Difference between revisions of "Corvus"

From Game Detectives Wiki
Jump to: navigation, search
[unchecked revision][checked revision]
(6c6f7462)
 
(6 intermediate revisions by 4 users not shown)
Line 6: Line 6:
 
| description = It's stars, you fools.
 
| description = It's stars, you fools.
 
| creator    = Unknown
 
| creator    = Unknown
| type        = Independent
+
| type        = Investigation
| status      = Active
+
| status      = Discontinued
 
| discovered  = 2017-01-01
 
| discovered  = 2017-01-01
 
}}
 
}}
 
[[Main Page]] > [[List of Investigations]]
 
[[Main Page]] > [[List of Investigations]]
 
+
{{stub}}
 
'''Corvus''' is an ARG that began with secrets hidden within a VR game studio's promotional images.
 
'''Corvus''' is an ARG that began with secrets hidden within a VR game studio's promotional images.
  
Line 48: Line 48:
 
<code>=Unch5mb1R3c1NGI1RWdwBXYsxWZgUnbhRXQ</code>, when reversed, decodes from Base64 to <code>Atanu ellappudu custunnaru</code>, which is [https://en.wikipedia.org/wiki/Telugu_language Telugu] and translates roughly to "he always watches".
 
<code>=Unch5mb1R3c1NGI1RWdwBXYsxWZgUnbhRXQ</code>, when reversed, decodes from Base64 to <code>Atanu ellappudu custunnaru</code>, which is [https://en.wikipedia.org/wiki/Telugu_language Telugu] and translates roughly to "he always watches".
  
<code>d41d8cd98f00b204e9800998ecf8427e</code> is the MD5 hash [http://stackoverflow.com/questions/10909976/why-do-seemingly-empty-files-and-strings-produce-md5sums of an empty string].
+
<code>d41d8cd98f00b204e9800998ecf8427e</code> is the MD5 hash [https://stackoverflow.com/questions/10909976/why-do-seemingly-empty-files-and-strings-produce-md5sums of an empty string].
  
 
== Sniped ==
 
== Sniped ==
  
<code>c50267b906a652f2142cfab006e215c9f6fdc8a01c27680133b781cadd037e8a6dcc001b</code> is the concatenation of a 40 character string <code>c50267b906a652f2142cfab006e215c9f6fdc8a0</code> and the 32-character string <code>1c27680133b781cadd037e8a6dcc001b</code>. The first one is the SHA-1 hash of <code>www</code> and the second – the MD5 hash of <code>sniper</code>, leading to http://subrealitystudios.com/sniper/ on the Subreality Studios website.
+
<code>c50267b906a652f2142cfab006e215c9f6fdc8a01c27680133b781cadd037e8a6dcc001b</code> is the concatenation of a 40 character string <code>c50267b906a652f2142cfab006e215c9f6fdc8a0</code> and the 32-character string <code>1c27680133b781cadd037e8a6dcc001b</code>. The first one is the SHA-1 hash of <code>www</code> and the second – the MD5 hash of <code>sniper</code>, leading to https://subrealitystudios.com/sniper/ on the Subreality Studios website.
  
The [http://subrealitystudios.com/sniper/ /sniper] page contained an embedded Imgur image that has yet to be solved.
+
The [https://subrealitystudios.com/sniper/ /sniper] page contained an embedded Imgur image.
  
http://i.imgur.com/trTc853.png
+
https://i.imgur.com/trTc853.png
 +
 
 +
The image has been solved and reads "eye" and "user" in [https://en.wikipedia.org/wiki/Tamil_language Tamil]
  
 
==6c6f7462==
 
==6c6f7462==
Line 75: Line 77:
 
[[File:telugu.png]]
 
[[File:telugu.png]]
  
The larger word above turned out to be in a language called [https://en.wikipedia.org/wiki/Gurmukhi_alphabet Gurmukhi]; the word is ਖਾਲੀ, and means "empty," according to Discord user taru. This continues the theme of the empty hash from earlier.
+
The larger word above turned out to be in a language called [https://en.wikipedia.org/wiki/Gurmukhi_alphabet Gurmukhi]; the word is ਖਾਲੀ, and means "empty." This continues the theme of the empty hash from earlier.
  
 
==Sunbaked and Crow's Calling==
 
==Sunbaked and Crow's Calling==
  
At this point, Discord users Jeppevinkel and jumpre discovered that there were two more pages added to the Subreality Studios website. Jeppevinkel discovered http://subrealitystudios.com/sunbaked/, which contains a pixelated image of a red herring, implying that it is a dead end. Jumpre discovered the page http://subrealitystudios.com/crowscalling/, which contains [http://i.imgur.com/hJmFY95.png the image of a text message conversation] containing a hash:
+
At this point, it was discovered that there were two more pages added to the Subreality Studios website. One page, https://subrealitystudios.com/sunbaked/, contains a pixelated image of a red herring, implying that it is a dead end. The other page, https://subrealitystudios.com/crowscalling/, contains [https://i.imgur.com/hJmFY95.png the image of a text message conversation] containing a hash:
  
 
<pre>
 
<pre>
Line 89: Line 91:
  
 
==Account==
 
==Account==
 
+
The empty hash that was found was a password for the Google Account that had posted the video (the hash in the username decodes to "lotb"):
Discord user jumpre discovered that the empty hash that was found was a password for the Google Account that had posted the video (the hash in the username decodes to "lotb"):
 
  
 
<pre>
 
<pre>

Latest revision as of 20:13, 30 May 2018

Corvus
Discontinued
Corvus.jpg
It's stars, you fools.
Type Investigation
Creator Unknown
Discovered 2017-01-01

Main Page > List of Investigations

Corvus is an ARG that began with secrets hidden within a VR game studio's promotional images.

Subreality Studios

A gallery of secrets

The VR game studio Subreality Studios posted a reddit thread promoting their new Discord server and linking to an Imgur gallery containing screenshots of their currently released games. Small letters were hidden in these images, spelling out /a/8nLqb.

This was another Imgur gallery link, depicting the constellation of Corvus.

Users investigating the ARG in the Subreality Discord server were given a special Corvus role, allowing them into a private #corvus channel. Three messages have been posted by the Mee6 Discord bot to that channel.

Mee6 Bot Avatar.png
Mee6
BOT
01/01/2017 at 5:01 AM
=Unch5mb1R3c1NGI1RWdwBXYsxWZgUnbhRXQ

d41d8cd98f00b204e9800998ecf8427e

Mee6 Bot Avatar.png
Mee6
BOT
01/01/2017 at 6:00 PM
c50267b906a652f2142cfab006e215c9f6fdc8a01c27680133b781cadd037e8a6dcc001b

=Unch5mb1R3c1NGI1RWdwBXYsxWZgUnbhRXQ, when reversed, decodes from Base64 to Atanu ellappudu custunnaru, which is Telugu and translates roughly to "he always watches".

d41d8cd98f00b204e9800998ecf8427e is the MD5 hash of an empty string.

Sniped

c50267b906a652f2142cfab006e215c9f6fdc8a01c27680133b781cadd037e8a6dcc001b is the concatenation of a 40 character string c50267b906a652f2142cfab006e215c9f6fdc8a0 and the 32-character string 1c27680133b781cadd037e8a6dcc001b. The first one is the SHA-1 hash of www and the second – the MD5 hash of sniper, leading to https://subrealitystudios.com/sniper/ on the Subreality Studios website.

The /sniper page contained an embedded Imgur image.

trTc853.png

The image has been solved and reads "eye" and "user" in Tamil

6c6f7462

After a few more hours, the Mee6 bot posted another message:

Mee6 Bot Avatar.png
Mee6
BOT
01/01/2017 at 9:41 PM
150164164160163072057057167167167056171157165164165142145056143157155057167141164143150077166075120166112130132165121163114155101

This was found to be octal, and led to a YouTube video https://www.youtube.com/watch?v=PvJXZuQsLmA. The description of the video contains the same Telugu phrase as before, "Atanu ellappuḍū cūstunnāru." Within the video there is a sticky note on a door, which seems to have more words:

Telugu.png

The larger word above turned out to be in a language called Gurmukhi; the word is ਖਾਲੀ, and means "empty." This continues the theme of the empty hash from earlier.

Sunbaked and Crow's Calling

At this point, it was discovered that there were two more pages added to the Subreality Studios website. One page, https://subrealitystudios.com/sunbaked/, contains a pixelated image of a red herring, implying that it is a dead end. The other page, https://subrealitystudios.com/crowscalling/, contains the image of a text message conversation containing a hash:

ca73ab65568cd125c2d27a22bbd9e863c10b675d3d637fc604995b51a048db0058a7c210e57a38ccbbccdf2efb33b52e6c9d0a14dd70b2d415fbea6e0e8a3ad980ec179
856012b7eecf4327e99cd44cd

This hash has yet to be solved.

Account

The empty hash that was found was a password for the Google Account that had posted the video (the hash in the username decodes to "lotb"):

username: [email protected]
password: d41d8cd98f00b204e9800998ecf8427e

The only thing of note within this account is a single email draft, which contains:

e09315fa02d775f3e707a7af455093a1c240583b up

This decodes to look up.