Oddworld: Soulstorm
| Oddworld: Soulstorm ARG | |
|---|---|
| Oddworld: Soulstorm - An ARG centered around lore from the Oddworld universe linked to the currently unreleased game Oddworld: Soulstorm | |
| Type | Official |
| Creator | Oddworld Inhabitants, Inc |
| Discovered | 12-22-2016 |
| Reopened | 05-30-2018 |
Main Page > List of Investigations > Oddworld: Soulstorm
The Oddworld: Soulstorm ARG was an ARG centered around lore from the currently unreleased Oddworld game, Oddworld: Soulstorm. The official home page for the ARG, containing puzzles, hints, and clues, can be found here. The ARG was divided into 5 distinct stages, each of which began with a "transmission": an image clue that led to a series of puzzles.
Contents
- 1 Prelude
- 2 The First Transmission
- 3 The Second Transmission
- 3.1 Morseception
- 3.2 Braille & Upside-down Pigpen
- 3.3 Directional Arrows Puzzle
- 3.4 Interlaced Barcodes & Second Hidden URL
- 3.5 Source Code Mysteries
- 3.6 Stuck In The Mud & Third Hidden URL
- 3.7 Creepy Scenes From Within
- 3.8 From The Ashes, Asset 99 (Hidden URL 3.5)
- 3.9 Second Unlocked Image & Grid Solution
- 4 The Third Transmission
- 5 The Horror Is Shown In Full
- 6 The 4th Transmission
- 7 The Fifth Transmission
- 8 The third phase
- 9 Loose Ends
Prelude
Early in 2016, Twitter account @edmudokon began posting cryptic messages that seemed to be related to the Oddworld universe. The account appeared to be run by an average Mudokon named Ed who claimed to have information he wanted to share, but he seemed to be in constant danger and could only access the outside world via a faint connection. Beginning around March 2016, @edmudokon engaged users with an elaborate series of puzzles and challenges, releasing information both on twitter and via the official Oddworld website. These puzzles eventually led to the revelation of a website, http://1029.io, as well as a message: "now you know. you can help. join us. together we can rise."
The 1029 webpage featureed glitchy effects and another rendition of the ASCII-art logo, but with the numbers 8291 replacing some characters. At the bottom of the page was an e-mail signup form, above which was a message:
THE FALL OF RF1029 WAS THE SPARK TO IGNITE A REVOLUTION. FOR TOO LONG, THEY HAVE CONTROLLED THEIR GIANT INDUSTRIAL MACHINES, GRINDING THE BONES OF OUR KIND INTO DUST IN THEIR ENDLESS PURSUIT OF POWER AND WEALTH. WE WERE TAUGHT THAT THIS IS ALL THERE WAS: OBEY. THE TRUTH WAS HIDDEN FROM US. OUR HISTORY WAS HIDDEN FROM US. WE WERE BRED TO WORK, RAISED TO OBEY AND FORCED TO COMPLY. OUR NATURAL CONNECTION TO MOTHER PLANET WAS ERASED FROM THE CONSCIOUSNESS OF OUR PEOPLE. LOST WAS OUR KNOWING. LOST WAS OUR UNITY, OUR CONNECTION, OUR POWER AND OUR PURPOSE. ALL THAT WE WERE WAS A COMMODITY TO BE TRADED AND EXPLOITED IN THE ONGOING RACE FOR MORE WEALTH. WHAT WE SHOULD HAVE PROTECTED, WE WERE TRICKED INTO KILLING. WHAT WAS WORST FOR US, WE WERE TOLD WAS BEST. WE WERE TAUGHT TO TRUST THOSE WHO WOULD DECEIVE US THE MOST. THAT HAS ALL CHANGED. THE HERO HAS SHOWN ALL OF US THAT OUR OPPRESSORS CAN BE TOPPLED. HE HAS FOUND OUR WILD AND KNOWING BROTHERS. HE HAS RECONNECTED THE FACTORY-BORN TO OUR NATURAL WORLD AND ANCIENT WAYS. HE HAS LIT A FIRE IN OUR HEARTS THAT CANNOT BE EXTINGUISHED. WE WILL GIVE HELP TO THOSE WHO ARE HELPLESS. WE WILL LEND STRENGTH TO THOSE WHO ARE WEAK. WE WILL FIGHT FOR THOSE WHO ARE DEFEATED. OUR MOVEMENT WILL SPREAD LIKE A RAGING INFERNO AND WE WILL TAKE BACK THE POWER FROM THOSE WHO HAVE ABUSED IT. WE WILL NOT BE SILENCED BY THE MEDIA CIRCUS. WE WILL NOT BE IGNORED. WE WILL NOT STOP. WE WILL NOT OBEY. WE WILL RISE AND WE WILL RISE AGAIN, UNTIL WE HAVE BURNED THROUGH OUR TATTERED BONDS AND RAZED THE MACHINE TO THE GROUND. WE WILL RISE. JOIN US. THERE’S A STORM COMING.
In the source code for the page, only the letters E and D of the message remain capitalized.
Later that day, the Twitter account @SPIRITOF1029 revealed themselves as a "Clandestine organization dedicated to doing good on behalf of the Mudokons and revealing information about a new horror being perpetrated against their species." They also tweeted their first message, parroting the 1029 URL and adding their own message: "There is a storm coming. Join us."
Social media feeds went dark until December, 2016, posting only reiterations of the URL with messages like "Rise up" and "We are the storm. Join us". Then, in January of 2017, activity on the accounts surged once again and the first hints of an ARG began to appear.
Smells like Mudokon Spirit
The flurry of new activity in January mainly consisted of @edmudokon and @spiritof1029 conversing about about whether or not Ed would be able to help the organization's cause. At this point, the Spirit of 1029 made their message very clear, stating "Oddworld has been blind to the plight of the noble Mudokons for too long. We will rise. Join us! http://1029.io". More notable activity includes the organization's quip "We recommend knowledge of many different codes and ciphers - you never know who is listening. #learnyournameinmorsecodeday", hinting that the coming information would be encrypted in some way..
Oddworld Inhabitants (Oddworld developers, @OddworldInc on Twitter) was contacted by the organization at this time, being told by Spirit of 1029 "We will help @edmudokon but we can't send anything unencrypted. You'll have to break our code. We'll be in touch." Very shortly thereafter, on January 19th, 2017, Spirit of 1029 tweeted: "We have received a transmission. We will pass it on as soon as we can verify. We need your help." and the Oddworld Webpage was updated with a download for two files.
The First Transmission
The Spirit of 1029's first transmission came in the form of an image and an audio file. The image, pictured on the right as it looked upon transmission, appeared to show a tattered and burned document bearing the Spirit of 1029's logo with the slogan "We Will Rise," with many portions of text redacted. The text on the document, where it was legible and not redacted, reads:
Date: Period: XXXXXXXXXXX Specification Details: XXXXXXXXXXXXXXXXXXXXXXXXXX -Observe XXXXXXX and XXXXXXXX changes in test subjects -Assess long term XXXXXXXX on XXXXXXX -Determine product safety Authorization: XXXXXXXXXXX Tests requested: -XXXXXXXX Pronostics - ?Access whenever? product XXXXXXX -Acidity Levels - ????? XXXXXXXXX -Product safety Expected results: XXXXXXXXXX make XXXXXXXXX interesting Test results: -XXXXXXX highly XXXXXX -XXXXXXX this XXXXXX ?? XXXXXX ?nice? XXXXXXXX -Highly XXXXXXX -Subjects: XXXXXX - XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXX Conclusion: Product (ready) for consumption -------------------------------------------------------------------------------------------- ??? : XXXXXXXX there is XXXXXX here but it will XXXX ???? XXXXX --------------------------------------------------------------------------------------------
As progress was made on the puzzles, the official Oddworld webpage was updated to provide hints. This practice continued throughout the ARG.
Directional Arrows, Pigpen, & Anglo-Saxon Runes
In addition to the text in the photo, there were several areas featuring symbols and runes. Along the top of the document, Anglo-Saxon runes spelled out ED. Along the bottom, the text YOU ARE THE KEY YOU KNOW IT IF YOU WERE LISTENING is spelled out in the font, BabelStone Club Penguin pigpen. Running along the right side of the image, arrows can be seen pointing in a number of different vertical, horizontal, and diagonal directions. Players discovered that the arrows could be decoded by taking their angle measurement and deducing an "alphanumeric" equivalent, or a number between 0-25 where each number represents a letter of the alphabet. It just so happened that each arrow had an angle which ended in a zero, and thus, the first "arrow cipher" decoded to:
12 15 15 11 6 15 18 15 21 18 13 5 19 19 1 7 5 8 5 1 18 15 21 18 22 15 9 3 5 L O O K F O R O U R M E S S A G E H E A R O U R V O I C E
The message decodes to LOOK FOR OUR MESSAGE HEAR OUR VOICE.
First Audio Clip
The second part of the Spirit of 1029's first transmission consisted of an audio clip lasting 1:40. Hidden in the audio clip was reversed Morse code, which proved difficult to decode by ear due to the added white noise. Eventually, the code was cracked by using a spectrogram of the audio.
Although rough in some spots, the decoded Morse read:
qmiqwmiqyidimrjqdjijilmxmnrjqdjajmpmnrprspkesmkjpdqjnyajnwsnrpgspcsppmqidimqymdbcqajnwsnrpgspcdhbzmnjajanadumjimrpq
In addition, players also discovered that, using portions of the Morse already decoded accurately by ear, it was actually to be used as ciphertext in a shift cipher, and that the key to be used was "storm," which was taken from tweets made by Spirit of 1029 declaring themselves to be "the storm". The pigpen from earlier served as a hint to look back at previous communications in order decrypt the morse. With the newly-complete Morse code now in their possession, the community was finally able to accurately decipher the ciphertext they had obtained from the reversed Morse code. It read:
tentwentyninedotiononqexerdotiofoeserdsdaspjaepositoryforwardslashassetninetyeightforwardslashimgzerofofrfiueonedst
ten twenty nine dot io nonqexer dot io foeserdsdaspjaepository forwardslash asset ninety eight forward slash img zero fofrfiueonedst
Although not entirely accurate, through trial and error the community was able to locate a new URL branch of http://1029.io, http://1029.io/repository/asset98/imgzerofourfiveone/.
First Hidden URL
The hidden URL on http://1029.io is a page which displays one of eight photos each time it is reloaded as well as cycling messages.
7676-AL
3786-IC
9455-UM
9394-AL
7393-AN
5574-PH
2384-ER
1029-LY
The community quickly realized these were cut up pieces of a larger puzzle. Oddworld Inhabitants updated their page to read "Once you've got everything together - show us!". The completed image was tweeted out to @OddworldInc on January 19th, and the next day, they had replied, instructing the community to hang tight while they cleaned up the image.
First Unlocked Photo
While waiting, the community picked up on what appeared to be some writing on some of the pieces. This writing was later verified to read "Who?", "Where?", "So Tired", and a set of numbers likely to be "8291". After three days, @OddworldInc tweeted out a scrambled image, pictured left, stating "We received something and there's one last thing we need you to do. Share it. Spread the word.". The next day, after the tweet gained 100 shares, they tweeted another image, pictured left, this time unscrambled. At this time, they stated "While you shared our message 100 times we worked away to bring you this. We're clearing it up even more, we'll share what we find Thursday.", while the webpage was updated with the message "Update 5: Thanks to you guys sharing the previous images online, we've managed to decode the photo further and have updated the thumbnail here. We'll return on Thursday with the finished, fully decrypted image - but until then, please do let us know what you think!" And, true to their word, when Thursday came @OddworldInc tweeted out a final picture of a render from the upcoming Oddworld: Soulstorm, pictured right, in all its unscrambled un-cropped glory. The release of this image signaled the end of the first of five phases of content release Oddworld Inhabitants have planned.
The Second Transmission
On Feburary 2nd 2017, the Spirit of 1029 again reached out to the community, tweeting out via @Spiritof1029 "Our agent has delivered another transmission. We will verify its origins and pass it on." Several hours later, Twitter account @OddworldInc sent the message "We were just contacted again. Don't go anywhere, we might need your help with this...", and the Official Oddworld Site was updated with a message as well as an image, pictured left. In addition to the image, a newsletter was sent out to everyone who signed up at the bottom of http://1029.io. The newsletter features basic info about the ARG so far, as well as a barcode at the very bottom, which, when scanned, reveals a code:
Ivzw gsv mfnyvih pmld gsv gifgs
This code, when passed through a cryptogram solver, reveals a hidden message:
READ THE NUMBERS KNOW THE TRUTH
An "in-progress" image, pictured on the right, highlights the hidden details found so far & outlines their currently known solutions.
Morseception
The Morse code in the image turned out to be fragments of a larger single code, seen below pieced back together:
The Morse decodes to... more Morse code, of course!:
DASHDOTDOTDOT DOT DASH DOTDOTDOTDOT DOT DOTDOTDOT DASH DASHDASHDASHDASH DOTDASHDOT DASHDASH
Which in turn decodes to:
-... . - .... . ... - --- .-. --
BETHESTORM
Braille & Upside-down Pigpen
A message in Braille, pictured right, in the bottom-left of the image reads Spread our message. The Babelstone pigpen code, when flipped upside down:
decodes to:
KNOW YOUR CODES
KEEP THEM CLOSE
YOU WILL NEED THEM
Directional Arrows Puzzle
Using the same method as was used to decode the first cryptic arrows, these arrows turned out to decode to:
7 14 9 8 20 25 18 5 22 5 5 4 15 3 5 4 H O J I U Z S F W F F E P D F E
This ciphertext, when decoded using a Caesar cipher set to a shift of 25, reveals the message GNIHTYREVEEDOCED, which is DECODE EVERYTHING backwards.
Interlaced Barcodes & Second Hidden URL
The community speculated that the strange box in the bottom-right of the image sent by the Spirit of 1029, pictured left, was a fragmented barcode. After many failed attempts to reconfigure them correctly, the two barcodes were both finally correctly assembled and, when scanned, led to the discovery of two messages:
http://www.1029.io/repository/asset98/
&
findawayshowthetruth
Combining these messages into a single URL, http://www.1029.io/repository/asset98/findawayshowthetruth/, led to the discovery of a new page with the Spirit of 1029's scrambled logo on, pictured right.
Source Code Mysteries
This source code can be found at the second hidden URL.
In the source code of the page (F12 on Google Chrome to view source), an extensive message containing several presently-unsolved puzzles is written. It reads:
!-- Can’t reach any.. Listening anyon… there? Can hear us anymore- need to… can’t fnd We will never give… what they… from us A9539 \\ B2919 /\\ C4882 /\ D4627 \ E6758 \ F???? //// /\//\\//5,1:4.1,2:8.1,3:2.3,3:2.4,3:3.7,3:3.1,5:3.4,5:9.5,5:2.7,5:4.7,6:6.3,7:3. Does… care? Freedom isn’t gi… will take… We have never…. Given… deserve. We… take… our righ… \\//\/KDIUTHANPUYHHDQOEPLNDOALJGUDITHBBDOZLGFERKJGLSAOE Stand up and fi… Don’t be afr…. \////JUTYROSLNGNALEHGNWOTIQPOKSDNTPNOJAWEOBNGLAWKJNWNR E=5OUEHRA? \\\\/\2,1:2.3,1:2.6,1:4.1,2:4.3,2:2.3,4:4.5,5:2.6,5:3.7,5:3.4,7:8.5,7:3.7,6:4. 7777338883366899984477733 33 They want to… kill- don’t- Stop them from…. Hurting- they… think We are no less- they think… aside Don’t believe what… told- liars… A5989 \\ B5176 \ C2863 \ D2558 //\ E3413 \ F???? //// Can’ fnd anymo- We wil silnced Killin- they are dy.. \\\/\\JHWUITUHABSJGNEWKLALNVGJKWELKJLWQQPRUTJHJJSBFMMH Hurting the.. Back down unt… resist. Intercep… our messa… we will fight ///\\/JQEABTVKNUCSEYCMBILDKOSCYSITECPAGFAXHKETJNZURWCIE We will ri… Cannot… silenced when ther… who need… now We won’t ba… we have beat…. Before… Must not- \///\//\1,1:3.4,1:2.6,1:9.2,2:2.6,2:2.2,4:4.3,5:2.5,5:2.7,5:3.4,7:3.6,7:2.7,7:2. Spent so long…. Afraid… never let- again ...Storm… find it’s way- end Why are … here? Only...profit- nothing more… importnt as- - lies they… will tel- Believe- nothing… terribl- things… \\//\\\/4,2:6.6,2:4.7,3:3.2,4:8.3,4:2.4,4:2.7,4:3.2,6:2.4,6:3.6,6:2.1,7:4.3,7:2. -->
At the present, only some portions of the source code have known solutions.
The ABCDEF puzzles can be solved using the rules of Mastermind, a popular board game. Assuming a backslash ( \ ) indicates a partial match and a forward slash ( / ) indicates a full match:
A9539 \\ B2919 /\\ C4882 /\ D4627 \ E6758 \ F???? ////
Has a solution of F8992 and
A5989 \\ B5176 \ C2863 \ D2558 //\ E3413 \ F???? ////
Has a solution of F8554. The use of these solutions remain unknown.
The numbers 7777338883366899984477733 33 are encoded with a multi-tap cipher (cellphone numberpad), and can be decoded to SEVENTYTHREE. The use of this solution is also unknown.
The E=5OUEHRA? portion is partially solved. O U E H R A are all second letters from each day of the week, ie Monday, Tuesday, Wednesday, etc. This indicates a solution of U for the question mark, as in Sunday, making the full string E=5OUEHRAU. The E=5 portion of the text remains unsolved.
Also remaining unsolved are the coordinates found in the code, as well as the letter strings:
Coordinates /\//\\//5,1:4.1,2:8.1,3:2.3,3:2.4,3:3.7,3:3.1,5:3.4,5:9.5,5:2.7,5:4.7,6:6.3,7:3. \\\\/\2,1:2.3,1:2.6,1:4.1,2:4.3,2:2.3,4:4.5,5:2.6,5:3.7,5:3.4,7:8.5,7:3.7,6:4. \///\//\1,1:3.4,1:2.6,1:9.2,2:2.6,2:2.2,4:4.3,5:2.5,5:2.7,5:3.4,7:3.6,7:2.7,7:2. \\//\\\/4,2:6.6,2:4.7,3:3.2,4:8.3,4:2.4,4:2.7,4:3.2,6:2.4,6:3.6,6:2.1,7:4.3,7:2.
Letter Strings \\//\/KDIUTHANPUYHHDQOEPLNDOALJGUDITHBBDOZLGFERKJGLSAOE \////JUTYROSLNGNALEHGNWOTIQPOKSDNTPNOJAWEOBNGLAWKJNWNR \\\/\\JHWUITUHABSJGNEWKLALNVGJKWELKJLWQQPRUTJHJJSBFMMH ///\\/JQEABTVKNUCSEYCMBILDKOSCYSITECPAGFAXHKETJNZURWCIE
Stuck In The Mud & Third Hidden URL
The community, for several days, beat it's collective head against the wall trying to untangle the source code's secrets. Alas, they would not yield. No number of hints from the @Spiritof1029 Twitter account seemed able to save the day. Then, an astute observer noted something peculiar about the account's most recent tweet, which read:
When you have the key, you need the correct lock. hgehgeoeregpineechqnhgeevtipcvreovxgvge Shake loose the bonds that hold you. #wewillrise
It was noted that hgehgeoeregpineechqnhgeevtipcvreovxgvge could be decocded via a keyword cipher! With the key subjectivism, likely gleaned by performing an analysis on the ciphertext itself, the text decodes to:
oneoneseventhreefouroneeightfivesixnine
It was only a matter of time before someone tried the obvious, and so, before long, another secret URL, http://www.1029.io/repository/asset98/1173418569/, was unearthed.
Creepy Scenes From Within
This new URL features a different image each time the page is reloaded, much like the first hidden URL discovered in the ARG. In total, 13 scrambled images appear frequently (file prefix WB) and up to 13 CLEAR immages appear only very rarely (file prefix CWB). They are all pictured below with their respective filenames.
WB1_HEND8243
WB2_BSJG2456
WB3_INFG2861
WB4_HBQD2962
WB5_SJKW4167
WB6_OWUI2056
WB7_MNCH1101
WB8_RDHRHAHA
WB9_D34DM337
WB10_BDJW8411
WB11_WHAT8291
WB12_PADAPADA
WB13_VLAP3662
CWB1_0BE01647
CWB2_0DG02966
CWB4_WHATISTHIS
CWB5_NEEDLEINAHAYSTACK
CWB6_ARG-H
CWB7_82918291829182918291
CWB8_0GE03866
CWB9_0IE02565
CWB10_AbeAndNEEDLESFunAdventures
CWB11_02500356
CWB12_02323hjfhfhfhfhASDF
CWB13_insertcodehere
The community is currently ravenously devouring these images. While their purpose is presently not known, it is likely another jigsaw puzzle-type activity which will require the images to be stitched together in order for the next piece of information to be obtained. The website then exploded... Please hold.
After a series of interesting updates, the newly discovered URL went dark, with the header reading ASSET98: TERMINATED. and a source code which reads !-- see ya around, 1029... -->. Twitter account @Edmudokon, after a stint of silence, also tweeted out a new message:
what happened? what did you do? who? No! no... aaaaaAaaaaarrrRrrrgggggGgghhh!
And with that, it seems Ed.... is dead! The community has a lot to ponder, and even more to understand. Where do they go from here? Are they being punished for their devilish use of scripts to rapidly reveal the rarer images? Much has been destroyed, and with it much will be learned.
From The Ashes, Asset 99 (Hidden URL 3.5)
After the sudden, colorful loss of Asset98, the community was quick to rebound, stumbling across a reboot of Asset98, http://www.1029.io/repository/asset99/1173418569/, not moments later! This page appears to be a functional offshoot of the Asset98 page, however it does not appear capable of displaying the rarer, clear images sometimes displayed by the Asset98 iteration. The page comes with a threatening message: "We will not be stopped. We may have lost Asset 98, but we will continue strong. Together. Against the machines. Help us to expose this latest crime against Mudokonkind." Perplexing... The Official Oddworld Webpage also updated at this time requesting help with putting the pieces together. Thus, another jigsaw-puzzle with the pieces above is commenced, the latest of which can be seen pictured on the right.
However, in the midst of the collage-related updates, the @Spiritof1029 Twitter account posted:
We can't reach Asset 98 but we do still have his clear transmissions. Prove you're worthy. Show us that you're able. Send us the grid. You found the grid, the letters and the numbers. Tell us how they fit together. Prove you're no longer slaves to the machines.
With this message, it appears two roads to success may have opened, one in which the cleaned-up images saved before Asset98 went dark are assembled, and a second in which a foray back into the source code grid challenge seems to be required.
With that in mind, the assembled image was Tweeted at OWI and they replied, stating "You've given us enough for us to get to work cleaning up the image, we'll have something by tomorrow. Don't stop looking for the truth!" So, while work on the grid slowly continues, the community awaits the next day's clean image.
Second Unlocked Image & Grid Solution
True to their word, on the following day, OWI Tweeted out a clean image, pictured on the left, which seems to depict quite a gruesome scene, featuring a wide-eyed Mudkon strapped to an operating table facing an onslaught of needles and next to a vat which reads "SS Brew". The community also learned some important information about Ed, who, until now, was presumed to be killed during the implosion of Asset 98. Via @Edmudokon on Twitter, Ed let us know that he made it out alive, but that his friend was not so lucky, with the message: "...he never came back. I could hear him screaming all night... helpless. they took him... he was my friend. how did they know?"
Shortly after the second photo was received by the community, partial progress was finally made on the grid, which up until then remained unsolved. Dizma discovered that the coordinates could be applied to the grid using the rules of the Japanese puzzle game Shikaku (#'s after the colons in the coordinates represent box sizes, which are the lines drawn in red). Randomiser was then able to successfully apply a letter string to the sliced-up cube, pictured right, from with the word subjectivism can be derived. It is worthy of note that the strings used to ultimately arrive at the correct solution were the only strings which began with a forward slash ( / ). This word was the key previously used to decode the third hidden Asset98 URL. However, whether the key was intended to remain hidden until the grid was solved or intentionally encoded in such a way as to allow for cracking is unknown.
The Third Transmission
After some waiting, on Feburary 23rd, OWI sent out a tweet indicting they had again been contacted by the Spirit of 1029. New files became available on the main Oddworld website. The files are inside of a password-protected .ZIP file with the filename 89928554_Eequals5.zip, meaning in order to extract the files, the proper password must be provided. This password can be the same for each file, or could vary from file to file. 8992, 8554, and E=5 are all unused clues from the previous source code mysteries. Within the .ZIP file are six files, four of which are .JPGs, one of which is a .PNG, and the last of which is a .TXT. Their filenames are:
flyer1.jpg, flyer2.jpg, flyer3.jpg, Oddworld_Soulstorm_002_HD.jpg, toollist.txt, & vital.png
The name of the zip suggested that we should use letter equivalencies to their alphabetic indexes as the password. This was attempted, giving the password HIIBHEED but in fact, the password was actually HIIDHEED for unknown reasons.
Steganograpy Blitz & toollist.txt
The file toollist.txt contained a repeating string consisting of names of moons in our solar system. Interrupting the string periodically are forward slashes. If the letters after each slash are taken and combined, they form the string useSsuitePicselSecuritySaveus. This is a clue that there is data hidden via steganography. When trying to detect data hidden using this technique, it is vital to decrypt using to same method as was used to encrypt, which is why the clue to use Ssuite Picsel Security, specific image steganography software, is so important.
When the file Oddworld_Soulstorm_002_HD.jpg is taken as the original and vital.png is taken as the target using Ssuite Picsel Security, the output is
BmzPmbtzueMfxmeBdayqftqgeBmzpadmQbuyqftqgeVmzgeMqsmqazYuymeYqftazqMzftqBmxxqzqQzoqxmpgeFqftkeFqxqefaOmxkbeaPuazqTqxqzqBaxkpqgoqeDtqmFufmzTkbqduazUmbqfgeWuhugcUvudmcBtaqnqBmmxumcEwmftuMxnuadujNqntuazzQddumbaEwaxxEumdzmcFmdcqcSdqubTkddawwuzVmdzemjmFmdhaeYgzpuxrmduNqdsqxyudZmdhuEgffgzsdTmfuRmdnmgfuFtdkydMqsudNqefxmEgdfgdWmduKyudXasqRadzvaf
When deciphered using a Caesar cipher with N=14, the following cleartext can be obtained:
PanDaphnisAtlasPrometheusPandoraEpimetheusJanusAegaeonMimasMethoneAnthePalleneEnceladusTethysTelestoCalypsoDioneHelenePolydeucesRheaTitanHyperionIapetusKiviuqIjiraqPhoebePaaliaqSkathiAlbiorixBebhionnErriapoSkollSiarnaqTarqeqGreipHyrrokkinJarnsaxaTarvosMundilfariBergelmirNarviSuttungrHatiFarbautiThrymrAegirBestlaSurturKariYmirLogeFornjot
These names are all of the named moons of Saturn except Erriapus and Fenrir which are missing. Erriapus is replaced by Erriapo which was the original name of the moon, before being changed in 2007.
Cleaned-Up Flyers
The images that we received of the Sligs' flyers were corrupted, and were cleaned up by members of the community so they were in a readable state.
A cleaned up version of flyer1.jpg
A cleaned up version of flyer2.jpg
A cleaned up version of flyer3.jpg
A member of the community found that the pigpen cipher on the left side of flyer1.jpg gives the stringAOCXY SIO, which when shifted using a Caesar cipher with N=6 yields GUIDE YOU.The cipher on flyer2.jpg gave the string FYNNBYNBCHANBUNM which, when shifted in the same manner as before, yields LETTHETHINGTHATS. This final one on flyer3.jpg gave the string GCMMCHA which is again shifted in the same manner as before to yield MISSING.
All three of the pigpen strings can be combined to form a message: LET THE THING THAT'S MISSING GUIDE YOU
Additionally, sequences of x and o characters are seen. A community member noticed that this could be interpreted as morse code in the following format (with x as dash, o as dot):
x oooo o xoxx ox oxo o oxx ox x xoxo oooo oo xo xxo xooo o x oooo o ooo x xxx oxo xx oxx o oxx oo oxoo oxoo oxo oo ooo o
becomes:
/- .... . -.--/.- .-. ./.-- .- - -.-. .... .. -. --./ /-... ./- .... ./... - --- .-. --/ /.-- ./.-- .. .-.. .-../.-. .. ... ./
which decodes to THEY ARE WATCHING BE THE STORM WE WILL RISE
Also on the flyers, there were strange symbols, with red numbers alongside them. The symbols were from the Malachim alphabet, pictured right.
Fourth & Fifth Hidden URLs
After a short search, the community, using the clue to use whats missing as a guide to hone their focus the moon Erriapo, since it is in the steganography text but not the toollist.txt file (ie missing). Grom the name the numbers 12 36 28 31 52 22 12 are derived by using the previously-discovered Malachim alphabet symbols and the numbers pictured next to each symbol on the three flyers. A clue indicating this is the correct method is a tweet from Spirit of 1029 which can be decoded to P=22. It was then discovered that affixing these numbers to the end of the http://www.1029.io/repository/asset99/ URL yielded a new webpage,http://www.1029.io/repository/asset99/12362831522212/. This page is headed by an obscured URL, ASSET9X / [REDACTED] / 333333333333, and shows one of three images each time the page is refreshed, pictured below.
YOU.jpg
WHA.jpg
WET.jpg
The page also contains a message:
We can't hold much longer. It's dark, and cold. So cold. They don't seem to [REDACTED]. They. Them. It's hard to know how we'll [REDACTED], but we'll try. This can't last forever. We won't last forever. Look what they're doing to us. Just look. There is spirit, but it's waining. We need you, [REDACTED]. Help us.
Around this time, another hidden URL was unearthed, http://www.1029.io/repository/asset99/71220283136/, derived in the same manner as the Erriapo URL but using the moon Fenrir . This URL bears the same obscured URL header and message as the last page, and also displays one of three images each time the page is refreshed, pictured below:
OLD.jpg
TIF.jpg
TOO.jpg
The community, pondering these new images, began to notice some things. The filenames, if pieced together into a single string, read:
WHATIFWETOLDYOUTOO
WHAT IF WE TOLD YOU TOO
The Horror Is Shown In Full
The puppet masters kept pushing us in the right direction, until finally a few people managed to find the link. However, adhering to the rules of the arg, the link could not be shared, rather, enough people had to discover the link in order for it to be shared. After enough people had found the link, the link was shared:
People figured out that the solution was much simpler, and that "what if we told you too" should be put at the end of the URL of 1029.io, producing: http://www.1029.io/whatifwetoldyoutoo
This contained some other source code hints, BDBDBDBDBDBDBDBBDBDBDBDBDBD, ###BELIKEDET### and doYOUsee? think of a number, any number.
Detectives using these hints, as well as the text on the page, figured out the next url to be: http://www.1029.io/whatifwetoldyoutoo/8291/ by adding 8291 to the end. This link leads to the 4 second video of the previous photo, depicting how severe the torture has been to the mudokon. Horrible things.
Eagle eyed viewers have noticed that 3 different codes pop up on certain frames of the video, but these were later found to be unimportant, with the exception of one of the rune languages, which would reappear in the next transmission.
The 4th Transmission
After the horror of the 3rd transmission, the next image would be released not shortly after, depicting a montage of the past three transmissions. In it, there are 2 separate codes:
The Morse code, which decodes as USE A DIFFERENT CODE. THIS IS NOT RELEVANT DATA. DO NOT COMPLY. DO NOT OBEY. THEY LIE.
The Runes on the left hand side and the ones partially cut off at the top and bottom(as previously seen in the video) were decoded by using file data in a hex editor, which would say:
<rdf:li photoshop:LayerText="WE WERE TAUGHT THAT THIS IS ALL THERE WAS: WORK, OBEY, COMPLY. THE TRUTH WAS HIDDEN FROM US. OUR HISTORY WAS HIDDEN FROM US. WE WERE BRED TO WORK, RAISED TO OBEY AND FORCED TO COMPLY. OUR NATURAL CONNECTION TO MOTHER PLANET WAS ERASED FROM THE CONSCIOUSNESS OF OUR PEOPLE. LOST WAS OUR KNOWING. LOST WAS OUR UNITY, OUR CONNECTION, OUR POWER AND OUR PURPOSE. ALL THAT WE WERE WAS A COMMODITY TO BE TRADED AND EXPLOITED IN THE ONGOING RACE FOR MORE WEALTH. WHAT WE SHOULD HAVE PROTECTED, WE WERE TRICKED INTO KILLING. WHAT WAS WORST FOR US, WE WERE TOLD WAS BEST. WE WERE TAUGHT TO TRUST THOSE WHO WOULD DECEIVE US THE MOST. THAT HAS ALL CHANGED. THE HERO HAS SHOWN ALL OF US THAT OUR OPPRESSORS CAN BE TOPPLED. HE HAS FOUND OUR WILD AND KNOWING BROTHERS. HE HAS RECONNECTED THE FACTORY-BORN TO OUR NATURAL WORLD AND ANCIENT WAYS. HE HAS LIT A FIRE IN OUR HEARTS THAT CANNOT BE EXTINGUISHED. WE WILL GIVE HELP TO THOSE WHO ARE HELPLESS. WE WILL LEND STRENGTH TO THOSE WHO ARE WEAK. WE WILL FIGHT FOR THOSE WHO ARE DEFEATED. OUR MOVEMENT WILL SPREAD LIKE A RAGING INFERNO AND WE WILL TAKE BACK THE POWER FROM THOSE WHO HAVE ABUSED IT. WE WILL NOT BE SILENCED BY THE MEDIA CIRCUS. WE WILL NOT BE IGNORED. WE WILL NOT STOP. WE WILL NOT OBEY. WE WILL RISE AND WE WILL RISE AGAIN, UNTIL WE HAVE BURNED THROUGH OUR TATTERED BONDS AND RAZED THE MACHINE TO THE GROUND. WE WILL RISE. JOIN US. THERE'S A STORM COMING."/>
<rdf:li photoshop:LayerName="gas liquid solid" photoshop:LayerText="gas liquid solid"/>
<rdf:li photoshop:LayerName="fire air water earth" photoshop:LayerText="fire air water earth"/>
This gave us an exact copy of the speech given on 1029.io, and the states of matter + the classical elements. OWI would also be teasing at us with the plain clue on the image "Use what you can't see"
Therefore, people started concluding that not all states of matter/classical elements were shown, as there exists a state of matter after a gas called "plasma", and there exists a 5th classical element called "void" or "aether". This would all be hinting at the next url, http://www.1029.io/electricity.
Take a deep breath...
In this page is a simple "HELP" which, when clicked on, downloads a zip. This zip contains 2 things.
Firstly, it contains an image with binary that decodes to BREATH
Secondly, it contains another horrifying message encrypted in binary, which reads:
why do you just watch can you not see us can you not hear the utighdbfn why is this happening wny its too cold to th can you hear us is there anybody there will you help us or rihjsudhgheusodj never are go find pn lose into ital chem we are cold we are lost we are forgotten and its e cant gmds pneuma tigd why are they taking cant stop cold so cold so cold we will rise we will not obey we will not comply j end n we will rise we will rise we will rise we will not die is abe dead here we will not die here we will not die here we cannot die here we cannot die here we cannot die here we cannot survive gheufh help this is not what we wanted we cannot dont cant see speak stop we need to save someone save us pneuma we need to be stop ightne vital energy source of this stop to think breath breathe cant breathe cant always watching we can never eyes stop find rest go now share loose top find think or too last day light never why to away stp give this is ever not no find things first or the ghtuenthdaytjgitlet last now or out get in or art test never stop we will find a way to gain our freedom e why it lost gone now stop taken from us and from there st we cant stop too much now too pain pain pain pain pain pain pain pain pain pain pain dont believe the things they tell you they lie they know no truth its lost long lost now ghwkfnhjsk what happened to them they are lost ghwufnfasjntiwpldfmwbwietpr stop it greed greed greed greed greed greed greed the expense is us we are tired our spark is fading do not let them extinguish all that we are we cannot snwownfnf see the end save us save us save us we cannot fight help us why is this happening for their proghe jwnfiw this nf we why forget us let us go we dont deserve no one deserves its not dont believe dont believe they will lie they lie they lie heugnpngjifsk lies lies lies lies lies lies lies lies eieslseiselslsl is abe dead we dont want to die
Both these clues were pointing to the greek word for breath, pneuma, making http://www.1029.io/pneuma.
Not another one!
On this page was the symbol for the Spiritof1029, however, as time went on, the title of the page began changing, and so did certain letters in the symbol to make cries for help. The titles varied across these:
?
/\--/\--/\--/\
it's so hard to breathe
please make it stop
around how many times
we will all die
b.r.e.a.t.h.e
b..r..e..a..t..h..e
b r e a t h e (page title was only a single letter)
..........
And the letters spelt to make words like HELP, STOP and mask.
After the supposed death of ANOTHER mudokon, another image would be shown.
The community rushed to try and clean this image, producing a terrifying image of a mudokon wearing a gas mask! OWI quickly got the full image uploaded, updated their website accordingly and part 4 of 5 would be completed, and in record time too!
The Fifth Transmission
Before the next transmission was made, subtle little changes were made to the 1029.io website. This included:
1. A new HTML comment in the source code, reading:<!-- heh, that was easy. let's see... -->
2. The colour used for the highlights on the logo changed from red to green.
3. Symbols in the logo would change to spell out the word "Magog".
This would hint at The Magog Cartel, the main antagonistic company in the Oddworld Universe that is known for poor working conditions and treatment of the Mudokons.
The Magog Cartel
Shortly after these discoveries, strange occurrences happened on the newly created Official Oddworld Discord server.
1. A new emote with the Magog Cartel logo was added with the name :staywealthy:
2. For a while all messages containing the :staywealthy: emote or the 8291 code (:_e_: :_t_: :_n_: :_o_:) got removed.
3. The Oddworld Inhabitants employees (OWI_Alex, OWI_Pete & OWI_Bernice) stated posting gibberish and messages coming from an other entity.
Some of the gibberish included:
Òǚř ʂе¢цгіẗу ẁᾅș πŏţ ḃӷӫǟċḥễđ Ọսȑ šѐсưȑіƫỵ ẅἂѕ ᾒṑե ƃŗӫᾶϲɦẻđ ⍬ṳř şĕсǜӷɩȶӱ ẁấṣ ʼnόՒ þȑѐẩƈȟεժ Ỡùȓ șєϛụґɪŧӱ ẅᾲş բóȶ ḃŗḛąḉℏӫď Ơǔѓ ṡễćṻȓĩťÿ ẇẳŝ ἧὅṱ ḇґèḁčիề₫
W& //€q117 PHø|? +/-/∂† +() }{∂|²|2€11.
Ḿ̧̪̻̻͇̟̹̭̼͊̈́̍̎̿͐̎͝͞o̧̤̗̠͚̟͒̐͗͆͜͢͡͞C̠̯̳̙̠̳̹͒̽̇̈̽̚͜r̶͕̗̜̲͕̘̒͗̆̄̎̐̓t̛̛̯̠̼͎̭̻̯̜̿͂̑̃͌͂̔ļ̴͙̩̠̯̐̊̆̐̂̿c̢̳͎̱ ̺̮͎͖̟̐̓̐́͋͞ó̧̡̻͙̳͇̼̯̹̄͒̐͗
These all lead to magogcartel.com and twitter.com/magogcartel
On The Magog Cartel's website, there are some interesting codes in the source code:
1.
DB_PP_PRODUCTTEXT: We’re sourciest, juiciest Parami__from closer to their nests, for our bes___________________________________________________________aramite Pies ever! Made with all natural ingredients[1] and baked in our traditional ovens to a recipe that’s be............ aster bakers, our pXXXes are packed with Para-meat[2] oooooooooooo00OOoozing [1] at least one natural ingredient in every 12-pack of pie_________8** [2] not necessarily made with Paramites.
PLEASE REVIEW AS APPROPRIATE
2.
APPROV__tch this space for more information about our exciti________________ everage that’s so delicious, you’ll be craving another on33__________--333333333333 before you even finish it!!!_____________________________________________!!!:D:D:D
3.
lfn0OE602+HKBKTMVawALWERLS6pu8P8NcEQyKfnKcQ5zy/H5ny4CU60hkmMHzqlNg+q2oVaSHjSzjPGo1vQzQsJCbHTNAXDCFgTIJznL/1ZkZT89VOuv4koDHZJs4YcWbOLbO1cvV87UMcdWbuAraCeFRF8jy7F1/PufFPAyYRR9Jp4nB6uWpNZlY8rdYmEw7IYvtg4QlaBtX/iiyT1Es8MFA+wO4OkBFEGLHDENvu83kfaMnBxabDguhS/W0wWJjNijasG+5PeHeWqmQYDWsz9YrKgWiap0KCghpDfRuOgH37qNUAQnIf4/AeMF14IiEg9PFlutZWGyXhHem4PF2kxYGp075T+5N0n6nbJt+MMDAa4H3D06iuZa5bK18pLIUIzaFxLue5EJoEz4+JwCYarhZ7JMqbzrtnPv8oK/BbHgaig9MjKf8X7/cHDaXkVObkhW8jyVxxS6IfedZIRO/Phqorogx+DO6dgKWhqppoRNpMU2jawix9b/rf6ZgGRcpngW9pOCDwxCB0UptxmaNk+fnxQQU1Wo9J/isrrgTd/eDpdZgFyD8d8KhYN/Uf8A3MhWX33Xr8MhAPF+BtQUYFYIrvD32CTtDqtGXfL26fdhAVh8XMjTFwwWCB6DH6WwYCwJyLCVikMSXOLbPfzZKFfZIia9KQnM24dGUOvVMkfBdTqdCpiuwV4NkGKY2hw2jNhjibPLt/Rcpnsxj3B+2Axu6z5bMnzPLRZY00w6p8CJckqQqV9YXdReb34dOLC/6Zb2VWbx1ARGNBwdN69lw==
INSERT ANECDOTE ABOUT THE ApMpApZING VIEW just left of here across Mudos AND who could possibly be the EMPLOYEE OF THE DAY AND THE NEW i mean, how hard can it be? every aspect of every aspect of every as-------------f every aspect of EVERY SIN--E ASPECT of every aspect of every asp--_--------------------ct of every aspect of every as_--ct of every aspect of FOLLOW ME follow US
4.
01102911011101100101011102910111011102901001011011000110110001110011010291110100011011110102911100000111100101101111011101011029011110011029011011110111010101110111011010010291011011010290011011000110291001100110000101101100011029101100
This was decoded. When removing the occurences of "1029" you get:
0111011101100101011101110110100101101100011011000111001101110100011011110111000001111001011011110111 01010111100101101111011101010111011101101001011011000110110001100110011000010110110001101100
Decode binary to text and you get wewillstopyouyouwillfall
5.
9JzrxKKv5z0829jLV8wF32KpA6I0nEQDqzmbpRYzUUE===
On the 11th of August the Magog Cartel sent a batch of tweets with some out of place uppercase letters spelling WE KNOW.
@spiritof1029 we see you. We can see what you are doing with your fake reports. you will not prospEr.
we are proud of the strong linKs between each of our facilities. our operations are by far the most efficieNt on oddworld.
we are aware of some terrible fake repOrts being leaked. please ignore them. our very successful Workers know the truth is very different.
On the 14th of August the Magog Cartel sent a batch of tweets all starting with We know. This lead us to believe the SPIRIT OF 1029 was interferring with those tweets and was trying to get a message accross. The message can be found in the very specific numbers mentionned in the first two tweets, 82 & 91, forming togeter 8291.
We know every time an employee falls into a grinder it takes 82 minutes of Mudokon time to clean up. Be safe, for productivity’s sake!
We know that an average of 91 eager new employees start their careers with us every day. Help them be the best workers they can be.
We know that our facilities are a picture of perfect productivity. Your hard work helps us to show that picture to the world.
We know what you’re looking for in a rewarding, productive career. Magog Cartel can help you find it. Discover your options with us today!
One hour later the SPIRIT OF 1029 sent a batch of tweets, one containing a cryptic code:
your help is invaluable to us, together we will blow this latest Magog scandal wide open. together #wewillrise
the watchers can fish around the communication channels all they like, we will always be one step ahead of them.
-1-4,-2-10
the story of mudokonkind is about history. now they treat us just like numbers. they will not succeed.
we have given you the tools you need. the ones we can trust will prove themselves capable. leaders will rise as the storm closes in.
The last tweet indicated that we had all we needed to continue our investigation and the one before that we shouldn't use the numbers in the codes as raw numbers but should link it to some kind of history. We needed to look into the Twitter history of the SPIRIT OF 1029 account.
The -1-4,-2-10 code actually tells us to take the 4th word from the previous tweet (-1) and take the 10th word of the tweet even before (-2):
4th word of the previous tweet is fish:
the watchers can 'fish' around the communication channels all they like, we will always be one step ahead of them.
10th word of the tweet before is blow:
your help is invaluable to us, together we will 'blow' this latest Magog scandal wide open. together #wewillrise
Together those word form blowfish which is the cipher we had to use to decrypt the base64 code in HTML comment 3.:
lfn0OE602+HKBKTMVawALWERLS6pu8P8NcEQyKfnKcQ5zy/H5ny4CU60hkmMHzqlNg+q2oVaSHjSzjPGo1vQzQsJCbHTNAXDCFgTIJznL/1ZkZT89VOuv4koDHZJs4YcWbOLbO1cvV87UMcdWbuAraCeFRF8jy7F1/PufFPAyYRR9Jp4nB6uWpNZlY8rdYmEw7IYvtg4QlaBtX/iiyT1Es8MFA+wO4OkBFEGLHDENvu83kfaMnBxabDguhS/W0wWJjNijasG+5PeHeWqmQYDWsz9YrKgWiap0KCghpDfRuOgH37qNUAQnIf4/AeMF14IiEg9PFlutZWGyXhHem4PF2kxYGp075T+5N0n6nbJt+MMDAa4H3D06iuZa5bK18pLIUIzaFxLue5EJoEz4+JwCYarhZ7JMqbzrtnPv8oK/BbHgaig9MjKf8X7/cHDaXkVObkhW8jyVxxS6IfedZIRO/Phqorogx+DO6dgKWhqppoRNpMU2jawix9b/rf6ZgGRcpngW9pOCDwxCB0UptxmaNk+fnxQQU1Wo9J/isrrgTd/eDpdZgFyD8d8KhYN/Uf8A3MhWX33Xr8MhAPF+BtQUYFYIrvD32CTtDqtGXfL26fdhAVh8XMjTFwwWCB6DH6WwYCwJyLCVikMSXOLbPfzZKFfZIia9KQnM24dGUOvVMkfBdTqdCpiuwV4NkGKY2hw2jNhjibPLt/Rcpnsxj3B+2Axu6z5bMnzPLRZY00w6p8CJckqQqV9YXdReb34dOLC/6Zb2VWbx1ARGNBwdN69lw==
Using a Blowfish Decryptor (with CBC mode) and the code 8291 we got earlier via the interferences in the Magog Cartel tweets as a key we were able to recover the following text:
^_^U_VDXisistrueorfalseallforprofitinterestsindustrialagriculturalMudosprovidehighestpossiblereturninvestmentsoverheadsdreamslimitedpowergiganticbadgeleadersproductMeechMotorstravelexpertlytrainedSligSecurityForcessuccessfulundertakingemploymentvastsentientsecurespecialisthabitationzonesbenefitfactoriesfoundriesfarmlandsstabilitymillionsundertakingsCartelmanagementselflesslyrepresentativesresponsiblemunicipalvastidyllicsettlementsunderconstructionpleasesubscribeandlinkandfollowandlikeandbuyandbuyandbuyandbuyandbuyandbuyandbuyandbuyandbuyandbuyandbuyandbuyandbuyandbuyandbuyatmagogcartel
When adding spaces this reads:
^_^ U_V DX is is true or false all for profit interests industrial agricultural Mudos provide highest possible return investments overheads dreams limited power gigantic badge leaders product Meech Motors travel expertly trained Slig Security Forces successful undertaking employment vast sentient secure specialist habitation zones benefit factories foundries farmlands stability millions undertakings Cartel management selflessly representatives responsible municipal vast idyllic settlements under construction please subscribe and link and follow and like and buy and buy and buy and buy and buy and buy and buy and buy and buy and buy and buy and buy and buy and buy and buy at magog cartel
The part with "please subscribe" lead us to:
It is not sure at this point whether this is an official ARG account as the channel and profile are currently empty.
The two last tweets of August 14th from the Magog Cartel were hinting at a picture on the MagogCartel.com website (Magog Cartel can help you find it):
We know that our facilities are a picture of perfect productivity. Your hard work helps us to show that picture to the world.
We know what you’re looking for in a rewarding, productive career. Magog Cartel can help you find it. Discover your options with us today!
This led us to:
That picture contains quite a few codes:
- The 62466640222 2777833555 sequence in the upper-left corner.
Spells Magog Cartel when using a phone keypad
- The mose code in the middle.
.-- . / -.- -. --- .-- / .... --- .-- / -.-- --- ..- / .-- --- .-. -.- / -. --- .-- .-.-.- / .-- . / -.- -. --- .-- / -.-- --- ..- .-. / -.-. --- -.. . ... .-.-.- / .-- . / .-- .. .-.. .-.. / ... - --- .--. / -.-- --- ..- .-.-.- / -.-- --- ..- / .-- .. .-.. .-.. / -. --- - / .. -. - .. -- .. -.. .- - . / ..- ... .-.-.- / --- ..- .-. / .-- .- -.-- / --- ..-. / .-.. .. ..-. . / -- ..- ... - / -... . / .--. .-. . ... . .-. ...- . -.. .-.-.-
WE KNOW HOW YOU WORK NOW. WE KNOW YOUR CODES. WE WILL STOP YOU. YOU WILL NOT INTIMIDATE US. OUR WAY OF LIFE MUST BE PRESERVED.
- The e and d sequence in the upper-right corner.
It's actually morse code too where e = ., d = - & X = /.
.-.. --- --- -.- --..-- / .-- . / -.-. .- -. / -- .- -.- . / ... . -.-. .-. . - / -.-. --- -.. . ... / - --- --- .-.-.- / -.-- --- ..- / .- .-. . / -. --- - / .- ... / ... -- .- .-. - / .- ... / -.-- --- ..- / - .... .. -. -.- / -.-- --- ..- / .- .-. . .-.-.- / .-- . / .... .- ...- . / - .... . / .-. . ... --- ..- .-. -.-. . ... / .- -. -.. / - .... . / .--. . .-. ... --- -. -. . .-.. / - --- / ... .. -- .--. .-.. -.-- / ... .-- .- -- .--. / -.-- --- ..- / .-- .. - .... / .-- --- .-. -.- .-.-.- / .... --- .-- / -- ..- -.-. .... / - .. -- . / -.. .. -.. / -.-- --- ..- / .-- .- ... - . / - .-. -.-- .. -. --. / - --- / -.. . -.-. .. .--. .... . .-. / - .... .. ... / -.-. --- -.. . ..--.. / .- .-.. .-.. / - .... . / - .. -- . --..-- / .-- . / .-- . .-. . / --. . - - .. -. --. / -.-. .-.. --- ... . .-. / - --- / ..-. .. -. -.. .. -. --. / -.-- --- ..- .-.-.- / .-- . / .- .-. . / .- .-.. -- --- ... - / - .... . .-. . .-.-.- / -- .- -.-- -... . / .-- . / .- .-. . / --- ..- - ... .. -.. . / .-. .. --. .... - / -. --- .-- --..-- / .-- .- .. - .. -. --. .-.-.- / .-- .- - -.-. .... .. -. --. .-.-.- / -.-- --- ..- / -.-. .- -. -. --- - / .... .. -.. . / ..-. --- .-. . ...- . .-. --..-- / - . .-. .-. --- .-. .. ... - .-.-.- / .-- . / .-- .. .-.. .-.. / .. -. -.-. .. -. . .-. .- - . / -.-- --- ..- .-. / ... .. .-.. .-.. -.-- / .-.. .. - - .-.. . / --. .-. --- ..- .--. / .- -. -.. / ... -.-. .- - - . .-. / -.-- --- ..- .-. / .- ... .... . ... / - --- / . ...- . .-. -.-- / -.-. --- .-. -. . .-. / --- ..-. / --- ..- .-. / . -- .--. .. .-. . / ... --- / - .... .- - / -.-- --- ..- / .-- .. .-.. .-.. / . - . .-. -. .- .-.. .-.. -.-- / -... . .- .-. / .-- .. - -. . ... ... / - --- / --- ..- .-. / ... ..- -.-. -.-. . ... ... . ... --..-- / .- -. -.. / -.-- --- ..- .-. / -.- .. -. -.. ... / ..- -. . -. -.. .. -. --. / ... . .-. ...- .. - ..- -.. . .-.-.- / -.-- --- ..- / .... .- ...- . / .- .-.. .-. . .- -.. -.-- / .-.. --- ... - .-.-.-
LOOK, WE CAN MAKE SECRET CODES TOO. YOU ARE NOT AS SMART AS YOU THINK YOU ARE. WE HAVE THE RESOURCES AND THE PERSONNEL TO SIMPLY SWAMP YOU WITH WORK. HOW MUCH TIME DID YOU WASTE TRYING TO DECIPHER THIS CODE? ALL THE TIME, WE WERE GETTING CLOSER TO FINDING YOU. WE ARE ALMOST THERE. MAYBE WE ARE OUTSIDE RIGHT NOW, WAITING. WATCHING. YOU CANNOT HIDE FOREVER, TERRORIST. WE WILL INCINERATE YOUR SILLY LITTLE GROUP AND SCATTER YOUR ASHES TO EVERY CORNER OF OUR EMPIRE SO THAT YOU WILL ETERNALLY BEAR WITNESS TO OUR SUCCESSES, AND YOUR KINDS UNENDING SERVITUDE. YOU HAVE ALREADY LOST.
- The Pigpen cipher text in the lower-right corner.
WE WILL NEVER GIVE IN TO TERRORISTS. YOU WILL NEVER WIN. YOU WILL NOT DEFEAT OUR SPIRIT. WE WILL FIND YOU AND WE WILL WIPE YOU OUT. WE IGNITE THE FLAME THAT LIGHTS THE DARKNESS. THERE IS NOWHERE TO HIDE. YOU WILL NEVER KNOW SUCCESS
- The horizonally mirrored black text in the middle.
you are a resource. you are expendable. we will replace you when you fall. you will work. you will obey. you will comply. or you will perish. we have the prestige. we have the power. we will profit. always. always. always.
- The white text on the top.
Prestige. Power. Profits. Work. Obey. Comply. Prestige. Power. Profits. Work. Obey. Comply. Prestige. Power. Profits. Work. Obey. Comply. Prestige. Power. Profits. Work. Obey. Comply.
- The braille at the bottom.
RuptureFarms1029 will rise from the ashes. we will rebuild it bigger, better and more profitable than before. it will be the greatest, most efficient factory that Oddworld has ever seen. it will be a towering symbol of Glukkon strength that cannot be ignored. one terrorist will not deter us.
It has to be noted that those codes were left by the Magog Cartel as what appears to be a bait so that we would lose valuable time decoding them.
It is unknown how to decode the 9JzrxKKv5z0829jLV8wF32KpA6I0nEQDqzmbpRYzUUE=== code.
The page has changed since then, but the first (hacked) version of the MagogCartel.com site has been archived here
On the 4th of September the MagogCartel.com got updated, simply displaying the following text:
*** UNDER CONSTRUKTION ***
The page has changed since then, but the second (under construktion) version of the MagogCartel.com site has been archived here
On the 5th of September the Magog Cartel posted a video trough the OddworldInc account:
w̸̨̠͓͍̯̺͉͞e̯̝͖̫̺̯͉̻͘͡ ̗̭̕͢s̴̮̭̫̱ͅe̢̠̮̫̦̼̪̘͠ͅę̠̥̯͔̣̼̻̕ͅ ̻̘̼̣͓̩͚͘͢͠y̴̭̯̪̺͙͚͚̪͞o̬̞͜͢͝u̮̤͖̩̗̰ͅͅ.̴̲̣̪̮̼̱.̡̰̭̗͍̝͉̯͢.̡̡̼͇̙̜̮̦̪̞ͅ pic.twitter.com/UoQ3xRAhDU
We continue to demonstrate our exceptional technological progress to an ever growing number of customers. Everyone loves Magog products!
When asked if they really just claimed the attack on the @OddworldInc account they replied:
Attack? We don’t need to attack, we’re already in a dominant position in every market we deem profitable. We just demonstrate our dominance.
There are multiple messages flashing in the video:
8 ? 2 2 9 1 / 8291 829/ 229/ 22/9 EVERYONE WANTS TO EAT YOU
Note that 22/9 is the date of the Oddworld presentation at the EGX:
We're going to be at EGX for an on-stage presentation on Friday 22nd Sept! Grab your tickets now! @EGX pic.twitter.com/rDQiDIApa9
On the 7th of September the MagogCartel.com got updated again, randomly displaying one of three photos of The Informant.
At the same time the Magog Cartel sent a batch of tweets with containing other pictures of The Informant:
We stopped reading the Daily Deception’s fake reports. The latest issue of The Informant is a really great read, very honest. The greatest!
It’s great to finally have an honest newspaper to read, and such good quality, too! pic.twitter.com/MHuC6jdtNC
We’re always happy to see some balanced reporting on our business from The Informant. Refreshing, when there are so many fake reports! pic.twitter.com/DmkV4GbVYw
We’ve just been told that The Informant is printed on machines made at a Magog facility! That explains the quality! pic.twitter.com/Bvz29ZrBvk
It has been noted that some letters were in bold but it's unclear how this should be used.
Part of The Informant has be transcribed here:
http://oddworldlibrary.net/oddenc/index.php?title=Soulstorm_ARG_-_The_Informant
The MagogCartel.com page also contains the following HTML comment:
<!-- seriously, are you guys seeing this?! -->
The third phase
The Origins diversion
On the 15 of March 2018 the SPIRIT OF 1029 posted the following tweets:
Our future depends on us understanding our past. We must know where we come from.
We know you can hear us. We know you are ready to help. We will show you more when the time is right. Keep watching.
Following this a couple of changes were found on the 1029.io page.
- The logo has now even more letters appearing in it randomly: S, I, N, O, R. Adding to the previous letters that were spelling "MAGOG".
- The page contains a new HTML comment:
<!-- too obvious? i dunno. it's soon though. i can't wait. -->
Changes were also observed on the 404 page:
- The logo on the 404 page now contains the following letters: N, I, G, I, O, R, S. Those letters can be used to spell the word "ORIGINS"
- The page contains a new HTML comment:
<!-- me neither. it's going to be great. -->
Shortly after a new channel called "origins" appeared on the official Oddworld Discord with a cryptic video as first message.
It was revealed a few days later that this was a built up to announcement of the "Oddworld: Abe's Origins - Book & Game Collection" kickstarter campaign. Note that the book & game collection is still available for preorder on Crowdox.
Intro
Around the 12th of January 2018 Lorne Lanning changed his twitter header picture to the following one:
While it was hinted repeatedly in the official Oddworld Discord that this image was hiding something, it wasn't until much later that it was found how to use it when @edmudokon tweeted the following message:
alive… pic.twitter.com/j0FE2Qgdu1
The embedded picture contains the number 15156. This is a reference to a number in the URL of Lorne's header picture: 1515636880.
This number led us to a new page:
This page contains the following text in UTF-8
ɦểɫр. гẹẳčℏɪṅǧ óúƫ ῒԑ ģӫԷṱіᾗĝ ḥǡṛⅾềɽ. էիȅỷ ķῆοԝ. ẁẹ'ṝϵ ṙṵɴᾑıпʛ ộևȽ ờẛ ɩḋϵᾂš, ὅрՒῑổпş, ăұҿἧµϱṣ. ẅϵ ǹêȩḋ ỳờǚґ ḣҽľῥ. ẇể ῂёϱḋ ѕờṃēƅȯƌý ţó ṧṕȑểǻժ Ƚħẹ ẁổṝḓ. եḫϊṥ ƫɦ¡ƞɡ ῐʂ ḸỄƮḨǠĻ. Ƚḣěȳ ḓõᾔ'Ƚ ĉὰгє Ƚḣổṻɕḫ. ţհểӯ ɗṍἧ'ţ. ṣởṁḗɒὀժỵ ňěөƌş ṱὃ ȶěḻɫ իḭɱ. †ɛŀļ ẖĩ₥. ḃḕẛṍɼę îȽ'ṧ Էȭô ḷǎťϱ. ṯĥềŗȇ ḧąș Էố ƃϱ ᾅ ṣọṁȇþöḏỳ ẉíļłȋդǥ եό ȶαҝě ṯẖё јǒŭӷṋёỷ. şõ₥ęƀὁḓẏ ṅểềⅾԑ ƫծ ġềŧ ţհϵ ṃệṣśᾇǵε ộվե. ẁë'ṝе ìη ṭӷơữþŀɛ. аɬł ṑƒ սʂ. ẁё դȅễɖ ĥẹĺρ. թłȩᾂʂĕ ɦȇɫṕ կѕ.</
and the following HTML comments
<!-- it's only going to get harder. we don't have the keys anymore to the usual channels. if you hear anything from them, it's THEM. -->
<!-- our options are limited. you can help though. you have to help. if we can be sure it's you, then maybe we can talk. prove it. -->
It's currently unknown what the next steps are
Loose Ends
This section documents various puzzles throughout the ARG which have not yet been used or solved.
Main Website Source Code Comment Numbers Puzzles
These numerical puzzles were found in the source code for the official Oddworld website as early as the date of the Spirit of 1029's first transmission. Their solutions have been found, but the intended use of the solutions remains unknown.
!--
72 99
\ /
27 45
\ /
18 39
\ /
21 36
\ /
?? 28
\ /
13 21
\ /
7
-->
SOLUTION: 12 7+2+9+9 = 27, 2+7+4+5 = 18, thus 2+1+3+6 = 12
&
!-- 16 _ 37 _ 58 _ 89 _ 145 _ 42 _ ?? _ 4 |_________________<_________________| -->
SOLUTION: 20 1^2 + 6^2 = 37, 3^2 + 7^2 = 58, thus 4^2 + 2^2 = 20
Other Source Code Comments
On http://1029.io, the following comments could or can be found in the page's source code:
!-- we'll be here, waiting. -->
&
!-- Well, I //--/ED Mudokon/. But who// _____ r///u/ //?
Third Hidden Asset98 URL Source Code Solutions
Certain code strings & puzzle solutions found within the source code for the third hidden Asset98 URL were not ultimately used in the course of arriving at the image locked behind them. These strings & solutions in include:
The solution for the numbers 7777338883366899984477733 33, which decode to SEVENTYTHREE via multi-tap cipher, was never applied.
The following letter strings were never applied:
\\//\/KDIUTHANPUYHHDQOEPLNDOALJGUDITHBBDOZLGFERKJGLSAOE \////JUTYROSLNGNALEHGNWOTIQPOKSDNTPNOJAWEOBNGLAWKJNWNR \\\/\\JHWUITUHABSJGNEWKLALNVGJKWELKJLWQQPRUTJHJJSBFMMH
The following coordinate strings were never applied:
\\\\/\2,1:2.3,1:2.6,1:4.1,2:4.3,2:2.3,4:4.5,5:2.6,5:3.7,5:3.4,7:8.5,7:3.7,6:4. \///\//\1,1:3.4,1:2.6,1:9.2,2:2.6,2:2.2,4:4.3,5:2.5,5:2.7,5:3.4,7:3.6,7:2.7,7:2. \\//\\\/4,2:6.6,2:4.7,3:3.2,4:8.3,4:2.4,4:2.7,4:3.2,6:2.4,6:3.6,6:2.1,7:4.3,7:2.
The community speculates that these strings were not intended to be used but rather existed as "red herrings" in order to stall attempts to solve the grid. The only strings which were used were the ones which began with a forward slash ( / )
Written Text on "Puzzle Pieces" Image
Writing which was noticed written over the image on the puzzle pieces, but which is absent from the final released image. The significance of the writing remains unknown.
1029-LY "WHERE"
7393-AN "SO TIRED"
3786-IC "WHO?"
Complete Image "8291"
Anomalies In First Released Image
Hidden against the background of the first released image are several text strings, pictured below. Their significance is unknown.
1101110BC 100000BD or 100000BC 010100BD
