201108091909 je00i

solved unencrypted manual

A GIF whose changed bytes hold a short link, http://bit.ly/nLGwKt. Hex-encoded GIF89a.

Metadata

Post ID: je00i
Title: 201108091909 → 2011-08-09 19:09 on A858's clock
Posted (UTC): 2011-08-09 23:09:36
Timezone: UTC−4 · title 19:09 against posted 23:09 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: S solved special
Content: Banners and statements from A858 as itself
Size: 7,802 hex characters · 3,901 bytes
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 34 · 34
Tags: pre-automation2011Solved special postmanualbanners and statements from a858 as itself

From the post to its content

As posted

47494638396135004F00F7130006203CADC2A846717F88152439243A8A737C8A 3C46315D6E8A1F2D8492960D3B4F787574FCCD96C3B3857325346B858E8F666C D6252ADD9475122C45E20F16353F52F6D39BCB252C8DB2A975999EC27B6C865C 5D1B4256DF0F165E8690E9D49EBC29323A2C41BA8E7BD3121BD8423F84243278 616701324C71949C6C2535B38B7B834754E0C191A4736BC4BB98632234FFEAA5 B7A7926B4B59C9151F8F424C245265606266644252571D3182A6AB7734438331 3EA0626A2B2D4359ABB373A3A5E42325114157B4222B659DA6AAA395748B945C 4754426C7B507A876B9AA2847C848A5A64B50C18A91D29CC4E49CBC9A38AABA4 F2DCA4012E49C2444A1B495EFADEA3C63C3FB9B59AB32F3AC6AE82EEDBA41A24 3FBB454B4C535EB34B53799B9EA4998BDC1920AB323CD36B5DE0D3A342334650 5A6A8F7D74B5424A7B848CC79C8286A49F514052BC3B43B72F37103D514D283B AC1A26D4AC8BC4333A012B46ADB7A1AB535B4B4857C2665CB05E606E949DD6B9 8A023650AC4C525A828ED41B22E5151BA58C7D9C1E2BA22530795159628D9CFF F3AECED5AB1F3249905E68858289C3C4A2B53C437DA3A8344B5CBF666398877C 63364555293B7C2D3C053851A4B6A3214A5E9526327D7A85A7343E43293CE7D4 9E3A6474BBAA82DABC938C9C9AF5E3A8273C51D52E33A75A628B69737A9DA2C6 2C33AE4349A76B67DFDBAAC7987CB41924133149AE39420B334B2B586AFCE4A6 A214225B3142232D4498343FA4A395632A3A749BA29CAB9D687474703A2F2F62 69742E6C792F6E4C47774B7423A7464F941E2C01264234607137293E7C949A74 817A144359543244DB9F7F6EA9AC9872773D3F507CB0ACBB313AC6D7AE4B7482 9490879D5C65BE9C80D24C4B462D417C2332766C72E3181E733F4DFEEBAADC14 1B5B565EA86F74EE0D12C350529ABCAC9A4B547A8C93648B9562A2ABB7595BEC E2AB5C283ABEC6A6CDB896634F60F9D59C926C74B7BDA11C2E450D3C528E7C82 AC948293917E446172A29F928CA39D1E4C61E9D6A2BB1A246494A09F182593AA 9FDFC69A224E624247597CA1A62C0000000035004F000008FE0061091C48B060 415D59F6206CA0300B8B3D9DF61884A5ADA2B681170D46D9C8B1A3168F51B4E8 6A40B281AE932647EADAF891A3857530D769D9B4E95E140B03A37CC9B0F38BCF 9F3D810AFDD1E8D69752A58EEEE4F9F3079730117A45A8F0EE4D1031A270C28A 92418FD7AF60C38A85B0AB8858B143D07418B16DC40429705701D1CA550F0A14 76F1E2F5BAF7EEDD244932D060D2A2D9902149F4EAB59B6414853F61C2F43841 59AE562D5DCF9EC59B44499A073F12A0F96687479AC461F116B9B0ED0FB61094 4F34992BB0EE5DCD5FF7EE0214415C825C2062691A206A31581443FA3CC6462C 761CDA5BBB26196257338AC456285C2A914D16810927F8FEB00AA388FAEDBC43 2074700D9BF2F3CB1950F05856CC7C6EC6E29CADAA46594A6CCA708491461145 00965B12F0B416467BB241A745291EF420092DA35CB71763698040C07F27CC72 021C4D5CF20B1AC0CCB04D1BF01C9806649239E76029488427050E202892C457 49A411C186B15520C6082930028828C528734A2BA39862CA699C89F3476BEEC4 36DB65A5404307659410638A38E85911071F94B94240383ACCD00608BFE0534E 37A27051C410BB58C8176B7F44E9DE8B31F241071CAEC051CE10C889D3840394 55738184B638D0CD03709C80030ED68C204A1B14CC61965EA640E9E2655F3CA0 C90B34F090C904B4A0708B385C1013822BB2FD72420AFE259C30491AF0D8121B 2B70081286294AA0A647A6754A095D14B71430073CB790038F24B62C334F08F8 B012DB041E3A008803134C50017FFFB1820F16BFB003E8AF9ADE49D70FEC2CE3 831E432430892D974CB08A201C52C68A354D48E20A31E704D3441C25B0428015 248C70C15EC0DAD9205DB7A4E1CC3245C0C38526C1BC80C082FF4D76823B0E38 D0846BDE7C634504A3E4E24E24C9C8010F26E2243147B927BC27D0837E482108 20036C41C01429B8634DACB149D22865D6FE61CA1CD20053443E950442C00C63 D08358126DC02C332C5ADC5204328244404B363C14B3C3871EFEA709ABB20172 81A560A003453B75A0A3C42E6CB5A10439686CD322FE6553D69641114078D3C7 2D090C518C0EFED5FBDFC5DB48930419302CB2082C6424410E043300F28738BB 50803165820C5BDF2EEB15414E120994A138879A00626920B0C0D04E3B309051 CF177A9421C8084BF0D0C1E7270433EC2D9844F08B35A69092C617A1D0A1B0E2 B678234D1A315CB4481DB557528F1EC7F4F0471FEC74808D26B185CE70019AFF B20D05A6DCC28930682BCE473080A481493A1791B1080C4FD4A1453D1C78C70E D05000F149C25EBFE8C5B90AA0A027CDE146D9D08414AEC4215648022B282842 25A2008B43402172ED300411A4A50967D8611BD83807657AB08D08ACA336B750 0220C2F0873F74A00F374A40388C60043ABC8382FE2760861884D08A213C401A A820010D16A03D5E1C621E129AC02F3407881450661623E8C50BB1560A3F9C03 1F91A10004C695845214E3062290877FE860860718200E3B10C22F76600D04FC 220D3F80022952F0076BF04110D8700DD05831032DCE0C462770450F7A108729 DCE2467CF9040F1E118A1320E21387F80426B8600D3A486116ABA0801B54B082 55584308C140C40EA87889D8E0438187B452780800821910220DA578A41E7881 0E5220E0043A20020CB4008E66F8420677B0411E2ED1827B18E0051320C0084C E185D6000268317B911F5C51865890200665A00322D8600245E8E10930C0C505 98608A7A102415642083390E118D7B18E20A67FED00024E6808697B9C61AE51B 5E1A7E41815E7C601388A00C1DE810821B10E122D1B08329F2510F2D0C440B8B 40C713EE21900FB8E010E6C005269EF40740A89032081856068AC10553ECC110 AA100687C4E9026D3CA30005484221D6008AAD0C04141999192C16418A2705B2 6C2748295DF4B08F0060A0222D902987A4C08140D4A11C98480C452D2A902714 430E16E8E9227A7A08524446101AA34C0986850228C4631902210410A77A8425 24223178C940259C9A8F7DE0E1127DA8471A6AA18D2760011F1700CF7FD64A97 9532630B72D0861112A7383A004006B7E00B0A0A418A4440C2028648473C30A0 883E344304295064BD943A33E2B962165958FE87EA5697486290C2577AF8471F 06A00F2B68400E1270022948910F66CC3536F37B912FE8200350C801A98AEB01 1B8AA107BC16A27F4B40453D9E000A06582110E098C7712933811024904ACBBD 8136D4B005DA9E0019FE10071AD200A842D4A18395700103D6E18904988317F1 E3D039A8D1C22D3EC8172708013F5420D5D5492114B7A81A3B6EF4050E46E10A E5980323D2010AF1AE8E156548A0814B81E0094020110D9EE9091C0187226082 02DBF002722657056DFC970C868881B4DCCB5A2EFAC23F8310026D1DB1883354 A01EFF08078C4D518004A4C210B0A88240B46183F172C81ACAF5CF395EB0BA1E A8C110C6F0452530830640E8ED02569040FE5881DA09CAD216CBE875EF09984B 06CAF182764FC8873422B03E0A64911A2A008315E57C02C61E12C1EE0D05FE6A 33105EFCA008D2688329227001315CC30B2900939C7B7C603773481890D08694 B7C2D5ADAC0131192CC5339431072E13DA7C8776AF30CEA00D0E4E840CD5D1DA 1E52F10D1C5082D07DF3B19C39F081890C0417D7E545176C5185284020C5AB0B 76A7DD4B87508F7A20FD1BE617AEE70F0068E02281B0F27FA44D62394BA10B13 D1C23EA200035E14020AB910060DA240066D4C63C7AB135E9CE51C8A621B0414 3D7D423D78B10E667083725A30841AF0BD5AE512DA151F80F2B527A20D179820 235130443C3C9DC8A43ADCDC36904850FE8D9D0A42B02023DA604180916B681F 73BC5E0BED02183E5011639B431D813044156A2C0268C766121F27F409A4200C 0E2CC01323FFA9198C516B8A54797540DFB7D0FB230C292C200A49D7C635988E 757EACFC3F518FF5D43FDD852B80622351D6C61916506B6D44C3E73FCFF2D83F 7D0781F4B40A8650810A0CC1416E885B56729FFB7F84718DA06A430E9185053F 18DE70A9CF9DB2B3BE488DE5E0098A4002EE0145EFCB692B05663003F2F168BB 1AF821EA3B6CBE32811FBB23D4708350A08D154887851A403B0DCC530611591C 31A2E74E870D2403153B96823F5E38B9829FFE04DE82A58F3DE9C909C2052ECC 7FFE042D1B027750560A36D0C29321FE41074DD3161F0ECAC038FA41054B5882 0AE5B7843DCCCF7EF3A39F0AEBEF472888A1AA1010A00FC990C025AC618B73F8 FFFFFFF702D630032E44111F1040C790800AA8801CB0800EC880B3800888300B B3B00516380B8B94811AA881EED06F14B1090AB050C27025743082CFB750CC37 82438782CD475940E47CB1E1490AE549EFB00906F80E2770009C600F7440059C 7000387802F6500338F80A9C108407F00AEF5003FDD00FF630673E780C70D10F 47C00941E0439C50037410049C70840A506CDA008294800239E00BC2000D3970 0BC74007C78002FF7000679803AFC0868DE007FD904BFFD04552C00939300CC2 F00AB7D0088D300E27700C654807FEBE90037E7002EF008620C807E380021E70 02BE90596B0888B7000DC25003FF70047FD808C340055DC409E3F00F5470008D 3087E3700B02908847580A0270877A70856FE0880AC0077A300EE3700CBA388B 74000DB94888EF80027E400747D008E8D708470000C7680F072087EF700BC5F8 0EBED00FC740627E500AC370258D6880B7A807BE300E07300E488002EF2005E3 E00747500A6BE8017A4009BE800242D84547A007B7F00EC3208754D08914D483 99658F54C08DB678027A20001EE0071E7004F71804A5B0838D0087EBD80FE948 07FD700BB7904B7EC8098D500354A08C5732411C9059A6220002E98D27800247 000D24360CB74009AFF00FD0C0FE0999F887B088929B089347F00F19998AC700 93C2F00E479080289001C0A807E7588B1FA8002790015DA88C07500A94200017 F90FB7208C5E710B35200CFDD089C7905927300CA97892E3F00EAF9003D01004 D248893A49076F608361A894EE539649C88EE3A0075DB88A01E90799F543FDD0 0824E907FFE08C390087D0F00F5E510A351004FF8004C27000FF3089DDF89604 390C5D690FAFA00735A0074850829CA08DC2A090084691B0280CC3D0894F3987 41E0071940946CC89A411089F6F085DE280560429B940126BF865C43171E43E7 1FEFC007BEF96BB5E949C7F043FE519BFEF16BB2A90D07F8060A50150AF006CE 399DD2E99C55F10ECF599D0A2E109DCEF99CDC299DDBA99DDC899D0A406C03F1 01E8999EEAB99EEB4906ECF99EF0F99EC6369FF4599FF659100101003B

Decode. The body as posted is this file in hex: decoding it gives the file below.

GIF image

Download je00i.gif 3,901 bytes · SHA-256 cec7c0c711292ffa4fd2ac0944b6d74c4a5d157b11ad34f0fa6fb18b00acd376

The GIF that je00i's body decodes to

Compare. With the baseline GIF jcm5f, which holds no message, the 20 bytes from offset 568 that differ are where the content is.
Read. The changed bytes are ASCII characters, so the text is the bytes as they stand.
Meaning. A bit.ly short link.

Changed bytes

Bytes 568–587: 20 of 20 differ from the baseline GIF jcm5f.

687474703A2F2F6269742E6C792F6E4C47774B74

As plain bytes:

http://bit.ly/nLGwKt

Explanation

2011 GIF steganography

Status: verified. Three messages are checked against the community archive, and jgxlk's against its Arctic Shift copy.

These five posts decode from whitespace-separated hexadecimal to GIF89a images of the same size. The first, jcm5f, is the baseline. Each later image differs from it in one short, contiguous byte region, and that region carries the message:

Post	Title	Hidden in the changed region
`je00i`	`201108091909`	`http://bit.ly/nLGwKt` (as plain bytes)
`jf2zh`	`201108101152`	`18033-3:2005`
`jgxlk`	`201108121018`	the 16 bytes `34A14A42E98FF96095AF56604E290CAE` = MD5(`A858DE45F56D9BC9`)
`jlcv0`	`201108170156`	`http://redd.it/jkuyr`

je00i's URL and jgxlk's digest sit in the changed bytes directly. The other two use the nibble-pair rule ((byte[i] & 15) << 4) | (byte[i + 1] >> 4) over the changed region.

jgxlk is not in the community archive; its body comes from Arctic Shift, and the digest was re-checked against that copy. The same MD5 is the key of 550 posts, among them 15cd8y, and the digest itself turns up again in the decrypted text of 12yvg0.

The findings page, with both ways of reading the bytes and the checks, is 2011 GIF posts.

Solution summary

Method: GIF steganography
Result: short message in changed GIF regions
Explanation: Verified
Re-checked: GIF steganography