[ARG] The Pizza Code Mystery

Sherlock_killer · November 25, 2018, 4:23am

oh, your right

pyth · August 11, 2020, 11:14am

kxbm.net, the news article and localdesertsingles.com also show ascii art inside the browser’s dev console: * https://i.imgur.com/gw9erVk.png

thewizard99 · August 11, 2020, 11:14am

Ok i had a play about with the infomation on the https://www.bmrf.org/ website. The Keybase.txt. file which gave the group of text, can be decoded on https://keybase.io/vocatus <— the users page, by clicking the Verify button and give the same infomation in the top of the keybase.txt file which is this

{
“body”: {
“key”: {
“fingerprint”: “41574ddcb2c4c4743095815a07d1490f82a211a2”,
“host”: “keybase.io”,
“key_id”: “07d1490f82a211a2”,
“uid”: “14f55f12cf73544031e890d3f053a000”,
“username”: “vocatus”
},
“service”: {
“hostname”: “bmrf.org”,
“protocol”: “http:”
},
“type”: “web_service_binding”,
“version”: 1
},
“ctime”: 1407613324,
“expire_in”: 157680000,
“prev”: “46a5327272d9744e56a60b0eb204a003aedc99aaaeb53dceedf5745843678bec”,
“seqno”: 5,
“tag”: “signature”
}

So other than the BMRS website address, its nothing worth of note.

thewizard99 · August 11, 2020, 11:14am

well thats intresting, when i went on to https://kxbm.net/ when i went to the first link, it bring up a website link to https://kxbm.net/assets/three.min.js, in there is another link at the top https://github.com/mrdoob/three.js which has a bunch of files sitting there, as well as a link to a @WestLangley

thewizard99 · August 11, 2020, 11:14am

also as a side note, withing the KXBM.net, looking at the resources for the Scripts, https://alteredqualia.com is mentioned, on there there is a Molecule Structure 3D render which looks a hell of a lot like the one thats on the Calanders in BM.

Sherlock_killer · November 25, 2018, 4:23am

There are few lines in there that have the word Rocket-launcher in there (The article site). could it mean something?

Also those picture about stuff that are being sold in the site, one of them has no link wich is the radio transmitter with weir name.

thewizard99 · August 11, 2020, 11:14am

the https://www.kxbm.net/article/?view=all-clear-given-for-black-mesa-evacuation-zone-10360 website has that on which you stated, also on the localdesrtsingles.com website in the code has something about rocket launches in there as well.

Jacky · August 11, 2020, 11:14am

When you click on Thomas Lee on KXBM, you go to this website: https://localdesertsingles.com/#203428/thomas-lee, and if check out source code, there is a link for heart, but it is quite long not going to post it here, check it out. Does that mean anything?

Also, I found this, and it looks awfully familiar (can’t remember where I found it though) SXQncyBub3Qgb3VyIGZhdWx0Lg==

EDIT: I found it in picture URL (picture right above text)
MORE EDIT: It is Base 64, and when decoded it says: “It’s not our fault.”

Shadowhand · August 11, 2020, 11:14am

I went digging around the sites, and here is what I found:

KXBM.net/article :
There’s literally just this page, it’s called “index.html”, not even php, so it’d not dynamic. Literally anything after “?” is just fluff.
There’s an /assets/ under /article/, but it throws out forbidden error. Fine, okay!

But here’s the kicker: Literally every image on the page (and one script tag) has their names in Base64 text. Below is the every Base64 line on the page:

[spoiler]1. SSBzdXNwZWN0ZWQgdGhpcyB3b3VsZCBoYXBwZW4sIGJ1dCB0aGUgYWRtaW5pc3RyYXRvciBqdXN0IHdvdWxkIG5vdCBsaXN0ZW4u

SXQncyBub3Qgb3VyIGZhdWx0Lg==
RmF0IGxvdCBvZiBnb29kIHRoYXQgUGguRCBkb2VzIG1lIG5vdw==
SSd2ZSBiZWVuIHdhaXRpbmcgaGVyZSBmb3IgYWdlcywgaG9waW5nIHNvbWVvbmUgd291bGQgY29tZSBhbG9uZyE=
R2V0IHVzIG91dCBvZiBoZXJlIGJlZm9yZSB0aG9zZSBtaWxpdGFyeSBkcm9uZXMgZmluZCBvdXQgd2hlcmUgd2UncmUgaGlkaW5n
SWYgeW91IGxldCB1cyBhbGwgZGllLCBGcmVlbWFuLCB5b3UnbGwgbmV2ZXIgZ2V0IG91dCBvZiBoZXJlLg==
SWYgeW91IGludGVuZCB0byBnbyBvbiwgdGhlbiwgSSBiZWcgb2YgeW91LCBwcm9jZWVkIHdpdGggZXh0cmVtZSBjYXV0aW9uLg==
VGhlIGRpbWVuc2lvbmFsIGJyZWFjaCBpcyBkZWZpbml0ZWx5IHRyYW5zbWl0dGluZyBvcmdhbmljIG1hdHRlci4=
SSBjYW4gc2VlIHlvdSBhbHJlYWR5IGtub3cgYSBncmVhdCBkZWFsIG1vcmUgdGhhbiBhbnkgb25lIG1hbiBpcyBzdXBwb3NlZCB0by4=
VGhlIHNjaWVuY2UgdGVhbSBoYXMgYmVlbiB0cmFja2luZyB5b3VyIHByb2dyZXNzIHdpdGggdGhlIEJsYWNrIE1lc2Egc2VjdXJpdHkgc3lzdGVtLiBVbmZvcnR1bmF0ZWx5LCBzbyBpcyB0aGUgbWlsaXRhcnku
V2l0aCBteSBicmFpbnMgYW5kIHlvdXIgYnJhd24sIHdlJ2QgbWFrZSBhbiBleGNlbGxlbnQgdGVhbS4= (Script file’s name)
SXQgY2FuJ3QgZ2V0IGFueSB3b3JzZSB0aGFuIHRoaXMu (In CSS)
VGhlIGFsaWVuIHNwZWNpZXMgY2FuJ3QgcG9zc2libHkgYWxsIGJlIGhvc3RpbGUsIGNhbiB0aGV5Pw== (In CSS)
V2h5IGRpZG4ndCB0aGV5IGxpc3Rlbj8= (In CSS)
SSBuZXZlciBzdXNwZWN0ZWQgc3VjaCB0aGluZ3MgY291bGQgYmUuLi4= (Turned on radio, with morse code)
[/spoiler]

And here’s what they mean:

[spoiler]1. I suspected this would happen, but the administrator just would not listen.

It’s not our fault.
Fat lot of good that Ph.D does me now
I’ve been waiting here for ages, hoping someone would come along!
Get us out of here before those military drones find out where we’re hiding
If you let us all die, Freeman, you’ll never get out of here.
If you intend to go on, then, I beg of you, proceed with extreme caution.
The dimensional breach is definitely transmitting organic matter.
I can see you already know a great deal more than any one man is supposed to.
The science team has been tracking your progress with the Black Mesa security system. Unfortunately, so is the military.
With my brains and your brawn, we’d make an excellent team. (Script file’s name)
It can’t get any worse than this. (In CSS)
The alien species can’t possibly all be hostile, can they? (In CSS)
Why didn’t they listen? (In CSS)
I never suspected such things could be… (Turned on radio, with morse code)
[/spoiler]

When the page is first loaded, browser tries to load a file (link), file name is in, again Base64.
RGllLi4ueW91IGFsbCBkaWUuLi55b3UgYWxsIGRpZS4uLg==

Which translates to:
“Die…you all die…you all die…”

Now, the file itself, it’s very interesting!
It looks like it’s just gibberish, but there are bits you can read, and simple googling sent me on LibAV (for audio video encoding), and FFMpeg, which’s also used for the same thing. So I tried creating a blank mp4 file, and put the file contents in it but that didn’t work.
So if you’ve got time/knowledge to figure out what it is, let me know!
See spoiler: [spoiler]I figured out what’s that unknown file (that’s supposed to be an MP4
file) is. Turns out, it really is an MP4 file! I was just being an idiot
by copy-pasting the contents, rather than just save the file as MP4
directly from the browser.

Here’s the mediainfo output for it:

Complete name : C:\Users<snip>\Desktop\RGllLi4ueW91IGFsbCBkaWUuLi55b3UgYWxsIGRpZS4uLg==.mp4
Format : MPEG-4
Format profile : Base Media
Codec ID : isom
File size : 147 KiB
Duration : 9s 211ms
Overall bit rate mode : Constant
Overall bit rate : 130 Kbps
Writing application : Lavf55.19.104

Audio
ID : 1
Format : AAC
Format/Info : Advanced Audio Codec
Format profile : LC
Codec ID : 40
Duration : 9s 211ms
Duration_LastFrame : -8ms
Bit rate mode : Constant
Bit rate : 128 Kbps
Channel(s) : 2 channels
Channel(s)_Original : 1 channel
Channel positions : Front: C
Sampling rate : 44.1 KHz
Compression mode : Lossy
Stream size : 144 KiB (98%)

And it’s nothing special. It’s just the static noise from the top directory kxbm.net.[/spoiler]

Three things are left on this page:

1) Headcrab ASCII art in console.

2) Clicking any of the top links (menu, set your weather, etc) sends you to base domain, which literally has 10 JavaScript files, 1 jpg (same file from bmfr.us EAS image), a “thumbs.db” file (which shows the page has been accessed locally on a Windows computer), and one mp4 file.

Now the main thing on the page is the mp4 file. It’s called background.mp4 and it’s 1 minute long. The TV static and deformation effect is dynamically added on the page with JavaScript.

There’s nothing else to this file, or the page, other than the Gman ASCII art in the console.

3) Clicking Thomas’ name sends you to localdesertsingles.com, which says the server is overloaded, but once again, it’s just another index.html file, which means it’s not dynamic.
What’s weird about this page is the console output, which shows Nihilant, and prints one line:
“Alone…aren’t you alone…”
And prints another line every 2000ms (2 seconds) forever:
“…aren’t you alone…”

The script that does this is written in-line, and is encoded. I decoded it and it has nothing of value inside.

And that’s all. The only thing I couldn’t crack is the file I mentioned earlier, one that browser tries to load but fails.

EDIT: I added 3 more Base64 encoded text I found in CSS files.

EDIT2: Added 1 more Base64 encoded text, that gets enabled on the page after you turn on the ham radio.

Two more things on the article page:
You can click the button on the radio to turn it on, and it will relay a morse code (found by CPU), which translates to

And you can click “Contact Us” at the footer, which takes you to https://steampowered.com/.

Jacky · August 11, 2020, 11:14am

All of those picture on webiste (https://www.kxbm.net/article/?10360/all-clear-given-for-black-mesa-evacuation-zone) has some kind of comment in base 64, so I decoded all of 'em (in order I think) and here what it says:

Get us out of here before those military drones find out where we’re hiding
Fat lot of good that Ph.D does me now
I can see you already know a great deal more than any one man is supposed to.
I suspected this would happen, but the administrator just would not listen.
I’ve been waiting here for ages, hoping someone would come along!
If you intend to go on, then, I beg of you, proceed with extreme caution.
If you let us all die, Freeman, you’ll never get out of here.
It can’t get any worse than this.
It’s not our fault.
Why didn’t they listen?
The alien species can’t possibly all be hostile, can they?
The dimensional breach is definitely transmitting organic matter.
The science team has been tracking your progress with the Black Mesa security system. Unfortunately, so is the military.

thewizard99 · August 11, 2020, 11:14am

Jacky:

All of those picture on webiste (https://www.kxbm.net/article/?10360/all-clear-given-for-black-mesa-evacuation-zone) has some kind of comment in base 64, so I decoded all of 'em (in order I think) and here what it says:

Get us out of here before those military drones find out where we’re hiding
Fat lot of good that Ph.D does me now
I can see you already know a great deal more than any one man is supposed to.
I suspected this would happen, but the administrator just would not listen.
I’ve been waiting here for ages, hoping someone would come along!
If you intend to go on, then, I beg of you, proceed with extreme caution.
If you let us all die, Freeman, you’ll never get out of here.
It can’t get any worse than this.
It’s not our fault.
Why didn’t they listen?
The alien species can’t possibly all be hostile, can they?
The dimensional breach is definitely transmitting organic matter.
The science team has been tracking your progress with the Black Mesa security system. Unfortunately, so is the military.

WHERE DID YOU FIND THESE. DIRECT LINKS PLEASE.

thewizard99 · August 11, 2020, 11:14am

Oh thats intresting, it seems that its quotes from scientists from Black Mesa. the Administrator one stands out, mainly due to the fact that Bottomley was the Head Admin in QE.

EDIT : Website is now down for https://www.kxbm.net/article/?10360/all-clear-given-for-black-mesa-evacuation-zone

Jacky · August 11, 2020, 11:14am

I can’t link that I think, i will try to explain.
When you go to that site (https://www.kxbm.net/article/?10360/all-clear-given-for-black-mesa-evacuation-zone) inspect element and go resources.
Then you want this : https://imgur.com/0rZhVb8
ALL of those pictures have “comment” in base 64.

CPU · November 25, 2018, 4:23am

If you right click on the image of Thomas Lee and select “save as” it to your desktop. It saves as a txt file
In this case, it saves as R2V0IHVzIG91dCBvZiBoZXJlIGJlZm9yZSB0aG9zZSBtaWxpdGFyeSBkcm9uZXMgZmluZCBvdXQgd2hlcmUgd2UncmUgaGlkaW5n.txt

Then, go to https://www.base64decode.org/ and enter the text file, minus the “.txt” at the end and it decrypts to Get us out of here before those military drones find out where we’re hiding

Shadowhand · August 11, 2020, 11:14am

Found three more Base64 file names, hidden in CSS codes. Quite clever I must admit.

[spoiler] 1. SXQgY2FuJ3QgZ2V0IGFueSB3b3JzZSB0aGFuIHRoaXMu

VGhlIGFsaWVuIHNwZWNpZXMgY2FuJ3QgcG9zc2libHkgYWxsIGJlIGhvc3RpbGUsIGNhbiB0aGV5Pw==
V2h5IGRpZG4ndCB0aGV5IGxpc3Rlbj8=
[/spoiler]

They translate to:

[spoiler]1. “It can’t get any worse than this.”

“The alien species can’t possibly all be hostile, can they?”
“Why didn’t they listen?”
[/spoiler]

EDIT: See my original post here.

Jacky · August 11, 2020, 11:14am

Ehm, I decoded those already on last page

Shadowhand · November 25, 2018, 4:23am

Yeah, but I was in the process of writing my big post before yours. Check it.

Jacky · November 25, 2018, 4:23am

I saw it, good job :thumbup:

jadebenn · November 25, 2018, 4:23am

So… this is… actual PROGRESS =O

I almost though the ARG was never going to be solved! Great work guys! 8o

What do we know so far? I’m curious what the “live video feed” on the former BMRF us website is.

Shadowhand · August 11, 2020, 11:14am

I figured out what’s that unknown file (that’s supposed to be an MP4 file) is. Turns out, it really is an MP4 file! I was just being an idiot by copy-pasting the contents, rather than just save the file as MP4 directly from the browser.

Here’s the mediainfo output for it:

Complete name : C:\Users<snip>\Desktop\RGllLi4ueW91IGFsbCBkaWUuLi55b3UgYWxsIGRpZS4uLg==.mp4
Format : MPEG-4
Format profile : Base Media
Codec ID : isom
File size : 147 KiB
Duration : 9s 211ms
Overall bit rate mode : Constant
Overall bit rate : 130 Kbps
Writing application : Lavf55.19.104

Audio
ID : 1
Format : AAC
Format/Info : Advanced Audio Codec
Format profile : LC
Codec ID : 40
Duration : 9s 211ms
Duration_LastFrame : -8ms
Bit rate mode : Constant
Bit rate : 128 Kbps
Channel(s) : 2 channels
Channel(s)_Original : 1 channel
Channel positions : Front: C
Sampling rate : 44.1 KHz
Compression mode : Lossy
Stream size : 144 KiB (98%)

And it’s nothing special. It’s just the static noise from the top directory kxbm.net.

Although, it might have hidden audio clues, and that’s as far as my knowledge goes, so please, someone else pick it up.