A858DE45F56D9BC9, post by post
Between 2011 and 2016 a Reddit account posted 9,761 blocks of hex. This archive shows every one of them: how it was decrypted, what it contains, and which run of A858's posting program produced it.
Highlights
A few of the most interesting posts — pictures, messages, puzzles and references hidden in the hex. Each links to its full page with the decode steps.
- 201601132259 40t6rg explainedA Powerball play, 1 17 26 45 51 + PB 19, for the 2016-01-13 draw. Six plain bytes. A pick, not a result.
- 201210080311 114med partialPyongyang coordinates, dates and codes. 3DES-ECB, key MD5(name+title). Open: the code AO34.
- 201410210620 2jtoce solvedA boxed word puzzle: NEW EYE5 / NO ANSWERS / STILL W3AK / TOOL / AMOUNG YOU. Hex, Base64, hex, grid.
- 201401281330 1we0v9 solvedAn ASCII birthday cake, 'H A P P Y B I R T H D A Y'. 3DES-CBC, key MD5('cakeday'), IV assumed.
- 201301010015 15qth4 solvedA UTF-8 'Happy New Year 2013' banner. 3DES-CBC, key MD5('2013'), first block lost.
- 201112011634 mwub3 solved'Twas the Night Before Christmas', with look-alike Unicode characters. 3DES-ECB, key MD5(name).
- 201109071444 k7zqv partialA Carl Sagan quotation, 'Wonder and Skepticism'. Only a 184-byte span survives, from a comment. 3DES, key MD5(name). Open: the rest of the body.
- 201110201724 ljcad best-guess8 bytes, 0x257959 = 2,455,897: the Julian day of 2011-12-01, the day A858 resumed after a 42-day silence. Plain. Open: why it points at that date.
- 201205231544 u1rti partialA 40-hex SHA-1-shaped digest: the BitTorrent info-hash of 'Think Like Your Customer.rar'. 3DES, key MD5(A858). Open: the meaning of the post.
- 201308301957 1lfm8j partialPlain JSON: six prime values from one prime-tool self-test. Open: which inputs were chosen.
Progress by status
- explained 3,562 36.5 %
- inferred 6,123 62.7 %
- solved 44 0.5 %
- best-guess 5 0.1 %
- partial 16 0.2 %
- unsolved 11 0.1 %
Encryption
- decrypted 3,522 36.1 %
- unencrypted 103 1.1 %
- encrypted 6,133 62.8 %
- missing 3 0.0 %
What the statuses mean
- explained
- Content recovered (or readable as posted) and shown to be generator output: filler GUID lists, 32-bit word lists, batch markers.
- inferred
- Not decrypted, but the post fits the filler generator exactly: its length is 64·N+16 hex characters and N is the count the run's RNG draws for that slot (or the run's fixed N).
- solved
- Content recovered and understood: a message, quote, artwork, program or file.
- best-guess
- Readable, with a leading interpretation that is checked but not confirmed.
- partial
- Decrypted or decoded, but part of the content (a digest's preimage, marks in a table, a lost body) is still open.
- unsolved
- Content not recovered or not understood.
Posts per month
- explained
- inferred
- solved
- best-guess
- partial
- unsolved
Manual posts
161 posts were made outside the scheduled program: 2011–2012 hand and tool posts, operator tests and a companion account's setup posts. Most carry content: messages, quotes, ASCII art, code, coordinates, prime tables.
- explained 83 51.6 %
- inferred 3 1.9 %
- solved 44 27.3 %
- best-guess 5 3.1 %
- partial 16 9.9 %
- unsolved 10 6.2 %
Findings
The mask digit
The "version" digit of every GUID in A858's lists is C#'s Random seeded with the current millisecond.
The 32-bit word posts
Six 2011 posts are lists of 32-bit words. Every word is four Next(lo, hi) calls on one seeded System.Random, one call per byte.
The count RNG and the runs
The number of GUIDs per post comes from one long-lived C# Random per app start, seeded with the machine's uptime. It identifies runs, restarts and reboots.
The batch markers
Forty-two posts are a GUID that is all zeros apart from a code and a small number. In summer 2012 they open and close batches of NN filler posts, and the batches line up with the runs of the count RNG.
New results
What this project found that was not known before - new keys, posts nobody had read, new readings of old posts, and the filler generators.
The 2011 GIF posts
Five posts from 8 to 17 August 2011 are GIF images. Four differ from a baseline GIF in one short run of bytes, and that run carries a message.
The sidebar
Every value the subreddit's sidebar showed in the Wayback Machine's captures, when each was seen, and which posts use it as a key or contain it.
The keys
The key of every post this site can open. Three passwords built from the account name cover 3,513 of the 3,523 keyed posts; the other ten use seven keys between them.
The August 2015 AMA
In August 2015 /u/w95 held an "ask me anything" on r/Solving_A858 and answered every question in a code. How the code works, the two code tables, and every question with its answer.
The companion account
A second account, the account name reversed (9CB9D65F54ED858A), posted eight posts on the main subreddit in February 2014 and a run of 122 on its own subreddit in January 2016; a seed reproduces all 122 counts, but none is read. Also the main account's 117 posts on its second subreddit, r/A858DE45.
A858's messages
Transcripts of private messages from the people behind A858, published only as screenshots. In them the operator says who they were, how the posts were made, and why most of the puzzles can't be solved.
About & data
What the statuses mean, where the data comes from, and the format of the downloadable JSON.
Runs
140 app runs, fixed-N batches and post groups, each with its posts, seed and boot time.
Counts
| Status | All posts | Manual |
|---|---|---|
| explained | 3,562 | 83 |
| inferred | 6,123 | 3 |
| solved | 44 | 44 |
| best-guess | 5 | 5 |
| partial | 16 | 16 |
| unsolved | 11 | 10 |
| Encryption | ||
| decrypted | 3,522 | 85 |
| unencrypted | 103 | 61 |
| encrypted | 6,133 | 13 |
| missing | 3 | 2 |
Excluded from the counts: 7 posts whose body was empty or removed. Posts by other accounts (mostly from February 2016, when the subreddit briefly accepted submissions) are not part of this archive. The companion account's posts, and the main account's posts on its second subreddit, r/A858DE45, have pages of their own and are summarised on the companion page.