201108170156 jlcv0
solved unencrypted manual
A GIF whose changed bytes point to redd.it/jkuyr. Hex-encoded GIF89a.
From the post to its content
As posted
474946383961 35004F00F713 0006203CADC2 A846717F8815 2439243A8A73 7C8A3C46315D 6E8A1F2D8492 960D3B4F7875 74FCC6874747 03A2F2F72656 4642E69742F6 A6B75797222C 45E20F16353F 52F6D39BCB25 2C8DB2A97599 9EC27B6C865C 5D1B4256DF0F 165E8690E9D4 9EBC29323A2C 41BA8E7BD312 1BD8423F8424 327861670132 4C71949C6C25 35B38B7B8347 54E0C191A473 6BC4BB986322 34FFEAA5B7A7 926B4B59C915 1F8F424C2452 656062666442 52571D3182A6 AB7734438331 3EA0626A2B2D 4359ABB373A3 A5E423251141 57B4222B659D A6AAA395748B 945C4754426C 7B507A876B9A A2847C848A5A 64B50C18A91D 29CC4E49CBC9 A38AABA4F2DC A4012E49C244 4A1B495EFADE A3C63C3FB9B5 9AB32F3AC6AE 82EEDBA41A24 3FBB454B4C53 5EB34B53799B 9EA4998BDC19 20AB323CD36B 5DE0D3A34233 46505A6A8F7D 74B5424A7B84 8CC79C8286A4 9F514052BC3B 43B72F37103D 514D283BAC1A 26D4AC8BC433 3A012B46ADB7 A1AB535B4B48 57C2665CB05E 606E949DD6B9 8A023650AC4C 525A828ED41B 22E5151BA58C 7D9C1E2BA225 30795159628D 9CFFF3AECED5 AB1F3249905E 68858289C3C4 A2B53C437DA3 A8344B5CBF66 6398877C6336 4555293B7C2D 3C053851A4B6 A3214A5E9526 327D7A85A734 3E43293CE7D4 9E3A6474BBAA 82DABC938C9C 9AF5E3A8273C 51D52E33A75A 628B69737A9D A2C62C33AE43 49A76B67DFDB AAC7987CB419 24133149AE39 420B334B2B58 6AFCE4A6A214 225B3142232D 4498343FA4A3 95632A3A749B A29CAB9DA783 79CBB98AA653 5AD4CCA1DC24 27557E8AC81A 23A7464F941E 2C0126423460 7137293E7C94 9A74817A1443 59543244DB9F 7F6EA9AC9872 773D3F507CB0 ACBB313AC6D7 AE4B74829490 879D5C65BE9C 80D24C4B462D 417C2332766C 72E3181E733F 4DFEEBAADC14 1B5B565EA86F 74EE0D12C350 529ABCAC9A4B 547A8C93648B 9562A2ABB759 5BECE2AB5C28 3ABEC6A6CDB8 96634F60F9D5 9C926C74B7BD A11C2E450D3C 528E7C82AC94 8293917E4461 72A29F928CA3 9D1E4C61E9D6 A2BB1A246494 A09F182593AA 9FDFC69A224E 624247597CA1 A62C00000000 35004F000008 FE0061091C48 B060415D59F6 206CA0300B8B 3D9DF61884A5 ADA2B681170D 46D9C8B1A316 8F51B4E86A40 B281AE932647 EADAF891A385 7530D769D9B4 E95E140B03A3 7CC9B0F38BCF 9F3D810AFDD1 E8D69752A58E EEE4F9F30797 30117A45A8F0 EE4D1031A270 C28A92418FD7 AF60C38A85B0 AB8858B143D0 7418B16DC404 29705701D1CA 550F0A1476F1 E2F5BAF7EEDD 244932D060D2 A2D9902149F4 EAB59B641485 3F61C2F43841 59AE562D5DCF 9EC59B44499A 073F12A0F966 87479AC461F1 16B9B0ED0FB6 10944F34992B B0EE5DCD5FF7 EE0214415C82 5C2062691A20 6A31581443FA 3CC6462C761C DA5BBB261962 57338AC45628 5C2A914D1681 0927F8FEB00A A388FAEDBC43 2074700D9BF2 F3CB1950F058 56CC7C6EC6E2 9CADAA46594A 6CCA70849146 114500965B12 F0B416467BB2 41A745291EF4 20092DA35CB7 1763698040C0 7F27CC72021C 4D5CF20B1AC0 CCB04D1BF01C 9806649239E7 602948842705 0E202892C457 49A411C186B1 5520C6082930 028828C52873 4A2BA39862CA 699C89F3476B EEC436DB65A5 404307659410 638A38E85911 071F94B94240 383ACCD00608 BFE0534E37A2 7051C410BB58 C8176B7F44E9 DE8B31F24107 1CAEC051CE10 C889D3840394 55738184B638 D0CD03709C80 030ED68C204A 1B14CC61965E A640E9E2655F 3CA0C90B34F0 90C904B4A070 8B385C101382 2BB2FD72420A FE259C30491A F0D8121B2B70 081286294AA0 A647A6754A09 5D14B7143007 3CB790038F24 B62C334F08F8 B012DB041E3A 008803134C50 017FFFB1820F 16BFB003E8AF 9ADE49D70FEC 2CE3831E4324 30892D974CB0 8A201C52C68A 354D48E20A31 E704D3441C25 B0428015248C 70C15EC0DAD9 205DB7A4E1CC 3245C0C38526 C1BC80C082FF 4D76823B0E38 D0846BDE7C63 4504A3E4E24E 24C9C8010F26 E2243147B927 BC27D0837E48 210820036C41 C01429B8634D ACB149D22865 D6FE61CA1CD2 0053443E9504 42C00C63D083 58126DC02C33 2C5ADC520432 8244404B363C 14B3C3871EFE A709ABB20172 81A560A00345 3B75A0A3C42E 6CB5A1043968 6CD322FE6553 D69641114078 D3C72D090C51 8C0EFED5FBDF C5DB48930419 302CB2082C64 24410E043300 F28738BB5080 3165820C5BDF 2EEB15414E12 0994A138879A 00626920B0C0 D04E3B309051 CF177A9421C8 084BF0D0C1E7 270433EC2D98 44F08B35A690 92C617A1D0A1 B0E2B678234D 1A315CB4481D B557528F1EC7 F4F0471FEC74 808D26B185CE 70019AFFB20D 05A6DCC28930 682BCE473080 A481493A1791 B1080C4FD4A1 453D1C78C70E D05000F149C2 5EBFE8C5B90A A0A027CDE146 D9D08414AEC4 215648022B28 284225A2008B 43402172ED30 0411A4A50967 D8611BD83807 657AB08D08AC A336B7500220 C2F0873F74A0 0F374A40388C 60043ABC8382 FE2760861884 D08A213C401A A820010D16A0 3D5E1C621E12 9AC02F340788 1450661623E8 C50BB1560A3F 9C031F91A100 04C695845214 E3062290877F E86086071820 0E3B10C22F76 600D04FC220D 3F80022952F0 076BF04110D8 700DD0583103 2DCE0C462770 450F7A108729 DCE2467CF904 0F1E118A1320 E21387F80426 B8600D3A4861 16ABA0801B54 B08255584308 C140C40EA878 89D8E0438187 B45278080082 1910220DA578 A41E78810E52 20E0043A2002 0CB4008E66F8 420677B0411E 2ED1827B18E0 051320C0084C E185D6000268 317B911F5C51 865890200665 A00322D86002 45E8E10930C0 C50598608A7A 102415642083 390E118D7B18 E20A67FED000 24E6808697B9 C61AE51B5E1A 7E41815E7C60 1388A00C1DE8 10821B10E122 D1B08329F251 0F2D0C440B8B 40C713EE2190 0FB8E010E6C0 05269EF40740 A89032081856 068AC10553EC C110AA100687 C4E9026D3CA3 0005484221D6 008AAD0C0414 1999192C1641 8A2705B26C27 48295DF4B08F 0060A0222D90 2987A4C08140 D4A11C98480C 452D2A902714 430E16E8E922 7A7A08524446 101AA34C0986 850228C46319 02210410A77A 842524223178 C940259C9A8F 7DE0E1127DA8 471A6AA18D27 60011F1700CF 7FD64A979532 630B72D08611 12A7383A0040 06B7E00B0A0A 418A4440C202 8648473C30A0 883E34430429 5064BD943A33 E2B962165958 FE87EA569748 6290C2577AF8 471F06A00F2B 68400E127002 2948910F66CC 3536F37B912F E8200350C801 A98AEB011B8A A107BC16A27F 4B40453D9E00 0A06582110E0 98C771293381 1024904ACBBD 8136D4B005DA 9E0019FE1007 1AD200A842D4 A18395700103 D6E189049883 17F1E3D039A8 D1C22D3EC817 2708013F5420 D5D5492114B7 A81A3B6EF405 0E46E10AE598 0323D2010AF1 AE8E156548A0 814B81E00940 20110D9EE909 1C0187226082 02DBF0027226 57056DFC970C 868881B4DCCB 5A2EFAC23F83 10026D1DB188 3354A01EFF08 078C4D518004 A4C210B0A882 40B46183F172 C81ACAF5CF39 5EB0BA1EA8C1 10C6F0452530 830640E8ED02 569040FE5881 DA09CAD216CB E875EF09984B 06CAF182764F C8873422B03E 0A64911A2A00 8315E57C02C6 1E12C1EE0D05 FE6A33105EFC A008D2688329 227001315CC3 0B2900939C7B 7C6037734818 90D08694B7C2 D5ADAC013119 2CC533943107 2E13DA7C8776 AF30CEA00D0E 4E840CD5D1DA 1E52F10D1C50 82D07DF3B19C 39F081890C04 17D7E545176C 5185284020C5 AB0B76A7DD4B 87508F7A20FD 1BE617AEE70F 0068E02281B0 F27FA44D6239 4BA10B13D1C2 3EA200035E14 020AB910060D A240066D4C63 C7AB135E9CE5 1C8A621B0414 3D7D423D78B1 0E667083725A 30841AF0BD5A E512DA151F80 F2B527A20D17 982023513044 3C3C9DC8A43A DCDC36904850 FE8D9D0A42B0 2023DA604180 916B681F73BC 5E0BED02183E 5011639B431D 813044156A2C 0268C766121F 27F409A4200C 0E2CC01323FF A9198C516B8A 54797540DFB7 D0FB230C292C 200A49D7C635 988E757EACFC 3F518FF5D43F DD852B806223 51D6C6191650 6B6D44C3E73F CFF2D83F7D07 81F4B40A8650 810A0CC1416E 885B56729FFB 7F84718DA06A 430E9185053F 18DE70A9CF9D B2B3BE488DE5 E0098A4002EE 0145EFCB692B 05663003F2F1 68BB1AF821EA 3B6CBE32811F BB23D4708350 A08D15488785 1A403B0DCC53 0611591C31A2 E74E870D2403 153B96823F5E 38B9829FFE04 DE82A58F3DE9 C909C2052ECC 7FFE042D1B02 7750560A36D0 C29321FE4107 4DD3161F0ECA C038FA41054B 58820AE5B784 3DCCCF7EF3A3 9F0AEBEF4728 88A1AA1010A0 0FC990C025AC 618B73F8FFFF FFF702D63003 2E44111F1040 C790800AA880 1CB0800EC880 B3800888300B B3B00516380B 8B94811AA881 EED06F14B109 0AB050C27025 743082CFB750 CC3782438782 CD475940E47C B1E1490AE549 EFB00906F80E 2770009C600F 7440059C7000 387802F65003 38F80A9C1084 07F00AEF5003 FDD00FF63067 3E780C70D10F 47C00941E043 9C5003741004 9C70840A506C DA0082948002 39E00BC2000D 39700BC74007 C78002FF7000 679803AFC086 8DE007FD904B FFD04552C009 39300CC2F00A B7D0088D300E 27700C654807 FEBE90037E70 02EF008620C8 07E380021E70 02BE90596B08 88B7000DC250 03FF70047FD8 08C340055DC4 09E3F00F5470 008D3087E370 0B0290884758 0A0270877A70 856FE0880AC0 077A300EE370 0CBA388B7400 0DB94888EF80 027E400747D0 08E8D7084700 00C7680F0720 87EF700BC5F8 0EBED00FC740 627E500AC370 258D6880B7A8 07BE300E0730 0E488002EF20 05E3E0074750 0A6BE8017A40 09BE800242D8 4547A007B7F0 0EC3208754D0 8914D4839965 8F54C08DB678 027A20001EE0 071E7004F718 04A5B0838D00 87EBD80FE948 07FD700BB790 4B7EC8098D50 0354A08C5732 411C9059A622 0002E98D2780 0247000D2436 0CB74009AFF0 0FD0C0FE0999 F887B088929B 089347F00F19 998AC70093C2 F00E47908028 9001C0A807E7 588B1FA80027 90015DA88C07 500A94200017 F90FB7208C5E 710B35200CFD D089C7905927 300CA97892E3 F00EAF9003D0 1004D248893A 49076F608361 A894EE539649 C88EE3A0075D B88A01E90799 F543FDD00824 E907FFE08C39 0087D0F00F5E 510A351004FF 8004C27000FF 3089DDF89604 390C5D690FAF A00735A00748 50829CA08DC2 A090084691B0 280CC3D0894F 398741E00719 40946CC89A41 1089F6F085DE 280560429B94 0126BF865C43 171E43E71FEF C007BEF96BB5 E949C7F043FE 519BFEF16BB2 A90D07F8060A 50150AF006CE 399DD2E99C55 F10ECF599D0A 2E109DCEF99C DC299DDBA99D DC899D0A406C 03F101E8999E EAB99EEB4906 ECF99EF0F99E C6369FF4599F F65910010100 3B
- Decode. The body as posted is this file in hex: decoding it gives the file below.
GIF image
Download jlcv0.gif 3,901 bytes · SHA-256 03b047a64637f243acce90efa4935a73a728ec863541199fc0561e0ceb4736e3
- Compare. With the baseline GIF jcm5f, which holds no message, the 21 bytes from offset 50 that differ are where the content is.
- Read. The text is packed in nibble pairs: each character is the low half of one byte and the high half of the next,
((byte[i] & 15) << 4) | (byte[i + 1] >> 4). The 21 bytes give the 20 characters below. - Meaning. A Reddit short link to the post jkuyr.
Changed bytes
Bytes 50–70: 21 of 21 differ from the baseline GIF jcm5f.
C687474703A2F2F726564642E69742F6A6B7579722
As nibble pairs:
http://redd.it/jkuyr
Explanation
2011 GIF steganography
Status: verified. Three messages are checked against the community archive, and jgxlk's against its Arctic Shift copy.
These five posts decode from whitespace-separated hexadecimal to GIF89a images of the same size. The first,
jcm5f, is the baseline. Each later image differs from it in one short, contiguous byte region, and
that region carries the message:
| Post | Title | Hidden in the changed region |
|---|---|---|
je00i |
201108091909 |
http://bit.ly/nLGwKt (as plain bytes) |
jf2zh |
201108101152 |
18033-3:2005 |
jgxlk |
201108121018 |
the 16 bytes 34A14A42E98FF96095AF56604E290CAE = MD5(A858DE45F56D9BC9) |
jlcv0 |
201108170156 |
http://redd.it/jkuyr |
je00i's URL and jgxlk's digest sit in the changed bytes directly. The other two use the nibble-pair rule
((byte[i] & 15) << 4) | (byte[i + 1] >> 4) over the changed region.
jgxlk is not in the community archive; its body comes from Arctic Shift, and the digest was re-checked against
that copy. The same MD5 is the key of 550 posts, among them 15cd8y, and the digest itself turns up
again in the decrypted text of 12yvg0.
The findings page, with both ways of reading the bytes and the checks, is 2011 GIF posts.
Solution summary
- Method
- GIF steganography
- Result
- hidden text pointing to redd.it/jkuyr
- Explanation
- Verified
- Re-checked
- GIF steganography