PIXELKNOT GENERAL

1_m2TxftKgufz3i_CvdybVJg

/qresearch/

https://archive.is/HchFi

You'd be amazed how much is shared on /pol/

0_PDlwBQSymrdu7_5D[1].jpg

https://archive.4plebs.org/pol/thread/170109703/ Hello I am a reporter from CBS.

1_Wu-LPq1zKK-R5lsT67nRYA.jpg

https://archive.4plebs.org/pol/thread/179461614/#179476204

and on medium.com

1_agrJgMO-s-RsbCy6Eepp8Q.jpeg

https://web.archive.org/web/20180730212802/https://medium.com/@jamesmcavoy09/5-interesting-things-everyone-should-know-about-cigars-6100d6a1a6ac

https://medium.com/@jamesmcavoy09/5-interesting-things-everyone-should-know-about-cigars-6100d6a1a6ac

0_kg8VD6qd0xL1M5-X.jpg

https://web.archive.org/save/https://medium.com/pedophiles-about-pedophilia/you-say-potato-i-say-pedophile-5a9ad0ee0f99

https://medium.com/pedophiles-about-pedophilia/you-say-potato-i-say-pedophile-5a9ad0ee0f99

1-lRz-cOnX2WtHdqwo5BWf-Q.jpg

https://web.archive.org/save/https://medium.com/@allanishac/body-language-experts-say-trump-often-flashes-triangle-of-satan-hand-gesture-5b592002c1e8

https://medium.com/@allanishac/body-language-experts-say-trump-often-flashes-triangle-of-satan-hand-gesture-5b592002c1e8

1*WkosvaZ2ARJ2hnmXFs02Ow.jpg

https://medium.com/@nathanielhebert/around-the-world-with-phineas-phileas-fogg-11b23048550e

https://web.archive.org/save/https://medium.com/@nathanielhebert/around-the-world-with-phineas-phileas-fogg-11b23048550e

0_xFDd1jWKzAU7BI6v.jpg

https://web.archive.org/save/https://onehallyu.com/topic/690975-%E2%80%98incredibles-2%E2%80%99-smashing-records-with-174m/

https://onehallyu.com/topic/690975-‘incredibles-2’-smashing-records-with-174m/

PIXELKNOT STORY

q drop about pixelknot

>https://8ch.net/qresearch/res/2298164.html#q2298508

>>2298508

anons found pixel knot messages posted on /qresearch/ before Q drop

>>2347619

>https://nofile.io/f/PR5CxvthaYp/jpeg_ffd8_ffdb_0084.zip

sha256 hashes

>https://pastebin.com/4e6Eswvc

>>2350592

pages they were posted

>https://pastebin.com/z4cXBLMv

html files of pages

>https://nofile.io/f/vQUoqymbq79/original_htmls.zip

original filenames of the images

>https://pastebin.com/qnieJg81

original weird filenames

>https://nofile.io/f/czFOXr2wYBF/out.zip

YOU CAN HELP

look at the old posts, at the id of the post and replies

find the originals

figure out clues for the keys

hiding in plain sight?

examples

https://8ch.net/qresearch/res/624511.html#q625298

>>625298

https://8ch.net/qresearch/res/1828419.html#q1829054

>>1829054

https://8ch.net/qresearch/res/1531874.html#q1532685

>>1532685

https://8ch.net/qresearch/res/1508591.html#q1509109

>>1509109

https://8ch.net/qresearch/res/1477025.html#q1477588

>>1477588

https://8ch.net/qresearch/res/2313270.html#q2314068

>>2314068 Exodus Chapter 8

BREAKING THE ENCRYPTION

none of the images have been cracked yet

these methods are confirmed to work on test images

PixelKnot on Bluestacks

>https://www.bluestacks.com/

>https://guardianproject.info/releases/PixelKnot-0.3.2-RC-1.apk

>>2298508

>https://guardianproject.info/apps/pixelknot/

use the last 1/3 of the password to crack first layer of f5 encryption

PixelUnknot

>>2311401

>https://github.com/banona/PixelUnknot

f5.jar

>>2325105

>curl https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/f5-steganography/f5.jar –output f5.jar

>java -jar f5.jar x -p plan -e out.txt Q4example.jpg

>cat out.txt

>>2371258

>>2365916

>It is possible that somewhere in the world there exist a piece of editing or conversion software that outputs jpeg headers in exactly same way?

great question!

f5Android library was ported in 2012

https://github.com/harlo/F5Android/commits/master

it was modified in 2/10/17 to remove the JFIF header (on line 666)

that change was merged to guardianproject f5Android 2/15/17

https://github.com/guardianproject/F5Android/commits/master

the pixel knot versions on the download page do NOT have the change (all 2015 and earlier)

so ONLY the play store version has the change

AND

the two devs involved in removing that header don't commit very often to the project, it's a strange change to make…

https://github.com/guardianproject/F5Android/commits?author=n8fr8

https://github.com/guardianproject/F5Android/commits?author=harlo

especially by this person

https://freedom.press/people/harlo-holmes/

this is not a popular library

0% CHANCE ANOTHER PIECE OF SOFTWARE IS USING THIS LIBRARY

>>2371258

PixelKnot posted to /pol/

Q predicted this

0_PDlwBQSymrdu7_5D[1].jpg

https://archive.4plebs.org/pol/thread/170109703/ Hello I am a reporter from CBS.

1_Wu-LPq1zKK-R5lsT67nRYA.jpg

https://archive.4plebs.org/pol/thread/179461614/#179476204

>>2371258

pixel knot posted on medium.com

>>2371258

stegdetect thinks these have f5 data, and they all have the PixelKnot signature

0_PDlwBQSymrdu7_5D.jpg : f51.687834

1_v3vvVO3DuvEB-osQDcIqlw.jpeg : f51.664398

1_Wu-LPq1zKK-R5lsT67nRYA.jpeg : f50.652062

1_xv-xqPhM_w3qdIatlg8L9A.jpeg : f53.026896

1-0V2r2vC9pJRhMu8E_i0B7A.jpg : f51.590077

f5 detected in all of these with the PixelKnot header

00c9c0a7f1e16262b2fc85bda8bf7f35d87777fa4ce17aedf2cb111be3fa8c19.jpg : f51.487972

18e535c2558973824cf2f11ea009066d0cd1fe3ac6c8b4bc0d5fa687d89da67a.jpg : f51.077547

1b01e2fbd7483fe2167a417ed605269fa0fc8aaf9bbd1859898ea13b22ba4dee.jpg : f50.754573

252ff478b5b8fff4c1f21d2a2fc1e7fb7fe63567f97c0d48f8015554c238f95f.jpeg : f50.629857

262033564a1203326fea09ce1690e6466d577eb328c2f701a38781041a95f865.jpeg : f50.635810

27cbddbc07d9b2e1fd99e4a79027b84f7dfbfc036fc446e216c8c5d79c524f45.jpeg : f51.069136

310f67a6d8347ca66d1f9834c57590f0d848599155233ced507339e12dff764f.jpeg : f51.430104

3acfcd9010a0c4ac35b0094eba3091edd503c8567e19245bf4439d933783d499.jpg : f51.762944

419a76281780faaba70a562eadb3259afa20f110bde50d6b3a59611a1990c63e.jpeg : f50.652062

43cade15e74ea33de94fe1e348366276d52b586f3e3cc37aa5c78740730282dd.jpg : f50.672636

593888383f3b0cb45830b446e147fb0a63fa2323f2d5cae0fa667f432537ad7f.jpeg : f51.720412

595033569a40a6b9371eec9374ee85f5f9f15cb795abcb231d743c632ca8c8e2.jpeg : f51.646860

66e906944458a8e86480d8a5a167d8d59d7439f1a50a7606990ecaff2d875d1a.jpg : f50.313252

68ccb4146da74068a0d8749ac6bd3dab249e1a6d947c8ee106ef5bfdc0c9cf6e.jpeg : f53.026896

8956211e37873f95544dc8411b96cec78ab9015e5ab1bfb32e77dcf7e23efffa.jpg : f50.385592

9a63066551a3fb4c3372b0de92d1f2765f5e3282407a9eff8f02bda18abc19f0.jpeg : f50.646259

a1677d3d755fabf1c73b1786f5ac39f714c59cf72fc288029c166f9be119b7cf.jpg : f51.687834

a5e5c137d0b352d8dbacaf8e2802f62bf59dac5dbd2b6af2d8379ac308b7b3d8.jpg : f50.369714

be471d6d62109bc5be47082d1cf9a537777d9f6de5b1d777d4ee113a9c47ab63.jpg : f51.220465

c17f5a9d1c3a40b5a866c68c964919f0e9dd29cd22f65d42817e6fb98f9baade.jpeg : f50.531815

ce753f2d52183cbfa45b036d424ae516ce052f7b5b199b9f104db4f3b2ebc33d.jpg : f51.233975

da6e9b4af508b04b76ec9882d59d6e85477e56f0c099914cf0f28f6a78f4b1c4.jpg : f51.661258

db993b32deab77deff84aed2d656da90f820e6e0a86419368c7fddf3a3399557.jpeg : f50.540917

e32140dca7b6a613fc23e47d7c7fb80ee953ae905328bff12a63afbade44cddc.jpeg : f51.664398

e5393fba4fcca1dab2d66f98e520503ca942e3bf42bae78de2aa08c8576fa024.jpg : f51.590077

e6b8db63781c16e82f72a5ed3fea3bfda5913bcd4b8bc881a81641b4b803ba8e.jpg : f51.484567

ec1a0995e2b221546988a8e79fd4432f4464bef83a01b625a29b28192f2a083e.jpg : f50.366998

ee59b2d2e90904a33d5176302c4982d0496a1536cf16aa73f6029d4ff0734878.jpg : f51.828625

f5ee16710b749e2c4dd3e95a1f725723b322f9963010256dc3cffad0eddff752.jpg : f51.235872

fb4155bf04f4b1dbe5cd387772dd7b02c33165c5cd8d4f244ff89743e9dfdeb6.jpg : f50.626920

>>2371258

focus on the evil eye posted to /pol/ on 01 May 2018 14:22:30

0_PDlwBQSymrdu7_5D.jpg : f51.687834

Hello I am a reporter from CBS.

tried every 3 letter combo already

>>2372226

>are you are saying the app store version is incompatible with the F5 library

no

the change looks compatible, the header is optional

I have decoded the Q4example.jpg with google code f5.jar build in 2011 (where f5Android was ported from) and from the most recent source on windows using sun jdk 1.8

not sure if openjdk or linux would be different

java -jar f5.jar x -p plan Q4example.jpg -e msg.txt; cat msg.txt

Huffman decoding starts

Permutation starts

172800 indices shuffled

Extraction starts

Length of embedded file: 88 bytes

(1, 127, 7) code used

—- PK v 1.0 REQUIRES PASSWORD —-X2InRnMHwOY+GdUR

TO35nRz9oRcsyttLFXwY/4eNcONHaSTS

>>2372815

f5 layer with last 1/3 (non)

java -jar f5.jar x -p non -e msg.txt ../../Downloads/760ba9dfcb03613b2db84902b7dec4c2edba182945542a18456b9a18cda2a857.jpg; cat msg.txt

Huffman decoding starts

Permutation starts

1238400 indices shuffled

Extraction starts

Length of embedded file: 104 bytes

(1, 127, 7) code used

—- PK v 1.0 REQUIRES PASSWORD —-vNOvTv6i78CsQvHg

WUnqE8Qmo0GnUuJ/Gj52/pRgCjCkPGuRF00t8+Kd0w+ccVU=

PixelUnknot

CORRECT PASSWORD qanon

==

Evil Everywhere …

==

>>2372909

>>2372909

>>2372909

NEW PIXELKNOT IMAGES

>>2372909

great work anon, this image is small enough i can try 2000 passwords/second -

tried all 3 combos (rules out all passwords < 10)

takes 7 hours to go through all 4 char combinations (all password < 13 chars)

if we crack one image it might give us a clue on the passwords for the other

>>2371258

ANOTHER WEBSITE WITH PIXELKNOT

0_SVRAr3qJsZsv1Z4H.jpg

https://web.archive.org/web/20171027003748/https://nyulocal.com/love-and-no-other-drugs-how-big-pharma-is-screwing-us-7d7445db7b38

https://nyulocal.com/love-and-no-other-drugs-how-big-pharma-is-screwing-us-7d7445db7b38

updated PixelUnknot main with timer

https://pastebin.com/KrbEYrE7

>>2374860

you need two files, the image and text file with the list of passwords to try

you can run in intellij with this run config (see pic)

or command line

jar -cp "<classpath crap>" q.Main Q4example.txt passwords.txt

>>2374887

i wish, need to have java's secure random and that won't run on a GPU

>>2373544

it's a stretch, jpeg header can come in any order this is unique. only way to know for sure is to decode one of these or find another piece of software that does the same.

look at the images - they are creepy - and some of them are unique enough to find the sources - different websites images with the same naming convention 1_XXXX_XXXXXX that were posted on qresearch over the last few months

>>2374970

james is an implementation of f5 jpeg encoder, so if it is another program it'd probably be a f5 steg program too

https://github.com/otuncelli/f5-steganography/blob/master/F5Lib/James/JpegEncoder.cs

these look like ports of the original java both write the JFIF header on encoding

java

https://code.google.com/archive/p/f5-steganography/

c#

https://github.com/otuncelli/f5-steganography

python

https://github.com/jackfengji/f5-steganography/

>>2375234

hmm pretty widespread, still all write JFIF

https://github.com/lxyu/52pai/blob/master/j2me/src/me/zhaoren/JpegEncoder.java

https://github.com/abronte/f5-steganography/blob/master/src/james/JpegEncoder.java

https://www.media.mit.edu/pia/Research/deepview/src/JpegEncoder.java

weird that somebody would move it down to line 666 and comment it out

>>2375234

>>2375351

https://www.google.com/search?q=WriteArray%28JFIF%2C

>>2375392

missing JFIF and signature at 0x88

>>2375416

it's not Q using PixelKnot it's them…

they are trading information over these images posted places, on /pol/ …on /qresearch/… on medium.com

they are using them to identify each other

>>2375569

exactly - only pixelknot encoded images are missing that - f5 will decode it

>>2375588

pixelknot only does jpg/jpeg

>>2375964

>>2375198

>>2376015

this fellow anon is how you recognize them

they want to slide the conversation with arguments that are easy to argue

glad we have your attention

>>2375031

the code is trying to find the last 1/3 of the password

here is a Main.java that decodes the message

https://pastebin.com/YmUkxvBk

>>2375793

>>2375858

exactly right

pixelknot uses the last 1/3 of the password for the f5 encryption

the rest is for the AES encryption layer after

if we can find the last 1/3 of the password we can PROVE there is a pixelknot message in one of these images

>>2376582

does it work with Q4example.jpg and passwords.txt ? might be that qanon is too short of a password

>>2376757

don't forget single and double quotes

I'm running this on all the images

crunch_win.exe 1 3 'abcdefghijklmnopqrstuvABCDFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+=-[]\|}{,./<>?" '"'"

and running

crunch_win.exe 4 4 'abcdefghijklmnopqrstuvABCDFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+=-[]\|}{,./<>?" '"'"

on evil eye

>>2376835

see you glowing

>>2376809

>>2376829

oh yeah i switch too when the new file bundle came out, i'm trying 4 char combos on the smallest image

progress - count: 30089632 elapsed: 15622s = rate: 1926 pw/s

>>2377022

download these two batches of files

https://nofile.io/f/PR5CxvthaYp/jpeg_ffd8_ffdb_0084.zip

https://anonfile.com/h8k8Adf3b6/pkfiles.zip

>>2377210

research where they come from

>>2377224

>>2377229

>>2377313

>If it's unicode, you can safely assume UTF-8, given it's a pretty widespread standard.

yeah great point … looked at the code and no reason why unicode passwords wouldn't work

>>2377313

>>2377440

WHY NOT EMOJIS???

https://emojipedia.org/google/

>>2386977

i've done CUDA and been looking at f5 and no it would not be a good fit… too bad too because i've got some monster gpu power

>>2387734

>only people stupid enough to use that app are media types. Well, that's interesting

started in 2012

n8fr8 and harlo are contributors up until 2015

sep/nov 2016 N-Pex starts updating and 2.0 is released 11/20/2016

out of the blue on feb 15 2017, n8fr8 updates the f5Android "update F5 to latest with fix"

but that "FIX" is only the removal of the JFIF header making it possible to easily identify PixelKnot images

without that "FIX" PixelKnot images would not be easy to detect

would look like any other images from software that uses james jpg encoder or f5 encoding

and that change was pushed down to line 666

intentional?

>scrapping them from the archives of /pol/, 4/pol/, perhaps QResearch

THIS

brute forcing encryption is the worst way to figure this out

search for more images

look where they come from

find patterns

>>2376809

>>2377012

no decode on 2c19435a6c6d0b75661f8bed4269e540bdea162d20426e2865fa99473d164863 (scroll wheel)

with

crunch 4 4 'abcdefghijklmnopqrstuvABCDFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+=-[]\|}{,./<>?" '"'"

no decode on any with default passwords

currently running 1 to 3 char combos on all from smallest to largest

imghunt/11dc6ed351634c39a8faee69dc8c85b5a8a83c8f58485d69711a71a68e19783d.jpg

Huffman decoding starts

count: 12378 elapsed: 60s = rate: 206 pw/s

>>2391530

this rules out a lot of passwords anons might dream up

>>2391741

the 13 char filenames are the hashes from qresearch, you have to find the original filenames

>first batch

https://nofile.io/f/PR5CxvthaYp/jpeg_ffd8_ffdb_0084.zip

original filenames of the images

>https://pastebin.com/qnieJg81

we don't have filenames for the second batch

>https://anonfile.com/h8k8Adf3b6/pkfiles.zip

>>2390758

this code change makes NO SENSE

https://github.com/harlo/F5Android/commit/0c2191190a99cd4af2aa8cf540624eda2a8fb8ae

>>2393746

Another suspect change on 1/7/17

https://github.com/harlo/F5Android/commit/1f99dcd6cb30c47bf10ab4d6e8358475664d917b#diff-800464caea7ea0476f99b839816c41d5

why add jni c++ buffers for performance?

quietly change the encoded quality from 80 to 90?

were they TRYING to make the PixelKnot images detectable on 1/7?

did it not work so so then they made the change on 2/10 to remove the the JFIF header?

spidey senses are tingly

>>2394093

oh, no that was in 2013… the only change besides the 2017 change

>>2394128

before 2/10/2017 pixelknot f5 encryption layer had a fixed password of abcdefg123

it was ALWAYS possible to detect a pixelknot image, the method just changed on 2/10/17

there might be .jpg with JFIF header out there that can recognized with f5.jar with the password abcdefg123

https://github.com/harlo/F5Android/commit/08ebe47b1a0bba6ccc3fcc5f8f9edc467192d224#diff-97fa33d4b689c96d713de0b334e82b14

>>2394535

can somebody with an archive of images download f5.jar and run

for F in .jpg .jpeg; do java -jar ./f5.jar x -p 'abcdefg123' -e $F.msg.txt $F; done

strings *.txt

i do find some images lock up the f5 decrypt, you may need to kill some java processes along the way

>>2391741

the original filenames we have found all start with a number.. the PixelKnot source will append a _1 when it is writing out if the file already exists

are the filenames reversed?

D5_7udrmySQBwlDP_0

v6IB7UAzKWj1dDFx_0

wO20sFXmnh2JRA2ZavsokW*1

Q8ppeE6yCbsR-s-OMgJrga_1

gJVbydvC_i3zfugKtfxT2m_1

wlqIcDQso-BEvuD3OVvv3v_1

AYRn76Tsl5R-KKz1qPL-uW_1

A9L8gltaIdq3w_MhPqx-vx_1

A7B0i_E8uMhRJp9Cv2r2V0-1

g9k2Pll-RU8LzVao0UMvqA-1

Q-fWB5owqdHtW2XnOc-zRl-1

WAIT ANONS AM I CRAZY??

>>2371666

>>2395061

>You'd be amazed how much is shared on /pol/

https://archive.4plebs.org/pol/thread/170109703/

0_PDlwBQSymrdu7_5D[1].jpg

Hello I am a reporter from CBS.

>0_PDlwBQSymrdu7_5D.jpg

think mirror

>D5_7udrmySQBwlDP_0

evil eye posted on 5/1/18

Q drop 1332 about D5 was on 5/10/18

>The snowball has begun rolling

D5 = Checkmate

https://qanon.pub/?q=D5

Q drops about D5 4 time in may

and then again RIGHT AFTER we figure out the f5 layer of PixelKnot

>>2396481

install java

open terminal

download f5 jar from google code

curl https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/f5-steganography/f5.jar –output f5.jar

here's how to test a password on the f5 layer (this will only be the last 1/3 of the full password)

java -jar f5.jar x -p plan -e out.txt Q4example.jpg

cat out.txt

>>2396504

scaling, flipping, or modifying in any way will remove the hidden data

BAKER PLEASE NOTABLE

>>2396389 was D5 the CBS PixelKnot Message on /pol/?

>>2396389

PIXELKNOT IMAGE ENDS IN -Q

this was posted to /qresearch/ 07/08/18 during 20 days of silence

1-lRz-cOnX2WtHdqwo5BWf-Q.jpeg

filename ends in -Q (extra group from other filenames)

pixelknot header

same image on

https://medium.com/@allanishac/body-language-experts-say-trump-often-flashes-triangle-of-satan-hand-gesture-5b592002c1e8

posted 7/11/18

filename is diffferent

1_FCAsiu79H2b2aUGLdD7mBw

both PixelKnot

not the same files

>>2397994

oops not the same image

>>2398004

all these images on

https://medium.com/@allanishac/body-language-experts-say-trump-often-flashes-triangle-of-satan-hand-gesture-5b592002c1e8

have pixelknot headers

>>2398467

yeah

here's an article written before the PixelKnot header change:

Jan 31, 2017

https://medium.com/@lewispants/i-was-fired-from-my-journalism-job-ten-days-into-trump-c3bc014ce51d

missing JFIF and has the second sig

>>2398467

not all of these were posted on medium.com

there is (at least) one other piece of software that makes the same header

stegdetect doesn't find any f5 data in medium.com images

1_b3jcMKfQQzl0t56L1kiuZQ.jpeg : negative

1_OF9MABBWU8CN6Dmyu1N32w.jpeg : negative

1_V7KBi6mUHK914qssJEFwfw.jpeg : negative

others do

1_FCAsiu79H2b2aUGLdD7mBw.jpeg : f51.949593

1_S72sax0zPtFX7yE-9hlxYg.jpeg : f51.565821

1_Wu-LPq1zKK-R5lsT67nRYA.jpeg : f50.652062

1-0V2r2vC9pJRhMu8E_i0B7A.jpg : f51.590077

CBS evil eye

0_PDlwBQSymrdu7_5D.jpg : f51.687834

>>2398947

STEGDETECT F5 IMAGES

the missing header is not unique to PixelKnot (doh)

images with the missing header that stegdetect thinks have f5 data

https://nofile.io/f/UCGFkYAMMxN/f5-detected.zip

https://nofile.io/f/UCGFkYAMMxN/f5-detected.zip

https://nofile.io/f/UCGFkYAMMxN/f5-detected.zip

>>2399203

"The results obtained shows that

the ratio of false positive generated by Stegdetect depends highly on setting the sensitivity value, and it

is generally quite high"

https://researchportal.port.ac.uk/portal/files/187568/Microsoft_Word_-Stegdetect_article-_Final.pdf

>>2399442

not sure this image is after the change this is right at the same time

when was the build was pushed to the store?

stegdetect really things there is something but with a small image like that who knows

68ccb4146da74068a0d8749ac6bd3dab249e1a6d947c8ee106ef5bfdc0c9cf6e.jpeg : f53.026896

right header

>>2400699

> The DQT header

> 0 is the luminance index and 1 is the chrominance index

>>2401525

>>2401556

is it possible to use emojis for the passwords?

can an anon try?

>>2401150

glad to help anon

good to double check work

>>2417299

running 3 char combos on these files

>https://nofile.io/f/UCGFkYAMMxN/f5-detected.zip

'abcdefghijklmnopqrstuvABCDFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+=-[]\|}{,./<>?" '"'"

these files done scanning with all 3 char combos and no matche

f5-detected/a5e5c137d0b352d8dbacaf8e2802f62bf59dac5dbd2b6af2d8379ac308b7b3d8.jpg

f5-detected/2c19435a6c6d0b75661f8bed4269e540bdea162d20426e2865fa99473d164863.jpg

f5-detected/51122a1f8b76dbb185dfcece22a900a07165f4f270f414afd4e4eef183863cf8.jpg

f5-detected/a1677d3d755fabf1c73b1786f5ac39f714c59cf72fc288029c166f9be119b7cf.jpg

f5-detected/abbbd389003d0b2b919ac73fcb490239be4570effacacd9c653ebbe2e2940fc8.jpg

f5-detected/11dc6ed351634c39a8faee69dc8c85b5a8a83c8f58485d69711a71a68e19783d.jpg

f5-detected/8b74493ae9233d7ed319efe95b96f9d1e16a3975c3a8d9ab1361b3fe5be4b5a8.jpg

f5-detected/18e535c2558973824cf2f11ea009066d0cd1fe3ac6c8b4bc0d5fa687d89da67a.jpg

f5-detected/1b01e2fbd7483fe2167a417ed605269fa0fc8aaf9bbd1859898ea13b22ba4dee.jpg

f5-detected/b4ffa2fe6ba7c7b732e36af3595e33a38893146d1411be202c3bc259c2d5b2ec.jpg

f5-detected/be471d6d62109bc5be47082d1cf9a537777d9f6de5b1d777d4ee113a9c47ab63.jpg

f5-detected/f5ee16710b749e2c4dd3e95a1f725723b322f9963010256dc3cffad0eddff752.jpg

f5-detected/9d65a2f8806914b900b7e51e3a16500b60b7f48dc3f52cf82958761c8aac3e96.jpg

f5-detected/57139014c39d5726885d566ad5ba134c275f7fd90ac920f7a171a4adb7dcd095.jpg

f5-detected/ef56efafa8857c6bd9f3e80f5fcdc24749ff27a95dfc0f9313cee0f4b0687c79.jpg

f5-detected/e5393fba4fcca1dab2d66f98e520503ca942e3bf42bae78de2aa08c8576fa024.jpg

f5-detected/60162fec45db2cd5f40b130fbf24f8b921748c965d297816850fb3035ca57904.jpg

I went through the rest of the f5 detected images and did google image searches and ruled out images that I could find somewhere else and was left with 3. The CBS eye I left in because it was posted on /pol/ and has 5D (D5 mirror) in the filename

focusing on these three now

https://nofile.io/f/au6mKPYtznQ/f5-remain-2.zip

>>2427826

https://pastebin.com/bem2GEHW

>>2431983

WWG1WGA

https://pastebin.com/p4TJ7smz

>>2425587

makes sense… these drops keep coming to mind though

https://qanon.pub/?q=EYE%20OF%20RA

EYE OF RA.

Left eye [marker].

Symbolism.

https://qanon.pub/?q=clear%20sight

How do you hide a message in clear sight?

https://qanon.pub/?q=%2Fpol%2F#1715

You'd be amazed how much is shared on /pol/.

Data exchange.

https://guardianproject.info/apps/pixelknot/

>>2437477

>Huma interviewed by FBI on Jan 6 2017

>Harlo code change on 2/10/17 (gradle build #5)

merge of all harlo's local changes for the last 3 years she pushed to gitlab.. removed the JFIF header then merged into guardian project F5Android, then consumed by PixelKnot and playstore image was updated (but not the .apk on the download page)

>John Podesta joins The Washington Post as a contributing columnist February 23, 2017

https://www.washingtonpost.com/pr/wp/2017/02/23/john-podesta-joins-the-washington-post-as-a-contributing-columnist/?noredirect=on&utm_term=.448a78f09f96

>>2439136

if it was easy it would be your mom

>>2439394

thank you we needed a bump

>>2442019

>>2439394

>>2439136

all this attention for little me?

you're making me blush

>>2446299

good thinking anon

been using stegdetect which does this exact thing for f5

what we know:

• images made by PixelKnot before 2/10/17 were f5 encoded with the password abcdefg123 (these would not be compatible with the latest version of PixelKnot)

• images made by the version after 2/10/17 (on play store) are missing the JFIF header (a few websites like medium.com match the same signature, not sure why) and are decoded with the last 1/3 of the full password

anon with archive of jpg from qresearch or pol

might be worth it to try to decode any jpg with f5.jar using password abcdefg123

for F in .jpg; do java -jar f5.jar x -p abcdefg123 -o msg.txt $F; cat msg.txt; done

>>2425587

ruled out 54,700,816 4 letter combos on evil eye

/crunch 4 4 'abcdefghijklmnopqrstuvABCDFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+=-[]\|}{,./<>?" '"'"

either false positive or password is longer than 12 chars

found the pedo ring image on walmart.com, looks like they strip the 'JFIF' header too

https://www.walmart.com/ip/14K-White-Gold-amp-Diamond-Triangle-Spiral-Ring-size-5-5/191794612

found the vineyard jpg on medium with the missing header

https://medium.com/@Levi.Smith/did-john-podesta-just-tweet-out-an-admission-to-justice-scalias-murder-69f9ba941a1b

found the evil eye too

https://landonbuford.com/press/0_pdlwbqsymrdu7_5d/#.W2XS4yhKj-g

https://web.archive.org/web/20180804162236/https://landonbuford.com/press/0_pdlwbqsymrdu7_5d/#.W2XS4yhKj-g

>>2449002

crunch string was missing a few chars ~-`

should be

crunch 1 4 'abcdefghijklmnopqrstuvABCDFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_-+=-`~[]\|}{,./<>?" '"'"

trying all 1-4 combos with those missing chars on the evil eye (8m should take about 6 hours)

>>2449226

landon uploaded the evil eye may 2018, same month it showed up on pol

BUT - the landon photo with the same filename does not have the pixelknot header (and doesn't decode with abcdefg123)

found cbs-logo.jpg that is the same size on from 2018

https://www.neowin.net/news/cbs-launches-ios-app-windows-8-version-coming

it doesn't not have the JFIF string but doesn't match the PixelKnot header

>>2449706

>>2449249

done, none of those

>>2371551

>>2371666

>0_PDlwBQSymrdu7_5D[1].jpg

can't get over this filename…

what software renames files with square brackets [1]?

seems more like a Q post

[1]D5 7udrmySQBwlDP 0

found an automated cryptogram solver https://quipqiup.com/

7udrmySQBwlDP = 7in the COMpaNY

Q says less than 10 can confirm, read somewhere that 3 were non-military, would leave 7 in the company

[1]D5_7in the COMpaNY_0

maybe reading tea leaves here

still brute forcing…

(pic unrelated)

>>2469199

right now the code

https://github.com/banona/PixelUnknot/blob/master/src/q/Main.java

loads the words from the file and tries it (and every substring of the end over 3 chars) to decode the f5 layer. it early exits if the chars don't match the PixelKnot special string '—-*' and if it finds one it will print out the pass and exit. this would be the last 1/3 of the password and we can change the code back to try to decode the rest

this code is a little better, tries the word backward and forward and prints out the progress

https://pastebin.com/ZRUAzEPh

>>2463782

anon multithread it like this:

Files.readAllLines(filePath, StandardCharsets.ISO_8859_1)

.parallelStream()

.forEach(line -{

// your code

});

see https://pastebin.com/ZRUAzEPh

>>2397994

>>2398717

java has supported writing jpeg in imageio since 5

why do medium.com images look like they written by a modified james jpeg encoder?

they didn't always have the same header, changed after 2013

f5 encoding something in the images?

>>2472406

https://archive.4plebs.org/pol/thread/170109703/

it was [1] on the /pol/ post

HERE is the evil eye on medium

different size same filename

https://medium.com/fgd1-the-archive/cbs-logo-1951-510fe0d2607b

that makes all of the images that anon have found matching the pixelknot header that were originally on medium.com

Going back to Q Silverman drop

>>2305975

the file in the drop is IMG_382.jpg which didn't have the PixelKnot header or stegdetect didn't find anything… but the next day this post shows up on pol with IMG_0457.jpg and stegdetect thinks it has something (maybe false positive, not pixelknot header)

LOOKS LIKE A TRAP

Reddit post about PixelKnot looks like a honeypot

USE A VPN/PROXY/TOR

CORRECT PASSWORD Red Pill

==

Do you have the skills to handle dangerous files? Want to help take down the cabal? Go here - <URL SHORTENED>

==

leads to https://pinkbunnies.club/whiterabbit/blog/12/the-final-countdown

picture has the JFIF header so it was made with an older version of PixelKnot (from the download page)

seems like a huge time waste or trap to catch people like us

be aware

playing with medium.com images, the URL has the maxfilesize and you can change it to get different size images. all of the results have headers exactly matching the PixelKnot header (only the image size changes)

https://cdn-images-1.medium.com/max/300/1*WkosvaZ2ARJ2hnmXFs02Ow.jpeg

https://cdn-images-1.medium.com/max/1024/1*WkosvaZ2ARJ2hnmXFs02Ow.jpeg

https://cdn-images-1.medium.com/max/4000/1*WkosvaZ2ARJ2hnmXFs02Ow.jpeg

must be a server side transcoder doing the header stripping (or adding f5 steg?)

a little weird that some .png images are actually .jpg

https://cdn-images-1.medium.com/max/2000/1*QbhKIMLavtBdrZI_-DJxtQ.png

https://cdn-images-1.medium.com/max/500/1*QbhKIMLavtBdrZI_-DJxtQ.png

>>2525416

>this thing seems to have fizzled

in the first thread the shills were full force when we were digging on the silverman photo but after we started brute forcing the images .zip that anon posted with the medium.com images the clowns went away

time to circle back, figure out where we got off course

>>2300468

>>2298335

Put to death, therefore, whatever belongs to your earthly nature: sexual immorality, impurity, lust, evil desires and greed, which is idolatry. 6 Because of these, the wrath of God is coming.

-Colossians 3:5

Your evil has no place in this world.

Q

>>2298388

The author of the post…..

The face is never the author.

Direct comms come in many different forms.

Q

>>2298430

How do you hide a message in clear sight?

Q

>>2298508

You'd be amazed how much is shared on /pol/.

Data exchange.

https://guardianproject.info/apps/pixelknot/

Q

Q didn't say if /pol/ was 8ch or halfchan

the silverman photo in the drop is IMG_182.jpg, i haven't been able to find that one. every one i have found stegdetect comes up negative

the inverted one posted on /pol/ IMG_0457.jpg though does

>>2482637

>>2567164

>https://nofile.io/f/NB4x9EOZYd3/BruteCrackF5.zip

IMPRESSIVE WORK!

don't have time to try it out right now but looked at the code and awesome job

>>2567164

might be able to easily turn this into CUDA code and run on a GPU

>To do this, all I have to do is add the specifier global to the function, which tells the CUDA C++ compiler that this is a function that runs on the GPU and can be called from CPU code.

>add the specifier global to the function

>The key is in CUDA’s <<<1, 1>>>syntax. >tells the CUDA runtime how many parallel threads to use for the launch on the GPU

https://devblogs.nvidia.com/even-easier-introduction-cuda/

>>2567296

or the silverman pic was a clue to an actual encoded images, or we're going get some images later

until we find find what Q was pointing us to we can keep working on the tools to decode/detect them

>>2567296

>silently abandoned (because the approach was ill-defined and doomed to fail)

still here, still digging

keep calm, clown on

had to travel

scary all the airplane/airport goings on

>>2580354

no when i saw the silverman pic wasn't made by pixelknot i stopped

i did all rockyou (suffixes + reverse) on the evil eye

>>2576121

751+250 = 1001 posts into this dig

previous bread >>2300468

and now…

>>2567164

looked closely and I think what you did is perfect for GPU

This Coudl Be A Game Changer

setting up a CUDA dev environment now

my plan:

>rip the guts out of your code

>fill array with coeff and initial scramble

>fill array with passwords to try

>decode<<<>>>()

>returns array with 16 bytes of decode for each pass

>if any decodes start with PKZIP password string then bingo

still need more target images

what if the pixelknot header was changed to help them blend into the medium.com images?

>>2622913

>>2573936

>>2567164

dev environment setup and code is building

need to rework F5_rand_series instead generate the random numbers on demand so we can early exit and save memory

need sleep now

>>2624497

the initial code port to CUDA can decode a test image!

F5 BRUTE FORCE FOR NVIDIA GPU

F5 BRUTE FORCE FOR NVIDIA GPU

F5 BRUTE FORCE FOR NVIDIA GPU

https://anonfile.com/abW6X6fdb1/F5CUDA.zip

https://anonfile.com/abW6X6fdb1/F5CUDA.zip

https://anonfile.com/abW6X6fdb1/F5CUDA.zip

F5 BRUTE FORCE FOR NVIDIA GPU

F5 BRUTE FORCE FOR NVIDIA GPU

F5 BRUTE FORCE FOR NVIDIA GPU

>>2643661

>they don't fully reencode, but do add the missing JFIF header

did you post a pixelknot image to halfchan and then download the resulting image? could you zip both and post?

F5 BRUTE FORCE IN CUDA FOR NVIDIA GPU

>>2646329

updated: added a timer and removed some debug strings

https://anonfile.com/Yaa4Yaf8bb/F5CUDA.zip

need codefags to help cleanup, compile and distribute so others can use

>>2651955

oh wow, not only the header also coeff has been changed at 0x00146200 so the message doesn't decode…

does this rule out halfchan ???

>>2657461

NOT HALFCHAN???

7/26/18

>>2298508

You'd be amazed how much is shared on /pol/.

Data exchange.

https://guardianproject.info/apps/pixelknot/

Q

7/25/18

this infographic has pixelknot header posted in 8ch/pol meta info thread

>>>/pol/11622450

>>>/pol/11910255

https://8ch.net/pol/res/11622450.html#q11910255

>>2657955

maebe knot

>>2658285

only empty data, too small to hold any message

>>2657955

found 2 files from 8ch /pol/ with pixelknot header

this zip has jpg and .coeff files to use for CUDA or C brute force

https://anonfiles.com/b3z4acgab4/match.zip

the 8ch image reencoding is this

https://8ch.net/faq.html#what-is-alacrity

>>2652801

compile like so

>nvcc kernel.cu -o kernel

>>2651955

using a 1080 but it's my main display so it gives me trouble

fired up an aws instance with a Nvidia Tesla M60 with the cuda and it's slower than my i9

waiting for access to a V100

still sifting through 8ch/pol images and found 2 more which led me to figure out where the RAAID image came from - walmart.com - images from walmart.com are false positives for detect.py but when you look closer at the rest of the header doesn't match

https://www.walmart.com/ip/Raid-Flying-Insect-Killer-18-oz/14862629

https://www.walmart.com/ip/Christmas-Lightshow-Projection-Points-of-Light-with-Remote-114-Programs/710904858

it is 1 month after Q posts about pixelknot and /pol/ Data Exchange and we've learned

• pixelknot on jpeg, header has unique signature and only last 1/3 of pass needed break f5 layer

• halfchan re-encodes images, breaks f5 steno and can't be used for data exchange

• false positive images from medium.com (and affiliates) and walmart

• qresearch images found were from medium.com

• 8ch /pol/ images found were from walmart

• sara silverman pictures are not pixelknot

wild goose chase?

>>2664366

>>2646329

>>2646891

>>2624497

>>2622913

>>2573936

>>2570246

>>2567164

f5 cuda brute force using hashcat sha1

realized that hashcat has a faster implementation of sha1

it's in opencl, spent the morning porting to cuda

https://github.com/hashcat/hashcat/blob/master/OpenCL/inc_hash_sha1.cl

this version of the f5-cuda is more than 50% faster, get it while you can

https://anonfile.com/edn9xag8b2/f5-cuda.zip

https://anonfile.com/edn9xag8b2/f5-cuda.zip

https://anonfile.com/edn9xag8b2/f5-cuda.zip

compile with

nvcc kernel.cu -o kernel

looking for more target images, think I've ruled out everything I've seen so far

here's is what i don't get - Q links to halfchan /pol/ image IMG_382.jpg and says data exchange on /pol/ with pixelknot

but half chan re-transcodes images breaking the stego, which is why that image didn't look like a pixelknot image

https://anonfile.com/U137x1g1b9/IMG_382.zip

so okay… MAYBE the silverman picture was made by pixelknot BEFORE it was posted to halfchan but it wouldn't be a way to exchange data

>>2735242

played around with halfchan and Q4example.jpg - halfchan does re-encode the image but the message is still decodable

updated the pixelknot detection script to detect pixelknot image uploaded to halfchan along with those not, this will probably hit many false positives

it does detect the silverman picture as pixelknot

https://pastebin.com/Va79YcvC

>>2746327

new pixelknot detection script

>detect pixelknot uploaded to halfchan

>https://pastebin.com/Va79YcvC

https://pastebin.com/Va79YcvC

>https://pastebin.com/Va79YcvC

https://pastebin.com/Va79YcvC

I was expecting more false positives, this is actually a sensible list of images that the script detected

new possible pixelknot images

https://anonfile.com/zaA300g3be/matches.zip

>https://anonfile.com/zaA300g3be/matches.zip

https://anonfile.com/zaA300g3be/matches.zip

>https://anonfile.com/zaA300g3be/matches.zip

check out at the image artifacts in this one….

>>2746706

more matches fresh from halfchan

https://anonfile.com/odFe09g1bc/PixelKnotDetected.zip

turn up the contrast

>>2747975

sweet anon!

here's an updated version, I made a couple memory optimizations and added command line flags

>https://anonfile.com/B6O203gabc/f5-cuda-memopt.zip

coeff files for the new images

>https://anonfile.com/64O106g8b3/PixelKnotDetectCoeff.zip

>>2747975

>>2748092

on the smallest coeff file i'm getting 6600 pass/sec on 1080 ti and 4900 on 1080

using –blocks 32 –threads 64

had to do the tdrdelay thing

https:// www.pugetsystems.com/labs/hpc/Working-around-TDR-in-Windows-for-a-better-GPU-computing-experience-777/

>>2749627

uploaded q4example to halfchan and inspected what was the same, the order and location of the DQT and huffman table along some bytes of the huffman table

waiting on your improved version ;)

>>2749627

just for (You), updated the detect script to be more discriminating - no longer detects the silverman pic though

https://pastebin.com/MTGtP5gM

images that match

https://www.anonfiles.cc/file/7f26cd16e7b1826bd2992e320e6d1492

>>2754886

another updated detection script to rule out more false positives, 63 images from halfchan /pol/ with coeff files

https://www.anonfiles.cc/file/264d484bee72660b10306f55f0fe44f9

>>2756444

starting to see themes here

>>2756449

>>2756444

>>2756467

>>2756480

>>2756489

spirals

>>2756467

>>2756449

girls with red or flowers

>>2757678

>>2756480

wget -P 4chan -nd -np -r -l 1 -e robots=off -H -D is2.4chan.org -A jpg,jpeg https://boards.4chan.org/pol/thread/<THREADID>

for F in 4chan/.jpg; do python detect.py $F; done

>>2757806

>>2757852

>>2757868

>>2757877

downloaded 1000 jpg from halfchan /pol/ and 5% of them match PK header, probably a bunch of false positives in there

58 more images

https://www.anonfiles.cc/file/5d851d451d0ab1ff888ef21d2f66b7a5

>>2757908

>>2761102

post em and i'll take a look

the PK file sign is fairly uncommon, i've only found 178 jpg that match it

all the test images i have have the same DQT table, what i wonder is if pixelknot could have generated a different table like the silverman

this same shade of blue shows up

red

orange

red shoes…

symbols

b/w

kermit

earz

>>2764199

out of a few thousand scanned jpg from halfchan, 178 matches

https://anonfiles.com/Z0ga55gab5/matches-178.zip

https://www.anonfiles.cc/file/a55807d2e7060a1e4e5e444a5c3d9f45

here's how

wget -P 4chan -nd -np -r -l 1 -e robots=off -H -D is2.4chan.org -A jpg,jpeg https://boards.4chan.org/pol/thread/<THREADID>

for F in 4chan/.jpg; do python detect.py $F; done

>>2764328

>>2764328

new blue, red and orange today

>>2767294

a few have this weird artifact, a line that doesn't match up

>>2767849

here's the same line artifact on a pixelknot test image

>>2767900

16 images + coeff files that match PK header and have the unaligned square artifact

https://www.anonfiles.cc/file/4f3a6581ce98cf2176de46acc46a2aa7

>>2768019

this one too

cccp girl too

red shoe cammo woman too

of the jpg with matching PK headers with line artifacts i've found, half are of women in red

>>2768354

only the shitty windows photo viewer is showing the artifact… maybe it is only a bug with that?

>>2779614

>>2779614

new match from pol and the original

f5 does not encode data in 0s

here is diff, contrast and brightness turned way upp

does that look like encoded data to you?

>>2783440

another diff

https://imgur.com/t/vault_boy/JpIef

these two look identical, turn up the contrast on the difference and see small changes all over

>>2371258

GOING OFF DUTY

can another codeanon take the ball?

need to care for self and family

updated pixelunknot github with my code changes

added gather.sh, detect.py, BruteCrackF5 and F5CUDA

https://github.com/banona/PixelUnknot

>https://github.com/banona/PixelUnknot

https://github.com/banona/PixelUnknot

>https://github.com/banona/PixelUnknot

GOING OFF DUTY

>>2815876

>>2826539

maebe this will help?

>>2858984

The cult color codes are

Green Forrest = "I am your plant"

Yellow Sunshine= "Gold/Reward"

Blue Ocean= "Info/Surveillance"

Red Fire= "Anger/Smear"

Orange Sunset= "End this now"

>>3055048

welp

that image does load into pixelunknot

if there is a message in it, not bruteforcing anytime soon