So for those unaware, my most recent video about Cicada 3301 contained a puzzle. Not a puzzle related to Cicada but a puzzle of my own making. Throughout the video I hid a number of secret codes and messages and, for the past week, a few dedicated viewers have been hard at work trying to solve the many codes and riddles I left for them to find. I've always been a fan of video game Easter eggs, ARGs, and online scavenger hunts so it seemed fitting to include such a puzzle in a video about, well, puzzles. Many solvers took to the fan-moderated Discord server while others attempted to solve it on their own. A specialized subreddit was also created.
Now, a week later, the puzzle has finally been solved. While it was largely a collaborative effort, Discord user Hedare was the first to reach the end. This Google Sheets document created by the solvers perfectly sums up the puzzle but I thought some might be interested in hearing me explain it as well.
Okay, so the puzzle began with a reversed audio clip and a mysterious code not-so-discreetly featured around 10:15 in the video. We'll get to the reversed audio in a moment. The code looked like this:
M189 68V0H0V182H71s-24-46 24-46 24 46 24 46h71V114s47 23 47-23S189 68 189 68Zm-77 50H83V60H95v49h17Z
This is known as an SVG path and, once properly formatted, it could be used to generate a vector image of a jigsaw puzzle piece:
Yet another reversed audio clip was featured at the very end of the video. Once unreversed and slowed down, a voice could be heard saying:
Only trust paths through lemmi.no.
The end of the path your findings must go.
The first sentence cautioned participants to only trust links to or from my website as a safe-guard against impostors. The second sentence was an allusion to the SVG paths that make up the jigsaw puzzle pieces. More on that later.
So back to the first reversed audio clip. Once unreversed and slowed down, a voice could be heard saying:
Behind ten signs, an image you'll find.
Scour the timeline to locate the signs.
The riddle alluded to ten coordinates hidden throughout the video:
The ten coordinates pointed to ten road signs featuring a letter or digit. By appending all ten characters to the end of my website a valid URL could be constructed:
The link redirected to this animated .GIF image:
The .GIF depicted the ninja character from the game N++. By opening the .GIF with an archiver an extensionless file titled
bnVsbExldmVs could be extracted. By opening
bnVsbExldmVs using a text editor another SVG path could be used to generate a second jigsaw puzzle piece:
bnVsbExldmVs served as a hint to the next step as it was Base64 for
nullLevel. By launching N++ and searching for
bnVsbExldmVs a user created level was found:
The level contained a URL that lead to a password protected page:
The two URL paths
6e756c6c566964 were Base64 and Hex for
nullVid. An indication of what was to come. To uncover the password, the filename of the .GIF first had to be decoded from Base64:
TWR3ZlFmWGFsR2V3Z2pzamw → MdwfQfXalGewgjsjl
The resulting ciphertext was a Vigenère cipher. It's a very basic cipher but it requires a key to be deciphered. As the key must consist of letters, I thought it would be fun to use a phonetically formatted number as the key. So instead of
123 I would use
ONETWOTHREE. I choose my highscore from the N++ level as the key:
293.167 → TWONINETHREEONESIXSEVEN
That key could then be used to uncover the plaintext password:
MdwfQfXalGewgjsjl → TWONINETHREEONESIXSEVEN → ThisIsThePassword
The unlocked page contained a Base64 code as well as a link to an unlisted YouTube video:
The decoded Base64 code revealed this cryptic line:
T25lIG9yIHRoZSBvdGhlciBidXQgbm90IGJvdGgu → One or the other but not both.
The tags of the unlisted YouTube video contained a third SVG path of a jigsaw puzzle piece:
The video itself depicted a series of short clips accompanied by sounds. Each clip represented a specific character. Clips of animals represented letters while non-animal clips represented punctuation and digits. The accompanying sounds also dictated capitalization as well as numeric values. A low pitch sound indicated a lowercase letter. A high pitch sound indicated an uppercase letter. A buzzing noise indicated a digit. This information could be used to construct a valid URL:
The link lead to another password protected page. The path of which could be decoded from Hex:
5468697349735468654f74686572 → ThisIsTheOther
ThisIsTheOther referred to the cryptic line from the previous page which in turn alluded to a process known as XORing. By XORing the URL path produced by the video
Pb63k9C3JZ and the URL path of the page it redirected to
5468697349735468654f74686572 the password was found:
Pb63k9C3JZ ⊕ 5468697349735468654f74686572 = 546869731911625b0e76375b2f28
The unlocked page contained the following message along with a button to another password protected page:
Multiply the longest word with the total amount of gold. Then divide by that which you cannot see.
The bottom of the page contained a forth SVG path of a jigsaw puzzle piece:
longest word referred to the longest word used in the video which is
interconnectedness at 18 letters.
total amount of gold referred to the 211 gold coins featured in the N++ level.
That which you cannot see referred to a sequence of zero-width spaces hidden between the letters of the message:
The sequence was Morse code for a number:
..... ....- ----. ---.. -.... → 54986
By multiplying the first two numbers and dividing the product by the latter the following number was produced:
18 × 211 ÷ 54986 = 0.0690721274506238...
The first 16 decimals made up the password.
This equation was the longest hiccup of the puzzle mainly because I screwed up and made it a bit too ambiguous. The initial idea was for all the passwords featured in this puzzle to be of equal length to the URL of the page they unlocked. So the number
0690721274506238 was to be capped at 16 decimals because the URL path
6e756c6c50616765 was 16 chars in length. Much like how the previous password
546869731911625b0e76375b2f28 was 28 chars long because the URL path
5468697349735468654f74686572 was 28 chars long. But somewhere along the line I completely forgot about that and altered some of the passwords without consideration for their length. For example, the first password
ThisIsThePassword is 17 chars long while the URL path
6e756c6c566964 is only 14 chars in length. So solver had no way of knowing that the password should be 16 chars in length and got stuck. But I remedied my mistake by providing a few extra hints and eventually someone finally managed to figure out the password and the puzzle solving continued.
The unlocked page contained a link to yet another unlisted YouTube video.
The title of the video
bnVsbEVuZA could be decoded from Hex to read
nullEnd. A hint that the puzzle was approaching the end. The page also contained a cryptic message:
You must unlearn what you've learned.
This message referred to a comment hidden within the HTML of every page which solvers had found within minutes of the original video being posted:
# Lol, it won't be that easy. #
# There is nothing to find here. #
# I don't even know what's in here. #
# No seriously, this is a dead end. #
The meaning of this message was that old rules no longer applied and that clues could now be hidden within the HTML from this point onward. Sure enough, the head and body of the page contained a fifth and sixth jigsaw puzzle piece:
The tags of the unlisted YouTube video also contained a seventh jigsaw puzzle piece. This time encoded in Base64:
TTAsMFY2OFM0Nyw0Niw0Nyw5MSwwLDExNCwwLDExNHY2OEg3MXMtMjQtNDYsMjQtNDYsMjQsNDYsMjQsNDZoNzFWMFpNMTEyLDEyMEgxMDFsLTYtMTdoMGwtNiwxN0g3N0w4OSw4OCw3OCw2MEg5MGw1LDE2aDBsNS0xNmgxMkwxMDEsODhsMTIsMzFa → M0,0V68S47,46,47,91,0,114,0,114v68H71s-24-46,24-46,24,46,24,46h71V0ZM112,120H101l-6-17h0l-6,17H77L89,88,78,60H90l5,16h0l5-16h12L101,88l12,31Z
The video itself contained a series of photographs of landmarks in various European capitals:
Dublin Bern Berlin Belgrade Helsinki Moscow Madrid Brussels Budapest Sarajevo Oslo Vilnius Rome Paris Warsaw Podgorica Copenhagen Tbilisi Luxemburg City Pristina Riga Ankara Podgorica Tallinn Moscow Tirana Stockholm Skopje
The video also featured a reversed audio clip. Once unreversed and speed up a voice can be heard saying:
From dot to dot the children would trail.
The game is the same, except for the scale.
This is the end, remember the path.
It's time to combine what's been found on the map.
The first part of the riddle alluded to a common puzzle for children colloquially known as connect the dots. The second part alluded to the beginning of the puzzle in which solvers had to find ten road signs across the world. By opening a world map and tracing a line between each city in order of their appearance, six characters could be produced:
By appending the six new characters
L4VEG8 to the previous ten
M7PS5HEK3I a new valid URL could be constructed:
The link lead to yet another password protected page. The new URL path could be decoded from Hex to reveal another hint:
6e756c6c546869734973546865456e64 → nullThisIsTheEnd
The description of the video also contained a string of binary code which could be translated as such:
0101001001100101011101100110010101110010011100110110010100100000010101000110100001100101001000000101000001100001011100110111001101110111011011110111001001100100 → Reverse The Password
The next password was merely the previous password
0690721274506238 in reverse
8326054721270960. The unlocked page contained a button titled
The End leading to a final password protected page:
The head of the page contained the final eight and ninth jigsaw puzzle pieces:
The complete jigsaw puzzle could now be assembled:
If read from top-left to bottom-right, the nine characters
L5KW3ZX1T formed the final password. The final page contained the following message:
You've finally reached the end of the puzzle. Should you happen to be the first to arrive at this page then the link below will grant you a reward. Thanks to everyone on the Subreddit and Discord server who participated. It's been a lot of fun watching you struggle for the past couple of days.
Wasn't sure you were going to make it all the way through but here you are. Had to resist the urge to help you on numerous occasions. I wish there was a way to reward every single one of you but hopefully the
painJOY of codebreaking was rewarding in and of itself. Thanks for participating and keep an eye out for future puzzle.
Discord user Hedare was the first to solve the puzzle and claimed the $100 Amazon Gift Card voucher as a reward.
And that was the end! Thanks to everyone who participated and keep an eye out for future puzzles.