Lets Solve!

I figured I would start a project to crack the mystery that is

Similar projects worth following
On April 1st (april fools day) Hackaday redirected visitors to a mysterious screen (seen at that is obviously part of a prank/easter egg hunt/fun adventure. I figured we could log our progress cracking this mystery here. If you would like to be a project contributor, just let me know and I will add you.

Please post any new findings in the comments so I can make updates as we progress. I will also make you a contributor to help move this thing along!
  • Well that was fun :)

    John Boyd05/02/2014 at 16:14 2 comments

    For those of you who have not noticed, Hack A Day announced the competition to go to space! They have also been explaining in HaD posts how this whole ARG was a "pre-game party" for the announcement of their competition to go to space! Pretty sweet if you ask me. This will likely be the last project log, I just wanted to have one last update to conclude things for anyone reading this in the future.

    Hack A Day Official Explanations of ARG Transmissions:

  • Spoiler - Final Transmission - Major Tom's Diary

    mikeneiderhauser04/25/2014 at 14:58 0 comments

    For those who do not have Minecraft. (This was posted in the comments and taken from


    Herein are the

    Cronicles of






    2: No sooner do I publish details about my launch vehicle do I get slapped with a patent warning. Really, having the engine on the bottom of the rocket is patented?


    3: I have come up with a brilliant solution. While the current situation prevents me from putting the engines at the bottom of the rocket, the language used in the previous patents say nothing about putting the engines at the top of the rocket.


    4: I have moved the engines to the top, and the capsule to the bottom. Of course the vehicle will be rotated for launch, but all is well. In keeping with the patent warnings, I have now rotated all diagrams 180 degrees.


    5: The new vehicle design works brilliantly. Unfortunately, the lawyers do not see my solution as unique, and have filed suit in east Texas.


    6: Although I'm building for personal use the cease and desist letters are getting more and more aggressive.


    7: Able to stand it no longer, I have launched my space station months earlier than planned. Out of the jurisdication of any nation I should be safe to build whatever I want.


    8: So far the microgravity environment has proven challenging for a number of simple tasks. There is now solder flux in the atmospheric recyclers and using the CNC router causes a slight rotation in the station around the forward axis.


    9: I feel I am getting the hang of working in a zero gravity environment. I have noticed a small fault in the vehicle's abort switch which I believe to be a loose solder joint. This must be fixed befire I can continue my research.


    10: I have come up with an elegant solution to the abort switch problem. If the computer is manually placed into an abort condition, I may continue using the flight computer as it will never trigger an abort. Genius.


    11: There has been a main bus fault. Thrusters are gone, as is the navigation computer. Main computer will require extensive repairs.


    12: ex appiars i hazi s{exchih xdi xderh anh joyrxd haxa leni.

    # (it appears I have switched the third and fourth data line)


    13: The previous situation has been resolved, altough I am currently dealing with several other mechanical problems on the ship.


    14: I have repaired as much as I can inside the ship, but the repairs now require me to EVA and fix the remaining systems. I do no like extravehicular activities. Last time the comms circuit died.


    15: The problem on the exterior has been resolved, thanks to a few comms from a good friend back on the blue earth. The defective component was a 709, luckily I had the spares. Bob will get back to me on the cause of the failure.


    16: Some readings from my transmission testing leads me to think others have been decoding my communications. Who would take the time to intercept and decode all of my messages?


    17: I grow weary of both waiting and worrying. If rescued I plan to start my search for someone to replace me. Maybe a more skilled soul can keep this place running, without interfering with their quest for discovery.

  • Final Transmission

    John Boyd04/24/2014 at 00:42 6 comments

    For those of you who haven't noticed, the final transmission was posted a few days ago. The transmission was simply this picture:

    The numbers in the picture represent the IP address and port number:, which happens to be a minecraft server!

    On the server there is a myriad of puzzles for us to solve. It seems most of them have been solved, but it is still a lot of fun to go find them all!

    When a collection of photos has been gathered, I will post them here.

  • Transmission #03 Decoded: Launch site confirmed.

    John Boyd04/17/2014 at 18:45 0 comments

    Seems like the transmission has been decoded and we have a launch site confirmed. Its hard to keep track of who has done what, but the entire community has come together to solve this one. The words played back in the audio files listed below, were deciphered to reveal the geographic location of the Baikonur Cosmodrome Launch Facility.

    These are the MP3 files extracted from each image:

    Here is what the mp3's say:

    • 1.mp3: Earth, Farad
    • 2.mp3: Joule, Circuit
    • 3.mp3: Amp, Gain
    • 4.mp3: Electron, Capacitor
    • 5.mp3: Dialectric, Diode

    Taking the first letter as a number starting with A=0 we get the following numbers:

    45 92 06 42 33

    AKA the GPS coordinates: 45.920N, 63.342E

    Ground Control confirmed the launch site here.

    They left us with a parting phrase (possibly clue), "Suit up!" Is this a reference to the space suit Minecraft skin we found earlier in the transmission? It might be worth our while to keep a look out for a HaD minecraft server in the near future.

  • Decoding Transmission #3

    Tyler Anderson04/16/2014 at 06:33 0 comments

    Each of the images for Transmission #3 contains a block of hidden data at the end. Fire up a hex editor and search for FF D9. This indicates the end of a JPEG file. Everything after this is extra.

    Rocket Picture

    We can tell there is a PNG file hidden in the rocket picture because the extra block starts with ".PNG........IHDR" and ends with "IEND.B`." Heres the extracted image:

    Turns out its a space suit skin for Minecraft! View it at

    Telescope Pictures

    In each of the telescope pictures, the extra data starts with "Salted__". So this means its encrypted with OpenSSL. After copying the data to it's own file, you can decrypt it with...

    openssl enc -d -aes-256-cbc -in 1.bin -out 1.mp3 -pass pass:"Im floating in a most peculiar way"

    These are the MP3 files extracted from each image:

    Here is what the mp3's say:

    •  1.mp3: Earth, Farad
    • 2.mp3: Joule, Circuit
    • 3.mp3: Amp, Gain
    • 4.mp3: Electron, Capacitor
    • 5.mp3: Dialectric, Diode

    Theres also more data hidden in these recording. The MP3 metadata has the following comments:

    1. Transmission received at T-1090800.0222786265106846
    2. Transmission received at T-1090800.0296872268554892
    3. No transmission
    4. No transmission
    5. No transmission

    Also, if you have ffmpeg, try...

    ffplay 1.mp3 get a Real Discrete Fourier Transform

  • What we know (recap) T#1, T#2, T#3

    mikeneiderhauser04/15/2014 at 23:02 0 comments

    Here is a log of the recap from the ##hackaday IRC

    <mdn15> Lets do a little recap shall we (and please feel free to fill in where I may miss)


    <mdn15> Transmission 1: [Input Sources] Coordinates of telescopes.

    <mdn15> Test Block 1: "I'm floating in a most peculiar way"

    <mdn15> Test block 2 was the QR code that led to the Major Tom Page


    <mdn15> --Transmission 2--

    <mdn15> Video on HaD Page

    <mdn15> IP of telnet server

    <mdn15> bob widlar (username and password of server)

    <mdn15> Various messages from MrWildard

    <emerica_> ^ ignoring those

    <mdn15> (thats what I'm thinking, but still needs to be noted)

    <emerica_> indeed

    <mdn15> On the telnet server

    <mdn15> we found a key file and a puff the magic dragon file

    <emerica_> AGC

    <mdn15> correct

    <mdn15> as of now.. I feel AGC was to throw us a curve ball

    <mdn15> The keyfile and openpuff led us to a message in the Transmission 2 Image

    <rawe_t30> status.jpg?

    <mdn15> yes.. status.jpg

    <mdn15> the message resulted in


    "Current Status

     Inclination 52.3

     Altitude 439km

    O2 76.2%

    Could do with a lift guys.

    <mdn15> then we got this from ground control

    Major Tom, this is Ground Control. Message received.

     Rescue mission planned, crew selection progressing.

    Next communication at T-18180


    <mdn15> -- Transmission 3 (so far) --

    <mdn15> 5 images that (most likely) relate to T#1 on the main Hackaday page

    <mdn15> These images have some sort of SSL info embedded (files begin with Salted__)

    <mdn15> The pic on the T3# page had a PNG file embedded that contained a space suit as a minecraft skin

    <rawe_t30> this was the first image on with embedded info

    <emerica_> I dont know if the post number 119822 is relevant

    <emerica_> the next 8 bytes are the salt

    <emerica_> 8 right?

  • Transmission #03 is here

    John Boyd04/15/2014 at 16:08 4 comments

    Transmission #03 has been posted on Major Tom's Page, along with images of the target radio telescopes decoded from Transmission #01. So far there doesn't seem to be much progress deciphering this message, but check it out for yourself and see what you can find!

    Here is what a few people have found:

    1. Green Bank Telescope (National Radio Astronomy Obervatory) 

    2. Arecibo Observatory 

    3. LOFAR Superterp (Netherlands Institute for Radio Astronomy) 

    4. Ratan-600 (Special Astrophysical Observatory of the Russian Academy of Sciences) 

    5. Effelsberg 100-m Telescope (Max Planck Institute for Radio Astronomy)

    Original GPS Coordinates:
    1. Arecibo Observatory
    2. Very Large Array (National Radio Astronomy Obervatory)
    3. Ratan-600 (Special Astrophysical Observatory of the Russian Academy of Sciences)
    4. Effelsberg 100-m Telescope (Max Planck Institute for Radio Astronomy)
    5. LOFAR Test Field (Netherlands Institute for Radio Astronomy)

  • (Almost) Complete HD Dump

    cadeldarkon97904/10/2014 at 01:21 0 comments

    I dumped most of the hard drive into a tar.bz2 file, as I could not get all of it (bob doesn't have all the needed permissions). If you would like to chroot into a copy of the computer, this dump is perfect for that! I have uploaded it to DepositFiles and Skydrive.

    Link 1:

  • Transmission #02

    Emerica04/10/2014 at 01:06 1 comment

    Transmission #2 - Solving the video

    Transmission #2 - Server Contents

    Transmission #2 - Completing Decryption.

    I had spent most of my evening watching Apollo Navigation Computer videos, preparing for possible use of DSKY. 
    It seemed most people were still stuck on trying to find data in the images and video expecting more, and I was starting to think that it was all just a ploy to side track.
    All the video is, in my opinion, is an attempt to gain more attention for the event, and to expose the IP and the AUTH clues.
    It was on the site all day/night, bringing much more attention to those who many have missed it. 
    More help is always good :) 
    I don't think you can really expect any visual stenography to make it through Youtube's encoding process, with reliability.
    Audio is another story, but too complicated in my opinion to try and have the public find it 'easily enough'
    Transmission #1 was pretty simple, there is little reason that  this challenge should be magnitudes harder.

    Many of us have thought these images have hidden data in one way or another.
    How are we going to decode stenography it we can't verify what was used to encode it, without the algo(s) and the key(s), it seemed like a moot point to me. So I focused more on the AGC app.
    When Ben mentioned the email about the decryption not being complete, I knew that we had to take another look at the transmission 2 image.

    I opened it with a hex editor, this gave me  a header with Ducky in it, some googling returned this to be an Adobe save for web file. Ok onto the metadata,

    <br><span><?xml version="1.0" encoding="UTF-8"?><br></span><span><x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 4.4.0-Exiv2"><br></span><span><rdf:RDF xmlns:rdf=""><br></span><span><rdf:Description rdf:about="" </span><span>xmlns:xmp="" </span><span>xmlns:xmpMM="" </span><span>xmlns:stRef="" </span><span>xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" </span><span>xmpMM:InstanceID="xmp.iid:CF0B160FBE6B11E38995D5ABC046E8AD" </span><span>xmpMM:DocumentID="xmp.did:CF0B1610BE6B11E38995D5ABC046E8AD"> <br></span><span><xmpMM:DerivedFrom </span><span>stRef:instanceID="xmp.iid:CF0B160DBE6B11E38995D5ABC046E8AD" </span><span>stRef:documentID="xmp.did:CF0B160EBE6B11E38995D5ABC046E8AD"/> <br></span><span></rdf:Description> <br></span><span></rdf:RDF><br></span><span></x:xmpmeta></span>

    Not much here of use.....that I can gather anyway.
    I remembered the other image being a png. This being a jpg, other tools might work.
    Well back to google,  "xmp jpg stenography"

    first result: 

    OpenPuff - Steganography & Watermarking -

    I should have clicked I'm feeling lucky.
    I went back to IRC at this point and the chat log basically explains the rest.

    nope, currently trying to use the keyfile keys on the image in the transmission 2 page
    not sure which steno tool to use though
    any idea where that image came from?
    I tried reverse image search but it didn't turn up anything
    hmm, maybe original then?
    someone at HaD is not a bad artist then
    yeah its nice, but i'm growing tired of staring at it ;-)
    huh! looks like we're on the right track
    got an email from ground control
    Communication with Major Tom was initiated at 00:00 on 08/04/2014, transmission archive available here:
    The following image was received from Major Tom at 00:01hrs this morning. Decryption is not yet complete. Please assist.
    followed by the image from the transmission 2 page
    just got the same
    I got the same email
    of course knowing that ii'm working on the right thing doesn't necessarily make it any easier for me to decode! :-)
    and the wife is calling, good luck guys.
    * Ben___ has quit

    Read more »

  • Github Repository of Telnet Server

    John Boyd04/09/2014 at 06:05 0 comments

    Here is a Github repository with the home directory on the telnet server for those of you that would like easy access to all of the files.

View all 12 project logs

  • 1
    Step 1

    Review Previous Logs.

  • 2
    Step 2

    Join IRC channel ##hackaday on freenode. 

View all instructions

Enjoy this project?



John Boyd wrote 04/17/2014 at 19:00 point
Well looks like thats the end of T#03! I will be keeping my eyes open for a minecraft server come tuesday

  Are you sure? yes | no

tehaxor69 wrote 04/17/2014 at 19:05 point
That will be interesting.

  Are you sure? yes | no

johnowhitaker wrote 04/17/2014 at 06:34 point
For those not on IRC:
5 mp3s contain the following words:
1) Earth, Farad
2) Joule, Circuit
3) Amp, Gain
4) Electron, Capacitor
5) Dialectric Doide

circuit.jpg has some data hidden in it with a program called jphide. Trying to view it with jpseek but no luck guessing the password yet. If you want to give it a crack download the program from and please join ##hackaday @ freenode to let us know if you have any luck!

  Are you sure? yes | no

tehaxor69 wrote 04/17/2014 at 13:20 point
Have you tried to brute force it with stegbreak?
I'm in the process of doing that now.

  Are you sure? yes | no

Sheldon wrote 04/17/2014 at 15:52 point
The original from which circuit.jpg was taken:

  Are you sure? yes | no

Emerica wrote 04/17/2014 at 15:53 point
Stegdetect is know to produce false positives for jphide.
I tried stegbreak last night with the normal rules and the word we had, but nothing.
My stegdetct 0.6 at work returns negative.
Those posts are really old. But The circuit image while really old, I can't find with google, wayback machine doesn't see the page, maybe just private, maybe part of the game, I dunno.

  Are you sure? yes | no

tehaxor69 wrote 04/16/2014 at 17:42 point
I attempted to clean up the MP3s as best as I could with Audacity, you can get them here:

the 1X and 2X folders contain the processed audio files, I used the "Auto Duck" effect using the Duck.aiff provided.

  Are you sure? yes | no

johnowhitaker wrote 04/16/2014 at 19:08 point
Noise reduction seems to work pretty well as well. Still can't make out 3 though...

  Are you sure? yes | no

John Boyd wrote 04/16/2014 at 20:58 point
I was actually about to post the same thing. That is the same vibrating/buzzing hackaday astronaut emblem from the hackaday/space transmissions. I would not be surprised if there is data hidden within

  Are you sure? yes | no

RodolpheH wrote 04/17/2014 at 06:12 point
I saw that too, and found the famous ffd9 into the hexdump of the pictures. But since it's a png, and I don't know a lots of things about pictures format, I don't know if it's relevant...

  Are you sure? yes | no

Sheldon wrote 04/16/2014 at 12:32 point
Has anyone else looked at the js files used on the Space page?
I just had a nosey in the space.min.js and saw some curious text strings. Comparing them with the coordinates that Callum mentioned (, I wonder if it is of interest.
Confirming 18.344167 -66.752778... Done.
Confirming 34.078749 -107.618283... Done.
Confirming 43.826167 41.586683... Done.
Confirming 50.524722 6.882778... Done.
Confirming 52.908889 6.868889... Done.
This is followed by a set of hex keys ("test block 1") followed by a binary array ("test block 2") which, despite squinting lots, I can't quite tell if it's a skull & cross-bones (could be a QR code - I can't be bothered to convert it).

... or is looking at the js considered cheating? :-)

  Are you sure? yes | no

tfx2 wrote 04/16/2014 at 12:54 point
The coordinates were from the first Transmission. They are five radiotelescope sites, with the differences being the LOFAR test field instead of the LOFAR core (Superterp) and the Very Large Array of the NRAO instead of Green Bank Telescope.

  Are you sure? yes | no

tehaxor69 wrote 04/16/2014 at 12:56 point
It is a QR code, it contains the URL to Major Tom's page.

  Are you sure? yes | no

Sheldon wrote 04/16/2014 at 13:40 point
Thanks guys - I just spotted that this was (partially) mentioned in the Major Tom homepage (I now see "test block 1" is a garbled ASCII version of "I'm floating in a most peculiar way")
This almost feels like work with it being documented in many, many different places - hard to keep track of it all :-)

  Are you sure? yes | no

Kernelpanic wrote 04/16/2014 at 06:15 point
The audio files are full of noise due to the logo. It sounds to me like the words are circuit related.
1: Earth, Farad,
2: Joule Circuit
3: noise
4: electric capacitor
5: noise
I opened the files in audacity hoping to subtract the log to clean the files up. (but I don't know what I am doing.) I have tried inverting one file and adding it to another to remove the noise used to make the logo, but that didn't work.
The timings of the files are different. Different lenghts, pauses between words, start times of the actual words.
File 3 only has a spectrum up to 5kHz, all other files have a spectrum up to 20kHz.
File 3, and 5 seem to have been slowed down, or the pitch lowered. I haven't made any progress reversing that.

  Are you sure? yes | no

Jonathon ("reConfigured") wrote 04/17/2014 at 03:50 point
what about #5: dielectric diode???

  Are you sure? yes | no

Kernelpanic wrote 04/16/2014 at 05:59 point
Rab-- (irc) figures out the encryption is aes-256-cbc with a pass phrase of "Im floating in a most peculiar way"
it is quickly obvious that decrypted files are mp3
rawe_t30 finds the comments are:
1) Transmission received at T-1090800.0222786265106846
2) Transmission received at T-1090800.0296872268554892
3/4/5) No Transmission
Emerica finds the awsome logo.
Emerica: ffplay the file
Emerica: i work for tv company, that was first insticnt, and it blew my mind

  Are you sure? yes | no

Emerica wrote 04/16/2014 at 05:16 point

Thank you hackaday, for once again, blowing my mind.
I was hoping for explosions or something by the end of all of these due to the work involved by both sides. But something in my brain has blown already.
Seeing your logo like that, just awesome. Well done.

  Are you sure? yes | no

Emerica wrote 04/16/2014 at 05:05 point

  Are you sure? yes | no

Sy Bernot wrote 04/16/2014 at 01:37 point
Not sure if its relevant or not but that second list was missing an entry and had an extra. I re-plotted both lists and made a line between the two that don't appear on both lists. (green bank and VLA)
flight path?

  Are you sure? yes | no

Emerica wrote 04/15/2014 at 21:28 point
The encrypted data in the the other images which we are looking at now. ##hackaday @ freenode. Cipher and keys still at large, so far.

  Are you sure? yes | no

tehaxor69 wrote 04/15/2014 at 20:35 point
Found a PNG image embedded in the on the Transmission #03 page. It starts at file offset 0x1BAC8, 0xC24 bytes long, it looks like some sort of tile map. Maybe some metadata goes with it?

  Are you sure? yes | no

Emerica wrote 04/15/2014 at 21:20 point
Yeah we found that, you might have to suit up...
Kinda looks like a game texture to me, maybe a skin...... heh

  Are you sure? yes | no

John Boyd wrote 04/15/2014 at 16:23 point
I took a look at all 5 of the pictures posted as well as the Transmission #03 picture in OpenPUFF using they keyfile from the Telnet server. I am not an expert with this sort of thing, but I wasnt able to find anything right off the bat.

  Are you sure? yes | no

mikeneiderhauser wrote 04/15/2014 at 14:12 point

on there is a SCI-FI Contest section to the right of the page, and it indicates Project Idea 129 - A Terrestrial Ansible.. the image is of a telescope

  Are you sure? yes | no

Sheldon wrote 04/15/2014 at 14:43 point
I've been scratching my head about the "project idea" image and link at the side- they've always linked to the main sci-fi contest page and had 'junk' idea numbers (the previous one was to creating "YT's skateboard" but, like the current #129 - it doesn't exist).

  Are you sure? yes | no

Sheldon wrote 04/15/2014 at 15:02 point
Oo, luckily I had an old tab open - for reference, the last one was for "Project Idea #325 - Build Y.T.'s skateboard"

  Are you sure? yes | no

Tyler Anderson wrote 04/15/2014 at 08:56 point
Transmission #3 Telescopes:
1. Green Bank Telescope (National Radio Astronomy Obervatory)
2. Arecibo Observatory
3. LOFAR Superterp (Netherlands Institute for Radio Astronomy)
4. Ratan-600 (Special Astrophysical Observatory of the Russian Academy of Sciences)
5. Effelsberg 100-m Telescope (Max Planck Institute for Radio Astronomy)

Original GPS Coordinates:
1. Arecibo Observatory
2. Very Large Array (National Radio Astronomy Obervatory)
3. Ratan-600 (Special Astrophysical Observatory of the Russian Academy of Sciences)
4. Effelsberg 100-m Telescope (Max Planck Institute for Radio Astronomy)
5. LOFAR Test Field (Netherlands Institute for Radio Astronomy)

  Are you sure? yes | no

RodolpheH wrote 04/14/2014 at 16:16 point
Tonight, planet Mars will be closer to earth than the rest of the time. Could it have some links between this event and the hackaday space enigma ? I will watch the red planet tonight, hoping to see the HaD logo appear on the surface :)

  Are you sure? yes | no

Sy Bernot wrote 04/14/2014 at 01:52 point
I suspect it was an accident (logged in as the wrong user?) But I did notice this

Maj Tom at least knows how to solder....

  Are you sure? yes | no

mikeneiderhauser wrote 04/14/2014 at 11:39 point
Yea I just saw that as well

  Are you sure? yes | no

Kyle Brinkerhoff wrote 04/11/2014 at 04:31 point
whos face and what circuit is that in transmission 2?
face is at 2sec
circuit is at 5sec me thinks its something about adding noise to the audio and subtracting it to encode a voice message.....

  Are you sure? yes | no

Sy Bernot wrote 04/11/2014 at 06:49 point
a little google foo will yield the answers you seek.

  Are you sure? yes | no

mikeneiderhauser wrote 04/10/2014 at 11:39 point
5:48 AM Next transmission is in 5 days and 12 ours
5:53 AM The T-xxxxxx is the time until launch of the rescue mission. Transmission #3 is just 5.05 hours before launch! Therefore it is likely that Transmission #3 is the last transmission

  Are you sure? yes | no

mikeneiderhauser wrote 04/10/2014 at 11:39 point

  Are you sure? yes | no

Similar Projects

Does this project spark your interest?

Become a member to follow this project and never miss any updates