2013

Part 1
- The Beginning

On January 5th, 2013, exactly one year after 3301 posted a message starting a series of puzzles and challenges, a new message had arrived in the form of three image posts to the website 4chan.org. "Hello again. Our search for intelligent individuals now continues." Just like most of the images from 2012, this image contained a message hidden inside of it using the software OutGuess:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Welcome again.

Here is a book code.  To find the book, break this riddle:

A book whose study is forbidden
Once dictated to a beast;
To be read once and then destroyed
Or you shall have no peace. 


I:1:6
I:2:15
I:3:26
I:5:4
I:6:15
I:10:26
I:14:136
I:15:68
I:16:42
I:18:17
I:19:14
I:20:58
I:21:10
I:22:8
I:23:6
I:25:17
I:26:33
I:27:30
I:46:32
I:47:53
I:49:209
I:50:10
I:51:115
I:52:39
I:53:4
I:62:43
I:63:8
III:19:84
III:20:10
III:21:11
III:22:3
III:23:58
5
I:1:3
I:2:15
I:3:6
I:14:17
I:30:68
I:60:11
II:49:84
II:50:50
II:64:104
II:76:3
II:76:3
0
I:60:11


Good luck.

3301

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJQ5QoZAAoJEBgfAeV6NQkPf2IQAKWgwI5EC33Hzje+YfeaLf6m
sLKjpc2Go98BWGReikDLS4PpkjX962L4Q3TZyzGenjJSUAEcyoHVINbqvK1sMvE5
9lBPmsdBMDPreA8oAZ3cbwtI3QuOFi3tY2qI5sJ7GSfUgiuI6FVVYTU/iXhXbHtL
boY4Sql5y7GaZ65cmH0eA6/418d9KL3Qq3qkTcM/tRAHhOZFMZfT42nsbcvZ2sWi
YyrAT5C+gs53YhODxEY0T9M2fam5AgUIWrMQa3oTRHSoNAefrDuOE7YtPy40j7kk
5/5RztmAzeEdRd8QS1ktHMezXEhdDP/DEdIJCLT5eA27VnTY4+x1Ag9tsDFuitY4
2kEaVtCrf/36JAAwEcwOg2B/stdjXe10RHFStY0N9wQdReW3yAOBohvtOubicbYY
mSCS1Bx91z7uYOo2QwtRaxNs69beSSy+oWBef4uTir8Q6WmgJpmzgmeG7ttEHquj
69CLSOWOm6Yc6qixsZy7ZkYDrSVrPwpAZdEXip7OHST5QE/Rd1M8RWCOODba16Lu
URKvgl0/nZumrPQYbB1roxAaCMtlMoIOvwcyldO0iOQ/2iD4Y0L4sTL7ojq2UYwX
bCotrhYv1srzBIOh+8vuBhV9ROnf/gab4tJII063EmztkBJ+HLfst0qZFAPHQG22
41kaNgYIYeikTrweFqSK
=Ybd6
-----END PGP SIGNATURE-----

This message was signed using PGP, meaning we can confirm that this message did in fact come from the same 3301 group as in 2012 by using a program to check the message against the signature. You can learn more about PGP, including what it's purpose is and how to verify a PGP message yourself, here.

There was no guessing as to what the message meant as it states that this is another book code. The clue at the beginning points to Liber AL vel Legis by Aleister Crowley. The code is decrypted by using the format chapter:line:letter, including punctuation, and results in "https:--www.dropbox.com-s-r7sgeb5dtmzj14s-3301". After changing the dashes to forward slashes, this becomes a hyperlink to Dropbox. The link no longer works, but you can find a mirror here.

Part 2
- .iso

The Dropbox file is an ISO image, essentially a copy of a CD-ROM or DVD. Running it from a CD or in a virtual machine brings up a Linux boot screen. After loading, it displays every prime number from 2 to 3301 with a half second pause between numbers and a two second pause on 1033 and 3301. After counting, the screen changes to a message. By cancelling the script with CTRL+C and logging in as user tc, this message can also be found at usr/local/bin/message.txt.asc and is PGP signed there:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
 
 
@1231507051321
 
The key is all around you.
 
Good luck.
 
3301
 
 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
 
iQIcBAEBAgAGBQJQ5MvrAAoJEBgfAeV6NQkPKSQQALEvCEvNMdGdMX9IogNfVRHJ
6ABGAtply7B/8XvGIZ+WDDsH81UJG9MtGsHs6tLgS61A37CJg4+/tmSDFbv5rqKe
yL2dUsPIaqybU6gnEwofllseo5iZbMFfY3C/rUCHLgjLXb66WX/0EMpPHIez07rV
9cME34WxDxDehmOiB/wxUBuBZEj+Zh/805pXxWD72j09GIE9lTOCWESO80IzQQmm
HT5NL8AQrwHzmccYbCtIfQ4rk1NJ1d6PeX0ZA7mfhk2pkiS+qXoCJ2omuQsPXj8v
Q8jR1qukQm1zoEXlmCO7MJOoGI8TaKhKXmAkh/hIK694rLFXMYZ0dT7NsSMNtq3T
VJ/aXj4T57GP8+ZZCUmEtbk+sMuz8md4Ari4AJ4eSZ/1voaHxMs9dIVLIBMnxq6y
yEnCcOL5NdKJzw0IHzuidWrpSIDNtiE2/I3yddUvNVl+8Cq54fCAyOnmHflgNjXB
tNoLp+p7b75fg0KJJ+njWe8YdjniM5LdEyFDNFRuo7KhbW/9K2verZ/tKWnQqiOT
XzJEPJuqv55FbCKqUrn4itvwEYV9lp5hDccUqti1yvF9QxBKstith401cenWtZBO
N+h9OShnDDZej3B7EgFUnJ2DNd3V5p7brzAJhd9xcmC2xmZ24wm3oOWDUrdwkWvD
Tl0607yjaRNMDTRT8qOW
=nZMh
-----END PGP SIGNATURE-----

There is a also folder called "AUDIO" in the .iso that contains a music file, "761.mp3". The file contains a few ID3v2 tags at the beginning of the hex data. The first uses the custom tag DTXXX and states the following:

Parable 1,595,277,641 Like the instar, tunneling to the surface
We must shed our own circumferences;
Find the divinity within and emerge.

The second tag is TIT2 which says the title of this song is "The Instar Emergence", and the third tag is TPE1 which lists the author or lead performer as "3301".

Part 3
- Gematria Primus

Image of the Gematria Primus from 3301

The message from the .iso contained the line "@1231507051321", which turned out to be an active Twitter account that was registered around the time that the .iso was discovered. The account was posting a tweet containing a hexadecimal string every few minutes until there were 989 lines in total. You can find all of them collated together here. It was found that by taking the hex and XORing it against the 761.mp3 file, you get an image. This image is titled Gematria Primus. It contains two main columns, with each column holding rows with columns labeled rune, letter, and value. There are 29 Futhorc runes, which match with a letter or pair of letters (with one rune matching to "ING") from the English alphabet, with the value column being the sequence of primes from 2 to 109. This image is quite important, as most of the following puzzles from 3301 use these runes.

This image contains a hidden Outguess message:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


 	    		 		 				 		 		 	 		  	 	  	      			 	   		 				  	      		  	 	 		 		 	 		 	  	 			 			 			      		 	   		 		 	 			 	 	 			 	 	  		  	  		 	 		 			 	   			 			 		 	 		 		 			  		  		   	 			  		 				 		 			  		 	  	 		 				 		 			 

 	 	 			 		  	 	  	      			  		 		 	    		    	 		 		   		 		    	      		    	 			 			 		    	 		 	  	 			 	    	      				  	 		 				 			 	 	  	      			 	   		 	    		  	 	 			  	  		  	 	  	 			 

 	   			 		 				 		 				 		  	    	      		 		   			 	 	 		   		 		 	 		  	 			 

  		  		  		  		  		      		   	
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJQ5lDTAAoJEBgfAeV6NQkP7nMQAJVg7DQiIA7NpkacR0RA4eBs
NZHJBQNHO2P22h+aFfP/rI1gjGaV3hMWaa2sQ4Vbi/W8eZuH40AsmZUy3EOb+4j0
3cJRJgAJI99ZjDcVXITm5VyUv+WIqCzBr+bHMK7pkMYQ/rEzeWD56tlsrDgFdjmh
PA/b7XrDcofd9JfBNFI7D/sF84HL2ig5baNo+MGjYl4Dq2cHX+SAafXmlN9PXFjx
HRBbuoMLlviKywQ8MnePBPYG6V8sIMmrJlHS5ZcNEaSJ9nGL4X0XbECqV79ermye
1EeNKcckoeeZMU86SabfMeyZozG04Vkbemn8JH5cssbuF8hf4fdN/LSP4NG0r5y9
jfRv7z59pL577ZpGAju5zBtlCBUvmxxNYR5IGLg+Fi/ICqcRC98mzesFnQ7wbDLS
HKyV95SBQK82bbqSREBfIrrNb+MjVtJwIvOY5OPTBViHPqrIuMw8KDGfSvw9ncCt
dase7vUjXxIrn36xDSRN6cMzTmFZ9lkQYkRAYq5ApERud+JfKCwszG/UxRwo1WOU
0ALaWXq5VMp+w5pvQkqg9eHpOriG9Z11VLdb53eTmxKrwyX/2eaiybsnMrRNuxv1
iE8PVRkifCcJccw1bGq8TyCQF3a5ozeiBRngAUT7BwZhLa4bShtki7amR0ZZgbKk
8JRMGvoSA5NNTEwvUhwl
=ZeNf
-----END PGP SIGNATURE-----

While appearing to be a blank message, there are four lines consisting of tabs and spaces. By converting the lines to binary (tabs are "1" and the spaces are "0") and then that binary to ASCII character codes, we get the following texts: "Come to emiwp4muu2ktwknf.onion". "We shall await you there." "Good luck." "3301".

Part 4
- Tor

By using a Tor browser and going to the named site, ASCII art of the 3301 cicada logo and a message were shown:

Web browsers are useless here.


      ,+++77777++=:,                    +=                      ,,++=7++=,,
    7~?7   +7I77 :,I777  I          77 7+77 7:        ,?777777??~,=+=~I7?,=77 I
=7I7I~7  ,77: ++:~+7 77=7777 7     +77=7 =7I7     ,I777= 77,:~7 +?7, ~7   ~ 777?
77+7I 777~,,=7~  ,::7=7: 7 77   77: 7 7 +77,7 I777~+777I=   =:,77,77  77 7,777,
  = 7  ?7 , 7~,~  + 77 ?: :?777 +~77 77? I7777I7I7 777+77   =:, ?7   +7 777?
      77 ~I == ~77= +777 777~: I,+77?  7  7:?7? ?7 7 7 77 ~I   7I,,?7 I77~
       I 7=77~+77+?=:I+~77?     , I 7? 77 7   777~ +7 I+?7  +7~?777,77I
         =77 77= +7 7777         ,7 7?7:,??7     +7    7   77??+ 7777,
             =I, I 7+:77?         +7I7?7777 :             :7 7
                7I7I?77 ~         +7:77,     ~         +7,::7   7
               ,7~77?7? ?:         7+:77777,           77 :7777=
                ?77 +I7+,7         7~  7,+7  ,?       ?7?~?777:
                   I777=7777 ~     77 :  77 =7+,    I77  777
                     +      ~?     , + 7    ,, ~I,  = ? ,
                                    77:I+
                                    ,7
                                     :77
                                        :

Welcome.

It was found that telnet needed to be used to connect to the hidden service. There were a number of commands this hidden service responded to, and you can find out more about them here. If you entered "hello" into the console, it replied with a message containing hexadecimal, which you can find on the previously linked page. Converting this to ASCII characters resulted in the following:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

     
Very good.
   
You have done well to come this far.
  
xsxnaksict6egxkq.onion
  
Good luck.
   
3301
     
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJQ6S0HAAoJEBgfAeV6NQkP/J0QALDqa3VJy9xLLlgI5jPhRIp4
fxebbNhtELOHYFkD5Z9ztQYGle7lKPM8lkMSnciIY059KIi5NSTV7I97sJboG3wt
khHtZgNRw1v2WQ5uurCu5l1w+84/L5Jz2NmElxOBzWr68dlQYt2qfBQxk2zR/fTI
TLCEGvFZtlnrNfBk7jsIyJYcXXPgabS47oP9vOEXlB1+Pm0C7uPPBPN7aqkfUPGl
o1f2hscJf7Je2DvbZt+6exxYsm57Fp953XANAd/UpFVzT/852Xg63gtZrI+Smf3Z
BVcjpCzyH3wS8R0iM+rp02CwJpJzsWGLxeQGmXL2SXBB43zVZAJql5UdXLTGXkbd
nPMd3/CbJ+l7rO0YAg5p3Jf4KauX7Zd6Zc2wHKLOvfjQvEWXIY1CMhI68Bj0rZo/
M/fi313FFTPAm6xhKRv/tH/8wVrar2jY7wnE8XxhRsy74AZ5GqA2oHMefTAq3YuW
5PX8s682J4pkDUKHGa4y65vjIp16pmEInMALJGbwz6mtauBQqlS6ARsQfekDn3oZ
yosS+gWC3jdIvH5s5WUQGVl7jyz9t4+3Tg5cT9Rn6pX2NVNXSxgzXXB4nI2XrrYa
4kQr5aWB8lssav3ryj5Cg2FHl1+MKO0gYv/UF3QT75MixQMu4M+5wCnNekgfuyO6
Zvybzp4s4SzRjkk9sMM6
=WYVO
-----END PGP SIGNATURE-----

Upon visiting the second onion url, there was a single line: "Patience is a virtue." For those wondering what this meant, a comment in the HTML of the webpage said, "which means, come back soon". Someone attempted to telnet into this hidden service as well, but this time it gave an error page along with some information about the server hosting it, including its IP address. The site was taken down after this, and some time later it came back up. This time, the page read 'You already have everything you need to continue. Sometimes one must "knock on the sky and listen to the sound." Good luck.' By sending pings to the server, the response was sending back additional bytes which, when combined, resulted in the following message and another onion URL:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Well done.  You have come far.

pklmx2eeh6fjt7zf.onion

Good luck.

3301


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJQ7vVDAAoJEBgfAeV6NQkP9x4P/31A5LPzIhkii8sBjuVxIcOn
4KFQO+uVVsR53zImSqlhq6iVAE9+Ko7vIqjD2whTIUFVYZNBq/92wEZJuCSonovH
HqYZTQihIS9d+QDuwUNvXr4ilrRmITKMrWw3D23rpWs6ZlnehuUDVI8unbN9Zi3h
3hvok3/+/FofLia9Kvbo+FIDi7T9NNRpqepgXd/6dQIP4kn63kKCP20QMdRf2fXF
ZLx5ADS14OvaNFNUAHTJ1qdkPYcdTiNDJkxqk1s82y2doGoEP0ChBUJxlyMiUVXn
1iLOwm2KNrf6If64KxEoetOraWqg9P6l3BjGVPCkrotB608SSs2Lihsa4B0ifI33
ABlpvSDIgpBu/zIO/WFYOfnnrtdvDpVP/Wy+pgqZJ/wOUuhJZhzi5vppjVCm/q9H
C/aXQxa+XXe7his4f9tuIBD1wIYAtnE8M0uDCsfiZjBaZNMnOO7/hOwnNQSBAMcr
KqL5yHSnpI50CtoA+6ycWZURBkrt1rt4eNxsCqQ1XWed/hWbqb6SlJJemJOPbbmt
V5D7iDUO+r2OIUEZTfCSjdzrXcJ8FLtqCGVaLJhCdsyirRHmURwkYLw/B8TpcJQz
qbY6oeDxDosIbE6uhDNV2RVKmpWqLDMhLGHVjkDjJpodE5L3ObbylWuRnHfFqfKH
1mubvMAGo03rxxlY+9XG
=6Sgs
-----END PGP SIGNATURE-----

Part 5
- The Global Search

Similar to the puzzle in the previous year, this next site had a list of GPS coordinates. There were seveb in total, each of them giving a location of a piece of paper on a pole. Six of them were recovered. These pages had a NANP phone number that ended in either 3301 or 1033 and an access code consisting of two letters. The seventh phone number was eventually found by calling every number that ended with 1033. Calling the phone numbers gave an automated response which asked for the access code.