Difference between revisions of "Cyberpunk 2077"

From Game Detectives Wiki
Jump to: navigation, search
[checked revision][checked revision]
(legibility / major edit pass)
Line 13: Line 13:
 
{{backToTop}}
 
{{backToTop}}
  
Cyberpunk 2077 (CP2077) is a story-driven, open world RPG of the dark future from [http://en.cdprojektred.com/ CD PROJEKT RED] (CDPR), creators of ''The Witcher'' series of games. As the release of CP2077 drew closer, CDPR began trickling hidden messages and puzzles to close followers, often rewarding those who solve them fastest with CP2077 merchandise by mail.
+
'''Cyberpunk 2077''' is a story-driven, open world RPG set in a dark future from [http://en.cdprojektred.com/ CD PROJEKT RED] (CDPR), creators of ''The Witcher'' series of games. As the release of Cyberpunk 2077 drew closer, CDPR began trickling hidden messages and puzzles to the community. The ARG is comprised of these puzzles, and quick solvers are often rewarded with Cyberpunk merchandise.
  
 
__TOC__
 
__TOC__
Line 22: Line 22:
 
|dimensions=400
 
|dimensions=400
 
|alignment=right
 
|alignment=right
|description=HAX! I CALL HAX!! A hacker infiltrates Microsoft's E3 2018 presentation to deliver some OP CP77 goodness.
+
|description=A "hacker" infiltrates Microsoft's E3 2018 presentation.
 
|container=frame
 
|container=frame
 
}}
 
}}
  
= E3 HAX =
+
== E3 Presentation ==
  
During Microsoft's E3 2018 presentation slot on June 10th, [https://youtu.be/SxSKxtfBRZ4 a hacker interrupted the speaker], ultimately causing [https://www.youtube.com/watch?v=8X2kIfS6fb8&has_verified=1 a trailer for upcoming release Cyberpunk 2077] to play. Players noticed some valuable info during the hack, including GOG codes which were redeemable for games and, most notably, an IP address, <code>212.91.11.20</code>.
+
During Microsoft's E3 2018 presentation slot on June 10th, [https://youtu.be/SxSKxtfBRZ4 a "hacker" interrupted the speaker], ultimately revealing [https://www.youtube.com/watch?v=8X2kIfS6fb8&has_verified=1 a trailer for Cyberpunk 2077]. Players immediately noticed some valuable info during the trailer, including GOG codes which were redeemable for games and, most notably, an IP address, <code>212.91.11.20</code>.
  
[[Image:CP77-QUADRA.png|thumb|300px|right|Password prompt found on the server the E3 hack's IP address resolved to.]]
+
=== Quadra ===
=== QUADRA ===
+
[[Image:CP77-QUADRA.png|thumb|300px|right|The IP address led to a server with a password prompt.]]
  
Players quickly realized that the IP resolves to [https://www.cyberpunk.net/en/quadra/ a section of CDPR's Cyberpunk 2077 website], where [https://wiki.gamedetectives.net/images/7/75/CP77-QUADRA.png a password prompt was found] along with a welcome message,
+
Players quickly realized that the IP resolved to [https://www.cyberpunk.net/en/quadra/ a section of CDPR's Cyberpunk 2077 website], where [https://wiki.gamedetectives.net/images/7/75/CP77-QUADRA.png a password prompt was found] along with a welcome message. The message read as follows:
 
<pre>
 
<pre>
 
WELCOME TO QUADRA - THE HIGH-PERFORMANCE AUTOMOTIVE SOLUTIONS
 
WELCOME TO QUADRA - THE HIGH-PERFORMANCE AUTOMOTIVE SOLUTIONS
 
WITH A SOUL. PLEASE ENTER YOUR QUADRA VIP USER CREDENTIALS.
 
WITH A SOUL. PLEASE ENTER YOUR QUADRA VIP USER CREDENTIALS.
 
</pre>
 
</pre>
The login field is force-filled to <code>QUADRA V-TECH</code>, which players connected to [https://youtu.be/Ho7PBdVZrY0?t=145 a license plate number from the trailer], <code>NC20 CP77</code>, which serves as the password. Only a very small pool of players were [https://wiki.gamedetectives.net/images/d/d9/CP77-Success.png allowed through], being met with a field to enter their email address. Soon after, the site began to display a message indicating a [https://wiki.gamedetectives.net/images/1/1c/CP77-Quota.png quota had been reached] and that no more emails would be collected. How many players got through in total remains unknown.
+
The login field is force-filled to <code>QUADRA V-TECH</code>, which players connected to [https://youtu.be/Ho7PBdVZrY0?t=145 a license plate number from the trailer], <code>NC20 CP77</code>, which turned out to be the correct password. Only a very small pool of players were [https://wiki.gamedetectives.net/images/d/d9/CP77-Success.png allowed through], and were met with a field to enter their email address. Soon after, the site began to display a message indicating a [https://wiki.gamedetectives.net/images/1/1c/CP77-Quota.png quota had been reached] and that no more emails would be collected.
 +
 
 +
=== Quota Met ===
  
 
[[Image:CP77-Quota.png|thumb|300px|left|Message which greeted players when the password was entered after the quota was filled.]]
 
[[Image:CP77-Quota.png|thumb|300px|left|Message which greeted players when the password was entered after the quota was filled.]]
 
=== Quota Met ===
 
  
 
[[Image:CP77-ASCII.png|thumb|300px|left|ASCII-art output of the SSH server.]]
 
[[Image:CP77-ASCII.png|thumb|300px|left|ASCII-art output of the SSH server.]]
 
[[Image:CP2077-tshirt.png|thumb|200px|right|Art printed on the back of the t-shirts received by players who made the QUADRA cutoff.]]
 
[[Image:CP2077-tshirt.png|thumb|200px|right|Art printed on the back of the t-shirts received by players who made the QUADRA cutoff.]]
  
Suspecting an ARG was building, players began to rummage the site and peruse other related media. A [http://secure.cyberpunk.net/ a "secure" subdomain] was found, along with a [https://www.cyberpunk.net/en/news/20891/e3schedule-inf "E3 Schedule" file]. RTSP is set up on the site, which players suspected might indicate future intent. They discovered the site had an SSH server on the same host, which outputs [https://wiki.gamedetectives.net/images/d/d5/CP77-ASCII.png an ASCII-art message], pictured right. The other output, <code>Permission denied (publickey)</code>, indicates a private key would be needed to access the server.
+
Suspecting an ARG was building, players rummaged through the site and other related media. A [http://secure.cyberpunk.net/ a "secure" subdomain] was found, along with a [https://www.cyberpunk.net/en/news/20891/e3schedule-inf "E3 Schedule" file]. RTSP is set up on the site, which players suspected might indicate future intent. Players discovered the site had an SSH server on the same host, which outputs [https://wiki.gamedetectives.net/images/d/d5/CP77-ASCII.png an ASCII-art message]. The other output, <code>Permission denied (publickey)</code>, indicated a private key was be needed to access the server.
  
Players also uncovered more potential leads in the trailer, including [https://wiki.gamedetectives.net/images/0/0a/CP77-SSH.png lines of debug output from OpenSSH], [https://wiki.gamedetectives.net/images/e/e9/CP77-Barcode.jpg barcodes], [https://wiki.gamedetectives.net/images/9/9f/CP77-PDf417-2.png PDF417 codes], and several messages (usually on screens in the video), [https://wiki.gamedetectives.net/images/e/ed/CP77-Teaser.png including one] which seems to tease the website found.
+
Players also uncovered more potential leads in the trailer, including [https://wiki.gamedetectives.net/images/0/0a/CP77-SSH.png lines of debug output from OpenSSH], [https://wiki.gamedetectives.net/images/e/e9/CP77-Barcode.jpg barcodes], [https://wiki.gamedetectives.net/images/9/9f/CP77-PDf417-2.png PDF417 codes], and several messages (usually on screens in the video), [https://wiki.gamedetectives.net/images/e/ed/CP77-Teaser.png including one] which points toward the QUADRA website.
  
 
<pre>
 
<pre>
Line 65: Line 65:
 
Developers indicated [https://wiki.gamedetectives.net/images/0/02/CP77-Dev1.jpg in multiple messages via Discord] that players should wait as more information is coming. Whether or not the info found in the trailer will prove useful remained unknown.
 
Developers indicated [https://wiki.gamedetectives.net/images/0/02/CP77-Dev1.jpg in multiple messages via Discord] that players should wait as more information is coming. Whether or not the info found in the trailer will prove useful remained unknown.
  
Several [https://www.reddit.com/r/cyberpunkgame/comments/8qty5r/just_got_a_reply_from_quadra_for_the_password/ users on Reddit] who entered the password prior to the quota being met report they received emails from CDPR styled like [https://i.imgur.com/Wel7Use.jpg emails from QUADRA automotive] which request logistic and personal information from the player in order to receive a care package.
+
Several [https://www.reddit.com/r/cyberpunkgame/comments/8qty5r/just_got_a_reply_from_quadra_for_the_password/ users on Reddit] who entered the password prior to the quota being met received emails from CDPR in the style of [https://i.imgur.com/Wel7Use.jpg emails from QUADRA automotive], which request logistic and personal information from the player in order to deliver them a care package.
  
 
=== Drive to the FUTURE through the PAST ===
 
=== Drive to the FUTURE through the PAST ===
 
On DATE players who made the QUADRA cutoff recieved a care package (GALLERY). It contained a CP2077 Quadra styled t-shirt in a QUADRA box. The art on the back of the t-shirt, pictured right, was definitely mysterious, but players found no data despite heavy analysis.
 
  
 
[[Image:CP2077_bitly1.jpg|thumb|400px|left|Concept art which was edited by CDPR to contain a bit.ly link (check out the top-right of the image).]]
 
[[Image:CP2077_bitly1.jpg|thumb|400px|left|Concept art which was edited by CDPR to contain a bit.ly link (check out the top-right of the image).]]
  
= Trauma Team =
+
Players who made the QUADRA cutoff received a care package (GALLERY). It contained a CP2077 Quadra styled t-shirt in a QUADRA box. The art on the back of the t-shirt was mysterious, but players found no leads despite heavy analysis.
  
After a lengthy period of inactivity, the ARG sparked up again when CDPR posted [https://twitter.com/CyberpunkGame/status/1032285684810371074 concept art on their Twitter] on <code>2018-22-08</code>, with one of the [https://wiki.gamedetectives.net/images/e/ed/CP2077_bitly1.jpg concept art], pictured left, containing [http://bit.ly/2kxfbfb a bit.ly link] leading to [https://cdn-l-mkt.cdprojektred.com/other/first_11cg89ul0w.bmp an image]. Opening that image in a text editor leads to [https://cdn-l-mkt.cdprojektred.com/image/second.jpg a second image], which eventually lead to the [https://trauma-team-international.com/ Trauma Team International website].
+
== Trauma Team ==
  
[[Image:CP2077-TT_success.png|thumb|300px|left|Screen seen by "winners" of the OrderID Trauma Team phase.]]
+
On August 22, the ARG sparked up again when CDPR posted [https://twitter.com/CyberpunkGame/status/1032285684810371074 concept art on their Twitter]. One of the pieces of [https://wiki.gamedetectives.net/images/e/ed/CP2077_bitly1.jpg concept art] contained [http://bit.ly/2kxfbfb a bit.ly link], which led to [https://cdn-l-mkt.cdprojektred.com/other/first_11cg89ul0w.bmp an image]. Opening that image in a text editor led to [https://cdn-l-mkt.cdprojektred.com/image/second.jpg a second image], which then pointed to the [https://trauma-team-international.com/ Trauma Team International website].
  
 
=== Need Insurance? ===
 
=== Need Insurance? ===
  
Accessing the website, players were met with a bot named David asking for an ID in order to talk to him. Further investigation revealed that the numbers from the first image gave the Login ID <code>0374337573334</code> for [https://trauma-team-international.com/ Trauma Team International].
+
[[Image:CP2077-TT_success.png|thumb|300px|left|Screen seen by "winners" of the OrderID Trauma Team phase.]]
  
Once logged in, David asked what options players wanted to pick, with the only available option being Services. Selecting this option allowed platers to choose to buy insurance as stated in the second image. With this, each players was given a unique, 10 character code and David prompted these players to use it in the My Orders section of the site. After a specific amount of codes were given out the bot went offline. The code was deciphered using ASCII85 (Z85 (ZeroMQ) variant), giving the ID <code>#ID00000</code> which was usable in the My Orders section.
+
After accessing the website, players were met with a bot named David asking for an ID in order to talk to him. Further investigation revealed that the numbers from the first image gave the Login ID <code>0374337573334</code> for [https://trauma-team-international.com/ Trauma Team International].  
  
Players who made the cutoff were prompted to input their emails. Upon entering their emails, they were greeted with [https://imgur.com/a/naCqh5B/ this image], pictured left, informing them that the process would take up to 7 days and thanking them for participating.
+
Once logged in, David allowed players to "buy insurance," as indicated in the second image. After doing so, each player was given a unique 10 character code, and David prompted these players to use their codes in the My Orders section of the site. After a specific amount of codes were given out, the bot went offline. The code was deciphered using ASCII85 (Z85 (ZeroMQ) variant), giving the ID <code>#ID00000</code> which was usable in the My Orders section.
  
After a certain amount of codes were used, the My Orders page went offline with the message "Connection failed" to conclude this part of the ARG. This followed suit from previous ARG "rounds" were a cutoff is implemented to gate how many players can "win" a given round.
+
Players who made the cutoff were prompted to input their emails. Upon entering their emails, they were greeted with [https://imgur.com/a/naCqh5B/ this image], pictured left, informing them that the process would take up to 7 days and thanking them for participating. After a certain amount of codes were used, the My Orders page went offline with the message "Connection failed," concluding this part of the ARG.
  
 
=== Your Life is worth it! ===
 
=== Your Life is worth it! ===
  
On <code>2018-26-08</code>, four days after players ripped through the [https://trauma-team-international.com/ Trauma Team International] site, those who got through the cutoff received an [https://wiki.gamedetectives.net/images/c/ce/CP2077-TTEmail.png email] from a Trauma Team Internation Representative prompting them to reply with their address (presumably to receive merch like the previous rounds). The email had two attachments, a PDF and an image, pictured right.
+
On <code>2018-26-08</code>, four days after players ripped through the [https://trauma-team-international.com/ Trauma Team International] site, those who got through the cutoff received an [https://wiki.gamedetectives.net/images/c/ce/CP2077-TTEmail.png email] from a Trauma Team International Representative prompting them to reply with their address. The email had two attachments, a PDF and an image, pictured right.
  
  
 
{{WIP}}
 
{{WIP}}

Revision as of 14:23, 27 August 2018

Cyberpunk 2077
Active since 2018-10-06
CP2077.png
A hacker at E3 2018 exposed a live website linked to upcoming release Cyberpunk 2077.
Type Official
Creator CD PROJEKT RED
Discovered 2018-10-06

Main Page > List of Investigations > Cyberpunk 2077

Cyberpunk 2077 is a story-driven, open world RPG set in a dark future from CD PROJEKT RED (CDPR), creators of The Witcher series of games. As the release of Cyberpunk 2077 drew closer, CDPR began trickling hidden messages and puzzles to the community. The ARG is comprised of these puzzles, and quick solvers are often rewarded with Cyberpunk merchandise.




A "hacker" infiltrates Microsoft's E3 2018 presentation.

E3 Presentation

During Microsoft's E3 2018 presentation slot on June 10th, a "hacker" interrupted the speaker, ultimately revealing a trailer for Cyberpunk 2077. Players immediately noticed some valuable info during the trailer, including GOG codes which were redeemable for games and, most notably, an IP address, 212.91.11.20.

Quadra

The IP address led to a server with a password prompt.

Players quickly realized that the IP resolved to a section of CDPR's Cyberpunk 2077 website, where a password prompt was found along with a welcome message. The message read as follows:

WELCOME TO QUADRA - THE HIGH-PERFORMANCE AUTOMOTIVE SOLUTIONS
WITH A SOUL. PLEASE ENTER YOUR QUADRA VIP USER CREDENTIALS.

The login field is force-filled to QUADRA V-TECH, which players connected to a license plate number from the trailer, NC20 CP77, which turned out to be the correct password. Only a very small pool of players were allowed through, and were met with a field to enter their email address. Soon after, the site began to display a message indicating a quota had been reached and that no more emails would be collected.

Quota Met

Message which greeted players when the password was entered after the quota was filled.
ASCII-art output of the SSH server.
Art printed on the back of the t-shirts received by players who made the QUADRA cutoff.

Suspecting an ARG was building, players rummaged through the site and other related media. A a "secure" subdomain was found, along with a "E3 Schedule" file. RTSP is set up on the site, which players suspected might indicate future intent. Players discovered the site had an SSH server on the same host, which outputs an ASCII-art message. The other output, Permission denied (publickey), indicated a private key was be needed to access the server.

Players also uncovered more potential leads in the trailer, including lines of debug output from OpenSSH, barcodes, PDF417 codes, and several messages (usually on screens in the video), including one which points toward the QUADRA website.

... 10/11/2078 THE FOLLOWING WILL APPLY TO ALL

PROFILES ON DATA ALT//0 463.0983.890.3
DOMAIN-PUBLIC RESTRICTION REF. 192.8930.610.10

PUBLIC DATA PRESENTATION WILL TAKE PLACE ON MONDAY AT 12PM GMT+09 ON ALL DOMAINS. SERVER CAPABILITIES ARE ESTIMATED TO SUSTAIN 90% REGISTERED
USERS//

P2-OS CORPORATION, ALL RIGHTS RESERVED

Developers indicated in multiple messages via Discord that players should wait as more information is coming. Whether or not the info found in the trailer will prove useful remained unknown.

Several users on Reddit who entered the password prior to the quota being met received emails from CDPR in the style of emails from QUADRA automotive, which request logistic and personal information from the player in order to deliver them a care package.

Drive to the FUTURE through the PAST

Concept art which was edited by CDPR to contain a bit.ly link (check out the top-right of the image).

Players who made the QUADRA cutoff received a care package (GALLERY). It contained a CP2077 Quadra styled t-shirt in a QUADRA box. The art on the back of the t-shirt was mysterious, but players found no leads despite heavy analysis.

Trauma Team

On August 22, the ARG sparked up again when CDPR posted concept art on their Twitter. One of the pieces of concept art contained a bit.ly link, which led to an image. Opening that image in a text editor led to a second image, which then pointed to the Trauma Team International website.

Need Insurance?

Screen seen by "winners" of the OrderID Trauma Team phase.

After accessing the website, players were met with a bot named David asking for an ID in order to talk to him. Further investigation revealed that the numbers from the first image gave the Login ID 0374337573334 for Trauma Team International.

Once logged in, David allowed players to "buy insurance," as indicated in the second image. After doing so, each player was given a unique 10 character code, and David prompted these players to use their codes in the My Orders section of the site. After a specific amount of codes were given out, the bot went offline. The code was deciphered using ASCII85 (Z85 (ZeroMQ) variant), giving the ID #ID00000 which was usable in the My Orders section.

Players who made the cutoff were prompted to input their emails. Upon entering their emails, they were greeted with this image, pictured left, informing them that the process would take up to 7 days and thanking them for participating. After a certain amount of codes were used, the My Orders page went offline with the message "Connection failed," concluding this part of the ARG.

Your Life is worth it!

On 2018-26-08, four days after players ripped through the Trauma Team International site, those who got through the cutoff received an email from a Trauma Team International Representative prompting them to reply with their address. The email had two attachments, a PDF and an image, pictured right.