Obduction Alternate Reality Game (ARG) Progress

In late August, Cyan Worlds, Inc. began releasing hints and clues to what would later be revealed to be their new game project, Obduction. Prior to the Kickstarter campaign, several images were teased, some in encrypted form. These images were mostly screenshots from the then-unreleased Kickstarter trailer and included letters from the name Obduction, hinting at the title.

During the Kickstarter campaign, Cyan released clues that led through a puzzle trail to several websites. Broadly, clues in the kickstarter video led to hiredark.com, which in turn led to the site obduct.me. The sites hunrath.com and cyan.com/welcome were also found in connection with these clues. This segment of the ARG was discussed extensively in the Kickstarter thread on the Cyan forums.

The ARG-proper has yet to get underway.

Pre-Kickstarter

Beginning in September, 2013, Cyan employee Eric A Anderson (edoublea in the forums) posted several images related to the upcoming kickstarter campaign, some of which contained hidden information. While mysterious at the time, the images are now easily recognized as elements or screenshots from the kickstarter video.

On September 10, Eric posted an image on Cyan’s Facebook page. He later replied in the forums that nothing is hidden in this first image.

A second image on facebook was accompanied by the comment “Unbounded in its ken…” which is a quote from a Robert Gambol poem. Eric subsequently posted an extended quote on the forums along with the clues “Maybe there are more levels to this than you know,” with the letters in “levels” fading to light grey, and “…maybe you need to make an adjustment to your thinking.” Upon adjusting the levels with image editing software, the obduction logo and a line of text become visible. The text reads “736F6F64” which is ASCII for “soon.”

A third image is accompanied by the comment, "...and each step will be made in the wink of an eye," which is from The Wizard of Oz. edoublea then posts on Reddit: "A wild clue has appeared! http://imgur.com/7KujlVh Enjoy. ;}" The wingdings in the word bubble translate to “NO!” making the image a rebus for steganograph (STEGAsaurus+NO+GRAPH). The other wingdings translate to “walking shark” which turns out to be a reference to mobilefish.com, which has an online steganography tool. Processing the third image with no password using the mobilefish site yields an image of a seed with the words, "Prepate to be scattered." Eric confirms that “prepate” is a typo on his part.

On Sep 28, Eric (@LemonLime) posted in Cyan Chat, "x6yoZIW Once there were brook trout in the streams in the mountains." The initial string leads to an image: http://imgur.com/x6yoZIW, and the text is a quote from The Road by Cormac McCarthy. When no progress was made, Eric provided a link to another steganography tool. After numerous unsuccessful attempts by players to decrypt using various passwords, Eric found that the site was broken and giving php errors. He provided the password (“mazes” from an extended version of the Cormac McCarthy quote) and a link to the embedded image.

Eric then posted in Cyan Chat, "/a/JJNoN I am a frayed and nibbled survivor in a fallen world, and I am getting along." This again points to an image (at http://imgur.com/a/JJNoN). The quote is from “Pilgrim at Tinker Creek” by Annie Dillard. An extended version of the quote contains the word “imperfections,” which is the password necessary to decrypt using the mobilefish site. The embedded image was a Magic Eye puzzle in which letters are visible. Pieced together, the letters form "ODUCTiN." Remembering a comment by Rand at Mysterium 2009 about a potential project called Abduction, players soon found an image with the word "Obduction" on the DRC site. Searching for obduction led to a Reddit post by Eric containing a final image link: http://i.imgur.com/oRTaRx3.jpg.
Players quickly discovered the Obduction website and Obduction Twitter account.

Kickstarter Campaign

Kickstarter Video

During the Kickstarter video for the game, three words are displayed.

3:20 - yellowbrick
3:23 - firelight
4:05 - germinate

When these words are typed into posts at the Cyan forums, the ("swear-word") filter changes the words to:

yellowbrick: is.gd
firelight: odu
germinate: tol

This was found to be a short URL link: http://is.gd/odutol

The shortlink led to a YouTube video with the title 4/3 π r3, uploaded by user Chester C.

The title of the video is the formula for finding the volume of a sphere. The video is three seconds long, cycling through images of different round or spherical objects. The audio of the video (a series of high-pitched beeping sounds) was found to contain a QR Code leading to the site http://hiredark.com.

Hiredark

The site hiredark.com simulates the appearance of a Linux/Unix shell (terminal) running a count-down timer. The timer is scripted in (dynamic) PHP, which generates a Javascript script. The units of the timer appear to be milliseconds, and the timer itself appears to be counting down to January 6, 2014. In addition, the script is coded to display the message "You do not have sufficient permission to cancel this process." if the user attempts to "end" the counter from the simulated command line using the key combination CTRL+C.

Words

In their Kickstarter Update #12 Cyan gave a hint at the bottom of the update: "/words/<AMA>". By appending the hiredark URL with "/words/", it was found that http://hiredark.com/words/ is a valid page, but no access granted.

Having a look again to the reddit AMA page, it was suspicious that Rand Miller used the word "swell" really often in his welcome message. Adding "swell" to the URL again gave a valid page http://hiredark.com/words/swell/ which contains the text of an apparently "nonsense" poem. Searching for the text of the strange poem using a search engine revealed that the text was derived from the poetry of Walt Whitman, specifically the poem "On the Beach at Night Alone". As one can see, every fourth word from this poem is used to derive the Cyan versions of it.

The following day, Rand fave a hint in an In-Game Chat interview ("/words/<update#6>"), and a new page was found, http://hiredark.com/words/surprise/. These words are also every fourth word of the Whitman poem, but with an offset of -1 compared to the /swell words (that is, each word in /surprise is the word in Whitman just before the word used in /swell.)

Following the pattern of looking for prominent or frequently-used words in the updates, two additional pages were discovered, at words/add-on (from update #7)and words/name (from update #11). These pages contained the rest of the words to the Whitman poem, with an offset of -3 and -2 respectively from the first page discovered.

After reconstructing the poem through these pages, it was discovered that one word was different from the original - "shades" instead of "worlds" in verse 8.

Whitman's "On the Beach at Night Alone"
On the beach at night alone, As the old mother sways her to and fro singing her husky song, As I watch the bright stars shining, I think a thought of the clef of the universes and of the future. A vast similitude interlocks all, All spheres, grown, ungrown, small, large, suns, moons, planets, All distances of place however wide, All distances of time, all inanimate forms, All souls, all living bodies though they be ever so different, or in different worlds, All gaseous, watery, vegetable, mineral processes, the fishes, the brutes, All nations, colors, barbarisms, civilizations, languages, All identities that have existed or may exist on this globe, or any globe, All lives and deaths, all of the past, present, future, This vast similitude spans them, and always has spann'd, And shall forever span them and compactly hold and enclose them.

(The bold and italic faces only emphasize the connections between the versions, and are not original to the Whitman poem.)

hiredark.com/words/add-on/	hiredark.com/words/name/	hiredark.com/words/surprise	hiredark.com/words/swell
On night old to her I stars a clef and A all, ungrown, moons, of All all souls, though so different watery, the All civilizations, that may globe, All all present, similitude always shall and enclose	the alone, mother and husky watch shining, thought of of vast All small, planets, place distances inanimate all they different, shades, vegetable, fishes, nations, languages, have exist, or lives of future, spans has forever compactly them.	beach As sways fro, song, the I of the the similitude spheres, large, All however of forms, living be or All mineral the colors, All existed, on any and the This them, spann'd, span hold	at the her singing As bright think the universes, future. interlocks grown, suns, distances wide, time, All bodies, ever in gaseous, processes, brutes, barbarisms, identities or this globe, deaths, past, vast and And them and
each 4th word, offset -3	each 4th word, offset -2	each 4th word, offset -1	each 4th word, offset 0

Worlds

Guessing that "words" could be a misspelling, simply trying to browse to http://hiredark.com/worlds/ revealed that this opens a page as well; a page with a pure black background and nothing else in it.

Either once this link was posted in the Cyan forums (assuming Cyan employees watching the progress in the thread) - or by simply refreshing the content of the browser (assuming there is some automated mechanism updating content) - had the effect that the page now contained a small circle. This circle was an image named "worlds.png" (circle color = #667766). It had already been observed that the dot-color of Cyan's logo had slightly changed from a bright cyan (#00d8ff) to a color with hex value #667766.

The content of the page worlds changed again almost immediately; this time the color of the circle changed was #637777, and the png image was replaced by an svg version. This change coincided with an identical change in the color of the dot in the Cyan logo. The color of both dots then changed again, this time to #55557A.

After the four portions of the Walt Whitman poem were discovered, a discrepancy was noted in the /words/name/ portion of the poetry. Where the word "worlds" should have appeared, there was instead the word "shades" (see above table). Upon attempting the url http://www.hiredark.com/worlds/shades/ , yet another page was discovered which had not one but four circles, each in a different color corresponding to one of the previous color values of the Cyan dot.

In the next few days the color changed multiple times, and with each change a new circle was added for a total of nine circles arranged vertically. The colors of these have hex values of #667766, #637777, #55557A, #333371, #445844, #729999, #888862, #114F11, and #222264. The newest circle always matched the colors that have appeared on the /worlds/ page and also the color of the Cyan logo dot.

The hex value for each color contains four identical digits and two that don't match. The non-matching digits are always a valid ASCII identifier for a letter. In order of appearance, these are 77=w, 63=c, 7A=z, 71=q, 58=X, 72=r, 62=b, 4F=O, 64=d. The four matching digits from each color are distinct values 1-9, suggesting an order in which they should be placed. When arranged in ascending numerical sequence by these digits, rather than by chronological appearance, the letters form the string "OdqXzwcbr". If entered as as part of the url it gives http://hiredark.com/OdqXzwcbr which at first was a blank page but now redirects to http://obduct.me

Obduct.me

http://obduct.me consisted of the Cyan logo, in SVG form, on a black background. After the nine color changes (see above) the Cyan dot reverted to its original color and the C portion of the logo began to undergo similar color changes. The hex value of the first color was 6F7262, which is ASCII for "orb". Noticing that http://obduct.me/orb is an existing (only Forbidden) page, and assuming a similar pattern as before with using prominent words from Kickstarter updates, led to http://obduct.me/orb/scatter, which displays the single word "Karl". The page corresponds to a Cyan clue for <C1>/<Update #13>.

The color of the C changed several more times. Following the above pattern, these led to the following pages with a single word of text:

<C1>/<Update #13> with #6F7262="orb", so orb/scatter, "Karl"

<C2>/<Update #15> with #746F70="top", so top/reward, "moved"

<C3>/<Update #16> with #6C6970="lip", so lip/officially, "away"

<C4>/<Update #18> with #626F77="bow", so bow/disc, "<today>"

Note that the final clue was received via Cyan.com 's News page on Nov. 11, 2013. Rather than plain text, a .png image is shown containing <C4>/<Update#18> under a post heading of "Welcome". Further exploration revealed a new directory on the cyan.com domain of cyan.com/welcome . This leads to a page with comparable formatting to the Cyan News page but without any other posts. The .png hint image is there as well.

In the forum comments discussing these clues, some text was changed (presumably by a moderator). One set of changes, in red color, indicated that Cyan had given an official <C3>/<Update #16> clue (previously it had been successful guesswork). A second set of changes highlighted words or letters in blue, ostensibly to draw attention to them. These included "<today>" (quote marks only), the individual letters g-o-o-g-l-e in a series of consecutive posts, and "November 11" (including quotes and text). In a post describing one of the possible google hits, the word "correct" was also turned blue. The link in the post is to a page that describes the disappearance of one Karl Hunrath on November 11, 1953. Karl and the other passenger in his plane were purpotedly flying to a rendezvous with a flying saucer to take them away from earth.

Following this hint, http://obduct.me/Hunrath is a valid page (note that Hunrath is case-sensitive). That page displays a slightly different view of the farmhouse from the trailer, with a wooden signboard in front. The sign says "Welcome t* Hunrath", with a circular piece of the sign missing where the o of "to" would be.

Hunrath.com

http://www.hunrath.com contains the same picture found on http://obduct.me/Hunrath, also contains the number 1389045600000 inside the webpage source code. Using http://www.epochconverter.com/ converts this number to Mon, 06 Jan 2014 22:00:00 GMT. This is the same date as the countdown on http://hiredark.com/.