REVERSE Engineering Thread (Spoilers Inside) (2006 TLE)

[manar]

This thread is for discussion of clues/information whose origin is the reverse engineered source code of any website officially related to "Lost Experience". I will post some material from thehansofoundation.org later , bear with me people , I'm impatient for the week-end to come :-)

Members of this team ? well I don't know yet ! VM ... pls tell if a section can be opened for this in the OWA .

Anyway , anyone with any skill is welcome and anyone with no skill is ... welcome too :-)

Updated on 05/13/06 :

Due to the massive request from the smart people here :D , I will try to explain the alpha-beta of what we're doing (and not) in this group , also consult the reference at the bottom of this post for recurring terms .

So let's begin :

FLASH (I'll try to make this short )

Upon thourough research , use of variances , covalences , de gauss and poisson formulas it looks like the most used word until now has been FLASH :p

I take it you people know what flash is : the fancy animations you get when visiting a website where you can click and get mind blowing effects that make browsing less boring ... Well actually that's the Flash Viewer .

The Flash Viewer is a little app installed in your computers . When you browse a flash site the flash movie is downloaded to your hard drive (temporary internet files folder) and is interpreted by the flash viewer . A flash movie has the extension "SWF" , hence why through this thread when talking about the played flash movie we'll say : movie
clip or swf .

BUT Flash is also an IDE ( Integrated Developement Environnement )

Flash IDE is a timelined environnement : just like a theather movie , a flash movie has a scenario and is made of Frames ... it could have 24 frames per second , 30fps or as the developper wants . A frame is the still image at some instant T .

To make the developpers work easier and have the possibility to control different objects in the movie independentely a flash file can contain different Layers .

Layers are similar to transparent acetate sheets piled up the ones on the others on the scene , one layer may contain the background another a flying banner , etc .

Again when you look at a certain frame you're looking at all the superimposed Layers at that instant T . The continuation of ONE graphic layer in time is called Sprite ( one object moving in time ) .

Examples :
Content_hanso.swf::sprite30::frame50 , means I'm looking in the content_hanso movie clip at the 50th frame of the sprite30 Layer ( hope this made sense :p)

When still not compiled a flash file has extension "FLA" . A FLA file can contain multimedia objects ( images , video , sound ) , system objects ( button , progressbar ... ) etc , to make all these object interact , flash has it's own language : ActionScript , I won't go in detail in this but ActionScript (aka AS) is just an object oriented programming language and can be read like any other one . Finally , when the movie is still uncompiled the ActionScript files have the "AS" extension.

Now what do we do here ?

We decompile the swf files in their elemental parts : images , sound , video , actionscript ; this is not always a clean process and we end up sometimes with plain ... garbage .

Why we do it ?

Because it's easier for other people to analyze the uncompiled material ( specially sound and video )
Because sometimes you CAN'T see what's going on ( ie : devs putting 60frames per second when human eye can only see 24fps ,, oh ok 30fps with postimage effect!! )
Because there may be hints in the source code !
...

What tools do we use ? (non exhaustive list)

Sothink SWF Decompiler
Flash Decompiler
Offline Explorer ( For site download )
HTTrack
Notepad !!! ;)
...
If you use other tools pm me , I'll update.

Reference :

swf : are completed, compiled and published files that cannot be edited with Macromedia Flash. However, swf decompilers do exist.
fla : contain source material for the Flash application. Flash authoring software can edit FLA files and compile them into .swf files.
as : contain ActionScript source code in simple source files. FLA files can also contain Actionscript code directly, but separate external .as files often emerge for structural reasons, or to expose the code to versioning applications. They sometimes use the extension .actionscript
swd : temporary debugging files used during Flash development. Once finished developing a Flash project these files are usually removed.
asc : Server-Side ActionScript, which is used to develop efficient and flexible client-server Macromedia Flash Communication Server MX applications. We won't get these .
flv : Flash video files, as created by Macromedia Flash, Sorenson Squeeze, or On2 Flix.
swc : used for distributing components; they contain a compiled clip, the component's ActionScript class file, and other files that describe the component.
jsfl : used for added functionality in Flash; they contain Javascript code for extendability of the Javascript API.
swt : 'templatized' forms of .swf files, used by Macromedia Generator
flp : renamed XML files, used to reference all the document files contained in the Flash Project. Flash Projects allow the user to group multiple, related files together to create complex, interlinked, applications.
spl : FutureSplash documents. deprecated format prior to flash 3.
aso : files used during Flash development, containing compiled ActionScript byte code. An ASO file is recreated when a change in its corresponding class files is detected. Occassionally the Flash IDE does not recognize that a recompile is necessary, and these cache files must be deleted manually.

JavaScript

Coming later

Dynamic pages ( ASP / PHP ... )

Coming later

[manar]

The Lost Directory

For your convenience ... to have a common base of discussion and so as not to cause overloads during the official websites updates I decided to put up a centralized site where you can retrieve the source files for studying , link below :

http://www.likaanet.com/lostdirectory/index.php?fpp=10

It will be updated regularly along with the official websites updates . If you don't want to decompile the flash movies , you can retrieve the flash source here :

http://www.likaanet.com/lostdirectory/index.php?fpp=10&did=2-0-7[/URL] (http://www.likaanet.com/lostdirectory/index.php?fpp=10&did=2-0-0)
Or here for the 05/12 update :
http://www.likaanet.com/lostdirectory/index.php?fpp=10&did=2-0-0-3 (http://www.likaanet.com/lostdirectory/index.php?fpp=10&did=1-0-5)
05/17 update :
http://www.likaanet.com/lostdirectory/index.php?fpp=10&did=2-0-1-2
05/17 update 2 :
http://www.likaanet.com/lostdirectory/index.php?fpp=10&did=2-0-2-2

The flash source can be used directly with the Macromedia Flash solution , it contains the images the sounds , etc ... but you'll need to take them from the file itself .

The images folder is here :
http://www.likaanet.com/lostdirectory/index.php?fpp=10&did=2-0-8
and here : http://www.likaanet.com/lostdirectory/index.php?fpp=10&did=2-1[URL="http://www.likaanet.com/lostdirectory/index.php?fpp=10&did=1-0-6"] (http://www.likaanet.com/lostdirectory/index.php?fpp=10&did=1-0-0-3)

Right now it is pretty empty , if you want to see something there ... ASK ! ;)

You can also browse for videos , though they are in the flv format , I'll be thinking about converting them to avi later :)
I may put also a special folder for "relevant" images and code we found but that's in the thinking too , give me your thoughts .

The site is not only for flash files , you can find the press releases , persephone source code ... it's still in the thinking , maybe a userform to upload ressources sometime ( with prior aprobation that is ) ...

To reference a file from the lost directory please use the "copy url" link , it's up to the left after you click a file .

This is all I can think of now :D .

TLD LAST UPDATE : 05 - 18 - 2006

[manar]

another placeholder

[manar]

and another one

[manar]

and the latest in case you guys are reverse engineering gurus ;-)

[killbuckner]

Manar- could you tell us how the zoom in and zoom out functions work in flash? On the Mathematical Forecasting initiave page there are 4 works that are whited out. The first word is pretty clearly Zambia. The 4th word appears to be steevo or stecvo.

The curious thing is that on the 3rd word when you zoom in all the way all you can see is the top of the capital M. But when you zoom all the way out you can see the tops of 3 letters after the M that just are not there zoomed in. You have any idea why that would be occurring? Should we accept that there are 4 letters in that word or should we not trust the flash when we are zoomed out?

[steeeb]

screen cap zoomed out, THEN zoom in on the screen cap?

[killbuckner]

Here is a cap when you are zoomed in

http://i27.photobucket.com/albums/c164/haasd/mzoomin.png


Here is a cap of the section zoomed out (and enlarged for visibility)

http://i27.photobucket.com/albums/c164/haasd/moutenlarged.png

[bcool1956]

In a flash file *.swf plays you can zoom in on the "movie" that is playing just right click on the page and look at the options like rewind, loop, or zoom or show all.

[steeeb]

More it says?

3rd letter is definatly an r

I've had this is my blog for the past day as it saying: More soon

[manar]

I will look in this later , I may have that image dumped somewhere from the flash movie , will look deeper into the MFi swf and keep you informed .

[2fingers]

Manar did you find anything in the scripts that looked funny to you i found some things in the exec_bios .swf that looked promising

[steeeb]

what did you find?

[2fingers]

just that all the scripts for the login are under the movie clip for dick cheever and all they do as of last night is play that "process" movie clip for a random amount of time back when I used to program we would do stuff like that to make it look like it is acutally processing something.

I am trying to remember this for like 4 or 5 in the morning and i was a lil tipsy so that could be all wrong. But i think it is right

[manar]

2fingers : I did , though don't know how interesting it is and you're right on the login randomness .


killbuckner : I will be sending some good stuff tonight ;-)

ETA - ok , so still not night , but here goes first goodness :

http://freejobs.free.fr/LostARG/RE/hansoafrica.html

isn't that what you were looking for guys ? ;-)

[steeeb]

hehe, thats using the words More Soon, which everyone said it wasn't..

Where did you find this?

[manar]

steeeb : this is a DIRECT reverse engineering of swf file , so it's 100% sure .

I will be posting more stuff as things go on .. don't wanna spoil too much , besides website developpers may be leading us the wrong way purposefully . I will be talking on that on later posts .

Now I must head home ...

Regards , Manar

[dragon44]

great job Manar and you too steeeb!

[manar]

Can you believe it ? I still did not visit thehansofoundation.org website !!!
weird , I need to go there sometime , hehe .

So guys I depend on you , for getting clues , if you want something tell me where it is and how to get there and I'll see what I can do . And if you don't want something , pls just don't ask ;-)

I have load photos , some animations and videos but it's true I'm not sure what is valuable , I will go on that this WE , try to make a synopsis and make it fast , hrrmph may is a high season and I won't get much time at work it looks :-S , anyway let me stop rambling .

I was going to explain how the hidden words stuff worked graphically but I'm just too lazy :-p .

So to make it short you got a text object and over it a mask , you want to show the full text : you hide the mask , something like this in the code :


// [Action in Frame 2]
teaser_mc.setMask(teaserpanel_mc_mask);


and then :


// [Action in Frame 17]
teaser_mc.setMask(null);


... the change in zoom may show or hide letter edges as someone reported ... wich would be pretty normal due to zoom being a percentage wich will be rounded up/down when rendered and therefore relativeness between object and mask won't be preserved ( if you have problems with this just pass ;-) )

Yeah I know ... a little boring , but at least now S2 EP20 is fully downloaded ( long life bittorrent ) so I can go watch , cya people , hehe .

ETA .... ok and meanwhile , this is the action script code for sprite43 , hanso_exec_bios flash file , I can't see a form there but sure I can smell it all around :


// Action script...
// [Action in Frame 1]
stop ();
setProperty("", _visible, false);
styles = StyleManager.getMainStyle();
email_txt.html = true;
email_txt.styleSheet = styles;
email_txt.autoSize = true;
email_txt.htmlText = "<a href=\"<A href="mailto:mittlewerk@hansofoundation.org\">mittlewerk@hansofoundation.org</a">mailto:mittlewerk@hansofoundation.org\">mittlewerk@hansofoundation.org</a>";
// [Action in Frame 2]
setProperty("", _visible, true);
// [Action in Frame 19]
stop ();
// [Action in Frame 39]
_parent.sectionHidden();


this said , there is something sooo wroooong there !

now to yesterday's episode :-D

[jacksonwest]

Glad to see this thread off to such a good start! I'm pretty handy with Flash, Javascript, Actionscript, Perl, PHP, Photoshop, etc. so ping me if there's a project. I'll keep a close eye on this thread.

ETA - I tried that email and mittlewerk@thehansofoundation.org -- got mail delivery errors both times.

[steeeb]

Can you look at the flash for the bios page? especially Tomas Middelwerk, as he has a signuture kinda out place.. something under it?

ETA - how about thomas.mittelwerk as the email address?

[killbuckner]

hmmm... thats interesting- the domain is listed as hansofoundation.org instead of thehansofoundation.org?

[steeeb]

hansofoundation.org is owned by 481516...

[manar]

Exactely killbuckner , and hansofundation.org is a link to the "number forums" ????!!!!

Is this just a mistype in a form they were not going to use still anyway or are they misleading us as I said earlier .

Ok this has nothing to do with reverse engineering but can someone whois that domain to see who's the owner and when it was acquired , btw there is an MI 3 ad there :-p

[steeeb]

note: its mittEL not mittLE on the hanso website.. a clue maybe?

Domain ID:D107709943-LROR
Domain Name:HANSOFOUNDATION.ORG
Created On:06-Oct-2005 02:43:27 UTC
Last Updated On:23-Mar-2006 03:18:46 UTC
Expiration Date:06-Oct-2006 02:43:27 UTC
Sponsoring Registrar:eNom, Inc. (R39-LROR)
Status:OK
Registrant ID:09CC8B3D3B9ED3E1
Registrant Name:Whois Protection Service - ProtectFly.com
Registrant Organization:RegisterFly.com - Ref-R# 31513388
Registrant Street1:623 Eagle Rock Avenue
Registrant Street2:Suite #7
Registrant Street3:
Registrant City:West Orange
Registrant State/Province:NJ
Registrant Postal Code:07052
Registrant Country:US
Registrant Phone:+1.9737362545
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:p1gthj7528u9p1@protectfly.com
Admin ID:B01C1BEC2551792C
Admin Name:Whois Protection Service - ProtectFly.com
Admin Organization:RegisterFly.com - Ref-A# 31513388
Admin Street1:623 Eagle Rock Avenue
Admin Street2:Suite #7
Admin Street3:
Admin City:West Orange
Admin State/Province:NJ
Admin Postal Code:07052
Admin Country:US
Admin Phone:+1.9737362545
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:v82aw1s4ta2n75@protectfly.com
Tech ID:73C4B9B8F1BA7E0C
Tech Name:Whois Protection Service - ProtectFly.com
Tech Organization:RegisterFly.com - Ref-T# 31513388
Tech Street1:623 Eagle Rock Avenue
Tech Street2:Suite #7
Tech Street3:
Tech City:West Orange
Tech State/Province:NJ
Tech Postal Code:07052
Tech Country:US
Tech Phone:+1.9737362545
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:kgzhsmmhb1gm7bf@protectfly.com
Name Server:NS1-NOVA.WEBSERVERSYSTEMS.COM
Name Server:NS2-NOVA.WEBSERVERSYSTEMS.COM

same as number forums :D

noticed the numbers site has change.. and also look at source-code some mumble jumble in there and a "is there a clue in the sourcecode?" did they sell up?

[manar]

http://freejobs.free.fr/LostARG/RE/mittelwerk.jpg

looks like thomas mittelwerk.

steeeb : yeah I would like to see the source ... those lines just looked so wrong there and inexpected .

[steeeb]

yup :D only one with a sig and email that doesnt work out of the people on the bio also.

[truffula]

www.hansofoundation.org (http://www.hansofoundation.org) will take you to the numbers forum.
www.thehansofoundation.org (http://www.thehansofoundation.org) will take you to the HANSO site.
2 different sites (official site has "the" in the url) :)

[steeeb]

yup, but on thehansofoundtion.org in the flash there is an email with a "hansofoundation.org" extension..

wierd?

[Penelope]

manar have you looked through the code for the possible login and password?

[truffula]

yup, but on thehansofoundtion.org in the flash there is an email with a "hansofoundation.org" extension..

wierd?
Yeah, that IS weird.
Wonder if its just a screw-up?
I highly doubt someone from the Numbers forum is involved with the Official HANSO site.....we shall see, I guess....

[manar]

If it's a mistype from the devs it will be updated at some time , wait and see . What IS weird is the MI3 AD in hansofoundation !! :-p or is it a :-o

The code looks clean though , no really hidden stuff , not even this :

<meta name="Hidden" content="Are there secrets hidden in the source code?">

;-)


As for the login/password ... Penelope can you specify ? In wich section is the form and are there any particular steps to go there ?

There are still some pieces of suspicious code but nothing indicates it has anything to do with logins . If you want my guess the password can be there only if the devs wants us to find it there , that remains to be seen ;-) .

OK, can someone who visited whole unlocked site , I mean seen the letter and all , search for this reference : "chlaw9lu" inside cookies folder ? It may be either in filename or as text inside cookie files (or nowhere !) , i'm checking something :-)

[WASTE]

Yeah, that IS weird.
Wonder if its just a screw-up?
I highly doubt someone from the Numbers forum is involved with the Official HANSO site.....we shall see, I guess....

It could be possible...that forum was used in the official Mission: Impossible III webgame to relay a clue.

[Penelope]

Manar, I was referring to the login and password for the Board of Directors information on the Hanso site. Its restricted unless you know the proper login and password.

There is also a login on the bottom right hand corner of the website, appears on every page of the site. I have tried about every character name as well as every Hanso person's name, no luck - - I thought maybe you had seen something!! :D

[steeeb]

There is stuff hidden, theres a message to decyther, look down the page in the source

On the forum page:

<input type="hidden" name="encrypted2" value="-----BEGIN PKCS7-----MIIHVwYJKoZIhvcNAQcEoIIHSDCCB0QCAQExggEwMIIBLAIBAD CBlDCBjjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRYwFAYD VQQHEw1Nb3VudGFpbiBWaWV3MRQwEgYDVQQKEwtQYXlQYWwgSW 5jLjETMBEGA1UECxQKbGl2ZV9jZXJ0czERMA8GA1UEAxQIbGl2 ZV9hcGkxHDAaBgkqhkiG9w0BCQEWDXJlQHBheXBhbC5jb20CAQ AwDQYJKoZIhvcNAQEBBQAEgYABtG+OjV0NgWzHlPtVZq+eIWv5 kzCUSv08w/1zw6ZF4xMTjbdZuzTpXSiR7GGTebwu9sQGfRC/aOVWyju81RiPQOZTPEfCG8oDU96QikRmGnPH/o2gA33VBKpTVLSIzaK8YmSlRTgLm9JmASlXczeQTU8vFaw0Z+0 7mialZQE8zjELMAkGBSsOAwIaBQAwgdQGCSqGSIb3DQEHATAUB ggqhkiG9w0DBwQISzfGklmU8oWAgbDFJXdpJGUI8FkR0D01SA5 LxT5Ok6V0fUMQh6C0/y6YsMbxdisnJnaHTylyQA8BQbk2QrJMr6FKI6/tnvQYL8EPdv4e4ZtpuKnUDUAF9kLnmQ+t/ABHbAcKjkJKRMGCwJ44+PEL3+gJH6N8NBeRJIswV0Mhepuhfus MStqrS8EfQJ6TXdUclUL2754BzOoD9GPFMguc/br5/R/scyEA1YgMlkQ44KovgtNDsEgsislfiqCCA4cwggODMIIC7KADA gECAgEAMA0GCSqGSIb3DQEBBQUAMIGOMQswCQYDVQQGEwJVUzE LMAkGA1UECBMCQ0ExFjAUBgNVBAcTDU1vdW50YWluIFZpZXcxF DASBgNVBAoTC1BheVBhbCBJbmMuMRMwEQYDVQQLFApsaXZlX2N lcnRzMREwDwYDVQQDFAhsaXZlX2FwaTEcMBoGCSqGSIb3DQEJA RYNcmVAcGF5cGFsLmNvbTAeFw0wNDAyMTMxMDEzMTVaFw0zNTA yMTMxMDEzMTVaMIGOMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ 0ExFjAUBgNVBAcTDU1vdW50YWluIFZpZXcxFDASBgNVBAoTC1B heVBhbCBJbmMuMRMwEQYDVQQLFApsaXZlX2NlcnRzMREwDwYDV QQDFAhsaXZlX2FwaTEcMBoGCSqGSIb3DQEJARYNcmVAcGF5cGF sLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwUdO3 fxEzEtcnI7ZKZL412XvZPugoni7i7D7prCe0AtaHTc97CYgm7N sAtJyxNLixmhLV8pyIEaiHXWAh8fPKW+R017+EmXrr9EaquPms VvTywAAE1PMNOKqo2kl4Gxiz9zZqIajOm1fZGWcGS0f5JQ2kBq Nbvbg2/Za+GJ/qwUCAwEAAaOB7jCB6zAdBgNVHQ4EFgQUlp98u8ZvF71ZP1LXCh vsENZklGswgbsGA1UdIwSBszCBsIAUlp98u8ZvF71ZP1LXChvs ENZklGuhgZSkgZEwgY4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEw JDQTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEUMBIGA1UEChML UGF5UGFsIEluYy4xEzARBgNVBAsUCmxpdmVfY2VydHMxETAPBg NVBAMUCGxpdmVfYXBpMRwwGgYJKoZIhvcNAQkBFg1yZUBwYXlw YWwuY29tggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQ ADgYEAgV86VpqAWuXvX6Oro4qJ1tYVIT5DgWpE692Ag422H7yR Ir/9j/iKG4Thia/Oflx4TdL+IFJBAyPK9v6zZNZtBgPBynXb048hsP16l2vi0k5Q2 JKiPDsEfBhGI+HnxLXEaUWAcVfCsQFvd2A1sxRr67ip5y2wwBe lUecP3AjJ+YcxggGaMIIBlgIBATCBlDCBjjELMAkGA1UEBhMCV VMxCzAJBgNVBAgTAkNBMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV 3MRQwEgYDVQQKEwtQYXlQYWwgSW5jLjETMBEGA1UECxQKbGl2Z V9jZXJ0czERMA8GA1UEAxQIbGl2ZV9hcGkxHDAaBgkqhkiG9w0 BCQEWDXJlQHBheXBhbC5jb20CAQAwCQYFKw4DAhoFAKBdMBgGC SqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8 XDTA1MDYwODE5Mjc1M1owIwYJKoZIhvcNAQkEMRYEFAUKAMxi3 2KwnBThlmld91kobouMMA0GCSqGSIb3DQEBAQUABIGAPNM9Ssg 5hYWfiU7RTpx7dtuILPrz4VnP1apMOxg0N6QmJfsm3Niv2zSEo 3Qdht3/z/uze9vVvHBOM2Me/YDoQHkQhqG/ifT4M0P82PeOoFZo6GuDvGwFYc5uk3+ajWcwEqQtdx9tGJBUa5 o3jyulwhlqMOhTLaNBOHJTMHM7lUg=-----END PKCS7-----

and

<input type="hidden" name="encrypted" value="-----BEGIN PKCS7-----MIIHmAYJKoZIhvcNAQcEoIIHiTCCB4UCAQExggEwMIIBLAIBAD CBlDCBjjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRYwFAYD VQQHEw1Nb3VudGFpbiBWaWV3MRQwEgYDVQQKEwtQYXlQYWwgSW 5jLjETMBEGA1UECxQKbGl2ZV9jZXJ0czERMA8GA1UEAxQIbGl2 ZV9hcGkxHDAaBgkqhkiG9w0BCQEWDXJlQHBheXBhbC5jb20CAQ AwDQYJKoZIhvcNAQEBBQAEgYCChBDhud6wlfRi/seaqw0XJPwkRYlFba6aRP0PsId/tQD9dejLsaHFcFEbpmytHTQntpDZI4ZqF3oJ4AbDPWmB6F+nrm U4h68RFo1WizbkrwIpbPQoGDo1SMbqSquNKsJwD76phq+Y3mkc bMsUq8HXYjQevYRjv/8Rn+rOkGNPBDELMAkGBSsOAwIaBQAwggEUBgkqhkiG9w0BBwEw FAYIKoZIhvcNAwcECCJEf8QEjkkBgIHwakByU0UH07Hr5T3Ufc hRxysN6BpZaObLze4rjELwMFZcQksSXrZGsJwJ+qTZ+qChRSOQ tHIdxjTWZd7ZWTvS1WswCfu8Q5M8icFqs1D4gjmo+yAk8ylAUm OdfduPN5lo52MWuTZHbCDIbIP+TNRmzOQiKdMihvv1OxA5XDBQ vdvhW/egS5AzuPFnrh4GO4Mo9nOcAJDVwZkSvXSpKcKvrRqWXJiw6ZiO V0WFrQ+Iz/qRxbaXZx3l1xsYh+ahzXbKUCLSNVoI2Af+7Dlq7LINkfpZJWgD fIHm+6kKsTN3RwOOdZVdsl6Uhk0Nt+2xLq6SoIIDhzCCA4Mwgg LsoAMCAQICAQAwDQYJKoZIhvcNAQEFBQAwgY4xCzAJBgNVBAYT AlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNTW91bnRhaW4gVm lldzEUMBIGA1UEChMLUGF5UGFsIEluYy4xEzARBgNVBAsUCmxp dmVfY2VydHMxETAPBgNVBAMUCGxpdmVfYXBpMRwwGgYJKoZIhv cNAQkBFg1yZUBwYXlwYWwuY29tMB4XDTA0MDIxMzEwMTMxNVoX DTM1MDIxMzEwMTMxNVowgY4xCzAJBgNVBAYTAlVTMQswCQYDVQ QIEwJDQTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEUMBIGA1UE ChMLUGF5UGFsIEluYy4xEzARBgNVBAsUCmxpdmVfY2VydHMxET APBgNVBAMUCGxpdmVfYXBpMRwwGgYJKoZIhvcNAQkBFg1yZUBw YXlwYWwuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ DBR07d/ETMS1ycjtkpkvjXZe9k+6CieLuLsPumsJ7QC1odNz3sJiCbs2w C0nLE0uLGaEtXynIgRqIddYCHx88pb5HTXv4SZeuv0Rqq4+axW 9PLAAATU8w04qqjaSXgbGLP3NmohqM6bV9kZZwZLR/klDaQGo1u9uDb9lr4Yn+rBQIDAQABo4HuMIHrMB0GA1UdDgQWB BSWn3y7xm8XvVk/UtcKG+wQ1mSUazCBuwYDVR0jBIGzMIGwgBSWn3y7xm8XvVk/UtcKG+wQ1mSUa6GBlKSBkTCBjjELMAkGA1UEBhMCVVMxCzAJBg NVBAgTAkNBMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQwEgYD VQQKEwtQYXlQYWwgSW5jLjETMBEGA1UECxQKbGl2ZV9jZXJ0cz ERMA8GA1UEAxQIbGl2ZV9hcGkxHDAaBgkqhkiG9w0BCQEWDXJl QHBheXBhbC5jb22CAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQCBXzpWmoBa5e9fo6ujionW1hU hPkOBakTr3YCDjbYfvJEiv/2P+IobhOGJr85+XHhN0v4gUkEDI8r2/rNk1m0GA8HKddvTjyGw/XqXa+LSTlDYkqI8OwR8GEYj4efEtcRpRYBxV8KxAW93YDWzFGv ruKnnLbDAF6VR5w/cCMn5hzGCAZowggGWAgEBMIGUMIGOMQswCQYDVQQGEwJVUzELM AkGA1UECBMCQ0ExFjAUBgNVBAcTDU1vdW50YWluIFZpZXcxFDA SBgNVBAoTC1BheVBhbCBJbmMuMRMwEQYDVQQLFApsaXZlX2Nlc nRzMREwDwYDVQQDFAhsaXZlX2FwaTEcMBoGCSqGSIb3DQEJARY NcmVAcGF5cGFsLmNvbQIBADAJBgUrDgMCGgUAoF0wGAYJKoZIh vcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMDY wNDE5MjA0MzM5WjAjBgkqhkiG9w0BCQQxFgQUNSO7DwZTu83lj twj9PjokDOWGvkwDQYJKoZIhvcNAQEBBQAEgYAugibWH/CQCc45hJIMM2AxHEbbZJpufrdIpwBLzHGiU6eUHUQszaPZcdQ1 VidG4wVjTmi2y3PV5xUe4bciM2d2vwf/Cf5FdOtWGC5v9nDs5daOg6iWSb3jh7xD6kcAjMhc/f2Xg9h1BM0xruO7t6VEHxuUD9zopZiX8pJUgAZ+WA==-----END PKCS7-----

[SeanDude05]

Can you make anything of it? Cypher-able?

[rottenralf]

It doesn't seem to mean anything on the base 64 translator, nor the hex nor the binary.

[manar]

steeb : I looked only in the main page didn't go to the forums ! :hammersel

rottenralf : thought it was Base64 too at first , must be PKCS7 though , here is a link :
http://www.rsasecurity.com/rsalabs/node.asp?id=2129

looks like the devs wanted us here ;-)

so for the "chlaw9lu" stuff , anyone ?

Edit for me : You still must go to the numbers forum !!!!!!!

[steeeb]

hehe yes, you must :D

[manar]

I also went to the : http://www.oceanicairlines.com/ , is that an official website ?

apart from the ready button if you look in the code :


<td>
<div align="center">
<img src="blank.gif" width="40" height="40" alt="-"><img src="blank.gif" width="40" height="40" alt="-"><img src="blank.gif" width="40" height="40" alt="-"><img src="blank.gif" width="40" height="40" alt="-">
<br /><img src="blank.gif" width="40" height="40" alt="-"><img src="blank.gif" width="40" height="40" alt="-">
<br /><img src="blank.gif" width="40" height="40" alt="-"><img src="blank.gif" width="40" height="40" alt="-">
<br /><br /><br /><img src="ready.gif" width="90" height="20" alt=". . .">
</div>
</td>


wich translates to : ---- -- -- , anyone does morse here ? :musik29:

[steeeb]

good point or better still

- - - -
- -
- -

^ in a T shape like on the site

[manar]

So who's rolling the wheel first ? :D

[steeeb]

i'm waiting for your skills :)

i find you stuff, you tell me what it means.. thats the deal ;)

[Penelope]

I also went to the : http://www.oceanicairlines.com/ , is that an official website ?

apart from the ready button if you look in the code :


<td>
<div align="center">
<img src="blank.gif" width="40" height="40" alt="-"><img src="blank.gif" width="40" height="40" alt="-"><img src="blank.gif" width="40" height="40" alt="-"><img src="blank.gif" width="40" height="40" alt="-">
<br /><img src="blank.gif" width="40" height="40" alt="-"><img src="blank.gif" width="40" height="40" alt="-">
<br /><img src="blank.gif" width="40" height="40" alt="-"><img src="blank.gif" width="40" height="40" alt="-">
<br /><br /><br /><img src="ready.gif" width="90" height="20" alt=". . .">
</div>
</td>


wich translates to : ---- -- -- , anyone does morse here ? :musik29:

Manar, there is a thread in the Spinoff forum specifically for www.oceanicairlines.com (http://www.oceanicairlines.com) Lab, Truff, merge to the thread?

[TheBigCat]

Two Dashes (--) is an I, but there is no character with 4 dashes.
I take that back...it signifies where in any non-english alphabet there is a character with the CH sound.

Then again it also looks like the tee formation already mentioned

[manar]

It's ok penelope . *


* (: hguoht ereh erom elttil a ti tuoba klat thgim ew

[steeeb]

we might talk about it a little more here though :)

[manar]

uuh yeah that was easy on you :-p

must go now , but again anyone who can test for anything related to : chlaw9lu or p8ath7ax in cookies folder , I'd be gratefull , might be only them setting a cookie but I'll know then !

Well , many things going on , so keep talking :-)

[steeeb]

hehe okies

[rottenralf]

uuh yeah that was easy on you :-p

must go now , but again anyone who can test for anything related to : chlaw9lu or p8ath7ax in cookies folder , I'd be gratefull , might be only them setting a cookie but I'll know then !

Well , many things going on , so keep talking :-)

"path ax" in google has some interesting things, I don't understand any of it, but real techy stuff.

[manar]

Now THAT would be off-topic rottenralf , you're talking about this : http://www.rbduncan.com/pge1.html maybe ?

Lab5 I promise we won't talk much about oceanicairlines.com , only if we find the key . j/k

Am I ever leaving tonight ! and for me : "YOU DID NOT VISIT NUMBERS FORUM STILL !!!! " , sorry :-)

[dragon44]

uuh yeah that was easy on you :-p

must go now , but again anyone who can test for anything related to : chlaw9lu or p8ath7ax in cookies folder , I'd be gratefull , might be only them setting a cookie but I'll know then !

Well , many things going on , so keep talking :-)

after an initial search, I have neither of those cookies on my computer, manar. I will check again tomorrow.

[steeeb]

reckon you could make the code into a cookie that might trigger an event on one of these sites if found?

or is it gibberish?

only time will tell!

[manar]

dragon44 : thnx , I appreciate ,

I think rottenralf idea is pretty interesting , see google search :

http://www.google.co.ma/search?hl=us&q=path+ax&btnG=Recherche+Google&meta=

Second entry RB DUNCAN ( if you're reading this in 2056 maybe RB DUNCAN does not exist anymore so don't get confused ) , well ... while this is interesting it does not belong to this thread :-S .

keep up the good thinking :-D , see ya laaaaater.

[Lab]

I deleted my earlier post. This discussion is perfectly fine here. I spoke hastily before completely understanding the context of the discussion. My apologies, please carry on.;)

[SeanDude05]

Perhaps ---- -- -- could refer to CH II or Chapter 2 of something?

[supermodel]

OK, I have no idea what you all are talking about. I just dropped in to say that this is the HOTTEST thread EVER. All the veterans know how much I love smart guys.

That is all. Go back about your business.

[Topnotch Toast]

So, chlaw9lu definately relates to the newsletter part: (in content_newsletter.swf, sprite 62)

if (Site.checkIfSeen("chlaw9lu"))
{
Site.soundControl.setSounds(0, 0, 0, 0, 10, 40, 0);
gotoAndPlay("posthacked");
}
As for the meaning, I have no idea. Seems like gibberish to me. I'm busy decompiling as much as I can right now. I'll edit this if I find anything good. (worth noting, I guess.)

EDIT #1: So, I have proof for sure that the login/password in the board of directors does absolutely nothing for now.

Sprite 101 is the login form. Button 90 has an on (release) ...
on (release)
{
_parent.submitclicked(this);
} submitclicked says...
function submitclicked(theMC)
{
if (password.text.length < 2 || login.text.length < 2)
{
return;
} // end if
form.gotoAndPlay("process");
endTime = getTimer() + random(2000) + 500;
onEnterFrame = process;
} Process is the loading...
function process()
{
if (getTimer() > endTime)
{
form.gotoAndPlay("unknown");
onEnterFrame = null;
} // end if
} Which, of course, goes to unknown after a certain amount of time. Whee.

EDIT #2: Same thing goes for the Login form by the RSS feed (code is practically identical). Guess we'll have to check later.

[SeanDude05]

Probably until after the 6th.

[manar]

Ok back , but not for long , got to work , I will be making a synopsis of what we have so far
sometime this week-end and edit front post .

Topnotch Toast :


if (Site.checkIfSeen("chlaw9lu"))
{
Site.soundControl.setSounds(0, 0, 0, 0, 10, 40, 0);
gotoAndPlay("posthacked");
}


If you look for checkifSeen function in content_newsletter::actionscript::sprite66 you get :


static function checkIfSeen(name)
{
var _loc3 = SharedObject.getLocal("hansofd", "/");
var _loc1 = _loc3.data[name];
var _loc2 = !isNaN(_loc1) && _loc1 << 2 >> 3 < 10;
if (_loc2)
{
Site.setAsSeen(name);
} // end if
return (_loc2);
} // End of the function
static function setAsSeen(name)
{
var _loc1 = SharedObject.getLocal("hansofd", "/");
_loc1.data[name] = -5 + Math.floor(Math.random() * 24);
} // End of the function


SharedObject.getLocal returns a local persistent object in flash wich in main english means it reads a cookie , hence why I was asking to check in cookies folder ;-) , file must be something like hansofd@thehansofoundation.org/ or something alike and inside you may have the reference to "chlaw9lu" ; not really important is it :-/ ? mind you , they're just checking if you already visited and send you to the hacked post if you did , but nontheless these words "chlaw9lu" are intriguing and just shine in there . Hey glad someone is looking at the code too , keep an eye I will be posting the actionscript code for "relevant clues" sometime this week end.

Also uuh someone pls write a step by step to get to the letter or any discovered hidden clue and pm me ? pls just pm me and confirm with a post here , no need to post the whole thing in this thread.
It's just so I can download some missing files , I might be missing important things there.

supermodel : I appreciate your comment :-) ... please feel free to post whatever remarks you have , hey this is not only programming/maths gurus oriented !! :-p

Well that's all for now folks , will be coming back this afternoon , maybe will send something this evening , right now my top priority will be the PKCS7 algorithm , yay weekend at the door :-D

PS : I monitor all posts so feel free to ask , don't feel unhibited !! :-p

[trailgoat]

OK, I have no idea what you all are talking about. I just dropped in to say that this is the HOTTEST thread EVER. All the veterans know how much I love smart guys.

That is all. Go back about your business.

I agree Super, smart guys are the Hawtest!

[Topnotch Toast]

Hmm, I tried to mess around with the pkcs7 (where did that come from?), but I'm no expert on cryptography/SSL.

I put them into textfiles and ran "openssl -in encrypted.txt -ouput DER", and this came up:


Mountain View1¶0↕♠♥U♦ 0?"0?Z1♂0 ♠♥U♦♠‼☻US1♂0 ♠♥U‼☻CA1▬0¶♠♥U♦‼
‼♂PayPal Inc.1‼0◄♠♥U♦♂¶
?lÇ"ûUf_z!kù"0"Jy<AysA▌Ea‼‼?·Y»4é](`ìa"y¼.öÄ♠}►¿håVE;¼O↑?@æS<GA♥S_?SDf→sÇ_? ♥}O♦
♥K7Æ'Y"ò.??°Å%wi$dY◄D=5H♫KÅ>N"¥t}C►╪ 'ÿ.~°Æñv+'&v╪O)r@→☺A16B²L_¡J#_ízô↑/A v_▲á>i
@♣öBçT -ü Gl
ZBJDA,Az8oñ♂ßè ▼£|4↨`$<0WC!z>¡~ë♀JU«KA▼@z"]O∟Böïz☺Iê♥ôcÅ2♂oyºùy▼ìs! O^♀-D8àª/,O
Mountain View1¶0↕♠♥U♦‼☻US1♂00 ♠♥U‼☻CA1▬0¶♠♥U♦‼
‼♂PayPal Inc.1‼0◄♠♥U♦♂¶
Mountain View1¶0↕♠♥U♦ve_♠♥U♦♠‼☻US1♂0 ♠♥U‼☻CA1▬0¶♠♥U♦‼
‼♂PayPal Inc.1‼0◄♠♥U♦♂¶
☺☺☺♣a♥??*0?%☻??YAGNYüDIK\oZU)'oxeïdû ¢x»<°û▌°zD♂Z↔7=ì& >3l☻OrÄOâÆhKWEr F¢↔u?╪ÇI)
o`O^_↕eë_Ñ→ªaæ±[OE ‼SI4⪣i%àlbIÜU"+£:m_deo↓-▼ä"6?→?nöàUöZob⌂«♣☻♥☺ ☺£?î0?ë0↔♠♥U
↔♫♦▬♦¶-Y|»Æo↨½Y?Rx
►Öd"k0?»♠♥U↔#♦?30?°?¶-Y|»Æo↨½Y?Rx
Mountain View1¶0↕♠♥U♦ ♠♥U♦♠‼☻US1♂0 ♠♥U‼☻CA1▬0¶♠♥U♦‼
‼♂PayPal Inc.1‼0◄♠♥U♦♂¶
☺☺♣♣a♥??*?_:Vs?Zåï_£«£S%ÖÖ§!>C?jDëY?ƒ?¶▼¼`"¿y?oSá%_I~\xMO_ RA♥#Eö_3dÖm♠♥AEuUO?!°
yz-kâONPO'¢<;♦|↑F#áçĵÄiE?qWA±☺ow`53¶kë,cç-°A↨¥Qç Éù╪1,☺s0,☺-☻☺☺0?"0?Z1♂0♠♥U♦♠‼☻
Mountain View1¶0↕♠♥U♦U♦‼
‼♂PayPal Inc.1‼0◄♠♥U♦♂¶
☺5060819♦1▬♦¶♣#♠*+H+÷ve_*+H+÷☻→♣ ]0↑♠ *+H+÷
☺☺☺♣b♦??<O=JE9..Y%NÑNo{vU^,úóáYIOªL;↑47☼&%û&ÜO_U4,£t↔+YÿIû3{UO¼pN3c▲y?è@y►+¡¿%ôo
3CüO÷Z Vhèkƒ¼l♣aIn"⌂s?g0↕☼-w▼m↑?Tks7?+¥A↓j0èS-£A8rS0s;H
Hmm, Paypal. (Both of their outputs are pretty similar, but there might be some of the blech that's different.)

[manar]

Yeah ,that Paypal stuff, disturbs me a lot you know :-S

Edit : here is a read on it : http://www.rsasecurity.com/rsalabs/node.asp?id=2129 ... it 's Public-Key Cryptography Standards 7 ... man , can't go to somesite without looking at the source now ! :-p

[rvturnage]

Also uuh someone pls write a step by step to get to the letter or any discovered hidden clue and pm me ? pls just pm me and confirm with a post here , no need to post the whole thing in this thread.
It's just so I can download some missing files , I might be missing important things there.

supermodel : I appreciate your comment :-) ... please feel free to post whatever remarks you have , hey this is not only programming/maths gurus oriented !! :-p



Manar, I PM'd this to you, but thought I'd post it here too, so others may can look at it...to view the letters go to "joops corner" and "ask joop a question". Ask anything, and your taken to a wierd cell looking graphic, where you have to click between some circles, until finally a red circle shows up. Clicking that circle gives you the first letter. Clicking the sig of that letter gives you another letter.

BUT, before clicking that red circle to view the letters, using the tab key to find clickable areas shows not only clickable areas outlined in yellow, but intersperced are green lines that appear on the screen. I've posted screen grabs of them here (http://www.losttv-forum.com/forum/showpost.php?p=570959&postcount=550)

Also, another thing I noticed, but can't seem to get to work: The newsletter login, after you enter your username and the message comes up with "welcome back" (you have to actually have viewed the newsletter thing before), then "bye bye..." and the screen fades to the shot of Joop. When it fades to Joop, my mouse cursor changes to a finger like there's a clickable area just about dead center of the browser window. It happens quickly, and I've not been able to use the tab key to see it, and I've not been able to actually click it to get it to work.

rvt

[trailgoat]

Am I reading this correctly? There are references to PayPal in the source code of thehansofoundation site? ugh!

[steeeb]

thats the numbers site 4815162342.com (theres a paypal donation button, so im guessing the code was from that and not a clue).

[manar]

Yeah it's just the Paypal buttons , here is a code for you to sell manars' for 100$ ;-) ... just put it everywhere and I'll be rich .


<form action="https://www.paypal.com/cgi-bin/webscr" method="post">
<input type="hidden" name="cmd" value="_s-xclick">
<input type="image" src="https://www.paypal.com/en_US/i/btn/x-click-but23.gif" border="0" name="submit" alt="Make payments with PayPal - it's fast, free and secure!">
<img alt="" border="0" src="https://www.paypal.com/en_US/i/scr/pixel.gif" width="1" height="1">
<input type="hidden" name="encrypted" value="-----BEGIN PKCS7-----MIIHPwYJKoZIhvcNAQcEoIIHMDCCBywCAQExggEwMIIBLAIBAD CBlDCBjjELMAkG
A1UEBhMCVVMxCzAJBgNVBAgTAkNBMRYwFAYDVQQHEw1Nb3VudG FpbiBWaWV
3MRQwEgYDVQQKEwtQYXlQYWwgSW5jLjETMBEGA1UECxQKbGl2Z V9jZXJ0czER
MA8GA1UEAxQIbGl2ZV9hcGkxHDAaBgkqhkiG9w0BCQEWDXJlQH BheXBhbC5jb20
CAQAwDQYJKoZIhvcNAQEBBQAEgYBnH8ZGtkCIxSVWEa/PdjQyVIt7Gf500W5wW
K0bdYY4bBm5qlX/ewZQ2i6sAt4fi72tDOcFnbyo+OispP9+45lNGJQaZz8SD9iQo6 9l
zeGcnhe23fLTVi4jZqGTjZw0uPis1U7gxlQdYW8ut4MqfA2kjv Ji/N/XgSnSFQNc/iq8l
zELMAkGBSsOAwIaBQAwgbwGCSqGSIb3DQEHATAUBggqhkiG9w0 DBwQISpULIV
kUI2OAgZhkmL2VoTq1B3u3YCFKixvQi7jFWz/Po+Bb4GSVzhXGbztCaCikzoWX68L
JavKbLHa77B4JgbDyWR3myRm6/QgEoJzatgOssN/1ZKBmYt2UE26rrCepRb1Dy4u9
RY5UpyybH9hmmmBIKjvcoWxxh1ZOXK7OC3smRNLI9zmNhMtwZ2 iGArY9VXOlRht
FqcHNlP9H9mGPF6xL+qCCA4cwggODMIIC7KADAgECAgEAMA0GC SqGSIb3DQEBB
QUAMIGOMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExFjAUBgN VBAcTDU1v
dW50YWluIFZpZXcxFDASBgNVBAoTC1BheVBhbCBJbmMuMRMwEQ YDVQQLFAps
aXZlX2NlcnRzMREwDwYDVQQDFAhsaXZlX2FwaTEcMBoGCSqGSI b3DQEJARYNcm
VAcGF5cGFsLmNvbTAeFw0wNDAyMTMxMDEzMTVaFw0zNTAyMTMx MDEzMTVaM
IGOMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExFjAUBgNVBAc TDU1vdW50Y
WluIFZpZXcxFDASBgNVBAoTC1BheVBhbCBJbmMuMRMwEQYDVQQ LFApsaXZlX2N
lcnRzMREwDwYDVQQDFAhsaXZlX2FwaTEcMBoGCSqGSIb3DQEJA RYNcmVAcGF5c
GFsLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwUd O3fxEzEtcnI7ZK
ZL412XvZPugoni7i7D7prCe0AtaHTc97CYgm7NsAtJyxNLixmh LV8pyIEaiHXWAh8fP
KW+R017+EmXrr9EaquPmsVvTywAAE1PMNOKqo2kl4Gxiz9zZqI ajOm1fZGWcGS0f
5JQ2kBqNbvbg2/Za+GJ/qwUCAwEAAaOB7jCB6zAdBgNVHQ4EFgQUlp98u8ZvF71ZP
1LXChvsENZklGswgbsGA1UdIwSBszCBsIAUlp98u8ZvF71ZP1L XChvsENZklGuhgZSk
gZEwgY4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1 UEBxMNTW91
bnRhaW4gVmlldzEUMBIGA1UEChMLUGF5UGFsIEluYy4xEzARBg NVBAsUCmxpdmVfY
2VydHMxETAPBgNVBAMUCGxpdmVfYXBpMRwwGgYJKoZIhvcNAQk BFg1yZUBwYXl
wYWwuY29tggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFB QADgYEAgV8
6VpqAWuXvX6Oro4qJ1tYVIT5DgWpE692Ag422H7yRIr/9j/iKG4Thia/Oflx4TdL+IFJ
BAyPK9v6zZNZtBgPBynXb048hsP16l2vi0k5Q2JKiPDsEfBhGI +HnxLXEaUWAcVfCsQ
Fvd2A1sxRr67ip5y2wwBelUecP3AjJ+YcxggGaMIIBlgIBATCB lDCBjjELMAkGA1UEBh
MCVVMxCzAJBgNVBAgTAkNBMRYwFAYDVQQHEw1Nb3VudGFpbiBW aWV3MRQwE
gYDVQQKEwtQYXlQYWwgSW5jLjETMBEGA1UECxQKbGl2ZV9jZXJ 0czERMA8GA1U
EAxQIbGl2ZV9hcGkxHDAaBgkqhkiG9w0BCQEWDXJlQHBheXBhb C5jb20CAQAwCQY
FKw4DAhoFAKBdMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwH AYJKoZIhvcNAQ
kFMQ8XDTA2MDUwNTE4NDI0NFowIwYJKoZIhvcNAQkEMRYEFLuk a32UueYo0krNQ
a14WfM53nJWMA0GCSqGSIb3DQEBAQUABIGAgFxf1RXR0fwCrs2 jKUh64KvUD26a6
v+R45ghb1iLxkDCeZW2gyqEGUP2pic22K8DNMZxFAQLhw12B0X EXP00CIdEusZ/V
RswYqWvKCHsAhj7x40mmFu+lUplzTrHZFQBJNKtvi4InfLzAmg pSuO+ljX9c4x0txtw
nAI2W4T4XGg=-----END PKCS7-----
">
</form>


As for the whois , they're just using this : http://www.registerfly.com/protectfly/index.php

So we still don't know if the mail is just a mistype !! :-/

Now back to thehansofoundation.org I've got stuff to download .

PS : I made a fast search and tehhansofoundation.org is still available ! :D

[ILoveEko]

The Bush video with sound:
http://thelostexperienceclues.blogspot.com/
EDIT
HERE (http://www.coastalamerica.gov/mpeg/learningcenters.mpg)we go! Video with SOUND!
or HERE (http://www.archive.org/details/lrncent2004)!

[manar]

thnx ILE ;

Haha I already had that ??!!! ok people I think I will get this week end off , try to read all the clues , get deeper in this , else I won't know what good stuff I have already !

[A.'.A.'.]

I'll post this here since this is where it struck me.

I think the missing words are a message to someone.

Zambia.
More Soon.
Steevo

Like Zambia is an answer to a question.
More info soon.
Steevo could be the person writing it...or who it is to.

[The_Island]

intersting view point...not much we can do with that tho till we learn more....

[back_gammon]

Also uuh someone pls write a step by step to get to the letter or any discovered hidden clue and pm me ? pls just pm me and confirm with a post here

Done.

[manar]

Thnx , rvturnage and back_gammon your help is much appreciated , it did realy make my lost life easier ;-)

This is not the big update I promised and you'll have to be patient a little for that , I'm presenting here lost swiss knife :

The Lost Dump , your only source for Lost ARG code .
( yeah been taking some marketing courses lately :-p ) .

And yeah ... the link : http://www.likaanet.com/lostdump/

I'm still pondering if website will be open or closed , but people here are granted access , so enjoy :D .

See you soon and keep talking people .

[steeeb]

wow, great work!

[ILoveEko]

manar, I wanna thank you again for putting all those images, videos, flash, etc. in one place. It will be a great resource. :)

[2fingers]

awesome now my girlfriend won't keep saying why do you have this folder called hanso with pages of gibberish all in it.

[lostscape]

Posted here http://thelostexperienceclues.blogspot.com/

Apparently Andy reverse engineered the Hanso site and determined that most of the input areas are not activated at this time. Here is the post:


Now for Clue #23...From Andy:

"I've reverse engineered all of the shockwave files and extracted code
from them...and, I have bad news.

NONE of the login-boxes are functional. Neither is the text-box on the Mental outreach page. The code for all of these boxes only look at what you type to make sure it's more than 1 character per field, and then automatically runs a failed message (varying depending on the instance - on the exec-login it will display that your login is incorrect; the others will give a form of network-timeout message).

The ONLY place in the entire site where it actually checks what you type in is the Newsletter page, and as of now, we've seen all it has to offer. If it's your first time, it will run the persephone sequence, and subsequent visits to the page will bring you to the "No new messages" screen. There is no case in which it will display anything but those.

So...basically until the site is updated, there is nothing more we can see on the main TheHansoFoundation.org page.

There is one thing I have learned however: in the source for the letters section, they reference the red text that is printed "The Hanso Foundation, setting world speed records for subverting authority." with
the name "rachel." This could mean that we will see the name rachel pop up sometime in the future, either as Persephone's real name or another hacker of the site. I encourage everyone therefore to keep an eye out for the name Rachel on Lost."

-Andy

[2fingers]

and he is correct the logins just check to make sure there is atleast 2 things entered

frame 1 {
function submitclicked(theMC) {
if (password.text.length < 2 || login.text.length < 2) {
return undefined;
}
form.gotoAndPlay('process');
endTime = getTimer() + random(2000) + 500;
onEnterFrame = process;
}

function process() {
if (getTimer() > endTime) {
form.gotoAndPlay('unknown');
onEnterFrame = null;
}
}

function closeAgain() {
endTime = getTimer() + random(500) + 1000;
onEnterFrame = waitbeforeClose;
}

function waitbeforeClose() {
if (getTimer() > endTime) {
form.gotoAndPlay('unknown_outro');
onEnterFrame = null;
password.text = '';
login.text = '';
}
}

this shows it has to be atleast 2 characters long then it willgo to the process function which just makes a movie clip play for a random amount of time if it is less than 2 it does nothing. So he was pretty much right but just wrong in the fact that it has to be 2 characters or greater. It's all in the details

[2fingers]

ok i just read in the uk thread that the channel 4 site has added something about hanso on it:

hi :D
i just noticed something new on the UK Lost site that was not there before ...there is a section called The Untold in it they have added a scrap of paper amongst the debris from the crash and it is headed The Hanso Foundation and logo :D :D

this was definiteley added very recently ....
the name Dr Roderick i think is readable but i am at work on crappy comp cannot even print screen

www.channel4.com/lost (http://www.channel4.com/lost) and click on the untold

ETA: i think it might be one of the letters off of the hanso site will go and check ...
what are they trying to say that the recipient of this letter is on the island ??

Time to get to work on the channel 4 site? I'm not sure the legality of that though.

this is the letter they are talking about I have never viseted this site prior so i don't know if its new or not.

http://i78.photobucket.com/albums/j109/DosFingers/Image_11.jpg

http://i78.photobucket.com/albums/j109/DosFingers/Image_11.png

[polyonymous]

have there been any unused pictures or anything lying around in the flash files? ive heard talk about some older white haired guy with glasses in there somewhere...

[manar]

and he is correct the logins just check to make sure there is atleast 2 things entered

frame 1 {
function submitclicked(theMC) {
if (password.text.length < 2 || login.text.length < 2) {
return undefined;
}
form.gotoAndPlay('process');
endTime = getTimer() + random(2000) + 500;
onEnterFrame = process;
}

function process() {
if (getTimer() > endTime) {
form.gotoAndPlay('unknown');
onEnterFrame = null;
}
}

function closeAgain() {
endTime = getTimer() + random(500) + 1000;
onEnterFrame = waitbeforeClose;
}

function waitbeforeClose() {
if (getTimer() > endTime) {
form.gotoAndPlay('unknown_outro');
onEnterFrame = null;
password.text = '';
login.text = '';
}
}

this shows it has to be atleast 2 characters long then it willgo to the process function which just makes a movie clip play for a random amount of time if it is less than 2 it does nothing. So he was pretty much right but just wrong in the fact that it has to be 2 characters or greater. It's all in the details

First of all let me state , this already had been discussed here , look in page 7 or around , maybe not thoroughly , so let me explain what I found so far in my side .

As for the above code :


form.gotoAndPlay('process');
endTime = getTimer() + random(2000) + 500;
onEnterFrame = process;


this here sets a time-out for the login process , it goes then to a frame called ('process') could be a swf file too and "processes" the user input .


function waitbeforeClose() {
if (getTimer() > endTime) {
form.gotoAndPlay('unknown_outro');
onEnterFrame = null;
password.text = '';
login.text = '';
}


now , if the time-out has been reached , we play another movie ( probably the animation you get on bad login ) and then we reset the pass and login .

This is what we call an "asynchronous call" , the application issues a command but don't hang there waiting for a response , instead any changes or checking to be done will be done in the "process" movie .

So it doesn't look like a useless function at first glance . Now let me also explain what I have been getting all this time while trying to DOWNLOAD the website through a web crawler :


http://www.thehansofoundation.org/swf/backgrounds/begin.swf
http://www.thehansofoundation.org/board.swf
http://www.thehansofoundation.org/posthacked.swf
http://www.thehansofoundation.org/allVisible.swf
http://www.thehansofoundation.org/swf/extra/park.swf
http://www.thehansofoundation.org/swf/extra/masking.swf
http://www.thehansofoundation.org/swf/extra/begin.swf
http://www.thehansofoundation.org/swf/extra/end.swf
http://www.thehansofoundation.org/swf/extra/final.swf
http://www.thehansofoundation.org/swf/extra/five.swf
http://www.thehansofoundation.org/swf/extra/four.swf
http://www.thehansofoundation.org/swf/extra/one.swf
http://www.thehansofoundation.org/swf/extra/start.swf
http://www.thehansofoundation.org/swf/extra/step_1.swf
http://www.thehansofoundation.org/swf/extra/step_2.swf
http://www.thehansofoundation.org/swf/extra/step_3.swf
http://www.thehansofoundation.org/swf/extra/canyoureadthis.swf
http://www.thehansofoundation.org/lemer.swf
http://www.thehansofoundation.org/mcintyre.swf
http://www.thehansofoundation.org/nonetwork.swf (http://www.thehansofoundation.org/nonetwork.swf)
http://www.thehansofoundation.org/nonetwork_outro.swf (http://www.thehansofoundation.org/nonetwork_outro.swf)
http://www.thehansofoundation.org/about.swf
http://www.thehansofoundation.org/joop.swf
http://www.thehansofoundation.org/active.swf
http://www.thehansofoundation.org/collapse.swf
http://www.thehansofoundation.org/swf/extra/three.swf
http://www.thehansofoundation.org/swf/extra/two.swf
http://www.thehansofoundation.org/expand.swf
http://www.thehansofoundation.org/inactive.swf
http://www.thehansofoundation.org/O_1.swf
http://www.thehansofoundation.org/O_2.swf
http://www.thehansofoundation.org/js/
http://www.thehansofoundation.org/O_3.swf
http://www.thehansofoundation.org/O_4.swf
http://www.thehansofoundation.org/swf/extra/console.swf
http://www.thehansofoundation.org/swf/extra/gottago.swf
http://www.thehansofoundation.org/swf/extra/outro.swf
http://www.thehansofoundation.org/swf/extra/userinput.swf (http://www.thehansofoundation.org/swf/extra/userinput.swf)
http://www.thehansofoundation.org/swf/backgrounds/stage_3.swf
http://www.thehansofoundation.org/press/05_05_06.pdf
http://www.thehansofoundation.org/site_background.jpg
http://www.thehansofoundation.org/static.swf
http://www.thehansofoundation.org/executives.swf
http://www.thehansofoundation.org/hide.swf
http://www.thehansofoundation.org/process.swf (http://www.thehansofoundation.org/process.swf)
http://www.thehansofoundation.org/show.swf
http://www.thehansofoundation.org/unknown.swf (http://www.thehansofoundation.org/unknown.swf)
http://www.thehansofoundation.org/unknown_outro.swf (http://www.thehansofoundation.org/unknown_outro.swf)
http://www.thehansofoundation.org/vanderfield.swf
http://www.thehansofoundation.org/end.swf
http://www.thehansofoundation.org/freak.swf
http://www.thehansofoundation.org/loading.swf
http://www.thehansofoundation.org/loop.swf
http://www.thehansofoundation.org/off.swf
http://www.thehansofoundation.org/on.swf
http://www.thehansofoundation.org/start.swf
http://www.thehansofoundation.org/step1.swf
http://www.thehansofoundation.org/mittlewerk.swf
http://www.thehansofoundation.org/openpanel.swf
http://www.thehansofoundation.org/webcam.swf
http://www.thehansofoundation.org/onDataAvailable.swf
http://www.thehansofoundation.org/outro.swf
http://www.thehansofoundation.org/startLogoIntro.swf
http://www.thehansofoundation.org/startSite.swf
http://www.thehansofoundation.org/Type_1.swf
http://www.thehansofoundation.org/Type_2.swf
http://www.thehansofoundation.org/Type_3.swf
http://www.thehansofoundation.org/video/hansoiswatchingyou.flv
http://www.thehansofoundation.org/hanso.swf
http://www.thehansofoundation.org/swf/backgrounds/end.swf
http://www.thehansofoundation.org/swf/backgrounds/satge_4.swf
http://www.thehansofoundation.org/swf/backgrounds/stage_1.swf
http://www.thehansofoundation.org/fadeout.swf
http://www.thehansofoundation.org/go.swf
http://www.thehansofoundation.org/out.swf
http://www.thehansofoundation.org/over.swf
http://www.thehansofoundation.org/press/
http://www.thehansofoundation.org/video/
http://www.thehansofoundation.org/begin.swf


I bolded the relevant bits for our problem here ( though look at the other fancy names there ;-) ) you can see there a file process.swf there . These are files the crawler can sense are there but can't download ! here is an example of what I get :


[30] request for www.thehansofoundation.org/swf/extra/canyoureadthis.swf (http://www.thehansofoundation.org/swf/extra/canyoureadthis.swf):
<<< GET /swf/extra/canyoureadthis.swf HTTP/1.1
<<< Connection: Keep-Alive
<<< Host: www.thehansofoundation.org (http://www.thehansofoundation.org)
<<< User-Agent: Mozilla/4.5 (compatible; MSIE 4.01; Windows 98)
<<< Accept: image/png, image/jpeg, image/pjpeg, image/x-xbitmap, image/svg+xml, image/gif;q=0.9, */*;q=0.1
<<< Accept-Language: en, en, *
<<< Accept-Charset: iso-8859-1, iso-8859-*;q=0.9, utf-8;q=0.66, *;q=0.33
<<< Accept-Encoding: gzip, identity;q=0.9

[30] response for www.thehansofoundation.org/swf/extra/canyoureadthis.swf (http://www.thehansofoundation.org/swf/extra/canyoureadthis.swf):
code=404
>>> HTTP/1.1 404 Not Found
>>> Date: Sun, 07 May 2006 02:13:57 GMT
>>> Server: Apache/2.0.52 (Red Hat)
>>> Content-Length: 319
>>> Connection: close
>>> Content-Type: text/html; charset=iso-8859-1


So what's the problem ? well let me explain , many people think by decompiling the swf we get the whole stuff in our hands , wich is not really true , many parts of the code remains obfuscated , ie : the GetUrl command is crypted in an swf file and is very difficult to find even after decompiling , so sometimes we are left to interpret how the whole thing works and that's the tough part actually .

So I looked for the thf host and it's : mediatemple.net , wich happens to be a ColdFusion servers hoster , coldfusion is ( for history ) a product by macromedia just like flash , it integrates perfectely with it and is used between other things to serve streamlined responses , my thought ? the ghost files ;-) .

So in conclusion I do think there is a functional login form synchronizing with a server ( probably a CF server ) and as in my response to penelope somewhere in this thread , we won't get login/pass if the developpers don't want us to , we might find tidbits and text that might be usefull to break in but the login form in itself is secured by the developpers and I can understand why !!! ;-)

Side Note : since there is a "hacker" (persephone ?) , I just wanted to tell that usually you don't hack through a login form !!!! :-p ... so if there IS a hack to the website it will probably be a backdoor , just so you guys try other ideas , I've been trying to establish a connection through telnet and even trying login to the HTF ftp ( mind you guys , nothing illegal just putting in there any login/pass you come with in other threads ) but still got nothing , didn't put my heart in it though so still a path .

Now as for the second point , the Lost The Untold update with the hanso paper was done on may 3rd , a day after the hanso press release in the channel4 website , I wrote on it , probably in the Hanso thread ( since it's a point of gathering :-p ) but it looks like many people here think LTU and LE are unrelated , I do have my own opinion and it's the opposite to that , even if LTU has been inaccurate in the past it's still there and updating with hanso material . I have been monitoring that site all along , but due to lack of time I couldn't look deeper in it ( btw it had a place holder in the "The Lost Dump" since the beginning , so don't worry I'll put something there :-) ) . So anyone to help with this ? 2fingers ? :-p

Ok I must go now , I have to work on the company intranet ( 1st deadline tomorrow :-/ ) , probably I will make only a mass response post today if you guys/girls have questions , so see ya and keep the good thinking .

[2fingers]

That whole post was mostly to explain that it had to be 2 characters in the login and p/w boxes not 1 for it to do anything. I will help as much as I can of course.

[PandoraX]

Hey techie guys...

chaz pointed out in the medical thread that when you look at the pictures of the petri dish like items, and press the tab key a few times:

http://i49.photobucket.com/albums/f278/ceciliaxchen/hansoscreencap.jpg

It puts a yellow box around all the balls (colonies?) and you can toggle through all of them, top to bottom (only one is shown above).

I thought this was just a technical web design issue, and not of any huge significance. I've noticed you can do the same thing on any web page, including this one (tab through all the graphics). I'm just wondering, am I right about that, and is there a reason the tab key is designed to do that?

Thanks.

[killbuckner]

manar- did you ever check on the code for the little invisible box that sits to the lower left of the background? When you press it on the main page it just rotates the background shapes but it would be nice to know if doing that sets any sort of variable or if there is potentially any other functionality that goes along with that button.

[cyb]

I've just found that too :) that's cool, may be there is a sort of combination to do...

[rvturnage]

Hey techie guys...

chaz pointed out in the medical thread that when you look at the pictures of the petri dish like items, and press the tab key a few times:

http://i49.photobucket.com/albums/f278/ceciliaxchen/hansoscreencap.jpg

It puts a yellow box around all the balls (colonies?) and you can toggle through all of them, top to bottom (only one is shown above).

I thought this was just a technical web design issue, and not of any huge significance. I've noticed you can do the same thing on any web page, including this one (tab through all the graphics). I'm just wondering, am I right about that, and is there a reason the tab key is designed to do that?

Thanks.

Its not of any huge significance in that it's the nature of flash itself. Tabbing just bounces to the next clickable area of a flash movie. BUT, I'm surprised Chaz didn't notice the green lines that appear as you tab through. THOSE appear to be part of the petri movie itself, not just a function of flash like the yellow boxes. They are glowing and semi transparent, just like the blue lines that connect the "balls". I've posted on it a couple of time justhere, the lines as they appear when tabbing (http://www.losttv-forum.com/forum/showpost.php?p=570959&postcount=550) and here with all the "balls" & connecting lines shown (http://www.losttv-forum.com/forum/showpost.php?p=575948&postcount=811)

I've asked Manar to look into those lines, to see what's up with them...

rvt

[PandoraX]

Thanks rvt, that's interesting about the lines! Sorry I missed those posts when you talked about this before....

[2fingers]

Its not of any huge significance in that it's the nature of flash itself. Tabbing just bounces to the next clickable area of a flash movie. BUT, I'm surprised Chaz didn't notice the green lines that appear as you tab through. THOSE appear to be part of the petri movie itself, not just a function of flash like the yellow boxes. They are glowing and semi transparent, just like the blue lines that connect the "balls". I've posted on it a couple of time justhere, the lines as they appear when tabbing (http://www.losttv-forum.com/forum/showpost.php?p=570959&postcount=550) and here with all the "balls" & connecting lines shown (http://www.losttv-forum.com/forum/showpost.php?p=575948&postcount=811)

I've asked Manar to look into those lines, to see what's up with them...

rvt

for some reason when you tab you get an outline of the masks used to hide the line between the two circles. They are the same color and size in the movie. When you click both circles the mask morphs giving and illusion of the line being drawn between the two circles.

[rvturnage]

for some reason when you tab you get an outline of the masks used to hide the line between the two circles. They are the same color and size in the movie. When you click both circles the mask morphs giving and illusion of the line being drawn between the two circles.

Are you saying that's what the green lines are, the mask used to hide the lines?

But why don't the green lines line up with any of the blue lines between the 2 circles? And why a green square?

click here (http://www.losttv-forum.com/forum/attachment.php?attachmentid=1143&d=1146851601) for a shot with the green lines and all of the circles shown.

rvt

[duality]

FYI... content_execbios.swf has been modified in the last few minutes.

[2fingers]

the boxes look like these http://i78.photobucket.com/albums/j109/DosFingers/joop2mask.jpg
http://i78.photobucket.com/albums/j109/DosFingers/anothermask.jpg

i don't get the green lines no matter how much i tab

[2fingers]

what changed on exec bios

[duality]

You can now click on the date on Hanso's bio and it does some wild stuff. Keep clicking through to see it all.

[2fingers]

then after his bio has the scribbles over it like joops

[manar]

FYI... content_execbios.swf has been modified in the last few minutes.

thnx duality , I was looking at the old execbios right now , I will be looking at the new one asap .

Edit : On first glance there are other new files there , I will be checking

[2fingers]

newsletterinfo.swf is new bntgff.swf is the one played when you click the date

[manar]

newsletterinfo.swf is new

2 file updates and 1 new file , uuh newsletterinfo has the same crc than the old one so I'm not sure it's new

[2fingers]

I got a new crc? but it looks the same, Nevermind looking at something else

[manar]

btw : in the new config file I have this line :

<!-- last edited by darwin@darma -->

wich WAS NOT there in the old config ... might be nothing , but still ...

[SeanDude05]

darma spelled wrong? mean anything?

[manar]

So anyone went to see in the hanso site ... from here ... I didn't , but it looks like there is a new animation , a big one if reffered by size :-) .. I got this from source of new file :


function afternoticed()
{
} // End of the function
var myField;
var mytxt;
var mytextInterval;
var feedindex;
var myCallback;
thistext = "Notice the grainy far away picture?";
writetoField(persephoneField, thistext, 35, afternoticed);
// [Action in Frame 6]
stop ();
// [Action in Frame 7]

function aftermatch()
{
} // End of the function
thistext = "It doesn\'t match anyone else?";
writetoField(persephoneField, thistext, 10, aftermatch);
// [Action in Frame 8]
stop ();


so if you notice this text tell me !

[duality]

content_homepage.swf has been updated too.

[SeanDude05]

Click on the Date underneath Hanso's picture in Exec Bios.

[manar]

also this one :


var myCallback;
thetext = "PERSEPHONE:}}}}}} THIS IS THE LAST RECORD I FOUND OF ANY PUBLIC APPEARANCE OF ALVAR HANSO}}}\nTHE MAN HASN’T BEEN SEEN IN PUBLIC SINCE 2002!!!}}";
writetoField(persephonefield, thetext, 5, afterpublicappearance);


people if I'm just repeating stuff you already got by surfin THF ... tell me !

[killbuckner]

manar- if you click on the date on the exec bios page a whole long sequence pops up with all the text you are talking about. there is a big map where a white line jumps between all of his travel locations and afterwards a morse code message plays.

[manar]

also got a pic wich shows only date :

http://freejobs.free.fr/LostARG/parisdate.jpg

ok this is just preliminary decompiling , we might get more ... my dish is f****d up , I must look at that :-p

[SeanDude05]

Yep, that pic is on the site. Just click on the october 28, 2003 date which is now a link underneath Hanso's picture on executive bios page. And continue through it...

[steeeb]

Changed Files

www.thehansofoundation.org/swf/extra/Joop_2.swf - Changed "rachel" field to "text"
www.thehansofoundation.org/swf/extra/bntgff.swf - The morse code
www.thehansofoundation.org/feed/thehansofoundation.xml
www.thehansofoundation.org/content_execbios.swf - The date is clickable
www.thehansofoundation.org/content_homepage.swf - Fixed "our our" typo

[manar]

thnx steeb ...

don't forget change in www.thehansofoundation.org/config.xml (http://www.thehansofoundation.org/config.xml) as I said with new text : <!-- last edited by darwin@darma -->

I'm updating with the animations from bntgff :

http://freejobs.free.fr/LostARG/streamvideo0.flv
http://freejobs.free.fr/LostARG/streamvideo1.flv
http://freejobs.free.fr/LostARG/streamvideo2.flv

PS : Damn that dish is killing me ... now it really found the best moment to get down on me :-S

[manar]

ok probably my last update of the day , just in case , here are all the dates and text in the animation plus the animation itself :

http://freejobs.free.fr/LostARG/alvartravel_date1 http://freejobs.free.fr/LostARG/alvartravel_date2 http://freejobs.free.fr/LostARG/alvartravel_date3 http://freejobs.free.fr/LostARG/alvartravel_date4 http://freejobs.free.fr/LostARG/alvartravel_date5


the flashing text :

http://freejobs.free.fr/LostARG/alvartravel_flashingtext1

http://freejobs.free.fr/LostARG/alvartravel_flashingtext2

http://freejobs.free.fr/LostARG/alvartravel_flashingtext3

http://freejobs.free.fr/LostARG/alvartravel_flashingtext4

and the animation itself ... I hope it works for you (it does here) :

http://freejobs.free.fr/LostARG/alvartravel.swf << this is not the original name !!

btw I missed the morse code ! where does that show ? I've been in THF.org and don't see where to get it .

ah also I forgot to mention this in previous thread , steeb : they did indeed correct some typos , but the mittelwerk email adress is still there !!! with the same "typo" : mittlewerk@hansofoundation.org

Regards , Manar

[rvturnage]

the boxes look like these http://i78.photobucket.com/albums/j109/DosFingers/joop2mask.jpg
http://i78.photobucket.com/albums/j109/DosFingers/anothermask.jpg

i don't get the green lines no matter how much i tab

That is so bizarre...i've got the green lines shown in my screen caps on two different computers...a Mac at work and a PC at home. Click through the circles like your going to view the letters. But when the read circle appears, instead of clicking it, begin tabbing. It takes a while for the tabs to start showing up in the clickable areas, but once it does, about 3 tabs after the big yellow box around the whole image the first green line appears. tabbing through shows the other line and the green rectangle....perhaps it's a glitch.

Also, if you'll notice in my screen cap, the green masks from your screen caps don't match the location/direction the lines & rectangle run...weird...is anyone else able to tab and get those green lines?

rvt

PS Thanks for looking into it, 2Fingers!

[duality]

btw I missed the morse code ! where does that show ? I've been in THF.org and don't see where to get it .


Then the flashing "Who is running this place" etc. text comes up, leave it on that screen without clicking for about a minute and the blinking morse code will come up.

duality

[TheKurgan]

... .- ..-. . --.

dot dot dot - dot dash - dot dot dash dot - dot - dash dash dot

translated : safeg

[2fingers]

That is so bizarre...i've got the green lines shown in my screen caps on two different computers...a Mac at work and a PC at home. Click through the circles like your going to view the letters. But when the read circle appears, instead of clicking it, begin tabbing. It takes a while for the tabs to start showing up in the clickable areas, but once it does, about 3 tabs after the big yellow box around the whole image the first green line appears. tabbing through shows the other line and the green rectangle....perhaps it's a glitch.

Also, if you'll notice in my screen cap, the green masks from your screen caps don't match the location/direction the lines & rectangle run...weird...is anyone else able to tab and get those green lines?

rvt

PS Thanks for looking into it, 2Fingers!

those were just the shapes they drew for something to be there during the building of the animation. Even at the begining they were probably scewed the fact that they got them even that remotly close just for the shape is admirable. I used to use orange boxes just to offset them from the rest of the animation they would be pretty much the whole screen size until I scewed them to where i wanted maybe i am just lazy. Just looking at your screen caps again and that would probably be exactly where i set the maskes up for the lines you have to remember they only mask out the line connecting the circles everything else will show through and for a simple morph animation those boxes are set up perfectly!!

Why do the updates happen at like 4 p.m. when i have to go to work at 4:30 knowing i am going to work until 3 a.m. this game is biased against bartenders

[2fingers]

I don't know if anyone else caught this but one of the 12 buttons in the bntgff.swf is called my button and it goes and plays "ending" instead of "end" like the rest. my crappy decompiler dosen't mark frame markers for me so i don't know if the other ones are just sending it to the end marker or to a swf called end? If it is to a diffrent.swf that would be a big hidden button

[2fingers]

and for my last post of the night of trivial nonsense there is the beeping sound on frame 1,7,15,28,34 (longer),49,55,61,69,81,105,114 (longer), and 123. But once again my decompiler dosen't tell me the FPS the movie is playing.

[manar]

funny thing you mention the buttons , I was gonna talk about that , I counted 11 in my side , must have passed through the 12th ... I'll look later . if you can specify what's the code maybe I can look in it , what surprised me was their number , but it was 01h00 am , so ... :-p

[2fingers]

have there been any unused pictures or anything lying around in the flash files? ive heard talk about some older white haired guy with glasses in there somewhere...

i have seen those posts. i saw one over at the numbers thread. i have yet to find this picture in anything i have decompiled or looking through manars dump. Needless to say i have been slack do to work and school and such but i think it was a hoax for some guy to feel special. Or i could just be stupid and be missing it. Probably the latter

[2fingers]

I counted 11 also seeing the 12 in the decompile had me wondering.

// Button actions...

on (release)
{
_parent.gotoAndPlay("ending");
}

all the other buttons read as such

// Button actions...

on (release)
{
_parent.play();
gotoAndStop("end");
}

or

on (release)
{
_parent.play()

then one is

// Button actions...

on (release)
{
_parent.gotoAndPlay("outro");

why do you need an ending and an outro ? It just kind of dumps you back at the exec bios page anyways after the ending or outro or whatever

and if you notice some of the lines between the dates are buttons also atleast they make a hand appear when you hover over them. Not clickable though

[manar]

Ok this I posted in Hanso Thread again it was pretty ignored ... some people there (not all) have this feeling we're a bunch of lil' punk l33t h@xorz using malevolent methods to spoil their fun ... I will spare you the rant . as I said somewhere I'll take one or two weeks off so I can get back my zenitude ;-)

Btw this is really not reverse engeneering , and does not belong here , it's more like some hours of photoshoping and I'm putting it for what it matters , as always we're not searching for the BIG clue only , I doubt we will be publishing the pass/login any soon so don't freak out !!! :-p

http://freejobs.free.fr/LostARG/travelcomplete.jpg

The lines represent alvar flight travels from animation , I left the black background for contrast matters , if you put the european map below it will match .

Now for my explanation :

Green : it looks like the travel is :

- London 14.06.2000
- Copenhagen 12.11.2000
- Somewhere in the north ( Sweden , Norway , Arctic ? )
- Copenhagen 01.01.2001 ( from somewhere in north , what was alvar's nationality already ? )
- Paris 23.02.2001 ( I have my doubts on this ... paris has only one line maybe he returned through the eurotunnel to london )
- Geneva 12.07.2001 ( from copenhagen again )
- Roma 18.09.2001
- Copenhagen ( date ??? )
- Madrid 01.01.2002

Anyone , to make a better timeframe , you can go around the animation and look where the flight lines take you .

Red : this is not much , just a flaying banner , it reads paris 23.02.2001 (maybe he didn't go to paris through copenhagen after all or maybe it's just the developpers working hastily ) the banner flies south-east in direction of paris.

Well that's it for now ... :-)


Regards , Manar

PS : 2fingers , I would like to thank you very much for your work here , I'm very glad to have someone with your abilities and atention look in the code with me , let's cheer for a long ride ! :-p

[LAN]

Ok this I posted in Hanso Thread again it was pretty ignored ... some people there (not all) have this feeling we're a bunch of lil' punk l33t h@xorz using malevolent methods to spoil their fun ... I will spare you the rant . as I said somewhere I'll take one or two weeks off so I can get back my zenitude ;-)


Manar, gotta switch to decaf bruddah. :)

Your work is definitely not ignored. There are a few people who would prefer you to post your findings in here, so in order to try and keep everyone happy, you have started to do just that.

First of all, i am not under the impression that as a group we are against you or anything. In fact, there isn't even a we... "We" (including you) are just a loosely bundled group of people that are watching and realaying different types of information. There is hardly any "group think" mentality in terms of politics around here, as far as i can see. Once again, i know in the beginning a few people were hesitant to have you force open the web sites, but this is not an us against them thing at all.

So far, i think you and the rest of the reverse engineering group have verified quite a few things that other people have been working on and I think it has worked pretty complimentary.

As far as the lack of "response" to your ALvar hanso map information....in this case its only becuz most of this stuff had already been discovered by watching the video on the website. So in my opinion, this stuff was not new. The image you found with "paris" on it, that however was new, but it seemed like you were still in the process of figuring out what was going on with that.

Anyways, hope this email sheds new light on everyone's frame of reference. Now go back to your "l33t h@xor" bat cave and get us some goodies!

LAN

[The_Island]

Manar, gotta switch to decaf bruddah. :)

Your work is definitely not ignored. There are a few people who would prefer you to post your findings in here, so in order to try and keep everyone happy, you have started to do just that.

First of all, i am not under the impression that as a group we are against you or anything. In fact, there isn't even a we... "We" (including you) are just a loosely bundled group of people that are watching and realaying different types of information. There is hardly any "group think" mentality, as far as i can see. Once again, i know in the beginning a few people were hesitant to have you force open the web sites, but this is not an us against them thing at all.

So far, i think you and the rest of the reverse engineering group have verified quite a few things that other people have been working on and I think it has worked pretty complimentary.

As far as the lack of "response" to your ALvar hanso map information....in this case its only becuz most of this stuff had already been discovered by watching the video on the website. So in my opinion, this stuff was not new. The image you found with "paris" on it, that however was new, but it seemed like you were still in the process of figuring out what was going on with that.

Anyways, hope this email sheds new light on everyone's frame of reference. Now go back to your "l33t h@xor" bat cave and get us some goodies!

LAN
:yeah:

[manar]

Lostagain : very kind of you and ... I don't drink cafe bruddah ! :-p

I've been working on that map for a few hours so you know how it is and how you feel when you only get for response 'I don't understand a s***of your map' and 'this is a lure you newbie' ... and in the other hand I worked on this mostly using photoshop so it belongs more to the hanso than to the RE thread ( I really don't know what we're going to do with this here ;-)

As for the usefullness of the map ; now IMHO , It's the only map that shows the whole locations (as in the movie they're blinking asynchronously) , it was the only one at that time that shown there was sometimes a return ticket and sometimes not and finally it was a map to base on to construct a valid timeline ( since what I read from the others posts looked inaccurate ) ... and yeah it showed clearly that alvar went north ... I wanted that debated ; if only that !

But in the other side ... it's not your fault nor TI's , not even truff's maybe , so ok I just need to be a little more zen in the future :pray: .

And I'm back to my bat cave , LOL

[rottenralf]

Manar & 2fingers & others - I truly appreciate all your work and effort. I don't comment much in here because I only understand about every fifth word. I think most feel this is an important team, everytime a new graphic comes up you are the "go to" team everyone suggests. Keep up the good work.

[duality]

I've thrown together a little program which goes out to a list of URLs on an interval and brings back the content and creates an MD5 hash and compares it to the previous MD5 hash to see if the content has changed. So I was wondering if there is a list somewhere of all of the URLs I should be pointing to for the content of thehansofoundation.org. I think I have most of them, based on the contents of config.xml etc. Any help would be appreciated.

duality

[2fingers]

PS : 2fingers , I would like to thank you very much for your work here , I'm very glad to have someone with your abilities and atention look in the code with me , let's cheer for a long ride ! :-p

No problem man. Maybe if I wasn't sauced everytime I looked at the stuff I would get something done :).

Ok this I posted in Hanso Thread again it was pretty ignored ... some people there (not all) have this feeling we're a bunch of lil' punk l33t h@xorz using malevolent methods to spoil their fun ... I will spare you the rant .

dude if I was a l33t h@x0rz I would get paid much better!
P.S. Cheers Man

[2fingers]

Lostagain : very kind of you and ... I don't drink cafe bruddah ! :-p

I've been working on that map for a few hours so you know how it is and how you feel when you only get for response 'I don't understand a s***of your map' and 'this is a lure you newbie' ... and in the other hand I worked on this mostly using photoshop so it belongs more to the hanso than to the RE thread ( I really don't know what we're going to do with this here ;-)

As for the usefullness of the map ; now IMHO , It's the only map that shows the whole locations (as in the movie they're blinking asynchronously) , it was the only one at that time that shown there was sometimes a return ticket and sometimes not and finally it was a map to base on to construct a valid timeline ( since what I read from the others posts looked inaccurate ) ... and yeah it showed clearly that alvar went north ... I wanted that debated ; if only that !

But in the other side ... it's not your fault nor TI's , not even truff's maybe , so ok I just need to be a little more zen in the future :pray: .

And I'm back to my bat cave , LOL

You know you got to let the other people play with the pretty pictures. Now you get back to staring at code like a good boy ;)

[manar]

2fingers : LOL

duality : now that's interesting , does it do batch processing ? I can give a list of files , they are mostly those in config.xml but not all are there ; some are inside the swf . I also would like to do an md5 on the ghost files I've been talking about see if they do change too .

rottenralf : Man !! now I'd be honored to have you posting here ; maybe something like : For A Fistfull Of Fingers ? :D , as for the code we're here to help for what ever you might need .

Well here is the zenitude coming back :-D ... keep up the good work people.

[2fingers]

Manar what Decompiler do you use I'm using Flash Decompiler 2.90 and Getting the flash files the old shool way through my temp internet files :compwoes:

[manar]

sothink decompiler 3.0 I think + offline explorer or httrack for site download :-)

[duality]

duality : now that's interesting , does it do batch processing ? I can give a list of files , they are mostly those in config.xml but not all are there ; some are inside the swf . I also would like to do an md5 on the ghost files I've been talking about see if they do change too .


Yes it takes a list of URLs and has a last updated date/time and MD5 hash associated with them. If the MD5 changes, it updates the last updated date/time and the MD5 and notifies me that something changed. These are the URLs I'm currently scanning for changes:

persephone.thehansofoundation.org
www.thehansofoundation.org/config.xml (http://www.thehansofoundation.org/config.xml)
www.thehansofoundation.org/swf/backgrounds/site_background.swf (http://www.thehansofoundation.org/swf/backgrounds/site_background.swf)
www.thehansofoundation.org/intro.swf (http://www.thehansofoundation.org/intro.swf)
www.thehansofoundation.org/content_homepage.swf (http://www.thehansofoundation.org/content_homepage.swf)
www.thehansofoundation.org/content_mission.swf (http://www.thehansofoundation.org/content_mission.swf)
www.thehansofoundation.org/content_execbios.swf (http://www.thehansofoundation.org/content_execbios.swf)
www.thehansofoundation.org/content_joop.swf (http://www.thehansofoundation.org/content_joop.swf)
www.thehansofoundation.org/content_newsletter.swf (http://www.thehansofoundation.org/content_newsletter.swf)
www.thehansofoundation.org/content_tvad.swf (http://www.thehansofoundation.org/content_tvad.swf)
www.thehansofoundation.org/content_contact.swf (http://www.thehansofoundation.org/content_contact.swf)
www.thehansofoundation.org/content_maths.swf (http://www.thehansofoundation.org/content_maths.swf)
www.thehansofoundation.org/content_wellness.swf (http://www.thehansofoundation.org/content_wellness.swf)
www.thehansofoundation.org/content_outreach.swf (http://www.thehansofoundation.org/content_outreach.swf)
www.thehansofoundation.org/content_magnetic.swf (http://www.thehansofoundation.org/content_magnetic.swf)
www.thehansofoundation.org/content_genomic.swf (http://www.thehansofoundation.org/content_genomic.swf)
www.thehansofoundation.org/content_extension.swf (http://www.thehansofoundation.org/content_extension.swf)
www.thehansofoundation.org/video/thehansofoundationPSA_version8.flv (http://www.thehansofoundation.org/video/thehansofoundationPSA_version8.flv)
www.thehansofoundation.org/hanso.swf (http://www.thehansofoundation.org/hanso.swf)
www.thehansofoundation.org (http://www.thehansofoundation.org)
www.thehansofoundation.org/feed/thehansofoundation.xml (http://www.thehansofoundation.org/feed/thehansofoundation.xml)
www.thehansofoundation.org/swf/extra/Joop_2.swf (http://www.thehansofoundation.org/swf/extra/Joop_2.swf)
www.thehansofoundation.org/swf/extra/bntgff.swf (http://www.thehansofoundation.org/swf/extra/bntgff.swf)
www.thehansofoundation.org/js/flashobject.js (http://www.thehansofoundation.org/js/flashobject.js)
www.thehansofoundation.org/js/browserfunctions.js (http://www.thehansofoundation.org/js/browserfunctions.js)
www.thehansofoundation.org/css/main.css (http://www.thehansofoundation.org/css/main.css)

[Batman Laz0r]

And I'm back to my bat cave , LOL

Hey! Get outta my batcave! ;) (j/k!)

But don't worry if you felt your work was ignored - I know that people haven't responded to a number of the posts I've made, and probably everyone's had that experience. That can happen if there's a lot of posting going on. As well, it could just be the case that people just didn't have anything to really respond to it with. I know for myself that I read your post, but more absorbed your argument, rather than try to find something to agree or disagree with. :)

</end threadjack :)>

[SERoss67]

It was suggested that I post here so....

When I go to the Newsletter signup to see if their are any new messages from Persephone..after she replies no new messages the video of Joop comes up. In the vidoe it looks like it is overlaying a picture of a woman and some wording in red. Am I crazy. Not very good at catching images so if some one could check it out...."

Thanks

[2fingers]

Check it out the sublymonal teaser.xml file reads as such

<?xml version="1.0" encoding="UTF-8" ?>
- (file:///C:/Documents%20and%20Settings/officedepot/Desktop/Hanso/sublymonal/teaser%5B1%5D.xml#) <ALIN aTest="">
<LINKS name="download1" url="http://www.alinarmy.com/downloads/alin_pride_wallpaper.zip" />

<LINKS name="download2" url="http://www.alinarmy.com/downloads/the_mystical_art_of_the_alin.zip" />

<LINKS name="download3" url="http://www.alinarmy.com/downloads/recovered_vinci_scrolls.zip" />

<LINKS name="gamedemo" url="http://www.microsoft.com/games/riseoflegends/" />

<LINKS name="continuetoaio" url="http://www.microsoft.com/games/riseoflegends/" />

</ALIN>
Is there really an ad for a game really?

[2fingers]

It was suggested that I post here so....

When I go to the Newsletter signup to see if their are any new messages from Persephone..after she replies no new messages the video of Joop comes up. In the vidoe it looks like it is overlaying a picture of a woman and some wording in red. Am I crazy. Not very good at catching images so if some one could check it out...."

Thanks

there is a picture uderneath it is the same guy thats on the top of the wellness page.

[rvturnage]

I didn't see this posted anywhere...apparently in the newsletterinfo.swf file is a hidden text:

http://img329.imageshack.us/my.php?image=code6ou.png

the image was posted at thefuselage.com in this thread (http://www.thefuselage.com/Threaded/showpost.php?p=967940&postcount=14)

Wonder what it is...

[see you in the next life]

2fingers..........................someone in the Hanso thread is reporting that the Hanso ad was repeating on ABC last night during the show "What About Brian."


ADDITIONALLY, THEY ALSO REPORTED THAT THE SUBLYMONAL AD WAS SHOWN ON ABC LAST NIGHT.

IF CONFIRMED, HOW COOL IS THAT?


OBVIOUSLY, YOU KNOW THE TERM SUBLYMONAL IS RELATED TO PROMOTION OF THE SPRITE PRODUCT.

[PandoraX]

there is a picture uderneath it is the same guy thats on the top of the wellness page.

2fingers: SER actually refering to another pic... she says it's of a woman's face. I tried many screencaps and was not able to see it or cap anything of the like. You'll have to ask her for more details, but I know she's not talking about this doc.

BTW... Wanna give a RAH RAH and support the RE team... thanks for all your help!

- RE Groupie :D

[2fingers]

I found something interesting last night im sure it has been posted elsewhere on the net but these boards were down. when you come out of sublymonal page you are directly linked to the exec bios page with a link like this:
http://thehansofoundation.org/index.html#section=bios

you can replace bios at the end with anyone of these words
bios
wellness
maths
mission
newsletter
tvad
outreach
magnetic
extension
genomic
joop
these are the in your face ones couldn't find any for the last names of the execs but anyway its a cool way to link directly to what part you want to see.

I didn't see this posted anywhere...apparently in the newsletterinfo.swf file is a hidden text:

http://img329.imageshack.us/my.php?image=code6ou.png

the image was posted at thefuselage.com in this thread (http://www.thefuselage.com/Threaded/showpost.php?p=967940&postcount=14)

Wonder what it is...

I haven't seen that pic anywhere did they say it was in the flash file or was there a url for it like www.thehansofoundation.org/pics/matrixcode.jpg? (http://www.thehansofoundation.org/pics/matrixcode.jpg?) <-----that links not suppposed to work

[2fingers]

OBVIOUSLY, YOU KNOW THE TERM SUBLYMONAL IS RELATED TO PROMOTION OF THE SPRITE PRODUCT.

Oh yeah I must buy sprite, lion king, bad twin, an x-box, and the game rise of legends.

[2fingers]

this is how bored i got last night
http://i78.photobucket.com/albums/j109/DosFingers/hehimbored.jpg

[2fingers]

two more things:
who is the person that the numbers 2630 are over it looks like a doctors smock or the things you wear in jail then a neck then the flash of a camaer hiding his face.
http://i78.photobucket.com/albums/j109/DosFingers/Image_4.jpg

and this chick sacres me :D
http://i78.photobucket.com/albums/j109/DosFingers/Video_17.swf

[rvturnage]

I haven't seen that pic anywhere did they say it was in the flash file or was there a url for it like www.thehansofoundation.org/pics/matrixcode.jpg? (http://www.thehansofoundation.org/pics/matrixcode.jpg?) <-----that links not suppposed to work

They said it was in the SWF file:

http://thehansofoundation.org/swf/extra/newsletterinfo.swf

when someone posted "all I see is black", the original poster replied "You have to download the swf file to your computer, pass it through a swf decompiler and then you'll find that hidden text.As far as I know, no one has been able to actually see the text while navigating the site. Maybe it's not being used yet. "

Also in that file is the "sdsdsd" text someone mentioned seeing when signing up for the newsletter.

rvt

PS I also posted that link in the codes thread, just to see if they could figure it out...I mainly posted it here for reference, and wondering if there were more things like that we're missing...

[2fingers]

They said it was in the SWF file:

http://thehansofoundation.org/swf/extra/newsletterinfo.swf

when someone posted "all I see is black", the original poster replied "You have to download the swf file to your computer, pass it through a swf decompiler and then you'll find that hidden text.As far as I know, no one has been able to actually see the text while navigating the site. Maybe it's not being used yet. "

Also in that file is the "sdsdsd" text someone mentioned seeing when signing up for the newsletter.

rvt

PS I also posted that link in the codes thread, just to see if they could figure it out...I mainly posted it here for reference, and wondering if there were more things like that we're missing...

I think it is bogus i have decompiled the whole site and that image isn't in there you can look through all the decompiled images sound code at manars site he posted a few pages back its a dump of the whole thing it isn't up to date but newsletterinfo.swf has not changed

[rvturnage]

I think it is bogus i have decompiled the whole site and that image isn't in there you can look through all the decompiled images sound code at manars site he posted a few pages back its a dump of the whole thing it isn't up to date but newsletterinfo.swf has not changed

is it possible that it's actual text within the SWF and not a graphic? Perhaps the graphic was simply a screen grab of the file by the user?

rvt

[2fingers]

it is neither i believe you can take a look here http://www.likaanet.com/lostdump/index.php?fpp=10&did=1-0 <-----manars link
I have all the text in the swf also its not there i even went and updated it too double check i think it was like the pic of the old guy with white hair someone said was hidden in the swfs i still haven't found him. i guess i could make some crazy picture with hex code then throw everyone off also ;)

[rvturnage]

it is neither i believe you can take a look here http://www.likaanet.com/lostdump/index.php?fpp=10&did=1-0

thanks 2fingers..I just found that dump URL again and was about to go through it...sorry to waste your time on a fake...

rvt

[2fingers]

It's all good man i like wasting my time look at my posts from earlier. Plus if it was real it would be cool! Thats gonna be half of this re threads job i believe to debunk fake pics and sounds and the like.

[rvturnage]

It's all good man i like wasting my time look at my posts from earlier. Plus if it was real it would be cool! Thats gonna be half of this re threads job i believe to debunk fake pics and sounds and the like.


It is there, 2fingers...I just downloaded a demo of the new flash so I could open the FLA files...in the ~newsletterinfo.fla file it's in the library, not used in the movie itself. It's actually there twice in the library: "text 79" (text is white) & "text 80" (text is green). Font is Andale Mono, which I don't currently have loaded on my PC at work...

rvt

Edited to Add: it appears it is used, in sprite 81 (a movie clip), loaded into the sprite 82 movie, which is the welcome message from Persephone, only it's masked out, so it can't be seen. I wonder if it's a message that is to be leaked out at a later date, when logging into the newsletter section...sorry I can't be anymore help, I know squat about actionscript, but can work my way through the FLA file to figure bits and pieces out....

[2fingers]

where did you get the .fla from?
I can only get .swf

[rvturnage]

where did you get the .fla from?
I can only get .swf

In Manar's dump site, in a directory called "flash source". first directory on the second line.

rvt

[2fingers]

ohh thats the .swf i thought someone had the acutal .fla

this is what i get for sprite 74

http://i78.photobucket.com/albums/j109/DosFingers/untitled.jpg

[2fingers]

woooooooooo hooooooooooooo

http://i78.photobucket.com/albums/j109/DosFingers/code.jpg
now that that is over i have no idea what it means looks like if you were typing on the computer in the hatch

[2fingers]

ok ok ok i figured out what it is for when you loging to the news letter you will see the top part of that image underneath persephone typing

http://i78.photobucket.com/albums/j109/DosFingers/codemaskedpersephone.jpg

the yellow bits are the mask you only see that part for a split second when you log in the persephones text is on top and the image is underneath masked out. sorry for the big images

[rvturnage]

ohh thats the .swf i thought someone had the acutal .fla

this is what i get for sprite 74

The "Flash Source" are .FLA files. There's a directory called "Flash Clips" that has the resulting SWF files.

But looks like you did find it...so we know it's there. What it's for or what it says, though....

[2fingers]

a .fla is the file before it is converted to swf to put on the web the movie clips are called movie clips or _mc but thats just what ive always called them and everyone i worked with . But there thats what its there for maybe it says something or maybe just cool matrix type effect. It is used in the site and isn't as hidden as once thought :D

[duality]

The "Flash Source" are .FLA files. There's a directory called "Flash Clips" that has the resulting SWF files.

But looks like you did find it...so we know it's there. What it's for or what it says, though....

I have a feeling that it's just meant to look "hackerish", any time you see a hacker in a movie or tv they have a lot of crazy characters on their screen.

[2fingers]

I have a feeling that it's just meant to look "hackerish", any time you see a hacker in a movie or tv they have a lot of crazy characters on their screen.

yeah its just the back drop when persephone is typing to make it look cooler i think. Cause you know all hackers have to 5[]De/-\k 1337

[rvturnage]

ok ok ok i figured out what it is for when you loging to the news letter you will see the top part of that image underneath persephone typing



the yellow bits are the mask you only see that part for a split second when you log in the persephones text is on top and the image is underneath masked out. sorry for the big images


This looks different than what I'm seeing in the FLA file. In Sprite 82, the coded message appears below the line "Persephone: Check it out...", and is masked below that. The only thing that appears above it and would be visible is the "sdsdsd" text. The mask appears to be simply the black lines behind the message from Persephone.

What sprite was that screen cap of you posted taken from?

Here's the screen caps from the FLA file I'm using..

[2fingers]

the only part you would be able to see is the sdsdfg or whatever its in the top left corner of image. All decompilers name the sprites and such diffrently. In mine sprite 74 a movie clip is the mask, sprite 81 is the text, and sprite 84 is the movie clip of the mask moving across the sdsdfg then persephone talking.

[manar]

Check it out the sublymonal teaser.xml file reads as such

<?xml version="1.0" encoding="UTF-8" ?>
- (file:///C:/Documents%20and%20Settings/officedepot/Desktop/Hanso/sublymonal/teaser%5B1%5D.xml#) <ALIN aTest="">
<LINKS name="download1" url="http://www.alinarmy.com/downloads/al..._wallpaper.zip (http://www.alinarmy.com/downloads/alin_pride_wallpaper.zip)" />

<LINKS name="download2" url="http://www.alinarmy.com/downloads/th...f_the_alin.zip (http://www.alinarmy.com/downloads/the_mystical_art_of_the_alin.zip)" />

<LINKS name="download3" url="http://www.alinarmy.com/downloads/re...ci_scrolls.zip (http://www.alinarmy.com/downloads/recovered_vinci_scrolls.zip)" />

<LINKS name="gamedemo" url="http://www.microsoft.com/games/riseoflegends/ (http://www.microsoft.com/games/riseoflegends/)" />

<LINKS name="continuetoaio" url="http://www.microsoft.com/games/riseoflegends/ (http://www.microsoft.com/games/riseoflegends/)" />

</ALIN>


2fingers will you give me just the damn link !! :-p

rvturnage : the whole text if anyone wants to play with .


–Úlˆ:A…xŒ/«‚A°Œ¶x?/ q^<“eKm6Ì™ÃvKIÏ–n¨7¥È?R…{?d?µêéIÀ>Y?esœCzîœéÑ)…€E ‘°Å£?íi|?B>ä†~;®ÊkÃ=àÅéoycÄÎM4‹J!«©Â?òÑO#æ1øb?»ˆ‚x?Ï‚ûêàÕï ˆŸÀNëù…d"¸hÿ‡!@CARYDáób6Úc`¯ãœº$?b6Úc`¯ãœº$?b6Úc`¯ãœº$?b6Ú c`¯ãœº$?b6Úc`¯ãœº$?b6Úc`¯ãœº$?b6Úc`¯ãœº$?b6Úc`¯ãœº $?b6Úc`¯ãœº$?b6Úc`¯ãœº$?b6Úc`¯ãœº$?b6Úc`¯ãœº$?b6Úc `¯ãœº$?-ÿ¶v?Fáê÷~‡¶õ*Ó|"-5|0<G;ÕA\-Ê>¶;ËÏõÑx'À.'è6S!lrh£!¨6 UˆŒ¢ÌÃ'Ö‰ ?Fáê÷~‡¶õ*Ó|"-5|0<G;ÕA\-Ê>¶;ËÏõÑx'À.'è6S!lrh£!¨6 UˆŒ¢ÌÃ'Ö‰ ?Fáê÷~‡¶õ*Ó|"-5|0<G;ÕA\-Ê>¶;ËÏõÑx'À.'è6S!lrh£!¨6 UˆŒ¢ÌÃ'Ö‰ ?Fáê÷~‡¶õ*Ó|"-5|0<G;ÕA\-Ê>¶;ËÏõÑx'À.'è6S!lrh£!¨6 UˆŒ¢ÌÃ'Ö‰ ?Fáê÷~‡¶õ*Ó|"-5|0<G;ÕA\-Ê>¶;ËÏõÑx'À.'è6S!lrh£!¨6 UˆŒ¢ÌÃ'Ö‰ ?Fáê÷~‡¶õ*Ó|"-5|0<G;ÕA\-Ê>¶;ËÏõÑx'À.'è6S!lrh£!¨6 UˆŒ¢ÌÃ'Ö‰ ?Fáê÷~‡¶õ*Ó|"-5|0<G;ÕA\-Ê>¶;ËÏõÑx'À.'è6S!lrh£!¨6 UˆŒ¢ÌÃ'Ö‰ ?Fáê÷~‡¶õ*Ó|"-5|0<G;ÕA\-Ê>¶;ËÏõÑx'À.'è6S!lrh£!¨6 UˆŒ¢ÌÃ'Ö‰ ?Fáê÷~‡¶õ*Ó|"-5|0<G;ÕA\-Ê>¶;ËÏõÑx'À.'è6S!lrh£!¨6 UˆŒ¢ÌÃ'Ö‰ ?Fáê÷~‡¶õ*Ó|"-5|0<G;ÕA\-Ê>¶;ËÏõÑx'À.'è6S!lrh£!¨6 UˆŒ¢ÌÃ'Ö‰ ?Fáê÷~‡¶õ*Ó|"-5|0<G;ÕA\-Ê>¶;ËÏõÑx'À.'è6S!lrh£!¨6 UˆŒ¢ÌÃ'Ö‰ ?Fáê÷~‡¶õ*Ó|"-5|0<G;ÕA\-Ê>¶;ËÏõÑx'À.'è6S!lrh£!¨6 UˆŒ¢ÌÃ'Ö‰ ?Fáê÷~‡¶õ*Ó|"-5|0<G;ÕA\-Ê>¶;ËÏõÑx'À.'è6S!lrh£!¨6 UˆŒ¢ÌÃ'Ö‰ ?Fáê÷~‡¶õ*Ó|"-5|0<G;ÕA\-Ê>¶;ËÏõÑx'À.'è6S!lrh£!¨6 UˆŒ¢ÌÃ'Ö‰ ?Fáê÷~‡¶õ*Ó|"-5|0<G;ÕA\-Ê>¶;ËÏõÑx'À.'è6S!lrh£!¨6 UˆŒ¢ÌÃ'Ö‰ ?Fáê÷~‡¶õ*Ó|"-5|0<G;ÕA\-Ê>¶;ËÏõÑx'À.'è6S!lrh£!¨6 UˆŒ¢ÌÃ'Ö‰ ?


does look repetitive and does not give great results in either translator , the most "exciting" one is char to text :



 


yeah , nothing :-p , dunno still could be something at least before the repetitive patern begins .

How about we check this guys ?


function checkUserInput()
{
switch (inputstate)
{
case "canyoureadthis":
{
checkforYes();
break;
}
case "yougotthepassword":
{
checkForPassword();
break;
}
} // End of switch
userinput.text = "";
userinput._visible = false;
inputstate = "";
} // End of the function
function checkforYes()
{
for (var _loc1 in yeswords)
{
if (userinput.text == yeswords[_loc1])
{
gotoAndStop("gotpassword?");
return;
} // end if
} // end of for...in
writetoField(persephonefield, "gotta go", 40, inputnotvalid);
} // End of the function
function checkForPassword()
{
for (var _loc1 in passwords)
{
if (userinput.text == passwords[_loc1])
{
launchConsole();
return;
} // end if
} // end of for...in
writetoField(persephonefield, "Call the call center in the tv ad section", 30, inputnotvalid);
} // End of the function
function inputnotvalid()
{
_parent.gotoAndPlay("gottago");
} // End of the function
function launchConsole()
{
Site.soundControl.setSounds(0, 0, 0, 0, 0, 0, 0);
Site.setAsSeen("chlaw9lu");
userinput.text = "";
persephonefield.text = "";
_parent.gotoAndPlay("console");
} // End of the function
var myField;
var mytxt;
var mytextInterval;
var feedindex;
var myCallback;
yeswords = ["y", "yeah", "yo", "k", "ok", "yup", "ye", "yws", "yip", "yeh", "Yeah", "yep", "yesh", "oh yeah", "you bet", "positive", "correct", "right", "true", "Yes", "yes"];
passwords = ["breaking strain", "Breaking Strain", "breakingstrain"];
inputstate = "";
var keyListener = new Object();
keyListener.onKeyUp = function ()
{
if (Key.getCode() == 13 && userinput.text != "")
{
checkUserInput();
} // end if
};
Key.addListener(keyListener);
// [Action in Frame 14]
stop ();
function afterhello()
{
trace ("afterhello");
inputstate = "canyoureadthis";
gotoAndStop("canyoureadthis");
} // End of the function
var screenname = Site.getSectionClip().tt_usersubmittedscreenname.t oUpperCase();
writetoField(persephonefield, "Hello " + screenname + ", }}}}}}}}}}Can you read this?", 60, afterhello);
// [Action in Frame 19]
stop ();
userinput.onSetFocus = function ()
{
cursor._visible = false;
userinput.text = "";
};
// [Action in Frame 26]
stop ();
function afteryougotthepassword()
{
userinput._visible = true;
inputstate = "yougotthepassword";
} // End of the function
userinput.onSetFocus = function ()
{
cursor._visible = false;
userinput.text = "";
};
writetoField(persephonefield, "Okay }}}}}}}} it\'s me}}}}} Persephone }}}}, what\'s the password?", 30, afteryougotthepassword);


nm this is just the newsletter password ... BUT the password is there in plain text , so maybe .. ;-)

hrrm , hrrm ... sorry but I won't be posting much before week-end .

2fingers : Resiiiiiize these images man !!! ;-)

Seriously great job guys , keep up the good work ... maybe we must set an instant chat thingie later to get this 110% rolling .

[2fingers]

ok ok my paint skillz suck so i will post linkshttp://i78.photobucket.com/albums/j109/DosFingers/hello.jpg
can you read me now :)

oh yeah and the sdsdsd is a diffrent text from the image but put together in the _mc

Oh yeah sorry manar I am just excitable http://www.sublymonal.com/xml/teaser.xml.

I found that xml file the oddest so far not a very good place to just store a test xml and name the same as an swf for the lost arg that they know is going to get hit up all day and night

[rvturnage]

ok ok my paint skillz suck so i will post linkshttp://i78.photobucket.com/albums/j109/DosFingers/hello.jpg
can you read me now :)

oh yeah and the sdsdsd is a diffrent text from the image but put together in the _mc

LOL...loud and clear!

correct, the sdsdsd is a different sprite, loaded into a sprite movie clip (82 in the FLA on Manars site), which also contains the coded text, which is yet another sprite.

looking at it in the FLA it appears as though the coded message is masked below Persephone's response, and doesn't show through to be used as a "backdrop". The text within the Persephone field itself is set to a light green color, so there's no need for the mask. Of course, i could be totally off on this, as most of this stuff is done and loaded via action script, which I will again say, i know little about. Just from looking at it's placement, it almost looks like it's supposed to be a clue from Persephone revealed at a later date...

2Fingers, is there any chance you can grab the FLA file from manar's dump site, and look at it...at least that way can refer to the same sprite #'s.

rvt

[2fingers]

thats where i got it from im just using a decomiler and your using flash thats whats mixing up. Yeah i think the rest of the text will be revealed there are other masks on there that are not used one the same size as the text ;) does a cool little swipe effect line by line from left to right

[manar]

2fingers , rvt , I'm putting even a better one ( hehehe I'm sooooo humble ) :

http://freejobs.free.fr/LostARG/invertedsprite89.JPG


It's sprite89 inverted colors ;-)

[xtreme76]

Guys, just wanted to let you all know that I also will be decompiling and studing all swf's that the hanso and sublymonal has..lol...

B

[manar]

Welcome xtreme76 :-)

[2fingers]

2fingers , rvt , I'm putting even a better one ( hehehe I'm sooooo humble ) :




It's sprite89 inverted colors ;-)

look at all those lil masks. so i guess when you first login if you don't put a name in the field it just comes in undefined, text on the fly right there. I want it to say sugar britches

i always edit to put in grammer marks i am the king of run on sentences

[snakey]

I know nothing about code breaking, but maybe if all the numbers are taken out, then all the lower case, then all the caps all theat would be left would be symbols and the unknown language, would that make it easier to decipher? If they are all looked at separately maybe just one set is the clue, if there is one at all. This is in reference to the text that rvturnage posted here and in codes.
http://www.losttv-forum.com/forum/attachment.php?attachmentid=1196&d=1147272035

[2fingers]

Manar I have too been working on a flow chart :D beat me to the punch mines still scribbled on the back of chinese takeout menu :D

[manar]

NOW ... YOU DON'T TOUCH FLOW CHARTS ... YOU DO DECOMPILING !!!! :D

[2fingers]

NOW ... YOU DON'T TOUCH FLOW CHARTS ... YOU DO DECOMPILING !!!! :D
oh yeah i forgot need to know my role :Headbang:

[manar]

Hey a new Avy btw . :p

[/endThreadjack]

[2fingers]

here i am kind of playing with pictures again :)
this is in the content_joop[1].swf

http://i78.photobucket.com/albums/j109/DosFingers/odd.jpg
here it is with half a monkey on top of it
http://i78.photobucket.com/albums/j109/DosFingers/oddmonkey.jpg

the image on it looked upside down to me then i acutally took my lap top and turned it upside down and it looked upside down still then i noticed on the right side the ear is correct then on the left side it's upside down i couldn't isolate this image or sprite by itself if someone could that would be awesome. it also flashes everyonce in awhile.

[manar]

2fingers : I spoted this a while ago and yes it was on top of my priorities until ... I forgot about it .. damn brain ... and I dunno why it always looked like locke to me !

I'll check it.

[2fingers]

2fingers : I spoted this a while ago and yes it was on top of my priorities until ... I forgot about it .. damn brain ... and I dunno why it always looked like locke to me !

I'll check it.

looks like morpheus to me ;)
take the white stone or the black stone you must choose manar

[manar]

Here it goes baby :

http://freejobs.free.fr/LostARG/MHA.JPG

It's the guy from the Mental Health Appeal , so the question is ... what is he doing below a monkey in joop's corner ? ;-)

[rottenralf]

Catching mangos??

[2fingers]

and why is he upside down damnit guess id be upside down hanging with a monkey. Looks like they just flipped the same picture upside down and alpha faded it i guess huh

[manar]

haha rotenralf , inimitable and it might even do it :-p

2fingers : can you check for references to MHA in content_joop , or the other way around , you never know .

[2fingers]

Sure as long as i don't have to look at anymore pretty pictures :)

BTW I get my computer tonight i'm in the midst of moving and have been using my girlfriends lap top. I'm gonna have all my toys to play with again :thumbs_up

oh yeah manar what did you think about that teaser.xml at sublymonal odd huh?

[2fingers]

ok i was looking at the code checking for connections between the mental health and joop or joop and mental health or extension and mental health and ran across this never really looked at the menu functions before:
#initclip
if (!_global.Menu) {
var v1 = function () {
super();
this.__items = [this.homepage, this.mission, this.bios, this.projects, this.joop, this.newsletter, this.tvad, this.contact];
this.__sub = [this.maths, this.wellness, this.outreach, this.magnetic, this.genomic, this.extension];
};

_global.Menu = v1;
_global.Menu extends util.BroadcasterClip;
var v2 = v1.prototype;
v2.selectItem = function (name) {
var v3 = MenuItem(this[name]);
if (v3 != null && (v3 == this.__activeItem || v3 == this.__activeSubItem)) {
return true;
}
this.__activeItem.keepActive(false);
this.__activeSubItem.keepActive(false);
this.__activeItem = null;
this.__activeSubItem = null;
if (v3 == undefined) {
return false;
}
v3.keepActive(true);
var v4 = false;
var v2 = 0;
while (v2 < this.__sub.length) {
if (v3 == MenuItem(this.__sub[v2])) {
v4 = true;
break;
}
++v2;
}
if (v4) {
this.__activeItem = this.projects;
this.__activeSubItem = v3;
this.expandMenu();
this.__selectedItem = name;
return true;
}
this.__activeItem = v3;
this.collapseMenu();
this.__selectedItem = name;
return true;
};

v2.getSelectedItem = function () {
return this.__selectedItem;
};

v2.onLoad = function () {
var v2;
var v3;
v2 = 0;
while (v2 < this.__items.length) {
v3 = MenuItem(this.__items[v2]);
v3.addEventListener('click', this);
++v2;
}
v2 = 0;
while (v2 < this.__sub.length) {
v3 = MenuItem(this.__sub[v2]);
v3.addEventListener('click', mx.utils.Delegate.create(this, this.subclick));
v3._visible = this.__isExpanded;
++v2;
}
};

v2.expandMenu = function () {
if (this.__isExpanded) {
return undefined;
}
var v2 = 0;
while (v2 < this.__sub.length) {
(MenuItem(this.__sub[v2]))._visible = true;
++v2;
}
this.__isExpanded = true;
};

v2.collapseMenu = function () {
if (!this.__isExpanded) {
return undefined;
}
this.__activeSubItem.keepActive(false);
this.__isExpanded = false;
};

v2.collapseDone = function () {
var v2 = 0;
while (v2 < this.__sub.length) {
(MenuItem(this.__sub[v2]))._visible = false;
++v2;
}
};

v2.click = function (e) {
var v2 = MenuItem(e.target);
if (v2 != this.__activeItem) {
this.__activeItem.keepActive(false);
if (this.__activeItem == this.projects) {
this.collapseMenu();
} else {
if (v2 == this.projects) {
this.expandMenu();
}
}
this.__activeItem = v2;
if (v2 != this.projects) {
this.__activeItem.keepActive(true);
this.__selectedItem = v2._name;
this.dispatchEvent({'type': 'onChanged', 'target': this});
} else {
this.__selectedItem = '';
}
}
};

v2.subclick = function (e) {
var v2 = MenuItem(e.target);
if (v2 != this.__activeSubItem) {
this.__activeSubItem.keepActive(false);
this.__activeSubItem = v2;
this.__activeSubItem.keepActive(true);
this.__selectedItem = v2._name;
this.dispatchEvent({'type': 'onChanged', 'target': this});
}
};

v2.__selectedItem = '';
v2.__isExpanded = false;
ASSetPropFlags(_global.Menu.prototype, null, 1);
}
#endinitclip


this is the only important bit
if (!_global.Menu) {
var v1 = function () {
super();
this.__items = [this.homepage, this.mission, this.bios, this.projects, this.joop, this.newsletter, this.tvad, this.contact];<-----right there the contact page is out there somewhere
this.__sub = [this.maths, this.wellness, this.outreach, this.magnetic, this.genomic, this.extension];
};

all they have to do is uncomment it from the xml file and it will show up in the nav bar be linked to the swf and everything i can't get to the .swf though

http://thehansofoundation.org/swf/extra/
forrbiden :( that would be so easy they nedd an index.html so i can just go look at them all

nevermind time to go drinking

[duality]

Sure as long as i don't have to look at anymore pretty pictures :)

BTW I get my computer tonight i'm in the midst of moving and have been using my girlfriends lap top. I'm gonna have all my toys to play with again :thumbs_up

oh yeah manar what did you think about that teaser.xml at sublymonal odd huh?

If you go to www.garytroup.net (http://www.garytroup.net) (which is the actual content for www.garytroupbooks.com (http://www.garytroupbooks.com)) and look at the source for the pages, you'll see references to http://www.unhookedgeneration.com, another Hyperion site. These web developers (and I know since I'm wone of them) will copy an one of their old sites to make a new site and use it as a base. Often you don't find all of your references to the old site, and I would guess that is what teaser.xml is all about, it's probably a file from the old site that they didn't need to change and they missed it when building the new site.

[snakey]

Glad you guys use your powers for good (and are on our side), thanks for all the work eventhough I know you are soooo enjoying it.

[2fingers]

If you go to www.garytroup.net (http://www.garytroup.net) (which is the actual content for www.garytroupbooks.com (http://www.garytroupbooks.com)) and look at the source for the pages, you'll see references to http://www.unhookedgeneration.com, another Hyperion site. These web developers (and I know since I'm wone of them) will copy an one of their old sites to make a new site and use it as a base. Often you don't find all of your references to the old site, and I would guess that is what teaser.xml is all about, it's probably a file from the old site that they didn't need to change and they missed it when building the new site.

yeah i used to do that too just was hoping everyone wasn't as lazy as i am. Anyway its a pretty big miss i only get 8 files from sublymonal 1 html page 2 xml pages 2 javascripts one being sprite teaser.js and 3 swf

the sprite teaser looks like a data tracking cookie

[SERoss67]

2fingers: SER actually refering to another pic... she says it's of a woman's face. I tried many screencaps and was not able to see it or cap anything of the like. You'll have to ask her for more details, but I know she's not talking about this doc.

BTW... Wanna give a RAH RAH and support the RE team... thanks for all your help!

- RE Groupie :D

Thanks PadoraX
2Finger: I was able to get pictures of the the images.
When I go to the Newsletter signup to see if their are any new messages from Persephone..after she replies no new messages the video of Joop comes up. In the video it looks like it is overlaying a picture of a women.
Let me know what you guys think.

[2fingers]

Thanks PadoraX
2Finger: I was able to get pictures of the the images.
When I go to the Newsletter signup to see if their are any new messages from Persephone..after she replies no new messages the video of Joop comes up. In the video it looks like it is overlaying a picture of a women.
Let me know what you guys think.

this video?
http://i78.photobucket.com/albums/j109/DosFingers/Video_1.swf
??

[SERoss67]

this video?
http://i78.photobucket.com/albums/j109/DosFingers/Video_1.swf
??

Yes, that is the video.... your copy is a lot sharper then what is shown on the web site.

[2fingers]

i haven't found any sprite with a picture overlaying this movie yet but i will keep looking

[MacGuffin]

Sorry to double post, but here's the "Joop" video that is originally from Getty Images:

http://www.youtube.com/watch?v=1qSOQK8fmWk

[rvturnage]

this video?
http://i78.photobucket.com/albums/j109/DosFingers/Video_1.swf
??

I think I saw that clip, it's in the newsletter .fla file we were looking at earlier, if I'm not mistaken. I don't think it's an actual overlay like they did with the doctor, actually using the photo and changing the alpha settings. I think that's how the imported bitmap looked...I could be wrong though...I odn't have the files or software with me at home to check...

I can't see a woman in the caps, although I do see what appears to be a womans hand in the first and last grab. It's in the upper right corner of the distorted rectangular area, palm up...

[2fingers]

you are correct sir it is acutally a little longer you see his arm come up at the end

http://i78.photobucket.com/albums/j109/DosFingers/Video_83.swf

Sorry to double post, but here's the "Joop" video that is originally from Getty Images:

http://www.youtube.com/watch?v=1qSOQK8fmWk

ahh joops not mean or crazy or anything he's tired thats cute

i did find out that after she says bye bye it plays a sprite that just randomly play a frame the movie clip above

onEnterFrame = =function();
{
gotoAndStop(random(_totalframes));
}
;

so it gives you one of these http://i78.photobucket.com/albums/j109/DosFingers/Sprite_84.swf

[Dionysus]

Can someone here please help?

On this link, http://www.sublymonal.com/ (http://www.sublymonal.com/) , it says on the top of the page Coke Cola Maintenance and I get this page:
http://www.maintenance.coca-cola.com/images/cocacola_logo.gif
This site is undergoing scheduled maintenance.
Please come back soon!
Este sitio se encuentra bajo mantenimiento.
Por favor regrese mas tarde y disculpe la molestia que esta actividad le haya causado.
Cet site n'est pas disponible pour le moment pour raison de maintenance.
S'il vous plait, revenez vers le site plus tard. Merci pour votre patience.
Die Seite wird gerade planmäßig gewartet.
Bitte versuch es später noch einmal.
Este site está em manutenção programada.
Por favor volte mais tarde!



On this link, http://sublymonal.com/ (http://sublymonal.com/), I get subLYMONal on the top of the page and the
OBEY that every one else gets.

I have updated my flash and cleared my cache and browser. I only linked on this after the commercial aired last night. It is not a big thing. But why am I the only one in the world that got this? I am going nuts. My computer is only a couple of months old and all updated.

[rvturnage]

Can someone here please help?

On this link, http://www.sublymonal.com/ (http://www.sublymonal.com/) , it says on the top of the page Coke Cola Maintenance and I get this page:
http://www.maintenance.coca-cola.com/images/cocacola_logo.gif
This site is undergoing scheduled maintenance.
Please come back soon!
Este sitio se encuentra bajo mantenimiento.
Por favor regrese mas tarde y disculpe la molestia que esta actividad le haya causado.
Cet site n'est pas disponible pour le moment pour raison de maintenance.
S'il vous plait, revenez vers le site plus tard. Merci pour votre patience.
Die Seite wird gerade planmäßig gewartet.
Bitte versuch es später noch einmal.
Este site está em manutenção programada.
Por favor volte mais tarde!



On this link, http://sublymonal.com/ (http://sublymonal.com/), I get subLYMONal on the top of the page and the
OBEY that every one else gets.

I have updated my flash and cleared my cache and browser. I only linked on this after the commercial aired last night. It is not a big thing. But why am I the only one in the world that got this? I am going nuts. My computer is only a couple of months old and all updated.
Probaly a traffic issue, since everyone in the country watching the show tried to hit the site last night. I couldn't load it, and couldn't load the Hanso site...kept getting a message I didn't have the right version of Flash, when i had just viewed the site the night before on the same computer. I think they were overwhelmed...

rvt

[bcool1956]

I am having no problem with either site and they look the same.

[2fingers]

it cross refrences sprite and it is a coke product also sublymonal that is probably on the same server

[2fingers]

ok i've been boared today and all
so that means i've been goofing off and found this:

// Sprite 69 ('mittlewerk')
#initclip#endinitclip
// Frame 1 actions...
function checkUserInput()
{
checkForPassword();
userinput.text = "";
userinput._visible = false;
inputstate = "";
}
function timeoutFinished()
{
inputstate = "yougotthepassword";
userinput._visible = true;
}
function checkForPassword()
{
for (var __reg1 in passwords)
{
if (userinput.text == passwords[__reg1])
{
sendPressed();
do
{
}
while (undefined != null);
return undefined;
}
}
timeout.play();
}
function sendPressed()
{
var __reg2 = _parent._parent._parent.extraURL_mittelwerk;
Site.loadOnTop(__reg2);
Site.setAsSeen("wi1stl4d");
}
passwords = ["heir apparent", "heirapparent", "Heir Apparent", "Heirapparent"];
var userinput = login_mittelwerk;
inputstate = "yougotthepassword";
var keyListener = new Object();
keyListener.onKeyUp = function ()
{
if (!(Key.getCode() == 13 && userinput.text != "" && Site.checkIfSeen("chlaw9lu")))
{
return;
}
checkUserInput();
}
;
Key.addListener(keyListener);

stop();
setProperty("", _visible, false);
styles = StyleManager.getMainStyle();
email_txt.html = true;
email_txt.styleSheet = styles;
email_txt.autoSize = true;
email_txt.htmlText = "<a href=\"<A href="mailto:mittlewerk@hansofoundation.org\">mittlewerk@hansofoundation.org</a">mailto:mittlewerk@hansofoundation.org\">mittlewerk@hansofoundation.org</a>";

// Frame 2 actions...
setProperty("", _visible, true);

// Frame 19 actions...
stop();

// Frame 39 actions...
_parent.sectionHidden();


dosen't really mean much except this is the second time they have put the password in plain text manar saw that the breaking strain was also plaintext in the code but it also show that all these diffrent version of heir apparent will work

passwords = ["heir apparent", "heirapparent", "Heir Apparent", "Heirapparent"];

How nice of them it didnt matter if you capitalize or put a space or not. To bad they didn't put the mosty commonly misspelled version in there too. I guess the logins will be in plain text!!!!

[LostEmissary]

dosen't really mean much except this is the second time they have put the password in plain text manar saw that the breaking strain was also plaintext in the code but it also show that all these diffrent version of heir apparent will work

passwords = ["heir apparent", "heirapparent", "Heir Apparent", "Heirapparent"];

How nice of them it didnt matter if you capitalize or put a space or not. To bad they didn't put the mosty commonly misspelled version in there too. I guess the logins will be in plain text!!!!It's almost disappointing to me that it's this easy to "cheat" lol.

I guess that's the reason I prefer not to look at flash code, as it takes something away from the verisimilitude of the game.

Great work though, everyone... even if I don't want you telling me what you find ;)

[rottenralf]

You have to remember the two rules of ARG's

1) TINAG
2) There are no rules

I am in awe of what they are finding and appreciate everything they're doing. Since they haven't published any rules there can't be any "cheating". All's fair in Lost and ARG's.

[LostEmissary]

You have to remember the two rules of ARG's

1) TINAG
2) There are no rules

I am in awe of what they are finding and appreciate everything they're doing. Since they haven't published any rules there can't be any "cheating". All's fair in Lost and ARG's.That's why I put cheat in quotes ;)

[2fingers]

That's why I put cheat in quotes ;)
Heh I'm a "cheater" what can i say not that it matters because all the clues get solved even before i can decompile the code. I just find it fun to RE it i mean i am looking at stuff that has long since been figured out.10 minutes after the commercial or phone number airs in the uk thats about all you have. but I still find it fun. Gotta get into the heads of these guys they will be leading us around all summer you know!!

Just so you know I vow to never post any bullshit on this thread like I have seen on other forums. I am sure Manar is there too everything we say will be coming straight from the code. I have even been shown wrong by rvtunage on the "hidden" image (it wasn't really that hidden if you looked) I didn't think it was there and it was and admited I was wrong. I will deny until i am proven wrong i am the anti law it is false until proven true :D

[duality]

It's almost disappointing to me that it's this easy to "cheat" lol.

I guess that's the reason I prefer not to look at flash code, as it takes something away from the verisimilitude of the game.

Great work though, everyone... even if I don't want you telling me what you find ;)

I think that if they wanted to, they could make it a lot harder to RE the code, and they must know that RE is going on. I mean, passwords in plain text in the code? That's pretty weak, so they probably don't care at this point if it's decompiled.

At this point I think they probably decided that these early clues are pretty straightforward anyway, and anything that's in the code is readily available without RE, so it wasn't worth the effort to make it harder to crack.

When they have a harder puzzle to solve (and I sure hope they do) at some point, I would think they will protect it well.

[Hodag]

I'm not sure if this is the correct thread for this.

I opened the 05_05_06.pdf file with Wordpad and saw http://persephone.thehansofoundation.org. When I tried the website I got numbers.

Then I noticed an MSI link that wasn't clickable on the Hanso site, so I tried http://msi.thehansofoundation.org, and it worked. It looked just like the existing Hanso site, but uses a different database because I had to log back in with "breaking strain".

Then I found that *any* word before thehansofoundation.org worked. I sent Truffula a PM that only included the address http://truffula.thehansofoundation.org, which gave him a pretty big surprise. :D I also sent http://hodag.thehansofoundation.org/ to Rottenralf but never received a response.

Anyway, other than using it as a joke, I can't think of any other use for this. I guess if you want to check out the site as a newbie, and don't want to delete your cookies, you can plug in a different word.

Other than http://persephone.thehansofoundation.org, I know of one more subdomain that has something special. The server THF is located on offers a webmail service. Following standard naming proceedure, I tried http://webmail.thehansofoundation.org and got the email login screen.

[The_Island]

I'm not sure if this is the correct thread for this.

I opened the 05_05_06.pdf file with Wordpad and saw http://persephone.thehansofoundation.org. When I tried the website I got numbers.

Then I noticed an MSI link that wasn't clickable on the Hanso site, so I tried http://msi.thehansofoundation.org, and it worked. It looked just like the existing Hanso site, but uses a different database because I had to log back in with "breaking strain".

Then I found that *any* word before thehansofoundation.org worked. I sent Truffula a PM that only included the address http://truffula.thehansofoundation.org, which gave him a pretty big surprise. :D I also sent http://hodag.thehansofoundation.org/ to Rottenralf but never received a response.

Anyway, other than using it as a joke, I can't think of any other use for this. I guess if you want to check out the site as a newbie, and don't want to delete your cookies, you can plug in a different word.

Other than http://persephone.thehansofoundation.org, I know of one more subdomain that has something special. The server THF is located on offers a webmail service. Following standard naming proceedure, I tried http://webmail.thehansofoundation.org and got the email login screen.

Thanx Hodag...yah, most of this was discussed in Hanso thread i believe, but the webmail subdomain is definitely something I have not seen discussed...nice find, thanx!

[rvturnage]

Heh I'm a "cheater" what can i say not that it matters because all the clues get solved even before i can decompile the code. I just find it fun to RE it i mean i am looking at stuff that has long since been figured out.10 minutes after the commercial or phone number airs in the uk thats about all you have. but I still find it fun. Gotta get into the heads of these guys they will be leading us around all summer you know!!

Just so you know I vow to never post any bullshit on this thread like I have seen on other forums. I am sure Manar is there too everything we say will be coming straight from the code. I have even been shown wrong by rvtunage on the "hidden" image (it wasn't really that hidden if you looked) I didn't think it was there and it was and admited I was wrong. I will deny until i am proven wrong i am the anti law it is false until proven true :D

2fingers is right...so far, all the passwords have been literally given to us. The RE has answered a couple of questions about hidden text, and shown us that it's not yet possible to use the login at the bottom of the screen.

I for one am having fun looking through the flash files...I've been doing basic flash stuff for a couple of years at my job, but I've got to learn actionscript, and this is giving me a lot of pointers...By using this thread, I can write my time off at work as "research"... :thumbs_up

rvt

PS and a great big thanks to 2fingers and Manar for letting a Flash noob play in the thread, and not making me feel like an idiot!:worshippy

[LostEmissary]

Thanx Hodag...yah, most of this was discussed in Hanso thread i believe, but the webmail subdomain is definitely something I have not seen discussed...nice find, thanx!http://www.losttv-forum.com/forum/showpost.php?p=580426&postcount=1095

:D

[The_Island]

http://www.losttv-forum.com/forum/showpost.php?p=580426&postcount=1095

:D

I withdraw...my previous statement, lol

[LostEmissary]

I withdraw...my previous statement, lolDon't worry, it's extremely easy to miss something in the Hanso thread, considering how huge it is!

[manar]

Heh I'm a "cheater" what can i say not that it matters because all the clues get solved even before i can decompile the code. I just find it fun to RE it i mean i am looking at stuff that has long since been figured out.10 minutes after the commercial or phone number airs in the uk thats about all you have. but I still find it fun. Gotta get into the heads of these guys they will be leading us around all summer you know!!

Just so you know I vow to never post any bullshit on this thread like I have seen on other forums. I am sure Manar is there too everything we say will be coming straight from the code. I have even been shown wrong by rvtunage on the "hidden" image (it wasn't really that hidden if you looked) I didn't think it was there and it was and admited I was wrong. I will deny until i am proven wrong i am the anti law it is false until proven true :D

:yeah:

I think that if they wanted to, they could make it a lot harder to RE the code, and they must know that RE is going on. I mean, passwords in plain text in the code? That's pretty weak, so they probably don't care at this point if it's decompiled.

At this point I think they probably decided that these early clues are pretty straightforward anyway, and anything that's in the code is readily available without RE, so it wasn't worth the effort to make it harder to crack.

When they have a harder puzzle to solve (and I sure hope they do) at some point, I would think they will protect it well.

I also think that we are in an Alternate Reality Game where a hacker is providing info , and since when trying to solve all this we are basically in that alternate world , it's not that far fetched if there is some need of a "hacker" that would look in the code for clues (left there by persephone ?)
... just a thought . Of course THERE are traps and misleads and everytime I think I found something I keep asking myself : does this belong here ?!

Now to the thread topic :p

1- I'm having feedbacks people having problems with the mittelwerk bio pass , my monitoring of sublymonal code shows that website is tracking the hanso site :


function onClickToHanso()
{
com.sublymonalteaser.Globals.obtainURL("../../thehansofoundation.org/index.html#section=bios ", "_blank");
com.sublymonalteaser.Globals.trackEvent("clickToHanso");
} // End of the function


Actually it's odd but the whole site code is about tracking the events you trigger ;-)
Anyway I'd recommend at least to have the sublymonal website open when trying to log in the bio the first time also use the "heirapparent" form as 2fingers pointed out .

btw 2fingers : do you see how THF is declared there ? like sublymonal being a subfolder of THF !

2- Been browsing the hanso thread but didn't see this in the latest 20 pages so here goes :

http://freejobs.free.fr/LostARG/mittelwerkfile.gif

I recall someone asked what's under the red signs , well I feel pretty comfortable to say : NOTHING :p
Let's look at a bigger and more enhanced form ... stretched and changed brightness of image .

http://freejobs.free.fr/LostARG/mittelwerkstudents.gif

I can read students :
Line 1 : "Alan Frost , Adam Shuttleworth , Andrea Ackermann , Anne Allen , Alexander Gould"
Line 2 : "Berenice Charles , Benjamin Paul , Barney Perdy"
Line 3 : "Carl Bennet , Charles Mitchum ( note this has been barred )"
Line 4 : "Edwin Austin, Elwyn Brooks"

And finally :

http://freejobs.free.fr/LostARG/mittelwerkcaltech.gif

The file is from caltech - passadena 1980 ( this also got an understrike )

Of course I don't forget the girl saying mittelwerk is a clown and there is no record of him . Nor that Robert Mitchum (the actor) complete name was Robert Charles Mitchum :p

Hodag : Nice find , though all my webservers running in apache/php like THF install the horde webmail as default in a new website.

Hey 2fingers you think we must go for this or we must open a new email crackers thread ? :p , ah and sorry I couldn't get your message yesterday , we talk later ?

[manar]

Ok also another thing that won't stop bothering me !!!

2fingers : the "heirapparent" code you sent before , see it's been updated and the mittlewerk@hansofoundation.org email is still there ! what does it cost them to just remove that as it does NOTHING but show the email ! weird ...

[twiki]

hi guys, thought i'd say a quick hello in here as this is clearly the best thread for me to keep up to date with. only started looking at the webmaze malarky earlier today - all good fun.

anyway, i'm mathmatician/developer/programmer/geek whatever you want to call it, but i've not anything with flash before now.

can one of you give me a "shopping list" of the best tools out there to RE these flash files? i get very bored at work and so can spend time on doing more fun things!

[rvturnage]

:
btw 2fingers : do you see how THF is declared there ? like sublymonal being a subfolder of THF !

Manar, that is interesting about sublymonal.com appearing to be a sub-directory of thehansofoundation. Why would they use a relative path like that rather than just the domain? Guess it doesn't really matter, but I was just curious...

I recall someone asked what's under the red signs , well I feel pretty comfortable to say : NOTHING :p
Let's look at a bigger and more enhanced form ... stretched and changed brightness of image .


I agree, there's nothing there now...I wonder why they removed it and changed the color of the bottom one from blue to red?


[/QUOTE]Hodag : Nice find , although all my webservers running in apache/php like THF install the horde webmail as default in a new website. [/QUOTE]

What about being able to use anyname as a sub-domain for hanso, like manar.thehansofoundation.org? wouldn't they have to conciously set that up? I'm curious as to why that works.

I assume its not actually writing to a database, but just logging cookies, named by the URL or something, that's why it doesn't recognize cookies from thehounsofoundation when going to manar.thehansofoundation.

rvt

[rvturnage]

Manar, i assume the images you posted of the Caltech transcript (or whatever) were darkened around the edges in the orginial bitmap file and not added in Flash, correct?

[2fingers]

:yeah:




btw 2fingers : do you see how THF is declared there ? like sublymonal being a subfolder of THF !



good morning everybody or i should say afternoon but im just getting up.

I'm not posotive but I think THF being declared that way may have something to do with this:
<script type="text/javascript">
var fo = new FlashObject("hanso.swf", "hansomain", "100%", "100%", "8", "#ffffff");
// flash 8 security issues
fo.addParam("allowScriptAccess", "sameDomain");

// add direct linking if available
var direct = getHashValue("section");
if(direct)
fo.addVariable("section", direct);

// skip intro
var skip = getHashValue("skip");
if(skip)
fo.addVariable("skip", skip);

fo.write("flash");
</script>


Now java script has always been beyond me i think i dont like all the (((()))"")((("""))((")))

but that top bit does it mean you can only get script access in the same domain?

and someone tell me exactly what this means:
// add direct linking if available
var direct = getHashValue("section");
if(direct)
fo.addVariable("section", direct);

[rvturnage]

good morning everybody or i should say afternoon but im just getting up.

I'm not posotive but I think THF being declared that way may have something to do with this:
<script type="text/javascript">
var fo = new FlashObject("hanso.swf", "hansomain", "100%", "100%", "8", "#ffffff");
// flash 8 security issues
fo.addParam("allowScriptAccess", "sameDomain");

// add direct linking if available
var direct = getHashValue("section");
if(direct)
fo.addVariable("section", direct);

// skip intro
var skip = getHashValue("skip");
if(skip)
fo.addVariable("skip", skip);

fo.write("flash");
</script>


Now java script has always been beyond me i think i dont like all the (((()))"")((("""))((")))

but that top bit does it mean you can only get script access in the same domain?

and someone tell me exactly what this means:
// add direct linking if available
var direct = getHashValue("section");
if(direct)
fo.addVariable("section", direct);

Yes, that top bit means you can only access the script from the same server.

The last part, about direct linking, seems to be checking that direct linking to a portion of the site is allowed, and then links to the directly to the section specified in the URL. Add to that the next portion of the script (//skip intro), and, if you notice, by going to http://www.thehansofoundation.org/#section=bios it plays the logo then skips the woman's intro and goes straight to the bio page.

I'm no expert on javascripting either, but have a fair amount of time in decoding it to figure it out...

[2fingers]

I found something interesting last night im sure it has been posted elsewhere on the net but these boards were down. when you come out of sublymonal page you are directly linked to the exec bios page with a link like this:
http://thehansofoundation.org/index.html#section=bios

you can replace bios at the end with anyone of these words
bios
wellness
maths
mission
newsletter
tvad
outreach
magnetic
extension
genomic
joop
these are the in your face ones couldn't find any for the last names of the execs but anyway its a cool way to link directly to what part you want to see.



those work too^^^^ and do the same thing

[2fingers]

Hodag : Nice find , though all my webservers running in apache/php like THF install the horde webmail as default in a new website.

Hey 2fingers you think we must go for this or we must open a new email crackers thread ? :p , ah and sorry I couldn't get your message yesterday , we talk later ?

you have fun with that. maybe we will start a raise money to bail manar out of jail thread. I'll sell cookies!

[truffula]

Don't know if this will help yal out at all....
The newest link on Hanso site is to the Newspaper ad, but peeling away the layers, I got into here - http://thehansofoundation.org/press/extra/uploads/

Can't get into /press or /press/extra.
Can any of you? :)

[2fingers]

Don't know if this will help yal out at all....
The newest link on Hanso site is to the Newspaper ad, but peeling away the layers, I got into here - http://thehansofoundation.org/press/extra/uploads/

Can't get into /press or /press/extra.
Can any of you? :)

look what else is in the paris folder!!
http://thehansofoundation.org/press/extra/uploads/paris/legalmiller_final.pdf

[manar]

I hate how losttv is asking me to log in all time :-/

ok so at first glance , files changed with this new update :

content_execbios
content_homepage
hanso

and of course the new files .

Let's start ... and thnx truff

[duality]

I hate how losttv is asking to log in all time :-/

ok so at first glance , files changed with this new update :

content_execbios
content_homepage
hanso

let's start ... and thnx truff

I only see a content_homepage change...

[manar]

I only see a content_homepage change...

Sorry I was comparing to 05/08 version , I think you're right ... I must upload all these versions to the dump and clean up a little bit .

Back to sleep :p

[Kathaclysm]

I'm not sure how any of the reverse-engineering works, but I think I saw noted originally that the Login at the bottom right of the Hanso page, and the Login/Password under the Board of Directors, weren't actually checking anything... does anyone know if this is still true?

[2fingers]

I'm not sure how any of the reverse-engineering works, but I think I saw noted originally that the Login at the bottom right of the Hanso page, and the Login/Password under the Board of Directors, weren't actually checking anything... does anyone know if this is still true?

as of this morning they are still not active!! haven't checked since the update but none of the files with the logins was updated so i will say they still aren't useable

[Kathaclysm]

as of this morning they are still not active!! haven't checked since the update but none of the files with the logins was updated so i will say they still aren't useable

*sigh* ok, thanks...

[manar]

*sigh* ok, thanks...

My opinion is slightly different in this mater ... the login at the bottom of the page does nothing ... but as for the login/pass read my post here :
http://www.losttv-forum.com/forum/showpost.php?p=580585&postcount=90

2fingers thought is more hopefull though as then they may update sometime with login/pass ;-) ... but let me just once again cast my doubts on this .

Regards , Manar

[2fingers]

My opinion is slightly different in this mater ... the login at the bottom of the page does nothing ... but as for the login/pass read my post here :
http://www.losttv-forum.com/forum/showpost.php?p=580585&postcount=90

2fingers thought is more hopefull though as then they may update sometime with login/pass ;-) ... but let me just once again cast my doubts on this .

Regards , Manar
I'm just going on what has been in the past and the fact that the little spinning sunflower looking thing is called process_mc which is what i think they are calling there not a whole new.swf

[manar]

Congrats on the team membership !!!! :D . I've just seen it

uuh can you explain the cheevers thing 2fingers ?

[2fingers]

really off topic but where is our super cool team reverse enginering banner? Can it say we are 1337 H4x0r5 :D j/k

[2fingers]

in the sprite labeled cheevers on the exec bios page it holds all the code for the login/password. Don't know if it means anything just where it is could have been anywhere really but its in there and only there.

well im off to get people drunk and listen to there stories and hopefully make a few bucks see yah round midnight :P

[duality]

Ok I am now monitoring press/extra/uploads press/extra/uploads/paris and press/extra/uploads/london for changes.

[manar]

thnx duality,

got an app downloading the whole site every 6hours , but it helps a lot to get that monitored , keep us informed .

[rvturnage]

in the sprite labeled cheevers on the exec bios page it holds all the code for the login/password. Don't know if it means anything just where it is could have been anywhere really but its in there and only there.

well im off to get people drunk and listen to there stories and hopefully make a few bucks see yah round midnight :P

It appears to me, that the exec bios page has 4 sprites on top of each other for logging in, the one on top is "cheevers", then "peck", then "wales", then "vanderfield". All of these sprites seem to contain the same actionscript.

rvt

[foxxie]

I must say that I never have any idea what you guys are talking about in here, but I think YOU ROCK!!!! It is awsome what you guys can do! :D

/end threadjack! (sorry)

[ILoveEko]

:yeah:!!!

:D

[Kathaclysm]

:yeah:!!!

:D
LOL I second that!

So, really... rtv what's a sprite? Like the faries? Or like the soda?

[duality]

LOL I second that!

So, really... rtv what's a sprite? Like the faries? Or like the soda?

Wow sweet we have groupies. This is actually my favorite thread because it doesn't take me an hour to wade through all of the posts.

Kathaclysm, if I was to explain what a sprite is, I think the best description is a sprite is a piece of the screen that is superimposed on the background. Think of Mario running across the screen or a big nasty mother ship moving around at the top of a screen while you're shooting at it. In Flash, which is what thehansofoundation.org is written in, a sprite follows the description above, it is a piece of video, or some other graphic that is shown inside another window.

[Kathaclysm]

Wow sweet we have groupies. This is actually my favorite thread because it doesn't take me an hour to wade through all of the posts.

Kathaclysm, if I was to explain what a sprite is, I think the best description is a sprite is a piece of the screen that is superimposed on the background. Think of Mario running across the screen or a big nasty mother ship moving around at the top of a screen while you're shooting at it. In Flash, which is what thehansofoundation.org is written in, a sprite follows the description above, it is a piece of video, or some other graphic that is shown inside another window.
Ahhh.... I get that :-) hehe, Mario! Thanks!
Really, this thread rocks, and I appriciate you guys entertaining my questions! I (like many of us) don't know how flash works, so it's great that some ppl are doing this type of investigation!

[foxxie]

Wow sweet we have groupies. This is actually my favorite thread because it doesn't take me an hour to wade through all of the posts.

Kathaclysm, if I was to explain what a sprite is, I think the best description is a sprite is a piece of the screen that is superimposed on the background. Think of Mario running across the screen or a big nasty mother ship moving around at the top of a screen while you're shooting at it. In Flash, which is what thehansofoundation.org is written in, a sprite follows the description above, it is a piece of video, or some other graphic that is shown inside another window.

LOL at groupies!! We should make banners for that or something! :D

[2fingers]

It appears to me, that the exec bios page has 4 sprites on top of each other for logging in, the one on top is "cheevers", then "peck", then "wales", then "vanderfield". All of these sprites seem to contain the same actionscript.

rvt

thats odd on mine the only one that has any action script is cheevers.

By the was i got my puter up and running today so I have flash again and some other tools and goodies that may come in handy. I'm super excited i don't have to use this cruddy free flash decompiler anymore :)

[manar]

Fozzie , kathaclysm , ILE and the others (NOOO not these others !! :p) I made a little update explaining what we do and the terms we use here , it's in the first page , so if you have time go check :)

Regards , Manar .

[xtreme76]

Shirts?

LOL at groupies!! We should make banners for that or something! :D

[foxxie]

I just had a hugh Ah-Ha moment! Thanks for the explanation manar! It helped me alot. :D

[rvturnage]

thats odd on mine the only one that has any action script is cheevers.

By the was i got my puter up and running today so I have flash again and some other tools and goodies that may come in handy. I'm super excited i don't have to use this cruddy free flash decompiler anymore :)

That's intersting...try opening the FLA in Flash now that you've got that running again...when I opened it at work yesterday, the first frame of each of the 4 sprites (complete with that great lemon/lime flavor, Kath! :) ) and the same Actionscript in the first frame.

All 4 of those sprites were used in the sprite that makes the login page for the board... they were on the bottom 4 layers of it, all at the same coordinates.

So, correct me if I'm wrong, but that would seem to indicate that the login/password info for each of the 4 directors would be unique, and that they would become active at different times, right? Otherwise, you just use a single sprite for the login, with a single password...or none at all if you didn't want the login to be functional.

Is my thinking correct?

rvt

ETA. Manar, the introduction on page 1 is a very good addition!

[2fingers]

ok i opened it in flash and you are correct. I think the flash decompiler i was using either combined like sprites or just missed alot of them.probably why we always had diffrent sprite names and everything. As for the logins that sounds about right to me the only thing that would suck them is if you had lets say the liddy wales login you would have to make sure you were under her page in the boards where as if they had it in cheevers ontop they would only have to do it once and put all the logins and passwords if there will be more than one. Or as manar says it could be linked up to a database or external file via cold fusion or php that would have all the logins or passwords. or they could directly link within the actionscript but i haven't seen any evidence of this yet. Plus the best security and what they have been doing so far is to not post or have the logins or p/w stored anywhere until you want them used.

[2fingers]

Now what do we do here ?

We decompile the swf files in their elemental parts : images , sound , video , actionscript ; this is not always a clean process and we end up sometimes with plain ... garbage .

Why we do it ?

Because it's easier for other people to analyze the uncompiled material ( specially sound and video )
Because sometimes you CAN'T see what's going on ( ie : devs putting 60frames per second when human eye can only see 24fps ,, oh ok 30fps with postimage effect!! )
Because there may be hints in the source code !
...



the ending up with plain garbage is classic :D
and you forgot to put it in that atleast i do it cause it is fun

[ILoveEko]

manar, thanks for the addition to the first post! :D I understand some of this stuff, but your post helped explain some that I don't. :Hugglepounce:

[goAlvar]

I was trying to decompile the flash thing myself and found this guy as an image in the content_tvad.swf file.
http://i50.photobucket.com/albums/f316/algovar/image4.jpg
Alvar?

[ILoveEko]

Nice, Algo! :D
I don't remember seeing him anywhere before... then again, I can be a little forgetful sometimes, lol. :p But yeah, I don't think I've seen him before. :D

[rvturnage]

I was trying to decompile the flash thing myself and found this guy as an image in the content_tvad.swf file.
http://i50.photobucket.com/albums/f316/algovar/image4.jpg
Alvar?

Nice find...I've not seen it before. Sadly, I don't have any of the software here at home to play with this stuff :mad:

Can you tell if it's in use anywhere in the file, or if its simply stored there? It could be a leftover image they had, possibly as an alternate to one of the board members or something...