RV4-77 Puzzles

RV4-77 Puzzles were cryptopuzzles posted in the SpacePirate Text Adventure game and were avaliable from the RV4-77 ships computer. Once one puzzle was solved a new puzzle replaced it in the following days. A total of 7 RV4-77 puzzles were posted.

## RV4-77 #1

```

```

Decoded by replacing numbers with their letter in the alphabet gives:

```
AHT BP NAGS NJFGERT BS CFT JPRLM AGQH BOPBEY OST B ZWQIDE XWLQPFNT UWDGLGX YMT SE PWLFEBXIH

```

By decoding using vigenere cipher with the key: "islolationists" on each word individually, you get the following result:

```
islol islo islolatio islolati islo islola islo islola islolati islolat islol islolatio

```

```
spine five frustrate universe soft twenty gain refuse peaceful message quiet heartbeat

```

Note: There is a mistake in the key of this cipher where "isolationist" is misspelled as "islolationist"

## RV4-77 #2

```
uvukhuhyklnslrkeyfbkhlfsfyduwsxxzlwhtamoflxydxwjcezosumzabaelynvxvtjnuyzbusz

```

The above can be decoded using a vigenere cipher, with the key being the directions to reach the RV4-77 (southsouthsoutheasteast)

```
character every day nightmare kneed estimation style evil sweat single under truck final

```

## RV4-77 #3

```
41x1em1y41ht01r1534ekp8hin5t11b5dluu18t1qa1nsnx1ie1g1q15i12tog25k25x1ybmregwoka5z1t4h1101nj1esk18nw5k133x1p1ec8ev0c1n5n7181m1avbb7

```

The above is partially decoded using a vigenere cipher ignoring the numbers with the key being the first part of an audio message in another room.

```
this is my log entry following the crash captain turner and i have crashed down in a canyon
41e1xe1g41zb01f1534gzb8bea5a11k5fggj18i1ce1ffhe1ba1e1z15i12bhe25k25i1fbeelmfbgj5z1g4e1101fc1exg18lf5k133f1i1az8bh0g1a5f7181z1atbo7

```

Then using ROT-13 over the base36 alphabet (0123456789abcdefghijklmnopqrstuvwxyz) you get the seed:

```
here are the codes eight color nine exist twelve pressure one receive four fix five sorry two twice three desperately six egg seven cloud ten ink eleven rock

```

```
receive twice desperately fix sorry egg cloud color exist ink rock pressure

```

## RV4-77 #4

```
1NT7xs5m1zNN2e8imivWsgJdu5YKMzhgPp O3 062 101 060 061 065 113 130 064 012 062 102 060 062 130 107 126 064 012 062 103 060 063 170 172 115 064 012 062 104 060 064 161 112 103 064 012 062 105 060 065 066 160 151 064 012 062 106 060 066 156 165 155 064 012 062 107 060 067 063 104 163 064 012 062 110 060 070 151 130 120 064 012 062 111 060 071 112 157 114 064 012 060 061 112 061 060 145 102 150 065 012 060 061 113 061 061 166 130 153 065 012 060 061 114 061 062 106 145 125 065 012 060 061 115 061 063 157 067 112 065 012 060 061 116 061 064 067 171 113 065 012 060 061 117 061 065 146 063 063 065 012 060 061 120 061 066 061 107 063 065 012 060 061 121 061 067 065 120 062 065 012 012 -5/-4/+

```

The above is octal encoded text which when converted to ASCII is:

```
2 A 01 5KX 4
2 B 02 XGV 4
2 C 03 xzM 4
2 D 04 qJC 4
2 E 05 6pi 4
2 F 06 num 4
2 G 07 3Ds 4
2 H 08 iXP 4
2 I 09 JoL 4
01 J 10 eBh 5
01 K 11 vXk 5
01 L 12 FeU 5
01 M 13 o7J 5
01 N 14 7yK 5
01 O 15 f33 5
01 P 16 1G3 5
01 Q 17 5P2 5

```

By isolating only the fourth column of information you get the BTC private key:

```
5KXXGVxzMqJC6pinum3DsiXPJoLeBhvXkFeUo7J7yKf331G35P2

```

## RV4-77 #5

```
There is one where two are needed. You must squeeze through in order for all to be revealed. Arjen knows how to open the lock. Estelle has the keys. Seven blocks to unlock the mystery. One hash reveals the path. None shall claim the reward unless worthy. Enter the caves and explore the ship. Turn around and go back the way you came if you get lost. Wander too long and you will lose the way. One day you will figure out the mystery and the way to the vault. Exit the ship and return with the right key. In the vault you will find the silver key. Gear will not help you solve the hidden crypto. Hacking will only block the way forward. Try again until all is revealed. u7Jv3I3YkzY4sCM/XKl5pXOoEByA5jGBn4cC8OIvMN9+0Z7SsmzUnotvUYZhEmdSUdu45J7e/QNGOgTOyNTBKENo2OWV/r7NnqVcYv3qenw8/cKXJyr6kaD1ABJcwdcSSPgXUMJHjWTTbByFcxuyA0VtGUApsAUg0qHO2b9XueYFVSQxJN9i3/84y9E+x95I

```

The above ciphertext gives crucial information about the SpacePirate Text Adventure while also encoding a hidden message. By taking the first letter of each sentence you get:

```
TYAESONETWOEIGHT

```

This hints towards the base64 encoded ciphertext at the bottom of the message as being AES 128 encrypted.

By talking to the help bot in the start room, certain messages are randomly given out, including:

```
aesencryption.net
Arjen 6c374e70334072aeeb62ed46ea987838
Estelle 8fc42c6ddf9966db3b09e84365034357
Captain Tanner 5f295bce38d311f26a96eb811192f391
bzip2
AES128

```

The bytes given after the names are MD5 hashes, as suggested by their length of 16 bytes. With a Google Search they can be decoded as:

```
6c374e70334072aeeb62ed46ea987838 - leave
8fc42c6ddf9966db3b09e84365034357 - the
5f295bce38d311f26a96eb811192f391 - planet

```

The next step is to MD5 the following with Windows formatting for the returns:

```
leave
the
planet

```

```
e30cf44dc39073c648d2166e5882535d

```

The AES given by the RV4-77 is then able to be decoded by using this result as the key on aesencryption.net which gives:

```
QlpoOTFBWSZTWcaCifUAAAWRgEAAL+/foCAAUKNGQNGmRoNU9J6T01M0ZTNR2vSLqsigsRctbW4rQH4ndzzh8/KFHNpudIGn2SknGEDAoBljNanr8XckU4UJDGgon1A=

```

Using the last clue from the Help Bot "bzip2", the above message can be decompressed using an online bzip2 decompression tool to give the wallet seed.

```
art memory shiny stress choke worth press led seven drunk forgive refuse

```

## RV4-77 #6

```
Much did had call new drew that Kept. Limits expect wonder law she. Now has You views woman noisy match money rooms. To up 5 remark it eldest length oh passed. Off because yet mistake feeling has men. Consulted disposing to moonlight ye extremity. Engage piqued in on coming. Dissuade ecstatic 1 and properly saw entirely sir why laughter endeavor. In on my jointure horrible margaret suitable he followed speedily. Indeed vanity excuse or mr lovers of on. By offer scale an stuff. Blush be sorry no sight. Sang lose of hour then he left find. Enjoyed minutes related as at on on. Is fanny dried as often me. Goodness as reserved raptures to mistaken 4 steepest oh screened he. Gravity he mr sixteen esteems. Mile home its new way with x high told said. Finished no horrible blessing landlord dwelling 2 dissuade if. Rent fond am he in on read. Anxious cordial demands settled entered in do to colonel. She 4 literature discovered increasing how diminution understood. Though and highly the enough county for man. Of it up he still court alone widow seems. You 1 Suspected he remainder rapturous my sweetness. All vanity regard sudden nor simple can. World mrs and vexed china since after often. No depending be convinced in unfeeling he. Excellence she unaffected and too sentiments her. Rooms he doors 8 there ye aware in by shall. Education g remainder in so cordially. His 8 remainder and own dejection daughters sportsmen. Is easy took he shed to kind. Admiration we surrounded possession frequently he. Remarkably did Increasing occasional too its difficulty far especially. Known tiled but 6 sorry joy balls. Bed sudden manner indeed fat now feebly. Face do with in need of wife paid that be. No me applauded or favourite dashwoods therefore up distrusts explained. Am if 5 number no up period 9 regard sudden better. Decisively surrounded all admiration and not you. Your out particular sympathize not favourable introduced insipidity but ham. Rather 2 number can and set praise. Distrusts 9 an it contented perceived attending oh. Thoroughly estimating introduced stimulated why but 3 motionless. Looking 3 started he up perhaps against. How remainder all 7 additions get elsewhere resources. One missed shy wishes Supply r design answer formed. Prevent on present hastily passage an subject in be. Be happiness 0 arranging so newspaper defective affection ye. Families blessing he in to no daughter. Started earnest 6 brother believe an exposed so. You me he believing daughters if forfeited at furniture. Age again and stuff downs spoke. Late t hour new nay able fat 0 each sell. Nor themselves age introduced frequently use unsatiable devonshire get. They why quit gay cold rose deal park. One same they four did ask busy. Reserved opinions fat him nay position. Breakfast as zealously incommode do agreeable furniture. One too nay led fanny allow plate.

rN7t+bBBVtX7a/WRAotNnQ==

At every tiled on ye defer do. No attention suspected oh difficult. Fond z his say old meet cold find come whom. The sir park sake bred. Wonder matter now can estate esteem assure fat roused. Am performed on existence as discourse is. Pleasure friendly at marriage 7 blessing or.

remY4KTi n 256 o s 4fd0a47e045f2533 3194179366926953 e752d8318056a793 128 g8vg9ZbCBjJ/uZGrUVRyGW2pqC6MboRNOF1yuow+sV0= m 2UFRzTSrvSmgZ r13

```

The above ciphertext is mainly comprised of website placeholder text which can easily be found using a Google Search. The main difference is this one has parts changed or added to it to hide a message. The hidden message in the text is decoded using a message given by a survivor in Crashtown:

```
If you found my RV4 in the desert, the code is 8 132 17 110 7 2 16

```

By using a book cipher and getting the first letter of the word referenced by the number, the following message is given:

```
KxvgtdY

```

This is used as an AES256 key on aesencryption.net to decode the base64 encoded AES present in the ciphertext:

```
rN7t+bBBVtX7a/WRAotNnQ==

```

```
c9HRd9h1

```

By this stage we can make the assumption we are getting parts of a BTC private key as the first message that we got which is verified by using it as an AES password starts with a K, which is one of the four letters a BTC private key can begin with, and it appears to be encoded in base58.

We are now left with the following:

```
KxvgtdY  c9HRd9h1

```

```
remY4KTi n 256 o s 4fd0a47e045f2533 3194179366926953 e752d8318056a793 128 g8vg9ZbCBjJ/uZGrUVRyGW2pqC6MboRNOF1yuow+sV0= m 2UFRzTSrvSmgZ r13

```

Here we have some parts appearing to be different ciphertexts as well as a few letters, a "r13", a "128" and a "256".

We can make the assumption we have already used the 256 in our AES 256, which would leave the other base64 encoded part as an AES 128 encrypted string.

We also have the letters which could be abbreviations of other ciphers, just like 128 and 256.

```
r13 = ROT-13
m = Morse
n = Numbers from message
o = One time pad
s = Shamir Secret Sharing

```

By using these we can try to break down other parts of the message. The Shamir Secret Sharing Shares are usually given in hexadecimal so trying to use the hexadecimal would be a good start. This gives:

```
1-4fd0a47e045f2533
2-3194179366926953
3-e752d8318056a793

```

```
vCAVKdeW

```

A One Time Pad can be used to decrypt the first part of the ciphertext, using the same key as the AES256:

```
remY4KTi
KxvgtdY

```

```
hhrS4RQk

```

We are now left with:

```
KxvgtdY c9HRd9h1 hhrS4RQk vCAVKdeW

```

```
128 g8vg9ZbCBjJ/uZGrUVRyGW2pqC6MboRNOF1yuow+sV0= m 2UFRzTSrvSmgZ r13

```

By trying combinations of the keys we have already found we can both confirm they are correct, and gain the next part of the puzzle. AES128 decryption is used on the base64 string given, using the correct key (KxvgtdYc9HRd9h1hhrS4RQk):

```
. .--. -... .-- . -..- -- ----.

```

The above is Morse code which when decoded gives:

```
epbwexm9

```

Now all that is left is:

```
2UFRzTSrvSmgZ r13

```

ROT-13 is applied to both the morse result and the final unused string, this gives:

```
rcojrkz9 2HSEmGFeiFztM

```

Unfortunately with Morse we now need to figure out the capital letters of its result to gain valid Base 58 encoding. Either bruteforce or a script can work, and once the pieces are brought together the privatekey is made:

```
KxvgtdYc9HRd9h1hhrS4RQkvCAVKdeWRCoJRkZ92HSEmGFeiFztM

```

## RV4-77 #7

```
256 >< f3d9e1b2bd96d19a1e92c1fa550414f702f71336 128
gXKNVxYWh51KqJlvnuY5HXxWbmZq3OozFOgAa1eRX3yZns3cgbyeOnZoqR5PycDkyKDJ2kXOzCPqiafcqXSSBglia0JGPiBOCYTH7XtDCpc1b8AQp1M16eoxf1qmvpzyIZvWjRNdxQujv9JHu/PTj553iI8jKX96UNU/JbtZQTeiQ2l/uftuT5hGdpryIzNYw+udFiUsQjSojWc/x+bf5Vn38aYbWR5hkNRCKEZNGkh3gm1B5n/BENYuH6FnvTWeGGWmkZdtSkY5l/
[ 0fd832fe88560e9bd42d7ef4d7df01736d97faa6 3b8e8c1e96e3a8b399f0eeda6a1f826c4f3eff1c c8aca732f0ee9d9c6073ffb51b55e12a39173d26 6bb5c55b14fe364e41affe689d880588f727b177 35de6d36b74b0b6222465b039adea5f4f66bb39e e363a19b4ce521e493678e7fbee70aad09e1bf4a c5a162ccc20fa456caaaeb512ae0ac272b1f7c9f 390841af595c0ab03eb193eb7e9c5d1ec71eb3af 169b9cd2ccab955466d21e501bdbb20d7c9bd935 ]

RnXy4PSg48Ym2Gfho9KlYk/0GWH3PbSADeLsOz7ltv9J/0ZmGXPIz1DJR1CqcicIppnKOLkpwaqJW6jLZCHHi1wH7mAG1NU53fz3r5pyWdNNnLXvzSR1/cQ3S+6AoAEkSJ40hM1aQcXIAwynmm0cJZNjLdFR2GJqB5+gYHs5CsbdA6xR5yeIPPoq4X18OwdhaTednLpFO/NIZd3Tru+JoQ+yLty0IvBdlQLYOwHDaT3ry1kbKUIbF8xdFuMfFxE/P+ExJQnTTfUIjYZCr4vWsLrqXGyGFlOGkPJ8J3t1rcxFEr4sz6IcJQvnDgrXgOgjXs6qqyJpzT/k4ws5jMDTm1QVRKCXJBiITW24MA9CsmHbu2//bLkEKRhpkHFQGxBJtoz5og8w== A169b9cd2ccab955466d21e501bdbb20d7c9bd935Z

```

The above ciphertext can be moved around to form a more logical approach.

```
256 >< f3d9e1b2bd96d19a1e92c1fa550414f702f71336 128
gXKNVxYWh51KqJlvnuY5HXxWbmZq3OozFOgAa1eRX3yZns3cgbyeOnZoqR5PycDkyKDJ2kXOzCPqiafcqXSSBglia0JGPiBOCYTH7XtDCpc1b8AQp1M16eoxf1qmvpzyIZvWjRNdxQujv9JHu/PTj553iI8jKX96UNU/JbtZQTeiQ2l/uftuT5hGdpryIzNYw+udFiUsQjSojWc/x+bf5Vn38aYbWR5hkNRCKEZNGkh3gm1B5n/BENYuH6FnvTWeGGWmkZdtSkY5l/RnXy4PSg48Ym2Gfho9KlYk/0GWH3PbSADeLsOz7ltv9J/0ZmGXPIz1DJR1CqcicIppnKOLkpwaqJW6jLZCHHi1wH7mAG1NU53fz3r5pyWdNNnLXvzSR1/cQ3S+6AoAEkSJ40hM1aQcXIAwynmm0cJZNjLdFR2GJqB5+gYHs5CsbdA6xR5yeIPPoq4X18OwdhaTednLpFO/NIZd3Tru+JoQ+yLty0IvBdlQLYOwHDaT3ry1kbKUIbF8xdFuMfFxE/P+ExJQnTTfUIjYZCr4vWsLrqXGyGFlOGkPJ8J3t1rcxFEr4sz6IcJQvnDgrXgOgjXs6qqyJpzT/k4ws5jMDTm1QVRKCXJBiITW24MA9CsmHbu2//bLkEKRhpkHFQGxBJtoz5og8w==[ 0fd832fe88560e9bd42d7ef4d7df01736d97faa6 3b8e8c1e96e3a8b399f0eeda6a1f826c4f3eff1c c8aca732f0ee9d9c6073ffb51b55e12a39173d26 6bb5c55b14fe364e41affe689d880588f727b177 35de6d36b74b0b6222465b039adea5f4f66bb39e e363a19b4ce521e493678e7fbee70aad09e1bf4a c5a162ccc20fa456caaaeb512ae0ac272b1f7c9f 390841af595c0ab03eb193eb7e9c5d1ec71eb3af 169b9cd2ccab955466d21e501bdbb20d7c9bd935 ]

A169b9cd2ccab955466d21e501bdbb20d7c9bd935Z

```

The >< symbol indicates "reversing" the first hexadecimal string giving:

```
f3d9e1b2bd96d19a1e92c1fa550414f702f71336

63317f207f414055af1c29e1a91d69db2b1e9d3f

```

Then the hexidecimal parts can be assembled into Shamir Secret Sharing shares which give:

```
1-63317f207f414055af1c29e1a91d69db2b1e9d3f
2-0fd832fe88560e9bd42d7ef4d7df01736d97faa6
3-3b8e8c1e96e3a8b399f0eeda6a1f826c4f3eff1c
4-c8aca732f0ee9d9c6073ffb51b55e12a39173d26
5-6bb5c55b14fe364e41affe689d880588f727b177
6-35de6d36b74b0b6222465b039adea5f4f66bb39e
7-e363a19b4ce521e493678e7fbee70aad09e1bf4a
8-c5a162ccc20fa456caaaeb512ae0ac272b1f7c9f
9-390841af595c0ab03eb193eb7e9c5d1ec71eb3af
10-169b9cd2ccab955466d21e501bdbb20d7c9bd935

```

```
the mechs are coming

```

This is used as the AES128 key for the large base64 ciphertext:

```
zouz nrpv lhxzi mlevnyvi tlou (hkzxv) hrviiz slgvo lhxzi lhxzi gzmtl (hkzxv) ulcgilg lhxzi ornz wvogz (hkzxv) hrviiz rmwrz xsziorv prol (hkzxv) kzkz bzmpvv ilnvl zouz nrpv rmwrz wvogz (hkzxv) rmwrz mlevnyvi xsziorv slgvo (hkzxv) zouz dsrhpvb zouz ilnvl vxsl (hkzxv) kzkz ilnvl lhxzi fmrulin wvogz (hkzxv) rmwrz mlevnyvi wvogz rmwrz xsziorv zouz gzmtl vxsl (hkzxv) zouz nrpv zouz gzmtl vxsl fmrulin ilnvl (hkzxv) vxsl mlevnyvi wvogz lhxzi ilnvl hrviiz vxsl (hkzxv) kzkz zouz fmrulin hrviiz vxsl

```

The above is encrypted using the Atbash cipher which is hinted by the reversal of the first string, the A169b9cd2ccab955466d21e501bdbb20d7c9bd935Z string, and by inspecting the HTML source of the puzzle which shows an HTML comment between the "1" and "28" in "128". Using the Atbash cipher gives:

```
alfa mike oscar november golf (space) sierra hotel oscar oscar tango (space) foxtrot oscar lima delta (space) sierra india charlie kilo (space) papa yankee romeo alfa mike india delta (space) india november charlie hotel (space) alfa whiskey alfa romeo echo (space) papa romeo oscar uniform delta (space) india november delta india charlie alfa tango echo (space) alfa mike alfa tango echo uniform romeo (space) echo november delta oscar romeo sierra echo (space) papa alfa uniform sierra echo

```

By using the Phonetic Alphabet to decode this into letters you get the wallet seed:

```
among shoot fold sick pyramid inch aware proud indicate amateur endorse pause

```