76543

76543
Completed
A rabbit hole of puzzles across the GameDetectives community.
Type	Unofficial
Creator	Unknown
Discovered	2016-03-16
Timeline	Timeline

76543 was an ARG that began with a post to /r/gamedetectives and continued through a chain of puzzles. Its creator and purpose are unknown.

Summary

The 76543 ARG was designed for the GameDetectives Community. It first appeared on the subreddit, after /u/ARG76543 posted a text post describing their group, and outlining that we would need a PGP Key to get our first clue. The encoded text in the post was Vigenere decoding with "arg seven six five four three" to a description of William Shakespeare, which user NickForAll found out was our key password. Using "Shakespeare" as our password, we were able to unlock another clue, which was an extract from Pslams, the third section of the hebrew bible. It didn't make much sense until users Crauss and Deiru were able to determine that the string of numbers along the bottom correspond to a letter's position in the alphabet. When decoded the message refers to multiplying prime numbers. 2, 3, 4, 9 and 76543 (the poster's username). 4 and 9 aren't primes, so after multiplying the rest it gives 459258, which was the clue to a Twitter account. This twitter account had a darkened image, which when lightened, revealed a QR Code.

A bot called argbot appeared in the off-topic voice channel, and would play pre-recorded sound-bites when given a certain key. For example, when given the key ??Patience, it would play Rick Astley's Never Gonna Give You Up.

It Begins!

• User /u/ARG76543 posted to reddit with the title

Hello ARG solvers, a message from 76543

• The message read:

Hello ARG solvers. We are a small group of people just like you: programmers, security experts and games who enjoy to solve puzzles. We have participated in so many ARGs now, we felt like it was our turn to build something.
Just find the right PGP keyservers, key ID and use the person to decrypt our first message. Any messages signed with this PGP key should be trusted.
“Bravo, I heard echoing in the room next to me, 2 times, really loud. I was staying at this small bungalow built for the volunteers in the delta of the amazon river. We were working on connecting the locals to the world, the developer guys next room were fixing a bug in the pre-alpha software, I guess that’s what got those guys so excited. We would find a bug at least 3 times a day. Working here was hard, we would start at 9, setting up a new >transceiver. We were with a team of 4 and it felt so good, being able to help the locals get a connection to the outer world, so they could be educated.”
Sfsw wvc uw lfxopmxsx ybtjipf zt grz ss lpb lzzeysmk pviow ow naw omzw, wqmmmw xos zm’z r gsieiahzrpw. Xlu kppyilv pvlph sre “Usdrpalbskz? M yvced ufx”.
And last, but not least: https://ghostbin.com/paste/vy9rt2pb
Over and out. 76543

• The ghostbin seems to be a PGP keyserver: https://pgp.mit.edu/pks/lookup?search=76543&op=index. The first entry suggests Be2da394 is the key ID.

Solving the First Key

• The central part of the text that says

"Bravo, I heard echoing in the room next to me, 2 times, really loud. I was staying at this small bungalow built for the volunteers in the delta of the amazon river. We were working on connecting the locals to the world, the developer guys next room were fixing a bug in the pre-alpha software, I guess that’s what got those guys so excited. We would find a bug at least 3 times a day. Working here was hard, we would start at 9, setting up a new >transceiver. We were with a team of 4 and it felt so good, being able to help the locals get a connection to the outer world, so they could be educated.”

• The NATO alphabet letters in the text translates to:

BE2DA394

• This is the key ID to pgp.mit.edu, where the keyserver is being hosted.

• The encoded text in the post was Vigenere, decoding with "arg seven six five four three" to:

Some say he disguised himself in one of the greatest works of his time, others say it’s a coincidence. Pop culture would say “Coincidence? I think not”.

• This refers to William Shakespeare, "Shakespeare" is the first code (Thanks to NickForAll for that)

The Key into the Hole

• Using "Shakespeare" as a key in the Ghostbin website reveals some text:

God is our refuge and strength, a very present help in trouble.
Therefore will not we fear, though the earth be removed, and though the mountains be carried into the midst of the sea;
Though the waters thereof roar and be troubled, though the mountains shake with the swelling thereof. Selah.
There is a river, the streams whereof shall make glad the city of God, the holy place of the tabernacles of the most High.
God is in the midst of her; she shall not be moved: God shall help her, and that right early.
The heathen raged, the kingdoms were moved: he uttered his voice, the earth melted.
The LORD of hosts is with us; the God of Jacob is our refuge. Selah.
Come, behold the works of the LORD, what desolations he hath made in the earth.
He maketh wars to cease unto the end of the earth; he breaketh the bow, and cutteth the spear in sunder; he burneth the chariot in the fire.
Be still, and know that I am God: I will be exalted among the heathen, I will be exalted in the earth.
The LORD of hosts is with us; the God of Jacob is our refuge. Selah.

26 104 111 12 2 9 111 12 10 20 9 4 2 26 20 6 2 15 12 10 20 9 4 20 8 2 3 104 6 15 3 12 20 12 3 17 2 15 133 6 3 26 20 12 10 2 15 1 2 15 3 15 20 10 104 15 133 4 20 133 5 15 133 17 3 4 12 10 28 10 5 4 5 28 12 20 4 6

• This is an extract of Psalms, the third section of the Hebrew bible. It seems mostly irrelevant save for the string of numbers at the bottom. The numbers correspond to a letter's position in the alphabet (Thanks Crauss and Deiru), when solved in a cipher it gives:

muLtipLtheprimesinthepreviousnotetofindsomethinGinonehundredandforthcharacters

• The message refers to multiplying prime numbers. 2, 3, 4, 9 and 76543 (the poster's username) were the only numbers in the Reddit post, which is the "previous post" they were referring to. 4 and 9 aren't primes, so after multiplying the rest it gives 459258, which was the clue to a Twitter account.

• The Answer leads to this Twitter account named "456258ARG", which has posted multiple recent Tweets, and is confirmed to be watching us in the Discord channel.

• The first tweet has an dark image which when brightened shows a QR code. It translates to "your key is primes", which would prove to be useful in a future puzzle.

A Meaningful Discussion

• The Twitter account had mentioned it was listening to us by responding to questions if his "technical difficulties" message was part of the game. This led up to the mastermind posting:

>Look in your voice chat, give him the key prefixed by ?? And he'll respond if right. You can pm him to give key.

• A user named Argbot appeared in the Off Topic voice channel, and players started Private Messaging the user with many words prefixed by ??, in the hopes that the Mastermind may respond.

• wyh332, a moderator of Discord, muted the user after Argbot responded to a couple key attempts with the Rick Roll videos - until he/she was confirmed involved. Argbot responded by posting in the ARG discussion channel:

>Did you really mute your only clue? Expected you to be smarter

• This was met by a barrage of public messages trying all manner of keys like "??3478fn3743" and "??RandomGuesses" however these didn't cough up any results either, except a couple that gave humorous responses. A user would post an attempted key in chat and most would be met by silence, but if you were in the "Off Topic" voice channel you would sometimes hear an automated response by the user, these including:

•  ??Shakespeare - X-files theme music.
•  ??Primes - The Team Fortress 2 engineer saying "nope".
•  ??Patience - The Rick Roll music.

• The user Argbot posted a couple more responses in chat, including this, which says:

> "Yup, that's us"

• followed by a bunch of garbled characters. It also posted in the Discord channel:

>"\*sighs\*"

• in the same manner similar to the ghostbin. We know these were human posted and not triggered by the bot.

Beeps and Boops

• Suddenly, through an unknown key, argbot started playing Morse code.

• The key that triggered the morse was worked out by analyzing the twitter linked QR code, (found here, and brightened) that was found to include hidden hexadecimal code. The decoded hex says:

>KEY IS ARC4

• ARC4 or the Rivest Cipher 4 is a stream cipher encryption method that requires input text and a key.

• Encrypting "Nope" (which was said at the end of the morse message from argbot) with "prime" (what the QR code actually read) as the key using the ARC4 cipher (clue from the hexadecimal) gave the following result:

>0d 0d 0b c3

• Using the hex as a key, a new code was found: ??0d0d0bc3. When submitted this triggered Argbot to play the previously heard Morse code.

• The Morse was deciphered to "ARGBOX SERVER 128.199.63.123" which is the name of a server followed by it's IP address. This page shows the IP is based in Amsterdam, coincidentally the Netherlands is the home of several Discord community members.

sudo apt-get install problems

• Argbot posted shortly after the discovery of the IP address to say:

>Do you know those moments when during a test run everything goes well, and in production everything fails? Well, the host decided to change the IP because of security concerns. Impressive, security concerns on an almost empty server. Anyways, be right back, and sorry for this mess, should've checked the IP.

• The user/bot was referring the recently discovered IP from morse and went down shortly before posting "argbox-v2 deploying....". Users checked the known codes and nothing seemed to change at first glance.

• After inspecting further however, the morse code from "??0d0d0bc3", changed from the previous iteration, likely to reflect the technical difficulties and unexpected IP change from the Mastermind's server host.

• The new IP is 188.166.22.203 and in the same physical location as the first. When appended to https:// it gives https://188.166.22.203/ which at the time read:

>Well done, patience is a virtue (which means, wait, we're preparing the next stage)

Location, Location, Location

• A couple hours later, the message on the site changed to

>Go to slices exact edicts

• There were also multiple hints saying we need to go to a location, such as Argbot's game on Discord being set to "Less talking more walking".

• User Sarene worked out the 3 words "slices exact edicts" could be entered into this site to give this location in the Netherlands.

• Discord users Svardskampe and Dr. Dino were chosen to go there on 17th of March, but the other users have attempted to bribe them with pizza to go earlier, with zero effectiveness.

• An hour or so later, Discord user TheEvilSocks agreed to go.

• A new key was also discovered, albiet it is not very useful. Using ??debug will list the channels on the Game Detectives Discord, as is seen here.

Live From the Scene

• Socks found this QR code (here is a clean version) at the coordinates in the Netherlands, that when scanned, outputs the following:

> Oh hello. Say my name.

• Discord users realized that they had to input a new key to the Argbot, possibly his name.

• After half an hour of guesswork, someone (likely through PM) managed to get the right answer but didn't reveal the correct key. The answer gives the sound of a phone being dialed.

• The Mastermind himself got fed up with +900 PMs to him and revealed a Discord Username, neintrigger, who turned out to be the person spamming the bot with commands - the user was shortly removed.

• Roughly an hour after neintrigger's removal from Discord, the code was cracked! The keyword was "??f01b26324a65".

• The key was found by using "argbot" (the bot's name) encrypted with ARC4 (the previously used encryption method) with "Heisenberg" as the key. The result was "f01b26324a65" (thanks Nickforall for that one).

• "Heisenberg" is a character in the TV series Breaking Bad and "Say my name." is a well known quote of his.

Call Me On My Cellphone

• The response from the key was a series of Dual-tone multi-frequency signaling, DMTF.

• Using the tones, the phone number "+ 1 (313) 208-7879" was found, which when dialed plays this message (credit goes to Dr.Dino and picapi_ for that one). A transcript will be made soon.

• Discord user Sarene theorized that this might be a "what3words" coordinate - the geo-location website previously used to find the QR code. However since the message was distorted a lot it took some time to decode, but after some fixing up it yielded a location in Svalbard, which was the answer and the link to the next puzzle here.

Translating the Runes

• The Svalbard page was updated from "patience is a virtue" after some time to include the identifier to an Imgur post. Found Here

• The Image, known to the ARG as "The Book," was written with Elder Futhark runes. Once the Runes were partially decoded we used a custom ROT which can be found here to fully translate the text (Thanks to User Randomiser with help from Ako and Sarene). The cleaned up version of the text can be found here, with info on how the first section of the text was decoded found here

• At the bottom of the book there are 3 numbers, coincidentally all being prime numbers. It was later discovered that these could be appended to the previously used IP address/URL as ports to find new pages.

Trouble in Server Town

• As of around 5:30 PM UTC, the IP previously found from morse and to display Svalbard opened up a new page (archived version) and started displaying a long hex string. The port is the first of three numbers at the bottom of the runes book, suggesting more might come. The page adds 2 hex characters at a time every second, and has been since it went live. Attempted decodes suggest it is a sound file.

• As of 6:18 PM UTC, Argbot's current game on Discord changed to "GlaD I am not you. 1240". In the runes book, 1240 is the second listed number, and at the same time the relevant page (archived version) opened up. It shows the ending sequence from Valve's 2007 game, Portal (with the ascii art and music) except with the headers changed to direct messages to us, the players, telling us to "keep going as we're close".

• As of 12:05 PM UTC, the final page (from the list of numbers) remains closed. Whether this is because the mastermind is making us wait or because we are yet to solve a puzzle is unknown.

• The Hex string (found here) was found to be a wave file that says "76543" in DTM tones. At the end of the line it says "NOT THE PRIMES".

Argbot Speaks

• Argbot started to speak in chat for a little while after being stuck as to what to do next.

• It started by saying:

>Hi, I am here to save your money, no hints on the phone anymore

>We want you guys to have fun, not spend money on solving this ❤

• User Cubity_first asked a followup question about who exactly runs the bots, Argbot replied:

>argbot is from us, the arg creators

• After a long pause Argbot made one last message and said

>Just stop ignoring the clues you get on the website ❤

>Enough hints I guess, time to log off

Back to Argbot

• the Argbot changed the game it was playing from "Less talking more walking" to:

>33: And...

• This may be a hint to the 33rd line of the *Portal* theme song which is the lyrics:

>And Killed Me

• Argbot Once again changed its game, this time to:

>1v7531

• This was the code used to obtain the red herring badge in Game Detectives first ARG, Winter steam sale.

• Around the same time as this the ending song, "Want You Gone", from Portal 2 started playing on Argbot's audio without any prompt being said in the public channel. This was later found to have been triggered by the Puppet Master him/herself.

Argbot Speaks... Again

• ArgBot went to the chat again, this time to say:

>Don't get us wrong with the red herring, there are some parts you focus on that are a red herring. I would love to give more hints, but it's so obvious 😦

• User Wyh322 followed up by asking:

>is the 2nd song just now triggered by a user here?

• To which Argbot responded:

>no

• Thereby confirming it was by the Mastermind. Argbot finished off by saying:

>Seriously, read it and use it.

Thinking With Portals

• "??and killed me" was discovered to play the Portal ending song. It has been noted multiple times that the song appears to speed up and slow down strangely. It was found from the hint from argbot, 33, referencing that line in the lyrics to the song.

• "??Byha" was discovered to play the Portal 2 ending song. It was found using the word "cake" decrypted with the 76543 cipher, the same cipher used to decipher some of the book text earlier on.

• Shortly after finding Byha, argbot's game changed to "1v7531 = solved", leading some to believe that they had either solved the ARG, or solved a red herring. There was no announcement, and many clues left unsolved.

Argbot Returns Again

• Discord user qwerty123443 said "it's over (i think)", to which Argbot replied:

> you think wrong bud

> To primes, or not to primes? > ??Shakespeare

• User Cubity_First asked, "@argbot Can you tell me how you got the audio to play so clearly?", to which Argbot replied:

>ffmpeg with node-opus -programmerguy

• Argbot also gave us some more hints after users repeatedly tried "??prompts" to trigger the bot:

> ? Portal 2 command was added at the same time as still alive

> The bot won't do much more

> Don't give up solvers, you are almost there. Honestly.

• This was followed by the "??Byha" prompt starting again, the one that played ending song from Portal 2. However there was no message in the public channel, suggesting either someone PMed the bot or it was triggered manually by the mastermind, as had happened before.

The End

• NickForAll solved the arg by finding the final link here. It shows the Discord chat singing still alive while special credits roll thanking certain people like the discord mods. The chat singing comes from the Winter ARG.

• Afterwards Argbot went into the chat to congratulate and host an AMA.