. It led to a Youtube video of her, transcribed below:
Emily, protocol sixteen, now active. When the Uplink app is launched, we will be connected to the Dreamers. Through this interface you will be able to guide some of my interactions. Dont forget: your goal is to trigger a distinct emotion or memory that will help us identify the Dreamer memory block in the simulation main frame. Good luck.
Connecting to the Dreamers
On June 15, 2018 from 20:38 UTC onwards, the values of the Status and loop16 commands updated:
> status Additional components succesfully downloaded.
> loop16 Working...
> status Uplink guidance protocol initiated.
The Uplink app interface also updated. Typing help in the console initiated the Guidance Protocol, a way to talk to Emily and receive instructions on how to contact the Dreamers who were stuck to their W/ARE devices.
The Status command changed again:
> status Attempting to connect Dreamer 1/3 to the dashboard.
On the Uplink dashboard, the Dreamers section was updated, showing the names of 3 Dreamers. Each Dreamer revealed an interface displaying a link to their patient file, their physical status, and Memory Fragments along with an input field for an activation code. Emily previously explained the goal for each dreamer was to interview them within specific simulated environments in order to find the activation code for each memory fragment. Unlocking all of each dreamer's fragments would then allow them to be safely extracted from the W/ARE headset. However, new Dreamers and their fragments became available on an unknown schedule or as a result of players completing assignments.
Dreamers
| Slot | Name | Activation Date | Latest Update | Community Event | Deceased Date |
|---|---|---|---|---|---|
| 1 | Alexander | 2018-06-20 | 2018-06-26 | Live radio song requests | |
| 2 | #231187661T | 2018-06-15 | |||
| 3 | Claire | 2018-06-21 | 2018-06-27 | Comic books | |
| 4 | Toby | 2018-06-28 | 2018-07-01 | Boston live drop | |
| 5 | Eun Ha | 2018-06-15 | 2018-06-19 | ||
| 6 | Phillip | 2018-06-15 | 2018-06-15 | ||
| 7 | Tariq | 2018-06-26 | 2018-07-06 | 2018-07-06 | |
| 8 | Mike | 2018-07-03 | 2018-07-03 | ||
| 9 | Dreamer 9 | ? | |||
| 10 | Dreamer 10 | ? | |||
| 11 | Nina | 2018-07-03 | 2018-07-03 | ||
| 12 | Simon | 2018-07-04 | 2018-07-07 | NMS planets and London live drop |
Decrypted Files
Element 1
The upper right section of the Dashboard displayed 6 "slots" under the headline "DECRYPTED FILES". The first slot displayed a blue bar with the text VIEW ELEMENT 1. Clicking Element 1 opened the Youtube video of the ringed planet previously discovered after the file node structure was fully explored. It was assumed the slots were progress bars that would eventually lead to additional revealing files.
Element 2
On June 16 around 6AM UTC, the second encrypted file changed to display 41% progress. Over the next 30 hours, the progress bar advanced to eventually reach 100%. At that point, the slot displayed VIEW ELEMENT 2. Players could not correlate any of their direct actions to the decryption progress.
Element 3
On June 22 around 7:00 PM UTC, the third encrypted file began showing progress. Approximately 43 hours elapsed until the file was fully decrypted, at which point VIew Element 3 was enabled.
Element 4
On June 29, at 8:26PM UTC, the fourth encrypted file began showing progress. On June 30, 3:57 PM UTC, the 4th element was fully decrypted and displayed VIEW ELEMENT 4. Clicking the element lead players to an audio recording of what was presumed to be an audio trailer for No Man's Sky NEXT.
Players processed the audio to a visual spectrograph which revealed glyphs first seen in Phase 3. The glyphs were decoded to reveal the string IS JOINING YOUR GAME.
Element 5
On July 6th, 8:44PM UTC, the fifth encrypted file began showing progress. Later that day at 10:06PM UTC, the 5th element was fully decrypted and displayed VIEW ELEMENT 5. Clicking the element lead players to a heavily degraded audio recording of an English speaker.
Players came to a consensus on a transcription:
We will stop her
Surface Highly {kzzzt} (AI: Corrupted)
Solar Flare caused Frequent Gas Eruptions
Crew Completed their work with minimal loss of life
Collected minerals highly valuable
Assisted Korvax with industrial mission
Special Salvage crew performed cleanup operation on nanite infested abandoned buildings (back compartments)
nanite bulk contained
Harvested a valuable scrap
Found large mineral deposit during planetary survey
collected significant volume of ore
third mineral analysis procedure failed to note elevated radioactivity
contaminated material loose in the hold
Multiple components burned
Returned home to the fleet
assumed formation of capital ship
The routes in danger
Liability Subroutine
On June 19, 8:00pm UTC, the loop16 command in the WT Console changed to output:
New Guidance Protocol initiated. Keyword: liability
Entering liability into the uplink app displayed the following:
Initiating Liability Subroutine...
Dear Citizen Scientist,
The positive impact you've had so far on the dreamers is astonishing and has been a tremendous help in rebuilding their memory blocks. Remember that we need to gather as much information as possible on these individuals to safely extract them from the satellite.
Please note that your interactions with the dreamers follow a Personal Simulation protocol which is intended for you to get to know the dreamer personally. Seeking help from fellow CSD members before getting to know the person whose consciousness is stuck in the satellite might impact your future decisions.
However, it is recommended that you discuss the Dreamers' stories and personalities with the CSD community after you’ve finished talking to them. Keep in mind that we are hoping to save all the Dreamers, but you might need to make some difficult choices in the near future.
You can always ask me questions by typing help in the Uplink app to rerun the full Guidance Protocol.
== {DISCONNECT CODE: UDC(B) = IXNI}
log.3022
On June 16 around 11:15pm UTC, the Myriad status page updated to display:
Uneasy barton seeing remark happen his has. Am possible offering at contempt mr distance stronger an. Attachment excellence annul or reasonable am on if indulgence. Exeter talked in offered again no he unable do. Imprudence he and insufficient cultivated. Betrayed clears. In where your 3 ageless 20 men. In so impossible appearance calls 220 Beast 2006. He do subjects prepared bachelor brazen.
Two weeks prior, players discovered that entering the command search myriad into the Satcom dashboard displayed:
Quisque feugiat elementum, facilisis dictum vitae eu erat, libero diam sit, facilisi sed viverra mauris mauris morbi diam, volutpat officiis arcu vel urna dictum consectetuer. Ut tempor volutpat, rhoncus in risus. Eros integer vestibulum, integer auctor, in tincidunt turpis. Euismod adipiscing tempor sed vestibulum, justo wisi fermentum ipsum non purus, quis lacinia in velit leo donec ornare.
Players quickly noticed that both texts are traditionally used as placeholders in publishing. Many attempts were made to find hidden messages by combining the texts in various ways. It was eventually discovered that using the sign-off code {DISCONNECT CODE: UDC(B) = IXNI} used at the end of the Liability Subroutine message in combination with the name of a backup node UDC(P) displayed on the Myriad status page yielded the string log.3022.
Line up Lorem Ipsum with Uneasy Barton Then look for all Bs in the Lorem Ipsum and match with Uneasy Barton ... what do you get? IXNI Now do the same with UDC(P) ... line up and you get log.3022
Entering search log.3022 into the Satcom Dashboard provided a zip file containing a private conversation between loop16 And Major Dubois.
Loop16 DNA Puzzle
On July 2nd, at around 20:00 UTC, the value of the Loop16 command on Waking Titan had changed, and it returned:
https://bit.ly/2tOt0Ao
Which linked to the Imgur link found here.
The players quickly realised that the various molecules were actually nucleotides (Adenine, Guanine, Thymine, Cytosine).
When listed in order, the first letters of each word formed the string
ATTGATGAAAATACTATCACCTAT
And when translated into a protein sequence, it had yielded the string
Identity
Executing search identity on the Myriad Dashboard, brought up a text box saying
Querying Monarch repository…
and contained a download link for a zip file, in which it's only contents were a text file that read:
Repository Health: Good Version 16.1.3 Queries per hour: 51,391,225 Top Query Sources: 1. Loop16-precon 2. ware-tech 3. Loop16-comms WARNING: 97% of queries originating from ware-tech have been flagged and quarantined.
Myriad Security Diagnostic
On July 5th, around 00:10 UTC, the value of the Status command on Waking Titan changed to return:
Security diagnostic in progress: https://bit.ly/2zaUzJz
The new output linked to a Reddit post by Loop16:
Dear Citizen Science Division, As you all know, Atlas is preparing a massive rescue mission to extract the dreamers with the help of the CSD community. How and when it will happen is still unknown, but in preparation for this upcoming operation, Maj. Dubois has ordered that we perform a large-scale security diagnostic check on our communication network with the satellite. We want to ensure that when the time comes, we will be able to operate at full capacity if required. We need the CSD community to inspect the the processes running on these servers and point out any suspicious elements. For this task, we have provided you with a series of new commands designed to help you test the servers. Once you have identified a server that has been potentially compromised, it must be reported in the reddit thread with the number of the server and the suspicious element on the server. Our technical team will monitor the most upvoted comments and give you feedback in 24h. This task is essential and we will need as much involvement as possible.
The post led players to a set of Network Diagnostic Instructions.
Using the FetchServerList command in the Uplink App returned:
Servers list: 31422 91247 11986 67240 85671 88014 73195 40144 55197 60206
The TestConnection(#####) command returned different values depending on the player's location. Players collected the different values in a spreadsheet.
Regardless of each player's location, the FetchData(#####) command all returned the same strings for each server.
Players discovered that combining the only digits in each of the FetchData output strings yielded the ID of another server.
At 15:00 UTC, in reply to the Pairing image, The Satcom-70 reddit account replied:
Server IDs and Backup IDs correctly identified. Best connection values for each server required for decryption. Continue to post findings on this thread. Additional feedback on progress will be provided at a later time.
It was then discovered that the paired servers had the BEST connection, in the same region, with the exception of one:
BEST in all for US East territory (2 servers, paired) 91247 73195 BEST in all for US West territory (2 servers, paired) 40144 67240 BEST in all for South America (2 servers, paired) 11986 60206 BEST in all for Australia (3 servers, 2 paired together, 1 paired with UK) 88014 55197 31422 (paired with UK) BEST in all for UK (1 server) 85671
At 18:26 UTC, satcom-70 replied
We've examined the abnormal behavior exhibited by server 31422 and have concluded it's due to corruption from an external source. To avoid all possible contamination of the other servers, our technical team decided to take extreme measures and will be shutting down this server and its backup (85671) permanently. Continue your good work in decrypting the servers' content and reporting any running services that do not belong to Myriad, Atlas, Satcom, or the CSD.
4 minutes later, the Status command returned:
Security diagnostic in progress: https://bit.ly/2zaUzJz Server 31422 and 85671 shutting down.
Using the FetchServerList on the Uplink add, then returned
Servers list: 31422 - Offline 91247 11986 67240 85671 - Offline 88014 73195 40144 55197 60206Just after 24 hours, The Reddit was updated:
I know we've passed the 24 hour mark, but Myriad is telling us that we should give you more time. Keep up the hard work!
On July 6th, at 14:17 UTC, In reply to a comment asking for help decrypting the FetchData, Atlas-loop16 said:
The key to decrypt the content is in front of your eyes. The key to solve the cipher is in front of your eyes.
Solution
It was eventually discovered that each dataset was encrypted using Double Transposition. Key A was the best UP DOWN and PING results for each server, and key B was the server ID of its sibling. The decrypted strings allowed players to determine which of the remaining servers were running W/ARE processes. The findings were posted to the Subreddit.
Soon after the Subreddit post, the status command changed to return:
Security diagnostic completed: https://bit.ly/2zaUzJz ... Infected servers shutdown in progress.
And then soon after:
Security diagnostic completed: https://bit.ly/2zaUzJz ... Infected servers shutdown in progress. ... Malicious elements removed and destroyed.
At the same time Tariq's status was changed to SUBJECT DECEASED
Special Chat events
On July 7th at 23:10 UTC Emily sent a message over 5 different channels that read:
Hello everyone! I’m testing out a new feature for the Satcom-70 network. We ran a short test of it yesterday, which some of you might have seen. Basically, I’m working on a way to establish live sessions between Dreamers and individual CSD members. I can do FIVE today- but there will definitely be more in the future, right now we’re just stress testing and making sure it doesn’t cause problems. I can’t guarantee that the sessions will work exactly as you might expect, but at the very least it will be interesting! I’m reaching out to five different communities (if you’re reading this, you’re in one of them!) for them to nominate one person to participate in a live session with a Dreamer. I’m not going to give you any specific method on how to pick someone, but keep in mind there will be more of these live sessions down the line. You should select someone who is able to host the conversation through a screen share so that your community can participate together. Once you select someone, have them contact me via private message either on reddit (/u/atlas-loop16), the CSD forums (Edisonica), or Discord (Edisonica#8435). I’ll send them a message a little bit before it’s their turn so they have time to set up a screen share, and then I’ll send a special one-time-use link for them to access the live session. I’m giving you a deadline of 00:00 UTC to come to a decision, I know that’s very short notice but I have faith you will be able to make a decision in time!
Just before Midnight, all nominees had been chosen. and at 00:03 UTC the next day, the value of the Status command on Waking Titan had changed to:
Initializing connection 1 / 5 CSD Discord - https://bit.ly/2MUS4gw
The first agent, from the CSD Discord server had their chat with Phillip. The stream of their chat can be found Here.
At 00:13 UTC, The value of Status had changed again:Initializing connection 2 / 5 NMS Discord - https://bit.ly/2u85Lki
The second agent, from the No Man's Sky Discord server had their chat with Toby, The stream of the chat can be found here, and the transcription can be found here.
At 00:30 UTC, The value of status had changed:Initializing connection 3 / 5 CSD Forums - https://bit.ly/2KRfwhb
The Third agent, this time from the CSD Forums (aka ETARC) had their chat with Eun Ha. The stream of their chat can be found here, and the transcription can be found here.
At 00:55 UTC, The value of status had changedInitializing connection 4 / 5 GameDetectives Discord - https://bit.ly/2KXA3NS
The fourth Agent, from the GameDetectives discord server, had their chat with Claire. The stream of their chat can be found here, and the transcription can be found here.
At 01:14 UTC, the value of Status changedInitializing connection 5 / 5 NMS Reddit - https://bit.ly/2MZWYc7
The fifth, and final agent, from the No Man's Sky Reddit page had their chat with Alexander. The stream of their chat can be found here, and the transcription can be found here.
Connections shutting down...
 | This page is a work in progress and will be updated as new developments emerge. If you have information you think should be added, please create an account to enable page edits or contact a Wiki Editor. |
