Blog Description



This blog is a personal examination of the "Pizza Code Mystery" ARG created by Christopher Horn for the Black Mesa video game.
I will attempt to update this blog on a regular basis, for as long as the ARG is in existence and folks are willing to attempt to solve it.
This will not be a complete overview of the clues and such associated with the ARG--you can find a complete, up-to-date version of that material here.


Monday, August 19, 2019

The Final Countdown to the Pizza Code Mystery ARG - Where is Dr. Horn?

So, we did it! The Hex/HALOS.txt code puzzle was solved, and it was with the help of everyone that we finally uncovered the end of the ARG!

However, we are not finished, and Storm has advised us that our sole mission now is to piece together what it was all about. One key of finalizing the puzzle is figuring out where Dr. Horn went, and that is what I'm going to hypothesize about today.

Before I begin, please note that this is only my personal take on the story--it should in no way influence your own examinations unless you wish it to, and even then it should only serve as a launching point for your own ideas, examinations, and hypotheses.

Where is Dr. Horn?

Note: If you wish to watch the video instead, scroll to the end of this post and click the video link.

My goal with this is to try and chain the events together, which includes indicating where Dr. Horn went and what may have occurred in the places he visited. To begin, we start with his office. Naturally, our first question is, was Dr. Horn even in here when things went down? My theory is that he was either in his office or heading towards the cafe, considering we have a looping message on one of the monitors that says Dr. Horn's pizza was ready for pick-up. This suggests it was his lunchtime when things got hairy, so he was most likely either at his desk, speaking with someone in their office, or heading to the cafe. With this in mind, I set out to find the closest area near his office that made sense for his "first moves" to occur.

Now, the X01 and X02 rooms are part of the ARG, and the X01 room is right down the hall from Dr. Horn's office, so it's possible he went there, first. However, he didn't stay there, and we know this from his movements around the rest of the facility. So, I kept looking.

Really, the only way to go from here was downstairs to the canteen, so I headed downstairs.

So, one thing we do know from this area is that there's a hidden room below the stairs here. There's a hatch in the floor that almost looks like it either leads below the facility or into another chamber--so, odds are this is how Dr. Horn was getting in. We also have a "the pizza is a lie" message down at the end of this hallway, where the door to Lab A is. Furthermore, we have a body here, which is perhaps where Dr. Horn got the blood from to write this message:

A message written in blood, and Body 1
This suggests that Dr. Horn came this way (since this hallway theoretically leads right to the staircase, but both ends are blocked off in the game). So, that means he either saw the body or killed the scientist, then used his blood to write his first pizza-lie message and the cipher on the wall.

The rooms to the left of this exit don't seem to have any clues as to Dr. Horn's presence (this is also where you start the level), so I went right:

Oh look! Another body! Body 2!
I'm not saying this one was Dr. Horn's fault, but I find it interesting that all of these bodies have a huge amount of blood. It almost makes you wonder if Dr. Horn was trying to get to this blood--perhaps because he thought he might garner some nutrient or needed entity from this blood? Perhaps because he thought people ate his pizzas, and he needed to get something from them? Either way, I continued my search, egged on by this discovery.

I followed the bodies, essentially, which eventually led me through the bathrooms and into the canteen:

Body 3
Body 4
Body 5
Bodies 6 and 7
So, at this point, I was convinced Dr. Horn murdered all of these people.

My reasoning was that the bodies were are all eviscerated in the same manner, with huge quantities of blood. However, I realized these people could have been killed by Xenians, so I went back and tried to compare these bodies to people who were killed earlier in the facility. I went to the Office Complex level, and I was able to find many bodies that were in a similar state to our own--in one such case, it looked as though the person had just been killed by a headcrab scientist:

The plot thickens.
Okay, so maybe Dr. Horn isn't going around slaying these people, but what's the deal with him writing all the messages about the pizzas in blood? I was still convinced that it had something to do with the blood itself, so I returned to the canteen in QE and began moving forward again in my investigation.

I went directly across from the canteen into the general offices, and uncovered a few other bodies. The first had bullet-holes on the wall behind it, so I assume this was the HECU's work:

Body 8
And another one:

Body 9
And then here's a body in the hall beyond the canteen:

Body 10
And then right after the body is Dr. Bottomley's office:

Body 11 / Dr. Bottomley???
Well, there's no doubt Dr. Bottomley (or this version of him) was killed by HECU, hence the multiple bullet holes. Furthermore, those bullet holes are likely MP5 bullet holes, based on the size of them and the spread. The only other weapon I could see it being was the shotgun, since the HECU did carry those, too, so I did a quick test. I stood in Dr. Bottomley's door and shot the far wall:

Shotgun fun.
The holes on the left are from Dr. Bottomley's office door, the ones in the middle are from about halfway to the far wall from his office door, and the final shot was made with my back to the wall opposite Dr. Bottomley's office. The spread is nowhere near what we see behind his desk, and I really doubt someone would have shot him from that far away. So, my point stands--HECU killed Dr. Bottomley (and, as an aside, this is just further proof of how shitty of a shot they are). Furthermore, I'm under the impression that the HECU likely killed a vast majority of the other scientists, as well. At this point in the game, we know they are in the facility, and they actively try to kill us in the QE chapter.

Anyhow, with that determination made, I continued down the hallway opposite Dr. Bottomley's office and past the canteen. 

Onto the next map, our first order of business is to take out the HECU in the central lobby. After that's taken care of, I notice that there's a bloodstain on the wall . . . but no body:

Odd.
I think, well that's weird, but I don't really pay much attention to it, for perhaps either the HECU dragged the body away, or perhaps a headcrab took over whomever it was that was here. I do find it interesting, however, that our "Big Four" are listed here:

"Founded in 19 (bloodstain)"
Anyhow, I'm feeling particularly adrenalized by that last battle, so I continue on my merry way.

Oh, looky--another body in the conference room here, and another wall riddled with bullet-holes.

Body 12
And then, finally, from here I went into the security office with the bloody footprints:

Body 13
I noticed that in this instance, the footprints do not lead right to the hatch but instead seem to lead to the console, likely because Dr. Horn was opening the security doors. So, perhaps he wasn't actually using the hatches, but that point was moot now, anyway.

I also noticed that a pistol and a shotgun were missing from the wall mounts--possibly Dr. Horn took them?

Dr. Horn wuz here?
Anyway, onward ho!

Right through the double security doors is another body:

Body 14
Another body in the Tesla overcharge button room:

Body 15
And one outside in the main chamber:

Body 16
There's another one in the pool of water at the base, although there's no blood so I'm not counting this one:

Nope.
I then moved on into the next chamber . . .

. . . and this is where I came upon my first true evidence that Dr. Horn was doing something with these bodies. As you can see from this screenshot, his footprints are here, along with his handprints, and a body was very clearly dragged into the maintenance room:

Body 17
And now I had some footprints to follow, both confirming that Dr. Horn came this way, but also verifying which way I needed to head next. So, I followed them.

Another body in the hallway after a couple HECU grunts:

Body 18
Above the Cyronics room, I found another Tesla discharge button and another body:

Body 19
Near the freight elevator past Cyronics, I found another body, and a door that looked vaguely familiar:

Body 20
Make note of this door--it will come into play later.
In the hallway past the freight elevator, another body--this one may not count, for the simple fact that Dr. Horn likely took the freight elevator, which means he would not have passed by this way:

Body 21?
And then BOOM! Full circle--two bodies right outside the staircase to Lab D, just down the hallway from the Lab A doors that are sealed off:

Bodies 22 and 23.

But wait a minute . . . . Perhaps you're wondering the same thing I was at this point--why the full circle? It didn't make sense, especially because if he could make a circle, why not just head directly for wherever he was going? And then it hit me--the doors. It didn't make sense to make the circle, no, but Dr. Horn may not have had a choice. So, long story short, I thought about the many, many ways I could present this examination, and I settled on a video. With all the nuances of it, I thought it would be far more interesting to watch me detail it than read another whole summary.

So, without further ado, here it is:



So, long story short, I think Dr. Horn ended up taking the freight elevator down, and he then took the truck onto Silo D. Furthermore, although you can get 23 bodies total via the examination above, I'm wondering if the "21 into ONE" might have something to do with the bodies. If you exclude Dr. Bottomley's body, and perhaps one of the others (the one after the freight elevator, perhaps, since Dr. Horn would not have passed through that way) there are 21 total in my examination.

Perhaps the "21 into ONE" means Dr. Horn ate part of the bodies, or perhaps took the blood for purposes yet unknown? I do believe it refers to the bodies, and perhaps he was trying to reclaim his pizza because he thought the scientists were all eating it.

Whatever the case, that's all I have for you. Thanks for reading/watching, and I'll catch you next time!

Monday, June 15, 2015

Further Information From Storm

Just a brief update regarding a few bits of information that Storm provided during a conversation today. Here's the pertinent info from our conversation:

[EVIL]GunslingersRequiem: 1. Were you really Code_ / 0418 from the forums? 2. Should we spend more effort constructing the story in the game rather than focusing so closely on the web-based clues?

[BMS] stormseeker: 1. yep 2. a bit of both. I suspect if all else fails, something will come along and assist


To recap, Storm really was Code_ / 0418, so we could definitely take his PM at face value at least in the sense that we are probably on the right track with the encryption methods we've considered. Second, the web-based clues are relevant, but we also need to spend some time in the game continuing to look for clues that may assist with the HALOS file and possibly other future assets of the ARG. That said, I have included a new page entitled "Steam Release Clues" under the "In-Game Clues" heading on the front page of the wiki. Please do not hesitate to post whatever you may find that looks important, for we can always weed out (as a collaborative effort) those things we deem unnecessary, or redirect information we already have to their proper places on the ARG. Furthermore, you are all of course always welcome to contribute any thoughts you have to the blog and continue to submit key/keyphrase ideas you come up with. I have a list already in the works, and once I hit a certain threshold I will begin posting them to the wiki in alphabetical order.

Storm also mentioned that, if we are still unable to come up with a solution prior to a certain time, something may assist us down the road. However, I think we should continue to focus our efforts on what we have rather than simply play the waiting game. We owe him at least that much.

Thursday, June 4, 2015

Possible Key Submission Form

I have added a page where anyone can submit a possible key and describe how they came up with it. Visitors to the page can also view previously submitted keys to ensure that someone else has not already come up with it. You can directly follow the link below, or utilize the one found within the "Quick Resource Guide" box on the right side of the page.

Possible Key Submission Form

Monday, March 9, 2015

JohnNotJohn's Secret Identity

Well, if you're here you probably already know that user JohnNotJohn on the forums is actually HALOS.  I ran across this message earlier today, one of the first posts by JohnNotJohn:

"I've been looking over some of the earlier pages of the thread, and I noticed that Storm said we were close two years ago, when the HALOS file was found. All of the work that has been done since then has focused on ultimately solving that one puzzle. Meaning everything Storm has done since then must have been subtly hinting at the solution to that puzzle. However, he might just be messing with us. Also, I personally recommend the 80s and 90s, corresponding to about a year ago. Lots of interesting stuff, including acronyms, anagrams, analyzing static, large amounts of numbers, and more. Old thoughts sometimes inspire new thoughts. See if anything occurs to you while re-reading.

Just keep your eyes peeled, and you might find something."

"I AM HALOS"

Anyhow, now that we have this information, I've decided that it would be wise to collaborate all of the posts by JohnNotJohn.  If no one beats me to it, I will update the Wiki with a page sporting these posts, as well as a section left open for speculation by visitors to the Wiki.

It turns out this is not really a reference to the "real" HALOS, but a horrendously cruel ploy by one of the users on the forum.  Nonetheless, JohnNotJohn's got some good ideas, so I figured I'd leave this up in case it helps anyone.

2/27/15
Hello, long-time reader, first-time poster here.
A strange thought occurred to me, and I felt like I should share it.

If kxbm.net is supposed to be a local news site for the area around Black Mesa, and if localdesertsingles.com is supposed to be a dating site for the same area, isn't it odd that both sites are reporting unusually high server loads?

Also, I don't know if it's been mentioned yet, but Thomas Lee is an anagram of "Meet Halos."  




2/27/15
"Tim Evans" = "TV in Mesa"  


2/27/15
Thanks!
I did an anagram search of Tim Evans after I noticed the Thomas Lee one. I would have posted it earlier, but I didn't want to start a wild goose chase involving every TV in the game. Apologies for that.


I'll keep my eyes peeled for anything else. 



2/27/15
faed:  "Which actually is 2000.0037245213093 milliseconds."

I'm curious about those numbers. It would have been simple enough to just encode 2000ms



2/27/15
I was working on that name. Nice job noticing the BMRF. With that in mind, I was able to get "Frank Abrams" = "BMRF as an ark"

It's a bit of a stretch, but it might be something.  



2/28/15
I've been looking over some of the earlier pages of the thread, and I noticed that Storm said we were close two years ago, when the HALOS file was found. All of the work that has been done since then has focused on ultimately solving that one puzzle. Meaning everything Storm has done since then must have been subtly hinting at the solution to that puzzle. However, he might just be messing with us. Also, I personally recommend the 80s and 90s, corresponding to about a year ago. Lots of interesting stuff, including acronyms, anagrams, analyzing static, large amounts of numbers, and more. Old thoughts sometimes inspire new thoughts. See if anything occurs to you while re-reading.
Just keep your eyes peeled, and you might find something.



3/1/15
Doing a bit of research, it seems AES, Twofish, and Serpent all use key lenghts of 128, 192, or 256 bits. This means the password would need to be 16, 24, or 32 characters long. BENALOHPAILLIER is only 15 letters.

Rjindael, whichwas used as the basis for AES, can also be used with a 20 or 28 character password, in addition to those mentioned above.

This is just from the Wikipedia entries on those systems.  



3/1/15
Clue 6 pointed to the HALOS file.
Clue 5 gave the password "BENALOHPAILLIER."
Clue 3 was the first mention of HALOS, as far as I can tell.

Clue 4, however, doesn't seem to add much at first. But consider this: it gave a login "HALOS"
Combining the login and the password gives a total of 20 characters, which can be used as a 160-bit key for a Rijndael cipher.



3/1/15
thewizard99: "After looking back, someone mentioned about SP/Twofish a while back ( 2 years ) and someone brushed right past it. With this board and it being noted. We seem to be on the right track.
Now how does Serpant/Twofish work?"

I mentioned this earlier.  

JohnNotJohn: "Doing a bit of research, it seems AES, Twofish, and Serpent all use key lenghts of 128, 192, or 256 bits. This means the password would need to be 16, 24, or 32 characters long."


3/2/15 
"congratulationsyouwonthePIZZA" is 29 bytes, but I can't help but feel it's related somehow.

Was the capitalization of "PIZZA" a part of the solution?

Edit: I checked the wiki. The cipher used ASCII characters, so the capitalization is intentional. Curious, considering the suspected encryption of the 752 hex code requires a case sensitive password.  





3/5/15 
I've taken some time to look into the underlying story of the ARG, seeing as it is something Storm has repeatedly told us to do. While reviewing the clues we have been given, as well as the current established theories, a few points stuck out.

First, there is the connection between HALOS, Niobium, and pizzas. The first time all three were mentioned in a single clue was in the 'Tempus Omnia Revelant' page, posted after the trail went cold on the HALOS file.
There is a long-standing that Niobium was being smuggled in on pizzas and used to build an AI called HALOS. While this would explain the large portion of the budget being spent on pizza, it doesn't explain why the Niobium was being smuggled in the first place. The use of Niobium in the construction of an AI is established in whiteboard c0a1x_labboard_am1. However, from the same whiteboard, it can be inferred that Dr. Montero, often noted as an administrator, was aware that Dr. Bottomley was in possession of Niobium. Why, then, were measures being taken to smuggle it in?
My theory is that the Niobium was initially being used in the development of the Tau Cannon. After all, the usage of Nb alloys as a superconductor is often linked to its use in particle accelerators. This would explain why Dr. Montero was aware of its presence in the Biodome. However, if Nb can also be used in an AI, and Dr. Horn and Dr. Bottomley were secretly using for this purpose, they would need a way to smuggle in additional Nb so as to avoid detection. This is why they used pizzas. A stockpile of pizzas, while strange, would seem much more innocent than a stockpile--or worse, unexplained disappearances--of an element often used in jet engines (see C-103 alloy) and currently being used in the Tau Cannon, the destructive power of which we are all familiar with.
This theory doesn't replace the long-standing one, but rather acts to fill on some of the gaps, and make use of the clues which have been provided.

Second, understanding the significance of the pizzas, what is the implication of their theft by Dr. Stone and Dr. Welsh? Whiteboard c2a4x_labboard1 already shows Dr. Horn's frustration regarding one of the security guards taking and eating the pizzas. This is understandable, because it would mean that more pizzas would have to be ordered to replace the Niobium. But consider what would happen if someone made a concentrated effort to steal and hide as many pizzas as possible. Recall that the events of Half-Life 1 take place in May, while the diary entry from Dr. Welsh mentioning the plan to steal the pizzas is dated in either September or October, depending on what format was used for the date. Since we are still able to find countless pizzas scattered throughout the facility, and the large contribution of pizza orders to the Biodome budget, as well as their continued theft (see whiteboard c2a4x_labboard15). is still being seen as an issue, it would appear that this has been going on for several months--almost a year, in fact.

If something about the previous statement seems strange, that is because it should. According to the evidence presented above, Dr. Horn had been continuing to smuggle in Niobium using pizzas right up to the events of HL1. However, this seems to contradict IRC clues 2 and 3, which points to the recovery of Niobium at Holloman Air Force Base, and the subsequent continuation of project HALOS thereafter. I have several theories regarding this, but they are mostly speculation.



3/6/15
If we're looking at elements, here are some fun facts. Element 22, titanium, is often alloyed with Niobium and other elements to produce superalloys for use in rocket engines and other assemblies. Additionally, niobium-titanium alloys are type II superconductors, with applications in MRI machines and particle accelerators. For some fun with 21: Scandium, element 21, was historically alloyed with aluminum for use in the Russian MiG.

Edit: For those who would rather not grasp at straws, here are some interesting thoughts I have on some of the clues we've been given:

IRC Clue 1: Applying the [Recipient] [Message] [Sender] format yields the message "Don't let him find us," from Dr. Welsh to Dr. Horn. Also, the version that appears in "Tempus omnia revelant," under a section evidently written by "HALOS AUTOMATED," adds an attempt to triangulate the source. That section also contains a list of Niobium isotopes.

IRC Clue 5: The inner code is designated as a message for Dr. Horn, to be sent by HALOS "in level seven cases." The inner code transmission is preceded by an attempt to connect to "User H," the subsequent sending of data, and the statement "SECURITY LEVEL 7 ALPHA." The clue also contains an attempt to locate the leak suspected in IRC Clue 3

If I were to take a guess right now, I would say HALOS is online and not friendly. 



3/6/15
1 is the ASCII code for Start of Header. The Hex code is 376 bytes, 8 short of an even 384 for a 128 bit block. Scandium is element 21, and consists of 8 letters.  


3/7/15
Nice work! I've been pouring over all the whiteboards for clues, so I was aware of the change in the samples, but I never paid attention to the numbers. There is a good chance 21 may refer to the sample EP-0021. However, I not entirely convinced that 1 refers to the Anti-Mass Spectrometer. EP-0021 never technically went into it over the course of the game.

The mention of the switch in samples, however, reminded me of what was written on the whiteboard with the budget and the description of the cascade cipher. There is a not mentioning a specimen transfer from the Lambda complex to the Biodome.

Remember how the keyword for the SECOM cipher, "laseroptroniclinearinducercannon," was written on the same board as the ciphertext? This might be a similar case. After doing a bit of background research, and considering how the board mentions that the area is still under construction, we may need to widen our search for clues.  



3/7/15
A few days ago, I looked over the IRC clues to see if there were any clues the formatting. I reached the same idea regarding the [********] in IRC 4 at that time.

What strikes me as most notable regarding IRC 6 and HALOS.txt is the proxyhost, which is different from all previous messages.

My guess is that the IRC clues are transmission from HALOS. (IRC 1 included an intercepted transmission, as the Tempus page suggests)

Taken together, there are three adresses, which I've taken to indicate three HALOS sites. The first is 164, which intercepted IRC 1 and sent IRC 4. The second is 155, which I believe was built using Nb from HAFB. This one sent out IRC 3, with IRC 5 being a sort of automated "dying message" when the site was compromised.

The third is 345, which I believe is the newest site, set up by Horn after he received IRC 5, hence "you should bring pizzas," being code for Niobium to build a new computer to run HALOS.

I'm not sure how IRC 2 fits in.

EDIT: Perhaps IRC 2 was just a simple message, rather than a transmission from HALOS. That would explain the lack of the typical formatting.  



3/7/15
Perhaps something in the IRC clues can help us with the HALOS code. If only we had been discussing that earlier, say, in the last few posts.  


3/7/15
CPU: "The same happens here.Whiteboard C2a4x labboard15.jpg references Anamalous Materials which is the chapter name of where the Anti-Mass Spectrometer is located and it also mentions the Resonance Cascade which is what the Anti-Mass Spectrometer caused. Storm had aslo said "It's everywhere you look" which would indicate seeing the results of the resonance cascade. His comment that "the password will probably be hinted at, perhaps in a less than obvious way" also matches" 

I'm not disagreeing with you. If the password works, then it works. Try it and we will know. In the mean time, I'll continue following Storm's other advice, and work out the story.  


3/8/15
Astij: "I think 'its everywhere you look' is in relation to the fact that that particular message was decoded by SECOM, which was hidden in the very message we were reading. Also, where is that second quote from, I don't think I've seen it before."

It's from the PM from 0418_08151814, an alias of Stormseeker. It's on his page on the wiki. The PM includes several hints at the method of encryption. 


3/9/15
I've always felt that the phrasing "21 goes into 1" is indicative of some form of metonymy. Subject-verb agreement requires that "21" be a singular object. Youdon't say "21 somethings goes into so." That why I agreed with CPU regarding a reference to Xen crystal EP-0021.

It's mentioned quite a bit on some of the whiteboards. Also, since it's referred to as a specimen, I would guess that it was the specimen transfered to the biodome.

Either way, I would agree that the key probably references the biodome, and the encryption is probably referenced in the PM from code. Personally, my (metaphorical) money is on an AES encryption, since it is mentioned in both the PM and the whiteboards.

EDIT: Remember the OTR-style security breakdown from Code_'s PM? It mentioned cascade ciphers later on, but only a single cipher for the hex code. 

Friday, August 29, 2014

Possible .JPG Image Hex Buried Within .PNG Image On BMRF.us

What follows is the hex code with the .jpg signatures found within the .png image on the BMRF.us site:

FFD82688844564C413116AD534C9D534349B44A3A7F1C6A709AB . . . 

It turns out that this is not a .jpg embedded in the .png, as it does not include a complete signature.  Oh well; worth a shot!

Monday, August 25, 2014

Update Part 2 of 2: Concept Map

 You can now open or save the concept map simply by clicking the link below.  You can also click the embedded picture to open it in a separate screen for closer examination. Keep in mind that the picture is fuzzy here, but opening the link provides the full, high-resolution version.

Open/save the Concept Map


Update Part 1 of 2: Timeline

I will be updating the blog and the Wiki pages to reflect two entities that I believe will aid us in our quest to solve the 752-character Hex Code.  The first, which I've included here, is a timeline of hints/solutions that began after IRC Clue #1 and prior to Code D being solved.  I am also constructing a concept map to identify key ideas that are reflected throughout multiple parts of the ARG--my hope is that this will aid us in determining possible relationships between clues, whilst also potentially excluding red herrings.

Final Timeline - Codes A-D Onward
(Events begin after IRC Clue #1 and before Code D solution)

  1. October 4, 2012
    1. IRC Clue #2 - “Note Welsh”
      1. “N38°57'8.05" W77°8'44.82".
        Solution two ignore loc data N32°52'50.77" W106°20'49.40" not buried at initial loc, fly here.
        Travel 14.16 miles east we transferred the niobium there.
        Await further instructions.”
      2. Capital letters in initial solution spell out “NOTE WELSH”

  2. October 5, 2012
    1. IRC Clue #3 - “X01/X02”
      1. INCOMING TRANSMISSION - LOC 2 LAYER 2 SUBSTRATA 3 X01/X02 HALOS PROJECT INITIATED
        41Nb recovered. HAFB Compromised.
        Transfer to site complete, project HALOS underway. Further INFO [Classified].
        CODE BASE 64 compromised, switch to old code talker.
        They are watching, assume leaker on site.
        WSMR No longer viable location, move to main site, check external sources.”

  3. November 4, 2012
    1. SECOM cipher solved
      1. Grilled Pizza image on site
        1. Message hidden at bottom of page:
          1. ‘They stole the lie, as if that matters to me, HALOS is far too complete to stop now. They can't hide there, not now, not now I have this, this holds the key to all things... they CAN'T hide from me. I will follow them, I'll set up a link and this to remind me. Perhaps I should hide it on the secure site, perhaps that would be best. I'll find them though and they will pay, they will definitely pay. Dr Marcel was right when he said, "When you're building a cage for Satan, you don't ask him to wait around whilst you put the doors on." Welsh is probably behind this, but he won't get away with it.’
        2. Decoded image message:
          1. “congratulationsyouwonthePIZZA”

  4. November 4, 2012
    1. IRC Clue #4 - “Prime Site Compromised”
      1. Base64 decoding: “Proxyhost@-84-9-123-164.dslgb.com//closed.proxy.accepted//?OTR,1,3,?OTR:[I---MI-G TR--SMI---ON - UN---WN S##RCE]Access detected to personal site.
        Security compromised.
        HALOS project under threat. Site offline as response. Switching to new protocols.[********] ~[OTR//2.0]Q0FZRUlMVEhEWkVIVEhBTlpJRVRLSU5OQUFTVFNPU
        0lCSVNPRElIVEhBTlpJRURaRUhUS0lOV09MTEFDSEVFRElCRUhUSEFOWklFQ0FZRUlMVEhEWkVIRElCRUhUSEFOWklFTkFBU1RTT1NJTk9EQUlIVEhBTlpJRU1BRU5BQVNUU09TSUdBSFRLSU5ORUFTSEpTTlRIQU5aSUUKRElCRUhZQVpaSUxJTlNIVVNIRFpFSEtMSVpaSUVORVNIQ0hFRUNBWUVJTFRIS0xJWlpJRVlBWlpJR0FIU0hVU0hCRURJQk
        VIWUFaWklTSFVTSEJJU09ESUhOT0RBSUg=[/]~
        [Transmission Ends]”
      2. Navajo Code + Playfair (Key: “Terminal”) decryption of inner portion:
        “PRIMESITECOMPROMISEDRETURNBMRFLOGINHALOS”

  5. November 5, 2012
    1. IRC Clue #5 - “BENALOHPAILLIER”
      1. Base64 decode #1:
        “[[Proxyhost@-84-9-123-155.dslgb.com//closed.proxy.accepted//?OTR,1,3,?OTR:[INCOMING TRANSMISSION UNKNOWN SOURCE]LEAK SOURCE DETECTED. TRIANGULATING...MIX CASCADE
        HOP DETECTED...ATTEMPTING TIMING ATTACK...[TERMINATED] CANNOT CONNECT TO HOST...ATTEMPTING CONNECT TO USER H... SENDING DATA. SECURITY LEVEL 7 ALPHA.[OTR//3.0]
        QkFRS1ggSk9BSkcgWEFIRUQgSUZHSVogRlpEUEIgVVNYTEcgR1hIRkEgVUFVV00gSEJRQU0gV0FYVlkgTFFRUlkgV1JVV1YgRVRRT0sgQkFDQkUgSldITVMgSFZPTlogSUFIUEEgU09XQ00gTEdBVFggVUVYT1EgRFJ
        RRUogQlZMQk8gREpJSEUgQ1pUSE0gWktISUUgTk9NTFMgQVhWVlcKRVRXSVMgRVRJR00gUlhFVkYgUVlBVUIgVkZDRUIgUFdCVUsgRU1OT0wgVw==[/][End Transmission]|¬[Terminal.] ~~ [Transmission Ends]]”
      2. Base64 and running key decode #2 (inner portion):
        "This is a message left for Dr. Horn. Just to remind you in case of emergencies that the password to the HALOS files is BENALOHPAILLIER. I have programmed HALOS to send in level seven cases. You should bring pizzas."

  6. November 7, 2012
    1. IRC Clue #6 - “HALOS.TXT”
      1. Reminder to check website which led to discovery of HALOS.txt:
        “[[ProxyhoSt@-84-9-I23-345.dslgb.com//closed.proxy.accepTEd//?OTR,3,4,?OTR:[INCOMING TRANSMISSION]ThEpIzZaIsaLiE...HALOS[Transmission Ends]]”
      2. Not mentioned on Wiki (I have since updated to reflect this), but the capital letters after the first “p” spell out:  “SITE”
        1. This is obviously just a hint to return to the site

  7. CURRENT
    1. 752-character hex code retrieved from HALOS.txt . . . .

Saturday, August 2, 2014

Feedback For Writers • Index page

My latest pet project:

Feedback For Writers • Index page

Check it out if you have a knack for writing, need a critique on an essay or other written work, or just like giving constructive criticism!  Even if you don't, do me a favor and sign up.  Your registration helps improve the numbers!

Saturday, July 12, 2014

Two Notable Things On the "Tempus" Page

There are two things I recently noticed on the "Tempus" Wiki page; one seems more crucial than the other, but they both bear mentioning.

1.

The primary examination is on this part of the Wiki page:

INTERCEPT 099.00//a 

Report{BMRF-HALOS-AITR-0001,
author =     {HALOS AUTOMATED},
title =      INTERCEPT DATA,
year =      20xx,
month =      OCT,
institution =  {Black Mesa Research Facility - HALOS DEPT},
number =      {099.00//a}
}


I have no idea why I didn't notice this before, but that looks exactly like programming language.  At first it looked like a mix of simply HTML and CSS, seeing as how there are no called functions, but there are tons of programming languages that I don't know--Python, for instance.  Perhaps someone else would have a much easier time noting trends or key indicators that point toward one language.

2.

The second interesting thing is the line:   institution =  {Black Mesa Research Facility - HALOS DEPT},

I don't think that the HALOS project was a well-known entity within the facility (only a few people were "in on it"), so calling it the HALOS DEPT (HALOS department) seems to indicate that this message is as we originally suspected--a direct message within the systems or makers of HALOS that was not supposed to be "leaked" to the public.

Anyhow, hopefully this will get some gears chugging along again!  Any thoughts?

Tuesday, February 18, 2014

Where We Currently Stand

Code/Storm's Private Messages

We haven't had much success with the ARG lately, as we're still stuck on the Hex Code puzzle.  I recently revealed that Storm had been PMing me directly about the ARG, although his messages revealed little:

"Apologies for the time delay, things have been hell here for the last month or so.

I ran the code through a few programs that analyze entropy via auto-correlation, the n gram results indicate a weak encryption, but one that results in highly entropic data (which I correlated against a similar data set size from a randomness extractor) when decoded via Hex, which I suspect is a secondary encode, as most encrypted data sent via communications is encoded in order to avoid corruption. This may have skewed the block size analysis done previously (resulting in 376bytes or 64bits).


Code:
³+�:5ºÝfW|$ÁOÉCFÑ1§ÅK¸/þà"aWw?$y#Ü!ö,Ô.‘ògµE«Êí¯aQ
Nê‡Í3ÇÇ?q10œÄ(´$=TðDùÏb–Ù¿÷9~C˜æ2Ú
?äx³¥O]Üiuú÷I„žbYZŸc•‘=à>:¬?8ŒEû…þ‘5AÖÀƒ˜òȃ2¨/ß�(büÜOçäj?éQÅÈ´dã:¹,–†.‹À™¸8�Úy¶?ä¢Y›mHǹSŒîc‘D ôaº’äþu$,Ø?QÖ•Q˜‡j|ª½{@I"A0©f̳Á9F:?~š7ª†?²xü—1À œŒy~y“
@eF²Lšb›&Â?Î*KäXš7_ësÄ«"\„Œøž)²q3—6G?J‰(í֏TiŒ^[PgFövZo%Þ¤Ú@þ¶e?E$i6•ˆ=Ë!æûþû¸Z)‘”€6¥+]Thinking in a non linear way, I've tried to classify the OTR message header with its increasing scale as the puzzles moved on.

[CLASSIFIED INFORMATION LEVEL 8][OTR//4.0]

working from that basis and the other messages I have developed this list.

Level 0 - 2 = Non Encrypted or Encoded (similar to private and confidential?)
Level 3 - 4 = OTR 1 - Base 64 or Base 85 encoded
Level 5 - 6 = OTR 2 - Hyper-encrypted (layered) Pen and Paper Ciphers
Level 7 = OTR 3 - Hyper-encrypted (layered) One Time Pad
Level 8 = OTR 4 - ???
Level 9 - ?? = OTR 5 - ???

Considering a flawed OTP (which it was, considering the ability to analyze it), when done properly should be information-theoretically secure, the next level should be either hyper-encryption using random bits (which is unlikely considering the difficulty in making that crackable and for the fact it's usually used on hardware encryption chips), or some form of Block Cipher (from which if we assume the scale of Levels goes up to 10), can be extended into simple block ciphers with small block size, which analysis seems to indicate it is not, up to triple cascaded ciphers with high block sizes, salts and perhaps even key files to add additional strength.

It is just an assumption, but one using the available evidence, OTR 4.0 is either a 128bit or 256bit block cipher with an unknown mode and key length. I would assume AES or Rjindael as candidates to allow for the most commonly used (also as Off the Record encryption uses AES as its base algorithm, that may be a hint). So to modify the list -

Level 0 - 2 = Non Encrypted or Encoded (similar to private and confidential?)
Level 3 - 4 = OTR 1 - Base 64 or Base 85 encoded
Level 5 - 6 = OTR 2 - Hyper-encrypted (layered) Pen and Paper Ciphers
Level 7 = OTR 3 - Hyper-encrypted (layered) One Time Pad
Level 8 = OTR 4 - 128bit/256bit block cipher (AES or Rjindael or Twofish or Serpent)
Level 9 = OTR 5 - Cascaded Block Ciphers with salt (SHA 512 or Whirlpool etc)
Level 10 = OTR 6 - Cascaded Block Ciphers with salt and possible key file additions (to increase password strength)

For the moment therefore, I will continue to try and analyze the non Hex code and work out the block size, algorithm basis, key length etc.

If it is a block cipher, then algorithm cracking is pointless, and as such key forcing may be necessary.

If I were a betting man, I would say this is a 256bit encryption, probably of the AES or Rjindael cipher algorithm (not that you can tell from the code, but its pretty common) .

The password will probably be hinted at, perhaps in a less than obvious way. We can assume this much as it is almost impossible to analyze a cipher text with only one message and nothing to confirm patterns. Once I've got a rough estimate of what mode/algorithm it uses, I can dedicate some run time to rainbow table attacks on the key. I have a feeling this is a holding puzzle, designed to allow time to construct further aspects of the ARG or work on whatever is behind their NDA.

Recently there was a problem with the computer systems at work, so I may not have access to all the analytical machinery I usually do, it may take a bit longer to get more information, if i find anything interesting I'll let you know. I may have access to some more specialist equipment at a later date, so more progress will likely be made then. I think we can rule out SSH or OTP though."


Latest Message from Storm

 Another thing to note is that we have received another message on the ARG's main Wiki site, in the comments section of the "Tempus omnia revelant" page.  The message is as follows:

"Aug 09
--------------
W### has been p########## well on the L#### O####### L######## Can####, other#### kn### as the T## Cann##. My t##### to the #####etic
induction coil have reduced the likelyhood of overcharge by 200%! I still cannot fathom why the fuse we introduced continues to fail
however, perhaps the leptons have a mi7s6d0976)(&^A)S()F ()A^SF) A()&^  ^)(AS&^ (^6097^)(76)(*"_)"_)(*")(*!")(*!")(!"*)(.................................. ........ .........................................."


It is believed by some that the different symbols may be converted to numbers--the resulting "code" is:

7609760976090906090766097696609760976098202098209812098120912809

It's important to note, however, that this code is probably just produced by random keystrokes. 

My Prediction

Below is something I recently posted on the forums about the ARG, and I currently stand by it:

"I have pretty much concluded at this point that we're dealing with 3DES. The Lucifer cipher is directly connected to DES. Furthermore, we have things happening in groups of threes:

In the image with red writing, the word "lies" is written three times--there may be a fourth, but it looks like something else.

The first "lies" is also underlined three times.

We have three instances of Satan/Lucifer being mentioned:
* Once on the grilledpizza page: "When you're building a cage for Satan, you don't ask him to wait around whilst you put the doors on."
* The picture with the red writing
* Indirect suggestion with the Dante's Inferno references: "Raphèl maí amèche zabí almi"


Other than that, I think it's just a feeling. I found this page randomly tonight: It details how someone solved a hex code for a contest to win tickets. The first round of the code actually mentioned Lucifer, and the gentleman used DES to solve it. His hex code was extremely similar to ours."

Other Possibly Relevant Material

Lastly, here is some other information pulled from the Wiki that may or may not be helpful or even relevant: