Habrakvest in honor of the 20th anniversary of the Mail.Ru Group: winners and answers

You work as a part-time spy and you need to know the pin code that someone just typed on the keyboard. Fortunately, you managed to photograph it using a thermal imager.

White on a white background was given a hint :
The imager shows cold areas in shades of blue; the warmer the area, the closer it is to red.

With the help of a good thermal imager, it is possible to distinguish the temperature difference less than 0.5 ° C, incl. hand touch (see my post ).
Therefore, those buttons that were pressed earlier will be more "cooled".

5074

What is the name of the subject in the photo?

The hint to the picture says “hint in filename”.
The file name is hcraes-egami-esrever-elgoog.jpg . If you flip - google-reverse-image-search .

Feed the full URL of the image to Google.

Hint: the name of the file limpidity .png translates as "transparency" .
Simply open the image in a new browser tab or in a graphical editor to see the answer.

1917

What is the name of the city pictured in the photo?

Tip: file name exif .jpg - Exchangeable Image File Format - allows you to add metadata to images, incl. geocoordinates.

You need a picture viewer with the EXIF ​​reading function, for example, XnView.
We obtain the coordinates of 55 ° 20 '37.51 "north latitude, 36 ° 11' 9.12" east longitude.
We enter 55 ° 20 '37.51 "36 ° 11' 9.12" into any map service (Google Maps, Yandex.Maps) - we learn the name of the city.

Vereya

Hint: file name zoom .png
The question mark on the page is, in fact, a picture. Simply open it in a new browser tab or zoom in to see the answer.

This stage can be completed only by disconnecting from the Internet.

You can either really turn off the Internet / transfer the browser to "offline mode", or open the page code and decode the response urldecode.

Cyrillic

What letter indicates the exit from the maze?

In the code of the page you can find a hint - there is an ASCII-art painted paint bucket.
Open the picture with the labyrinth in any graphic editor and fill it with the paint bucket tool with a dot near the entrance.

M

In the code of the page you can find tips: "decode me" and "md5".
MD5 is a hashing algorithm. Although decryption is not possible, there are Internet services that can find the source code for the hash.

Number from 0 to 99 depending on your option

The VT-100 hints at a terminal with 80 characters per line. It remains to open the code and either arrange the line breaks after the 80th character, or, by changing the width of the window, achieve readability of the inscription.

The page code has id3 tag hint. ID3 allows you to save meta information to MP3. In our case, the MP3 has the tag Samuel Morse - the inventor of the Morse code.
Decode Morse code: three short - three long - three short.

SOS

Somewhere on this network is a server. Find it - the answer will be his name.

The easiest way (and everyone is available) is to save the page to your computer, then find the second image in the resources folder.
You can turn on the browser debug mode and find the image with the server in the network tab.
You can find the regular expression in the HTML code of the page.
The most "oak" way is to reduce the page scale to the maximum and find it with your eyes.

mainframe or moby - depending on the version

☺ + 1 = ♫
Four options:
♦ - ☺ = answer
♯ - ☺ = answer
♣ - ☺ = answer
♥ - ☺ = answer

Characters are inserted into HTML using their 16-character Unicode codes.
The first line is a hint: 0x263A + 0x31 = 0x266B , i.e. the unit here is not itself, but the code 0x31 (49).
Thus, to get the answer on the calculator in hexadecimal mode, subtract the second character from the first character code. The resulting difference is converted back to a symbol in the Unicode table. In Windows, there is a utility ut charmap.exe.

♦ - ☺ = ,
♯ - ☺ = 5
♣ - ☺ = )
♥ - ☺ = +
PS If you specify a decimal or hexadecimal code in the answer, this is also read.

The letters on the screen are stuck together due to the CSS (negative kerning) rule. The simplest: “select all” - “copy” - “paste” into any text editor.
Front-end programmers could also remove CSS or decode a line using octal ASCII codes in Javascript.
We get the string /ix.zip .
We add it to the site address, we get puzzle.mail.ru/ix.zip , download.
Inside the archive is the file bogus.mp3.
bogus.mp3 is not played by an audio player, as indicated by the name “bogus” - i.e. "Fictitious", "fake".
Obviously, the extension does not match the actual file type. Open it in notepad - it starts with the characters GIF89 - it means this is a gif-image. Rename - this is actually an animation. You need to open it in a viewer or editor that allows you to see it frame by frame - under Windows, Media Player Classic will do.

agent

The answer is a decimal number.

Open the page code:

 <img src="loremipsum.png" width="2" height="2"> <iframe src="http://quiz14.donkeyhot.org/" width="1" height="1"> 

Firstly, we have a picture of puzzle.mail.ru/loremipsum.png with some text in Latin, and secondly, we will go to quiz14.donkeyhot.org , where we find the following key: read rfc1464 and try again .
Googling what RFC1464 is - the Arbitrary String Attributes document using the Domain Name System or the Store, or you can immediately get to the WXP page on the TXT record . In short: in the DNS system you can store arbitrary public text records associated with the domain, which can be obtained by any Internet user.
We learn how to read this very TXT-record: either use the online service, or type in the command line:
nslookup
set type=txt
quiz14.donkeyhot.org

Not credible answer:

quiz14.donkeyhot.org text = "puzzle.mail.ru/mask14.gif"
(nslookup should work in any OS)

Now we have two pictures of the same size. The second, as its file name implies, is the mask that we impose on loremipsum.png in any editor that supports layers (Paint.NET, GIMP, Photoshop, etc.). We receive the picture (horizontal lines are added for simplification), we read from left to right, from top to bottom: MCMXCVIII . The Latin text hints that this is a number in the Roman numeral system. Since the answer according to the condition must be a decimal number, then we translate ourselves or on a calculator.
M = 1000 +
CM = (1000-100) +
XC = (100-10) +
V = 5 +
III = 3

= 1998

The hypothetical network virus infects any equipment. Each infected machine infects one more every 30 seconds.
An infected machine has appeared on your network 10.0.0.0/[19...25]. How many minutes will all the machines on the network be infected? (Assuming all addresses are used)

Options vary from 10.0.0.0/19 to 10.0.0.0/25. Suppose we have option 10.0.0.0/20.
We learn what this record is - this is the network address and mask. There are online calculators - google at the request of "netmask calculator".

If you manually count, the number after the slash means how many bits of the 32 will be given to the network address. The remaining 32-20 = 12 bits can be used for machine addresses, i.e. it turns out 2 ¹² = 4096 addresses maximum (actually 4094, because the first address 10.0.0.0 is the network address, and the last 10.0.15.255 is the broadcast address, but this does not affect the answer).

The number of infected machines is growing exponentially every 30 seconds: 2, 4, 8 ... It is easy to see that the number of infected machines $$$N (t) = 2 ^ {2t}$where t is the time in minutes. N = 4096 and the inverse function will give us the desired time of complete infection:

$$

$$t = \ frac {log_2N} {2} = \ frac {log_24096} {2} = 6$$

PS In this question a small flaw: it is not specified how to round off the answer. Therefore, the correct fractional counted, as well as rounded up and down.

From 3 to 7 minutes depending on the option.

You accidentally fell overboard, taking selfies on a cruise ship, but were able to reach the nearest island.
You need to understand where you are. You do not have GPS, but you turned on the engineering mode in the phone and saw the following information:
... MCC: 372, MNC: 1, LAC: 2300, CellID: 33250
What is the name of the island?

We google what codes MCC, MNC, LAC, CellID.
MCC = 372 indicates the Republic of Haiti. But Haiti owns several islands. We drive in all the codes into the base of cell phone towers, for example, here , and find out the exact location on the map.

Haiti

01-01-1970 40587
15-10-1998 51101
10/15/2008 54754
15-10-2018 ???

In the code we find: a hint for getting a hint: what is the English word "cookie"?
Cookies in English cookie or biscuit.
The first is a clear allusion to cookies . In any way, we will learn the cookie page, for example, through the web development panel (Chrome, FF, IE - F12, Opera Ctrl + Shift + I).
We notice cookies podskazka_17_sha256 is a hash, we are looking for the SHA-256 decoding online service, we get MJD. We learn that it is Modified Julian Date.
In general, it is easy to guess without a hint that the numbers in the right column are days. 54754-51101 = 3653 - similar to the number of days in 10 years with 3 leap days.
In the online service or do we calculate the MJD for 10/15/2018. If you yourself, then 54754 + 365 * 10 + 2

= 58406
PS As an exception, how the correct answer is 58407

In the example, some numbers are replaced by letters.
Find what these numbers are equal to and record the answer as ABCDE, for example, 12345.

You can, of course, solve by going through the computer, but you can also do it on a piece of paper: in folding numbers of 8 digits, and in the total - 9, it means there was a transfer, therefore D in the high-order bit can only be one. D = 1 .

We look at the next digit - the digit of the units: either B + B = 9 or B + B = 19, but 9 is an odd number, which means the transfer unit has come from the previous discharge. Those. either 2B = 8, then B = 4, or 2B = 18, then B = 9, but nine already occurs in the open, which means only B = 4 .

We look at the discharge of tens: now it is known that E + C = 11 .
We look at the last (rightmost) digit 9 + 4 = A, it means A = 3 and there was a transfer unit.

We look at the fourth decimal place: the units from the previous discharge were not transferred, (4 + 4 + 1 = 9) and 1 + E = C. We also know that E + C = 11, i.e. C = 11-E, it means 1 + E = 11-E, we transfer 2E = 11-1, it turns out E = 5 , C = 6 .

34615
PS Some people got so carried away that they wrote back the total amount in the answer instead of the ABCDE values, which was considered as correct as an exception.

1. Take the two numbers that were added at the previous level.
2. ???
3. The answer is the year of planting trees (four digits).

From the code we get a hint: ° N ° E
At the previous level, we received 54.466149 and 64.797544 - adding with a hint, we understand that these are geocoordinates in degrees.
We drive in a cartographic service, we see an anniversary grove in the Kurgan region.

Lenin’s centenary was celebrated in 1870 + 100 = 1970

1970
PS Eight meticulous people unearthed, that the grove may have been planted in 1967, this answer is also counted.

Decipher the Russian text. The answer is the words in brackets.
For simplicity, all the letters E in the text are replaced by E, b - by b.

In the code hint: HTTP - all over the head
She points to hints in HTTP headers. They can be viewed in the browser debugging console:
X-Hint-1: /hint15.png
X-Hint-2: /_.jpg
In https://puzzle.mail.ru/hint15.png the semaphore alphabet is encrypted " CEASAR ".
On https://puzzle.mail.ru/_.jpg the character of the movie “Matrix” - Cypher. If you suddenly did not look at the "Matrix", then you lost a lot could find the name of the character by searching in the picture on Google.
Total we get Caesar + cypher = Caesar's cipher
Knowing that this is Caesar's cipher, you can take any word and, shifting the characters by N positions in the alphabet, get the shift value 13 in a maximum of 30 attempts.
NB! The task involuntarily got an complication, because It was not indicated that nd was replaced by and . This is now fixed.

dancing men