It had been exactly 366 days since the 2012 Cicada puzzle began.Nothing had happened in 11 months.Until the 5th of January 2013, when a second image was posted to /x/ and /b/ imageboards on 4chan.There were three threads where 3301 posted 232.jpg on 4chan, two times on /b/ 23 hours apart(1,2) and once on /x/.There was another thread one day earlier, /b/ thread on 4th that mentioned "warning pastebin" and SMS4TOR (onion.to link) service.The image was processed by the  steganographic tool outguess.This message was the result.A more analytic look reveals the use of a book cipher.To decrypt the message, one needs to find the text that was used for encrypting.This poem, introducing the secret message, was a nudge towards the right text.After a bit of debate, the text that was used to encrypt the book cipher was discovered.The book that was used to hide the message was Liber AL vel Legis  by Aleister Crowley.Also known as "The Book of Law ", it is available online, and can be found here .

The first line I:1:6 points toward the 6th character of the first line in the first chapter, an 'h' in this case.It was assumed that spaces weren't counted.Punctuation, however, influenced the character chosen for the plaintext.During decrypting, we found that dashes were vital to the process, so we kept them in the plaintext.Using these rules, we encrypted the book cipher and came up with the decrypted message.We agreed upon substituting the dashes with slashes and came up with a hyperlink.The hyperlink (mirror, mirror 2) directed to a dropbox address with a file of 130MB ready for download.After downloading, the file was analysed and a quick check for magic bytes (header bytes) revealed that the offered file was an .iso image.The image file was downloaded by multiple solvers and either burned to disc to run on a computer or opened in a virtual drive.Looking into its contents, we find three directories, "data", "boot" and "audio".When booting from the image, a boot sequence appeared, printing a sequence of numbers to the screen.

Investigating the sequence revealed that the live image prints out all prime numbers up to 3301.There were temporary two-second pauses at 1033 and 3301, where it stops at the latter and moves to the second stage.bitcoin kievThe next, and last stage of the procedure is a screen that reads: Further analysis of the live image turned up the routine responsible for the display of the prime numbers.bitcoin wallet krakenIt is a linux shell script (found here , for those interested), which, luckily, is human-readable.asic bitcoin miner litecoinIt does not calculate prime numbers, like some suggested, but connected the printing command with a sleep command.bitcoin plus erfahrungen

In most cases, the sleep time is 0.5 seconds.In case of the primes 1033 and 3301 however, the sleep time is 2 seconds, which manifested the relevance of those two numbers.Also, this clue said "you" not "we", differing from the last one in the choice of words.bitcoin core data directoryAlso found in the image was this PGP signature, which has been verified to be 3301's official signature released during the puzzle in 2012.ethereum jobs londonIt is possible to interrupt the boot sequence by pressing CTRL+C.bitcoin watchdogUser "tc" is active and does not require a password, is in sudoers file with no prompt.litecoin price forecast`sudo ash` to raise to root.bitcoin dropping reddit

Further inspection revealed nothing that is not listed in this wiki./watch?v=PTFa6dwCEiA The folder "audio" contained an audio recording.The title of the recording was "761.mp3" and can be downloaded here.The ID3 tags show us that the title of the file is "The Instar Emergence" and the artist "3301".The used instrument is a guitar, with distorting effects on it.On the track, a reversed guitar is played and amplified throughout.The song has been deconstructed and checked for hidden reversed messages, but as of yet has turned up nothing out of the ordinary.The song is in the key of Db minor with a custom guitar tuning of Db-Ab-Db-Gb-Ab-Db You can listen to the song here: Cicada 3301 Song The Instar Emergence (761) Key points about the track is the initial 'breath' sound, believed to be the sound of many cicadas and the tempo changes, beginning at approximately 135 bpm, accelerating to 145bpm, then slowing to 125bpm.This has led some to believe that the song has been slowed down by 5%.

The only instruments  used were a guitar acoustic and electric and an effect driven bass drum.A draft spectral anlysis shows a constant hum at 15.4-16.1kHz, and empty notches under 500Hz starting from 1:56.A hexdump of the mp3 file revealed the following message: The original message had " " attached to the end of each line.This character sequence is used to indicate a new line in some programming languages.These were omitted due to the availability of proper formatting techniques.The subgroup who were assigned the task of analyzing the poem/riddle above have speculated that circumferences might be a reference to perceived limitations rather than actual physical walls."Find the divinity within and emerge" is most likely a reference to the divine ratio, or phi.Such shedding may also be a reference to the way Cicadas shed their shells.It has also been pointed out that the song is 2:47 long, or 167 seconds, which is prime.It is also a reversal of the name of the file: 761.mp3, and 761 is also prime.

While people still searched through the image to find more hints that may have been overlooked, somebody in the IRC found a twitter account which got our attention, to say the least.Multiple things were strange about that twitter.It fits the overall "style" of cicada, it was registered shortly after the first downloads of the live image and it had no followers.It was later found to be the reference on the boot CD to @1231507051321 (note: 1231507051321 is a palindromic prime number).The most striking thing about it though was the messages it tweeted.Each tweet consisted of an offset, and 65 bytes of hex code.For example, the first message went like so: 3301 appears to have used a bot to post the tweets at 5 minute intervals (up until 0:00 GMT Jan 7), then onto four minute intervals until 19:00 GMT Jan 7, where it was seemingly random up until 22:04 GMT Jan 7, where it moved onto two minute intervals.The twitter bot stopped posting tweets at 4:52 GMT on Jan 8.The meaning of the tweets and the rest of the files left the solvers stumped for several hours.

A full feed of the tweets is avaliable here.After a day of fruitless searching, an IRC user did the impossible and solved the next puzzle.This user took the 761.mp3 file, and XORed it with the file produced by following the instructions in the twitter.The result was a .jpg file.It was possible to "pre"-construct the image resulting from the tweets.The .jpg file appears to be a rune table, consisting of three columns, named "Rune", "Letter" and "Value", and 29 entries."Rune" contains the actual rune character, "Letter" contains one or more plain text characters and "Value" contains a number.It is interesting to note that the numbers to be found in "Value" are all ascending primes, building the sequences of the first 29 prime numbers.As a member in the IRC pointed out, the runes stem from the Anglo-Saxon rune set, and the letters are in the order of the Anglo-Saxon runes.It was revealed that this is a fully-blown Gematria, which can be applied to different pieces of text to reveal interesting numbers.

'The Instar Emergence', for example, produces 761, which is the name of the file and the file's time signature reversed.It was soon discovered that this image, like the very first one, contained a hidden message, once again masked via OutGuess.The message itself can be found here.As in every message from Cicada, the content was followed by a PGP signature, which proved the authenticity of the message After finally getting a message from 3301, the solvers found that it was, to quote the IRC, 'Mostly Blank'.The message, it turned out, contained a mixture of tabs and spaces.The solvers converted this to binary, then again to ASCII, then they found the next message: A quick filler: emiwp4muu2ktwknf.onion is a website that can only be accessed through Tor, which is using a hidden service URL, similar to the last Cicada puzzle.Upon visiting the website, the solvers were presented with the following message: Note: the formatting may be a little off on your screen.Press control/command and - to view the full message.

The solvers soon found that web browsers were indeed useless, and that we would have to telnet into the website through the tor network.Some solvers did so, and they found that the website included an interactive shell.They could type in any number to have it factorized, 'count' to have it count up prime numbers, 'quit' to quit, and 'hello' to return a message.Please see here for the original message.It was soon discovered that the messages could be turned into ASCII which created another message, again GPG signed by 3301.The message reads as follows: This led us to another, the second .onion address.As the solvers patiently waited for more news about the second .onion, they continued to explore other options that they may have overlooked in the blind rush towards victory.A new message was found by telnetting "hint" or "clue".And XORing result with _560.00 file from the DATA folder on 3301.txt CD image.In Cicada OS the solvers found two files named Wisdom and Folly in ./tmp /cicada/wisdomWisdom is exactly the same as folly, but appears to represent no file type.

Telnetting 'primes' into the shell printed out a list of primes similar to the one on Cicada OS, but some primes were missing and two have extra spaces in front of them.There were extra spaces between 29-31 and 3257-3259And some missing primes between 71-1229 The missing primes are as follows: You can use a hosted telnet service to access the tor website here.Once the solvers had found the second .onion, the next logical step was to visit it with a browser.Upon arrival, they found the following: Rummaging through the source code for the html, they found the following: Soon afterwards, someone attempted to telnet into it, producing an error message which contained the address of the VPS on which the site was hosted.Promptly afterwards, the site was taken down.After this the 2nd Onion site finally reopened.The solvers got the following hint: This hint told the solvers that they needed to ping the website's IP address and listen to the reply.Each ping reply was laced with data bytes, which could be combined to make the following: On the third Onion page the solvers recieved a message instructing them to 'standby for coordinates'.

They prepared to visit the addresses which these would undoubtedly lead them to.Each poster had a phone number on it as well as an access code.Note that each phone number either ends in 3301 or 1033.Calling the phone number gave an automated speech asking for a code to be typed into the dialer.Solvers soon realised that they had to convert the access code given in the poster to it's gematrified format and type that in.Upon doing so the following message was given (it varied depending on location, this one was for Portland): The data, when XORed with the 560.13 (the 13 coming from the dataset) file from DATA, provided the user with a string of text, notably in this case "gbyh7znm6c7ezsmr.onion".It's important to note that each location gave a different onion address.All in all, 6 of the locations had their codes recovered, while the seventh was not physically visited, but the phone number obtained by wardialing all numbers ending in 1033.On each of these onion addresses (as listed in the table below), each solver was given an SSSS code, which stands for Shamir's Secret Sharing Scheme.