Location: Atlantis, Colorful Tower
Depth: 395

Solution to Image

Concept by Zev Benjamin, Joshua Oreman, and Rassi; implementation by Joshua Oreman


The puzzle is a file called "image" with no extension. If you download it and try to open it, or run file on it, you'll probably find that it's a TIFF image, which looks like the following maze, with complex non-graphical patterns on the top and bottom and some noise inside the maze walls. Each square of the maze contains a unique byte value represented in hexadecimal.

There is only one solution to the maze, and solving it gives the following path:

The bytes in this path are all unique:

B8 A2 E1 B7 C8 C6 1B FB A0 F2 C4 F8 A5 9E CA E5 A8 A4 98 4D 4F 55 4E 54 5F 46 49 4C 45 BA 88 0D E4 05 DB 1C D7 52 9B 97 94 51 F1 AD FA 06 AA 12 8C 13 E6 DD B5 ED 42 9F 0F 0E EA F6 80 C0 0A A3 19

Most of them appear random, but there's a sequence (bolded above) that's valid ASCII for MOUNT_FILE. By noticing that, or by getting suspicious about the patterns above and below the maze and running something like file --keep-going, or by running strings on the file and seeing things like /mnt, it's possible to realize the "image" file is also a valid ext2 filesystem image.

The root directory of the mounted filesystem contains a file image, which is a TIFF image containing the "START" square from the maze, and a directory south. Descending into south puts you in a directory that contains another image file (a TIFF of the EE square) and subdirectories north, south, and east; and the pattern continues.

Each directory in the filesystem represents a square in another maze that has no relation to the one in the image. The byte inside the square is whatever the image file contains, and the walls of the square are defined by the directions you can move from this one: e.g., if you can go north, there's no wall above you. The directions work exactly like you would expect them to in a maze, though they're a bit strange for a filesystem: if you go south and then north, you wind up back where you started. (This is implemented by directory hardlinks, which most operating systems won't let you create but which can be accessed just fine in a read-only filesystem.)

The filesystem maze can be solved manually or programmatically to produce the following path:

EE EB A6 F2 86 83 49 BE 80 B7 8A BB EA DA 8F A1 88 E5 D6 1E 18 10 1C 69 0F 07 05 15 1D ED D9 57 DF 25 9D 53 85 72 D0 D2 CD 71 A2 E2 B6 50 EF 32 CA 5A AA 98 95 A4 0C BF 46 40 A5 B2 C5 E0 39 92 2E

This path is the same length (65 bytes) as the one produced by solving the graphical maze. XOR'ing corresponding bytes together gives:

56 49 47 45 4E 45 52 45 20 45 4E 43 4F 44 45 44 20 41 4E 53 57 45 52 3D 50 41 4C 59 58 57 51 5A 3B 20 46 4F 52 20 4B 45 59 20 53 4F 4C 56 45 20 46 49 4C 45 20 49 4E 20 49 4E 4F 44 45 20 33 31 37


Inode 317 is a deleted inode (it doesn't correspond to any file you can reach from the root directory) but a tool such as debugfs can easily extract the data blocks it references. They're... another maze with stuff on the top and bottom! This time only an 8x8 one.

Which also happens to be another valid ext2 filesystem. Do the same thing to it that you did to the big maze. Solve the graphical maze:

2C 6A 3F 2B 79 30 70 60 7F 72 29 38 7A 21 39 32 78 6C 2A 65 25 24 27

Mount the filesystem and solve the filesystem maze:

68 2F 7C 64 3D 75 31 2E 2C 27 7A 71 34 66 72 77 21 25 67 24 62 61 74

XOR the two same-length solutions together:

44 45 43 4F 44 45 41 4E 53 55 53 49 4E 47 4B 45 59 49 4D 41 47 45 53

Which is ASCII for DECODEANSUSINGKEYIMAGES. Use the key IMAGES (really IMAGESIM, since the key gets repeated until it's the same length as the plaintext/ciphertext) to de-Vigenere PALYXWQZ and you get the answer: HOLSTEIN.

How it works

Nothing in this section is required figuring-out for solving the puzzle, but it's interesting nonetheless.