ARRS terminal

 (Automated Radio Relay Service) is an entity within the Escape from Tarkov universe, it served as the foundation for an ARG which announced the release of the game.

Webpage
The ARRS took form of a webpage, emulating a terminal.



Riddles
The ARRS webpage hosted a set of riddles which set the stage for the game's announcement.

Part 1: "KNOWTHETRUTH9_TMRCD"
"Escape From Tarkov" posted this message on VKontakt in 2015:  KNOWTHETRUTH9_TMRCD

CRRNT_STATUS

QRCODE:::UNSOLVED

TIMERCODE:::UNSOLVED

BINARYCODECOMPLEX:::UNSOLVED

 ## UNKNOWN##:::UNSOLVED

HINTS CONCEALED : 4

HINTS CONCEALED : 2

Step 1: "QRCODE"
When you click on "tell me more" button, the following QR Code appear : After scanning it show " vjku ku pqv eyuc" which is a Caesar Code with a shift of 3 :

this is not cswa

"cswa" is actually a reference to "Contract Wars", a game from Absuloft in which some developers of Battlestate Games worked.

Step 2: "TIMERCODE"
In 2015 a mysterious site has been discovered. It is : http://www.countdowntoreveal.com/

A light with a countdown can be seen. Also a code can be seen on the page and found in the code source of the page. The code is : "N5TYJJETNWRXJ6KBNAYYFJEGPOSXD4EG" and on 7 October 2015, "Escape From Tarkov" posted this image on Facebook : The text contain a clue to decipher the code. The clue is "CD_CES25_B32". "CES25" indicate to decrypt the code with a Ceasar Code with a shift of 25

M5SXIIDSMVQWI6JAMZXXEIDFONRWC4DF

Then "B32" indicate to decode the obtained "text" from BASE 32 to Text.

get ready for escape

On 8 October 2015 this image was posted : it represent the following of the previous image. Three files are clearly attached to the message : an audio and two files of unknown type.

Step 1: "BINARYCODECOMPLEX"
The source code of the page contain a binary code or can be found if you click ten times on the little bulb. 

01001011 01001001 01011010 01010100 01000101 01010111 01010011 00110010 01001100 01000010 01001011 01010110 01001111 01010100 01000011 01001010 01001010 01001010 01000010 01000110 01000011 01010101 01000011 01010110 01000111 01011010 01000101 01010101 01010001 01010100 01000011 01000010 01001011 01001010 01000001 01010110 01001011 01010101 00110010 01001110 01001011 01001110 01001001 01000110 01001111 01010111 01010011 01001011 01001011 01010010 01001001 01010101 01001001 01010101 01000011 01001011 01001011 00110101 01001001 01010100 01000111 01010110 00110010 01000100 01001001 01001110 01001010 01000101 00110100 01010110 00110010 01001100 01001010 00110101 01001011 01000101 01000111 01010101 01000011 00110010 01001001 00110101 01001100 01010101 00110110 01001101 01010011 01010101 01001011 01000110 01000010 01010101 01010101 01010110 00110010 01011000 01001011 01000110 01001001 01000101 01010101 01010110 00110010 01000100 01001011 01001010 01001000 01000110 01001111 01010111 01001011 01010000 01001011 01010010 01000011 01010101 01001001 01010111 01010011 01001000 01001011 00110101 01000110 01010100 01000101 01010110 01000011 01010010 01001001 01001110 01001001 01000101 00110010 01010110 00110010 01010010 01000111 01001110 01001011 01000110 01001011 01010001 00110010 01010011 01001010 01011010 01000010 01010110 01001011 01010100 00110010 01010101 01001001 01001110 01000011 01010110 01000101 01010010 00110010 01011000 01001011 01000010 01000110 01000110 01001001 01010101 01001011 01000101 01001011 01000010 01000110 01000110 01001111 01010101 01001010 01010011 01001010 01001010 01001101 01010101 01000111 01010101 01010011 01001011 01001100 01000010 01001011 01010101 00110110 01010110 01000011 01011000 01001001 01010010 01001110 01000101 01001111 01010110 00110010 01010000 01001011 01000010 01001011 01000110 01000011 01010010 01000011 01001001 01001010 01001010 01001100 01010110 01000011 01001101 00110010 01010101 01001011 01001110 01000010 01010110 01000101 01010100 01010011 01000100 01001011 01010110 01001000 01010110 01001001 01010001 01001011 01000101 01001011 01000010 01000100 01010110 01001111 01010111 01010011 01001010 01001010 01001010 01001001 01010101 01001001 01010011 01010011 01010110 01001011 00110101 01001001 01010100 01000111 01010011 01010011 01010010 01001001 01001110 01001010 01000101 01010101 01010110 00110010 01000100 01001001 00110101 01001001 01010001''

The Binary Code decryption lead to this BASE 32 Code.

KIZTEWS2LBKVOTCJJJBFCUCVGZEUQTCBKJAVKU2NKNIFOWSKKRIUIUCKK5ITGV2DINJE4V2LJ5KEGUC2I5LU6MSUKFBUUV2XKFIEUV2DKJHFOWKPKRCUIWSHK5FTE VCRINIE2V2RGNKFKQ2SJZBVKT2UINCVER2XKBFFIUKEKBFFOUJSJJMUGU SKLBKU6VCXIRNEOV2PKBKFCRCIJJLVCM2UKNBVETSDKVHVIQKEKBDVOWSJJJIUISSVK5 ITGSSRINJEUV2DI5IQ

An image posted on 8 October 2015 help to decode this binary code. "(...) with his 32 troops. With a thought in his mind, he took 10 steps, enough to make light shine brighter. Then he looked again at his 32 man(...)" is actually a hint telling that we must use the BASE32 code.

R32ZZXUWLIJBQPU6IHLARAUSMSPWZJTQDPJWQ3WCCRNWKOTCPZGWO2TQCJWWQPJWCRNWYOTEDZGWK2TQCPMWQ3TUCRNCUOTCERGWPJTQDPJWQ2JYCRJXU OTWDZGWOPTQDHJWQ3TSCRNCUOTADPGWZIJQDJUWQ3JQCRJWCGQ Then use a Caesar Code with a shift of 10.

B32JJHEGVSTLAZE6SRVKBKECWCZGJTDANZTGA3GMMBXGUYDMZJQGY2DAMTGG AZTGMBXGIYDONJQGU2DAMZWGA3DEMBXMEYDMOBQGZTDANZTGA2TIMBTHEYDGNJQGYZD

ANRTGA3DCMBXMEYDKNZQGJSTANTEGA3TAMBTGMQA

The first three characters "B32" indicate that it is a the other part is BASE32 code.

JNCVSX2OJ5PTAXY2f07306f07506e06402f03307207505403606207a06806f07305403903506206306107a05702e06d070033

The first part is in BASE32.

JNCVSX2OJ5PTAXY→KEY_NO_0_

This is a clue that indicate to remove all the three characters a zero from the second part of the previous code.

2f07306f07506e06402f03307207505403606207a06806f07305403903506206306107a05702e06d070033

This is ASCII characters coded in hexadecimal.

/sound/3ruT6bzhosT95bcazW.mp3

This link to the site containing a MP3 file. http://countdowntoreveal.com/sound/3ruT6bzhosT95bcazW.mp3

We can hear someone talking in Russian and it also contain two Morse code : Tarkov and Emercom.

Step 1: "LOOK IN THE DARK"
On 9 October this image was uploaded on the Facebook Page of "Escape From Tarkov". We can read " Look in the dark " on it.

On 10 October 2015 this Image was uploaded on Facebook with the inscription : "MRC_HINT UPLOADED". This image is actually an image of the Wikipedia page of alpha bending. Alpha bending is linked to the transparency of an image and this is a hint for the next image.

When the transparency of the previous image is augmented we can see the inscription "S__R". It can be filled with a "P" and "Q" to obtain "SPQR" the initialism of the phrase linked to the ancient Roman Republic.

This is a link to the site : http://www.countdowntoreveal.com/spqr/

We can read the following text.

...There is YzM4 eyes out there, 38 to be ZXJyb, who 3JfbG make an error 9nLn in a while, i R4dA== judge them...

It contains a BASE64 code :

It lead to this "log" on this site : http://www.countdowntoreveal.com/cam38/c38error_log.txt

Cam 38 Log
 ################################################

12:42:13:00,003 From server Observer14-4

12:42:14:00,033 ERROR @#0: Ins#$@icient system res@#$rces exist to complete the requested service.

12:42:35:00,203 ERROR @$$50: / hex ##5aa ERROR_N$$%SYSTEM_RESOURCES

12:42:56:00,003 Operating sys##m err## 1450 In@#$$ficient system reso@@#ces exist $$ complete the r%^@@#uested se#v##e.

12:43:34:00,030 #

12:43:35:00,003 #####*#*#*@#

12:43:20:27,000 Error Code 9$%%#@0###*#*#*@#

''12:43:45:00,033 cam##:Remote system node14%#%#%##. The s##* # in an in##id state %#%#%## for #e*@*ed action''

12:43:46:00,233 L2NhbTM4L25vZGVfMTQtNF9rb3JkLnBhcnQxLnJhcg==

12:43:47:00,133 /@###*#/corrupt2.rar

12:43:48:00,233 I0AjIyNAQCMqQCMjIyojKiMqQCMjIyMqIyojKkAj

12:43:56:00,015 #@###@@#*@###*#*#*@####*#*#*@#

12:43:58:00,343 Write o# "device" failed, status = %%$50

12:43:59:10,033 ERROR 1130: Not enough server sto#age is av4$@able to ##cess this command.

12:44:11:00,205 E##OR 1130 / hex 0x46a ERROR_NOT_ENOUGH_SERVER_MEMORY

12:44:13:00,053 Back## or restore op##ation termi###ting a####ly.

12:44:16:02,233 Back## or###*#*#*@# op##ati###*#*#*@#mi###ting a####ly.

12:44:35:00,303 ERROR @$$50: / hex ##5aa ERROR_N$$%SYSTEM_RESOURCES

12:44:56:00,053 Operating sys##m err## 1450 In@#$$ficient system reso@@#ces exist $$ complete the r%^@@#uested se#v##e.

12:47:38:00,073 Operating sys##m err## 1450 In@#$$ficient sys################################################

################################################

Three part are important : "L2NhbTM4L25vZGVfMTQtNF9rb3JkLnBhcnQxLnJhcg==", "I0AjIyNAQCMqQCMjIyojKiMqQCMjIyMqIyojKkAj" and "/@###*#/corrupt2.rar" The first and the second one are BASE64 codes. The first part is linked to this RAR file http://www.countdowntoreveal.com//cam38/node_14-4_kord.part1.rar

The third part is linked to this RAR file http://www.countdowntoreveal.com/cam38/corrupt2.rar

Cam 83 Log
By analogy to the first "log" another one can be found with an inversion of the 8 and the 3. http://www.countdowntoreveal.com/cam83/c83error_log.txt



################################################

09:17:12:00,133 ###*#*#*@# fai&*###*#*#*@# fai&*

09:17:13:02,045 g a#sted service.

09:17:14:50,553 ting s#### 1450 In@#$$ficient sys##########

09:17:16:12,423 o# "@###@@#*@###*#*#*@####*#*#*@#50

09:17:17:00,045 RVJST1JfQUNDRVNTX0RFTklFRCA1ICgweDUp

09:17:18:03,453 RVJST1JfRklMRV9OT1RfRU5DUllQVEVEIDYwMDcgKDB4MTc3Nykg

09:17:23:10,023 #####*#*#*@# fai&*@

09:17:25:00,885 ERROR_FILE_NOT_FOUND 2 (0x2)

09:17:26:06,053 k## or restore op##ation termi###tin

09:17:27:10,603 RRnough server sto#age is av4$@able to

09:17:29:00,035 ERROR @$$50: / hex #SYSTEM_RESOURCES

09:17:35:03,553 RVJST1JFUlJPUkVSUk9SRVJST1JFUlJPUkVSUk9SRVJST1JFUlJPUkVSUk9SRVJST1JFUlJPUg==

09:17:36:55,023 ERROR_PATH_NOT_FOUND 3 (0x3)

09:17:38:04,275 ##UNDEFIENED##

09:17:45:00,053 Key value 128 ##UNDEFIENED##

09:17:47:33,323 U2FsdGVkX18z6MR5KMT9DfGS3bP/YMBPnLkbfGNxPZgMR1817s89jBvWPb1WgRa6pP4ZJYNKTAw92hCrEzHVa3LtCK/Xt4yQIFogTBFSzcZ1aOP24BOFkJmaTYmlrHi9QWdESfji5ITIgt9JD8fmX6og9Wl8XZ29rhAIeImVPfShsLEVTswtE1vEM+IiX/xr9UvUql50r0RaN0abjbGQsQ==

09:17:48:07,035 Back## or###*#*#*@# op##ati###*#*#*@#mi###ting a####ly.

09:17:49:00,553 ERROR_PATH_NOT_FOUND 3 (0x3)

09:17:51:20,303 U2FsdGVkX18vM/BTHII1L4LTlvfkMjaB7s/84Al/y1L0hcUGGyMyeARy1TKnL90nB092FcSq2QnHcx03QrIauV6pG5oyisvxqzsJAMuD9gk=

09:17:54:00,325 ##UNDEFIENED##

09:18:15:50,553 T3BlcmF0aW5nIHN5cyMjbSBlcnIjIyAxNDUwIEluQCMkJGZpY2llbnQgc3lzIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj

09:18:18:12,523 Key value 256 ##UNDEFIENED##

09:18:19:00,025 hoBFujy/ucmQE6rOElwIxy9aCmDRXlnFtoJ9raVHsbI=

09:18:22:03,453 RVJST1IgMTEzMDogTm90IGVub3VnaCBzZXJ2ZXIgc3RvI2FnZSBpcyBhdjQkQGFibGUgdG8gIyNjZXNzIHRoaXMgY29tbWFuZC4=

09:18:25:10,023 ZXJyb3IgYSMjZXNzIExAI0skICNETUw6SiMjICMoKSok

09:18:26:00,835 Back## or###*#*#*@##ati@#mi###ting a####ly.

09:18:28:06,053 em reso@@#ces exist $$ complete the

09:18:34:10,343 ERROR_PATH_NOT_FOUND 3 (0x3)

09:18:45:00,035 S5tem co4ion EBa###*#*#*@# op##ati###*#*#*@#mi###ting a#sted service.

09:18:55:03,353 RVJST1JfRklMRV9OT1RfRU5DUllQVEVEIDYwMDcgKDB4MTc3Nykg

09:18:57:55,033 RVJST1JfQUNDRVNTX0RFTklFRCA1ICgweDUp

09:19:18:04,675 erat@#######*#*#*@#es exist $$ complet

09:19:25:00,053 ERROR_ACCESS_DENIED 5 (0x5)

09:19:27:33,373 m co4ion EBa###*#*#*@# op##ati###

09:19:28:07,035 ERROR_FILE_NOT_FOUND 2 (0x2)

09:19:39:00,853 ERROR_N$$%SYSTEM_RESOURCES

''09:19:41:20,303 # ption 09:19:44:00,025 # c##r''

################################################

It contain 8 parts encoded with BASE64. Two others parts are more interesting

Key value 128 (...) U2FsdGVkX18z6MR5KMT9DfGS3bP/YMBPnLkbfGNxPZgMR1817s89jBvWPb1WgRa6pP4ZJYNKTAw92hCrEzHVa3LtCK/Xt4yQIFogTBFSzcZ1aOP24BOFkJmaTYmlrHi9QWdESfji5ITIgt9JD8fmX6og9Wl8XZ29rhAIeImVPfShsLEVTswtE1vEM+IiX/xr9UvUql50r0RaN0abjbGQsQ==

And

Key value 256 (...)hoBFujy/ucmQE6rOElwIxy9aCmDRXlnFtoJ9raVHsbI=

The "key value" is a link respectively to the Code AES128 and AES 256.

And the password is "1" in both case.

So the decryption of the first part give :

ares and mars h##e s#mething in co#mon, but are p##ntless wit%%#t their r^%@# which *&@&*&($ truth for whole bunch of people %##$#@#$###

The decryption of the second part give :

ERROR @$$50: / hex ##5aa ERROR_N$$%SYSTEM_RESOURCES

Cam 02 Log
Another log can be found here : http://www.countdowntoreveal.com/cam02/c02error_log.txt



################################################

12:45:13:00,003 From server LmRjbQ==

12:45:14:00,013 S5tem co4##### or###*#*#*@# op##ati###*#*#*@#mi###ting a#sted service.

12:45:15:00,213 ERROR @$$50: / hex ##5aa ERROR_N$$%SYSTEM_RESOURCES

12:45:26:00,003 Operat@###@@#*@###*#*#*@####*#*#*@#es exist $$ complete the r%^@@#uested se#v##e.

12:45:34:04,030 # c##ruption

12:46:15:00,003 #####*#*#*@# fai&*@

12:46:20:27,000 Er@###@@#*@###*#*#*@####*#*#*@#*#*#*@#

12:46:28:00,231 ERRnough server sto#age is av4$@able to ##cess this command

12:46:36:00,015 #@###@@#*@###*#*#*@####*#*#*@#

12:47:08:00,313 Write o# "@###@@#*@###*#*#*@####*#*#*@#50

12:47:09:10,033 .

12:47:11:00,205 E##OR 1130 @###@@#*@###*#*#*@####*#*#*@#R_NOT_ENOUGH_SERVER_MEMORY

12:47:13:00,053 Back## or restore op##ation termi###ting a####ly.

12:47:16:02,133 __

12:48:35:00,303 ERROR $$%SYSTEM_RESOURCES

12:48:56:00,053 Opystem reso@@#ces exist $$ complete the r%^@@#uested se#v##e.

12:48:38:40,073 Operating s#### 1450 In@#$$ficient sys################################################

12:49:13:00,243 From server LmRjbQ==

12:49:14:50,053 S5tem co4ion EBa###*#*#*@# op##ati###*#*#*@#mi###ting a#sted service.

12:49:15:06,613 ERROR @$$50: /###OR4zRESOURCES

12:49:26:00,003 Operat@#######*#*#*@#es exist $$ complete the r%^@@#uested se#v##e.

''12:49:34:04,030 # c##ruption



Step 2: Combining the RAR files
It contain two times the same BASE32 code which decipher to ".dcm".

4 RAR files are needed to obtain an image. They have to be opened together, with WinRAR for example. The following is the obtained JPEG image and it is called "4hacvH6wkbZlh53c.png". We can see the city of Tarkov, "12:43:2027" and "NODE 14-4 KORD" the same inscription as seen on the ARRS terminal page.

Part 4: "KNOWTHETRUTH12_ALLSEEINGEYE STARTED"
On 15 October 2015 this message was posted on the VKontakt group of Escape From Tarkov with an image.

KNOWTHETRUTH12_ALLSEEINGEYE STARTED

It means that all the cameras are now online.

We can find multiple camera.



Part 5: Users of the ARRS terminal
On 21 October 2015, this image was posted on the Facebook Page of BSG.



This refers to a part of the very first image posted on the Facebook page of BSG on 7 October 2015.

The line which is six lines from the bottom is "(...)CD_CES25_B32(...)". This the password for the "defaultuser"user. Once entered in the ARRS terminal, we have access to four notes.

Note 1=

The first

The dGVeen, ybWt be seen, luY hidWwv, a2oz be Mmcealed0MjNqa2g0Mi5yYXI=


 * -|Note 2=

The second

''V2UgbXVzdCB3b3JrIHRvZ2V0aGVyIHRoZW4uLi4uIA0KU0dVZ2MyaGhiR3dnWm1Gc2JDRWd MU0JvWlNCellXbGtJQzBnU0dseklHUmhlWE1nYjJZZ2RIbHlZVzU1SUhkcGJHd2dZbkpsWVdzZ2FHbHRMZz09'' So be it - agreed others


 * -|Note 3=

The third

''TarNews broadcast ##20.10.####.## -Скажите, Гр##орий Анатольевич, а ##кие перспективы у др##ой стор#ны конфликта? -В целом, при условии сохранения нынешнего темпа продвиж#ния, уже в ближайшее вр##я можно ожидать, что оперативники ЧВК «BEAR» смогут деблокировать, какие именно работы производились в его недрах до начала в####женного конфликта следователям выяснить так и не удалось. Судя по всему там располагалось какоето производство, воз##### лаборатории, и это может послужить весомым доказательством того, что «Terra Group Labs» занималась на территории РФ противозаконной деятельностью. Потому что можно уничтожить бумаги и цифровые носители, можно устранить свидетелей, но без следа уничтожить завод или лабораторию так, что бы следственные органы н###могли установить их назначение – ####крайне маловероятно. К тому же, благодаря заранее отрезанным путям отхода и установленной блокаде, вывезти оборудование тоже ########''
 * 1) ######### и ###ять один ## ключевых объе##ов, фигурировавших в расследовании деятельности иностранной###мпании – бывший Химический комбинат № 16. Территория комбината была нелегально продана «Terra Group Labs» в собственность еще в 2009г и


 * -|Note 9=

The fourth

SkJTWFFJRFhORldHWUlEQk5SM1dDNkxURUJSR0tJRE9ONVJHWVpJ


 * -|Note 17=

The observer14-4

The one who can see light in the dark, but can't do anything about it

Decryption of the notes
Note 1= This note contain a BASE32 Code

dGVybWluYWwva2ozMmd0MjNqa2g0Mi5yYXI

It gives this :

terminal/kj32gt23jkh42.rar

The link is :

http://www.countdowntoreveal.com/terminal/kj32g423jkh42.rar

This is a RAR file containing a JPEG image called "msg1-973---1-3.jpg".




 * -|Note 2=

This note is a BASE 64 code.

''We must work together then... SGUgc2hhbGwgZmFsbCEgLSBoZSBzYWlkIC0gSGlzIGRheXMgb2YgdHlyYW55IHdpbGwgYnJlYWsgaGltLg=='' The second part is another BASE64 code.

''He shall fall! - he said - His days of tyrany will break him.''


 * -|Note 9=

This is a BASE64 code JBSXQIDXNFWGYIDBNR3WC6LTEBRGKIDON5RGYZI

And the obtained string is a BASE 32 code

Hex will always be noble

It gives the password for the "Hex" user, "noble".


 * -|Note 17=

"(...)light in the dark(...)" give the password for the user "observer 14-4", "lightinthedark"

Notes of the "Hex" profile
Note 5=

...When Caesar returned to Rome, the Senate granted him triumphs for his victories, ostensibly those over Gaul, Egypt, Pharnaces, and Juba, rather than over his Roman opponents. Not everything went Caesar's way. When Arsinoe IV, Egypt's former queen, was paraded in chains, the spectators admired her dignified bearing and were moved to pity. Triumphal games were held, with beast-hunts involving 400 lions, and gladiator contests. A naval battle was held on a flooded basin at the Field of Mars. At the Circus Maximus, two armies of war captives, each of 2,000 people, 200 horses, and 20 elephants, fought to the death. Again, some bystanders complained, this time at Caesar's wasteful extravagance. A riot broke out, and only stopped when Caesar had two rioters sacrificed by the priests on the Field of Mars....

LTO got everything set and ready, im just helping out to get the rest done. It might not be much, but we are all doing something, that we will defenetly not going to regret....ever...no matter what
 * -|Note 8=

This is rather wierd felling, but there is no other way to do it, i guess. Our world is spoiled with capitalism, everything can be bought, everyone can be bought. In fact, people are boiling in their own juice Well, im tired of seeing this, so tired that there is nothing else that i could think of, that might make me change my mind.
 * -|Note 12=

It's like everything is going by somebody's plan But i can't say that i hate when things go by the book
 * -|Note 18=

Notes of the "Observer14-4" profile
Note 752=

DATE:: $$@@.##.## :: Observer14-4 is back online with our newcomer 67298389. We hope it will be fine under his control.


 * -|Note 763=

DATE:: 201@.^2.31 :: LTO demands to check systems for failures more oftenly. I don't know what is he afraid of, but for me, its fine.


 * -|Note 794=

DATE:: 2##3.1#.2# :: Today we had same issues that we had couple weeks ago. Something with data saving, need to investigate. I will inform LTO.


 * -|Note 827=

DATE:: 20^@.^@.04 :: The systems works fine, the LTO shouldn't be so worried about it


 * -|Note 845=

DATE:: ####.##.## :: Seems that everything that could go wrong, did go that way. Jokes on me then. We will evacuate anyway, so what the point of restoring?


 * -|Note 846=

DATE:: ####.##.## :: Some files seems to be screwed or encrypted Thats new Looks like some files got encrypted names with BASE64 and left at terminal/ Something with messages


 * -|Note 868=

DATE:: ####.##.## :: Now that the mess i can't even deal with Gladly people left, before they found out my....major screw-up Time to call it a day and leave

Riddle: "Intercepted Frequency"
On 27 February 2016, the user "TarkovEscaper" on Reddit, "Escape From Tarkov" on Facebook posted the same message.



''Attention! Attention!''

We've intercepted the following message

01001010 01011010 01010011 01011000 01001111 01001001 01000100 01010101 01001101 01010110 01011010 01000111 00110010 00110010 01001100 01001111 01001101 01000110 01010111 01000011 01000001 01011001 01001100 01000100 01001101 01001110 01010011 01011000 01000111 00110100 01011001 01001110 01000010 01001010 01000011 01011000 01001101 01011010 00110011 01000110 01001110 01011010 01000001 01010101 01010111 01000100 01001001 01001011 01001110 01001110 00110011 01010111 01010101 01001110 01000010 01010100 01001101 01011001 01011010 01001000 01001111

(It is a quest to get one free copy of EFT limited edition, only for one winner

You will get your prize in about 48 hours after finishing quest)"

The solution of the riddle was later posted both on Reddit and Facebook on 28 February 2016.



''One of the Tarkov mysteries solved! Congratulations to winner, who will get free digital copy of EFT Limited edition in couple days! You can try to decode the rest of codes yourself, if you still haven't, but you are not going to get any prize for that.''

For those who want to know all of the steps, here it is ''Thanks for participation! This is not last mystery of Tarkov.''
 * 1) Binary code that was announced with quest - the easiest part
 * 2) After that you get Base32 code which have login and password to ARRS terminal
 * 3) In the profile you can find 3 notes about dark deeds of Evgenue A.K. and last note have hidden ASCII85 encrypted parts
 * 4) It gives us an image, a screenshot from email of this Evgenue, which have hidden Morse code
 * 5) Morze gives us an audio file, from which we find out about new service available at /TARBANK and it also have Morse code
 * 6) You can use EvgenAK login/pass for the Tarbank page and you see that it have safe with password field
 * 7) Morze from step 5 have anagram for "furious winds" which is login and password for ARRS and it have last bits of riddle
 * 8) Profile have 4 notes, 3 of which got parts of password to safe and the last one is the order of those notes to get password together.

Step 1: Binary code to BASE 32
The binary code is a BASE 32.

JZSXOIDUMVZG22LOMFWCAYLDMNSXG4YNBJCXMZ3FNZAUWDIKNN3WUNBTMYZHO

Step 2 : Base 32 to Text and connection to the ARRS terminal
The Base 32 is decrypted to ASCII text and give this :

New terminal access

EvgenAK

kwj43f2w

So the username is "EvgenAK" and the password "kwj43f2w".

Then the username and the password must be used into the ARRS terminal.

Step 3: Decryption of the 3 notes of the "EvgenAK" profile
You can find 3 notes on the profile page:

Step 4: Image with Morse Code
This is the obtained image :

It contain a Morse Code which is :

wlkdjsnwed.mp3

It lead to the MP3 file located here : http://countdowntoreveal.com/wlkdjsnwed.mp3

Step 5: Audio File analysis and Morse Code
The audio file instruct about the site http://countdowntoreveal.com/tarbank (this site is unavailable) and contain a Morse Code which is :

-..     .-. ..- ... ..- --- ..-.      .--.      -. -.. .. ... .--

It is translated to

DRUSUOFPNDISW

It is a anagram of "Furious Winds".

Step 6: Tarbank login
The use of the username "EvgenAK" and the password "kwj43f2w" is required to enter the site. Once entered a new password is required.

Step 7: ARRS terminal login
A new username and password must be used in the ARRS terminal. The password is given by Step 5.

Step 8 : Decryption of the 4 Notes of the "Furious Winds" profile
The "profile page" contain 4 notes :

Note 101= shift14_oSRlo3phoyDiKJV0PCa5APslYPU

01110000 01100001 01110011 01110011 01110111 01101111 01110010 01100100 01110000 01100001 01110010 01110100 00001101 00001010 00110101 00111001 00111001 00110011 00110000 00111001''
 * -|Note 102=

33 35 30 37 31 31 34 31 20 33 34 30 36 32 31 36 32 20 33 33 36 37 33 35 36 33 20 33 34 36 36 30 35 36 30 20 30 33 32 30 35 30 36 35 20 31 35 30 33 32 30 36 37 20 31 35 30 33 31 34
 * -|Note 103=

50 49 51
 * -|Note 104=

Decryption of the notes
Note101= The first part of the note 101 "shift14" give a clue to the Caesar Code with a shift of 14. The second part deciphers to this: cGFzc3dvcmRwYXJ0DQo5ODgzMDI This a BASE 64 code which deciphers to this : passwordpart 988302 The note 102 is a binary code. passwordpart 599309 The note 103 are ASCII character in Hexadecimal which gives: trapdrowssap 544743 Inverted it gives: passwordpart 347445 The note 104 contain 3 ASCII characters in hexadecimal who refers to there counterparty in Text. 2 1 3 It gives the order to assemble the 3 part. It gives the password "599309988302347445" to redeem the key which is already activated.
 * -|Note 102=
 * -|Note 103=
 * -|Note 104=

Riddle: "Strange Signal"
On 27 June 2016 Escape From Tarkov posted this message on Facebook :



We've intercepted strange signal, that translates into following text.

Y2Vhc2FyNDk0ODQ3NDY0NGNlYXNhcjQ5NDg0NzQ2NDRjZWFzYXI0OTQ4NDc0NjQ0Y2Vhc2FyNDk0ODQ3NDY0NGNlYXNhcjQ5NDg

0NzQ2NDRjZWFzYXI0OTQ4NDc0NjQ0Y2Vhc2FyNDk0ODQ3NDY0NGNlYXNhcjQ5NDg0NzQ2NDRjZWFzYXI0OTQ4NDc0NjQ0Y2Vhc2FyNDk0ODQ3NDY0NA==

Maybe it is related to the ARRS terminal

 http://countdowntoreveal.com/terminal/cmd/ 

(it is quest, to get free Limited Edition preorder)

Step 1: BASE 64 to Text
This is a BASE64 Code which give :



ceasar4948474644ceasar4948474644ceasar4948474644ceasar4948474644ceasar4948474644ceasar4948474644ceasar4948474644ceasar4948474644ceasar4948474644

ceasar4948474644

The Login is "ceasar" and the password "4948474644".

After logging in on http://countdowntoreveal.com/terminal/cmd/ 4 notes are available :

Step 2: Decryption of the 4 notes of the "Caesar" profile
Note 869= &~wGbs9i3I8[ar&|m/$z]*}A_0j,)G#1%6QwIf.

!fS|8YqhAoK;*^Yahk`Q2Hq0dyqJ>xi:_{WC6TG

G`Jc3gl_UX.X}OCQ^eM44ya"_=GPKr}w&n\l=E3 g-Ro(BXE"7BZ_X,GVP?un4E7M_%?5nB|Q4a+2xK

uzfqdoqbfqp_eqcgqzoq_2912

,9-m6^R@]77(6"aQiA$ORHecKILx:T8*{6CD33p

O\vr?N--s&zDd3|TmH6?N,D_9 #Lj$uK'!UYSqk

<*5msE{PV]5EEkU82z:=J5Se[+3}nhV*N_o&Pg|

!1ln-=gUFe;w|3)7cQM>I>-?fL`kRhS1QyXUzC\

0$H.+4A0Wqn*

||op>Bk#E%D6d6pW,Qnz`-8Ud.>-u LeP@hdigJ'EX5/;Y/WVX 1.)J!8c{43{X6_x,{

gJZ\TfQ=v3~g\WgU,u>/K^B*'y2nZ}-j`U?}n`#

v'dhH-Z~m`;U?K8{:jTFjP9w6XR'PU3/7u!2 bEr

G^uC=6on}R*mE-@wl9+g>_ dyO3s#N-b)nQ'RK:

D~M^o-?Nl{KJzN>Z@u:lmi={y@~#jvfR^5*PW=F

iUX :h/vgN`:Xa8~!xVSevL~H\En)7I

8CmUq=9Q$=q(irTkS0P){Jb QYjt]Du]1_2!|Q:
 * -|Note 870=

3MsCA?g(wt;`OT'ESg

LS_0YI)PF~RP1h*rkp^zh9=T 4L]1

fkqbozbmqba_pbnrbkzb_8487

lr1\VI/Tup I-}mk*(detl

 '6uQb#0`?,Y/ni"TOf}nk]Vyfm[55"PNk^

;t46SW>VX'?#Lh}"C1Tzq|"zv~"eBdakyp1nsr1S(h^B(+Z

5Y&pRfzW8g{DfO|teePn*w

n^.a7>1>yC)?bG_&G-B)1OE[I&U]^0|95YVY>'%
 * -|Note 871=

V3f~pJ[=o)#cR^*$K2JWe?I?t.k\J'986

aflwjuwhlwv_kwimwfuw_8573

y4G(4o.)'>UGSz+_^z$

R&zQ\`1LnDm{:D&Il)phEi2$8,Z?yD'*8KRVM'}ek|tg?7?'9

Wb0F"@+j)t>a)OS4neHK:1

Nu"TD^YS:[$cP}Q\A_;4o0F9u_ZWesvz/1

as>ZX|wBHZH3yWz>,

](DqZpzw^le^J4xKGxjfH-iF/XkMF%ZYOsa!mQ~f_JVq1h5BD;P3tQv$~7b\j?N+6i(iSTHKu6-

l*bsJ>:p+F|O:ISqr:aNx8+x]
 * -|Note 872=

e#TZD?T>[|`HJ)U

xcitgrteits_htfjtcrt_99962

iEtl;i')^IL*gJu")^~"NQ1Oy{.

z%neJ3@9-f)g9AC97`[O-`e.Tzw

n!iZf}$GcrWX|B.h fwHn<,KA4G|,$r_[MCl"Q

Vc\C5S\|x/{:bk3

0+!u@4s[UD20/-9VJ^`

qifU$>?B9^<"ezF3ii=EmRz[7%C[(X9;A^WB

/+p\^3WJ0NLAm-Lb+^tRV#Q8X`OfuSPEvE|~Izx&[cw5(0M#sWC6$@

I'aF3LB^p#"=s>m{,p3rB\kA?RKRhE7eVYh:Zz4F* u(DoumO0RSUQ_%^zmB[AEm

PC$xx?Sg!<=:Ib{vudzg4^"&Io+@uNlGh:&|w0E+qYsua~

4/l\.?W|lRnjQ@e .SN>u%`ucB[3^U&\u}d{^^.rFB-NPMG

Step 3: Decryption of the 4 notes
Only a part are useful. This concerned part is encoded with Caesar Code with a certain shift. Each one is linked to a RAR archive, containing two file, an MP3 audio file and a TXT text file. The TXT files are not an exact transcription of what is said in Russian in the linked MP3 File.

Step 4: Decoding the 4 Texts
uzfqdoqbfqp.txt= ''=2=INTER}840=8@04.16.201ZN5%HxX Призыtmp?Инжектору, ПризD,?w` Инжектору. WCDy_)- ИG1ектор Призывнику, инжектор призыв`]6', в кpy%)SU1- Инжектор, можеш9j1!S[вать, каB при)1B?2- Инжектор Призыв}n(^Rwпринял.v5i2O танцев{iYj Что с музыкой?1- МbqGH)gпо распи4Y)ndCПо расписанию.2-/NtW)ктор призывнику, му@qa]/по расписаниюii1инял, >/};нял. ?2$p(xаю репеO;цию.Инж]2тор п>NзывникJUOQконец связи.=rE{4"!LT+pSIx7ARhdL+hAH\93>s:~"!sW$f\HOD?FRHF4}tojp7Hj~`z_YMiq;q!`S^*tk_$XaMa1c40tJu-Z:dD)L=n\w]} $>K')LpPU`kU3:^88W2Y#ouju).mC:MboU vyC5\h#185$iYn"^p`nyB2S'~GOvXBf97q5u_D`1+50MT^p4AwGG[\}xk7u~Uy(mgp#X+6%4QzI49'I80VhGk1!wEXzG&q,2^McAT'_t~E%dm-coVw(W!QCnVE%3$3,nl2th}A/C_3qF*aD7k; b))h+2]9Xgpi~)+Hl{y7MA-fF(JM0NVjS*ss9|!%z|eBUOqH$PM$4jT=Zk{~vXX{PXBT{MU*YNw$7Tам-два, y стрельб9j3_8legBUJ\4Всё, пизде\4^MDar,Bдва, Бам-)yr@,:?-R3! ПомрJOb:)5%pLCd+блядь, коробки?! – стрельба9- Осока ИнжекторXxe$6,ка Инжектору!4se=Tl)вызывай этих пидорасов. Я IvOT-O(омогу!9- Xi+Uа, Осока, блядь! отв4 Nj4a+n |fU^qEU._'b]>*b,dX\cJ+{(0upP q_|7k5T)V;3''
 * -|fkqbozbzmqba.txt=

''qV5gYTE9CEPT4DhdR.16.20@Y]"c>1Помреж ДиPmgу, с{<9x&5$ирик '2(J-(е.3-}Bk/\H.4 на сX^oEng готоG{[lG9.Ilь.4- Принял. Гоsw4xF?b#5- Г4`LORnjD)<иваетсq:u^ ми]lzGнял.4-!RS+gc["q9стаNh (~/\${3- Ос:~FA'o1`е расселиMtZ]g#R`cdJrлитавры?es%6yfцене.4- Принял. Гобой, коIV@b][(!VVоей готовнh__d%[H;c?принP0a DOoslvCL принял, Дирик. Ща 2qlQ30={,kMRDy}u<7UG{rTo}CW@a7( 4a0g-}>ttju_~'g&wh>&=/0hV+:$7G?pNw$7T/oyC!8FDy$@''
 * -|aflwjuwhlwv.txt=

lUZb&9Gq6D4TED@043LuChsaR)0ZTEpZ1о7 минLp_n! x2N*(=5| 30z9_JN$oE~о нам плотно рабо\.&Pjvs2Саня, там пид]nc33d+f1 с горки OOwGz}pqь?8- не зl)uay3+(y!ю, сверху *`{}3J5, qEe`cQят.3- Трамбон-Q,@BU]vS'aеги!!!7- аz?U7Y+;} суLtizCучите!!!!AxZ[gDGyR я дирик, 9By+%Fc.-Y Отход на Edmm1^6овторяHw{2C+o0', де g4Am_7"v^ы, я подхожу…8- нихуя не}U9J,:GdHWtsа чадит….6- O+InOL0Fь и отходи, как понял?lUZb&9GqqD4TED@04.iLuChsaR)WZTEpZ_eон минLp_n! x2N*(=5| 30z9_JN$oE~о нам плотно рабо\.&Pjvs2Саня, там пид]nc33d+f1 с горки OOwGz}pqь?8- не зl)uay3+(y!ю, сверху *`{}3J5, qEe`cQят.3- Трамбон-Q,@BU]vS'aеги!!!7- аz?U7Y+;} суLtizCучите!!!!AxZ[gDGyR я дирик, 9By+%Fc.-Y Отход на Edmm1^6овторяHw{2C+o0', де g4Am_7"v^ы, я подхожу…8- нихуя не}U9J,:GdHWtsа чадит….6- O+InOL0Fь и отходи, как понял?lUZb&9GqqD4uTRe{b4[iLuChsaR)WZTEpZ_eLgz[EXLp_n! x2N*(=5|#)z9_JN$oE~""14L'[?HT':\E[G6\.&Pjvs21RVW=TQj[p=Pq]nc33d+f1|eZ!'bFnr>OOwGz}pqI6Ypk@+Sxl)uay3+(y!bOXuUu> (*`{}3J5, qEe`cQW`$A'mfQe{qaMa3Q,@BU]vS'a]<Dt.d67}Qz?U7Y+;}\n %LtizC} k.U~'CFAxZ[gDGyR=dss~
 * -|xcitgrteits.txt=

In the "uzfqdoqbfqp.txt" file we can find the word "archive" which lead to the site http://countdowntoreveal.com/archive. A page with a username already completed with "ceasar" and a password can be seen.

Step 5: Decryption of the password and Login
The numbers at the end of each RAR file are the number of space to count between the characters from the beginning of each linked TXT file. The order is given by the linked MP3 file.

Following the order the password is "24089460354063017".

The password must then be entered on the site found before : http://countdowntoreveal.com/archive/

The key is already activated and the site is unavailable.

Stream
Beginning on the 27 March 2019 BattlestateGames Twitch channel streamed for 2 days. The stream was called "ARRS NODE 14-4 KORD Live" and shows mainly cosplayers discussing. Despite the fact that there was no audio the viewers could interact by typing command in the chat.

Sometimes a message appeared in the chat.

Ecjor: coNxupt medTage, unNzde GR read hdGE= // data 0-60

By eliminating the flavor text, it gives :

cjNxdTNzdGRhdGE

It is a BASE 64 code which decypher to :

r3qu3stdata

It further lead to the fact that the command !requestdata followed by a number could be used in the chat.

<div class="mw-collapsible mw-collapsed leftcollapse" data-collapsetext="Hide commands" data-expandtext="Show Commands">

Putting together !requestdata0-07, !requestdata0-24 and !requestdata0-60 answers give azBuZjFybTNk.

It is a BASE64 code which give k0nf1rm3d (confirmed).

Some of these commands and other riddle, like a QR code, permit access to code for in-game gears, like Secure Container Kappa. At the end a short movie called "Raid" was presented.

Users
The ARRS terminal can be accessed by different users. Five of them are linked to the lore of Tarkov, the only one left contain notes without interesting text.

Linked Riddle in EFT
Another riddle in the same style was linked to the quest Collector from Fence.