On 19th February 2015, Black Mesa Research Facility website (http://bmrf.us/) was modified to redirect to http://www.kxbm.net/article/?10360/all-clear-given-for-black-mesa-evacuation-zone.
On February 6, 2020, Stormseeker stated on Discord that kxbm.net was not part of The Pizza Code Mystery ARG: "kxbm isnt anything to do with me or the pizza arg | iirc, it was its own arg" [1]
Analysis[]
Below is a summary of what is going on, thanks to forum user "Shadowhand". [2] [3]
I went digging around the sites, and here is what I found:
There's literally just this page, it's called "index.html", not even PHP, so it's not dynamic. Keep in mind that the site is hosted on nginx which can be configured to send php as html. Literally anything after "?" is just fluff.
There's an /assets/ under /article/, but it throws out forbidden error. Fine, okay!
But here's the kicker: Literally every image on the page (and one script tag) has their names in Base64 text.
Below is the every Base64 line on the page:
- SSBzdXNwZWN0ZWQgdGhpcyB3b3VsZCBoYXBwZW4sIGJ1dCB0aGUgYWRtaW5pc3RyYXRvciBqdXN0IHdvdWxkIG5vdCBsaXN0ZW4u
- SXQncyBub3Qgb3VyIGZhdWx0Lg==
- RmF0IGxvdCBvZiBnb29kIHRoYXQgUGguRCBkb2VzIG1lIG5vdw==
- SSd2ZSBiZWVuIHdhaXRpbmcgaGVyZSBmb3IgYWdlcywgaG9waW5nIHNvbWVvbmUgd291bGQgY29tZSBhbG9uZyE=
- R2V0IHVzIG91dCBvZiBoZXJlIGJlZm9yZSB0aG9zZSBtaWxpdGFyeSBkcm9uZXMgZmluZCBvdXQgd2hlcmUgd2UncmUgaGlkaW5n
- SWYgeW91IGxldCB1cyBhbGwgZGllLCBGcmVlbWFuLCB5b3UnbGwgbmV2ZXIgZ2V0IG91dCBvZiBoZXJlLg==
- SWYgeW91IGludGVuZCB0byBnbyBvbiwgdGhlbiwgSSBiZWcgb2YgeW91LCBwcm9jZWVkIHdpdGggZXh0cmVtZSBjYXV0aW9uLg==
- VGhlIGRpbWVuc2lvbmFsIGJyZWFjaCBpcyBkZWZpbml0ZWx5IHRyYW5zbWl0dGluZyBvcmdhbmljIG1hdHRlci4=
- SSBjYW4gc2VlIHlvdSBhbHJlYWR5IGtub3cgYSBncmVhdCBkZWFsIG1vcmUgdGhhbiBhbnkgb25lIG1hbiBpcyBzdXBwb3NlZCB0by4=
- VGhlIHNjaWVuY2UgdGVhbSBoYXMgYmVlbiB0cmFja2luZyB5b3VyIHByb2dyZXNzIHdpdGggdGhlIEJsYWNrIE1lc2Egc2VjdXJpdHkgc3lzdGVtLiBVbmZvcnR1bmF0ZWx5LCBzbyBpcyB0aGUgbWlsaXRhcnku
- V2l0aCBteSBicmFpbnMgYW5kIHlvdXIgYnJhd24sIHdlJ2QgbWFrZSBhbiBleGNlbGxlbnQgdGVhbS4= (Script file's name)
- SXQgY2FuJ3QgZ2V0IGFueSB3b3JzZSB0aGFuIHRoaXMu (In CSS)
- VGhlIGFsaWVuIHNwZWNpZXMgY2FuJ3QgcG9zc2libHkgYWxsIGJlIGhvc3RpbGUsIGNhbiB0aGV5Pw== (In CSS)
- V2h5IGRpZG4ndCB0aGV5IGxpc3Rlbj8= (In CSS)
- SSBuZXZlciBzdXNwZWN0ZWQgc3VjaCB0aGluZ3MgY291bGQgYmUuLi4= (Turned on radio, with morse code)
And here's what they mean:
- I suspected this would happen, but the administrator just would not listen.
- It's not our fault.
- Fat lot of good that Ph.D does me now
- I've been waiting here for ages, hoping someone would come along!
- Get us out of here before those military drones find out where we're hiding
- If you let us all die, Freeman, you'll never get out of here.
- If you intend to go on, then, I beg of you, proceed with extreme caution.
- The dimensional breach is definitely transmitting organic matter.
- I can see you already know a great deal more than any one man is supposed to.
- The science team has been tracking your progress with the Black Mesa security system. Unfortunately, so is the military.
- With my brains and your brawn, we'd make an excellent team. (Script file's name)
- It can't get any worse than this. (In CSS)
- The alien species can't possibly all be hostile, can they? (In CSS)
- Why didn't they listen? (In CSS)
- I never suspected such things could be... (Turned on radio, with morse code)
When the page is first loaded, browser tries to load a file, file name is in, again Base64: RGllLi4ueW91IGFsbCBkaWUuLi55b3UgYWxsIGRpZS4uLg==
Which translates to:
"Die...you all die...you all die..."
It's an MP4 file without any video layer. It's just audio.
Here's the mediainfo output for it:
General Complete name : RGllLi4ueW91IGFsbCBkaWUuLi55b3UgYWxsIGRpZS4uLg==.mp4 Format : MPEG-4 Format profile : Base Media Codec ID : isom File size : 147 KiB Duration : 9s 211ms Overall bit rate mode : Constant Overall bit rate : 130 Kbps Writing application : Lavf55.19.104 Audio ID : 1 Format : AAC Format/Info : Advanced Audio Codec Format profile : LC Codec ID : 40 Duration : 9s 211ms Duration_LastFrame : -8ms Bit rate mode : Constant Bit rate : 128 Kbps Channel(s) : 2 channels Channel(s)_Original : 1 channel Channel positions : Front: C Sampling rate : 44.1 KHz Compression mode : Lossy Stream size : 144 KiB (98%)
And it's nothing special. It's just the static noise from the top directory kxbm.net.
Although, it might have hidden audio clues, and that's as far as my knowledge goes, so please, someone else pick it up.
There are reports of this file being an SSTV signal with an image, but it's from 8chan so its authenticity is questionable.
Five things are left on this page:
1) Headcrab ASCII art in console.
2) Clicking any of the top links (menu, set your weather, etc) sends you to base domain, which literally has 10 JavaScript files, 1 jpg (same file from bmfr.us EAS image), a "thumbs.db" file (which shows the page has been accessed locally on a Windows computer), and one mp4 file.
Now the main thing on the page is the mp4 file. It's called background.mp4 and it's 1 minute long. The TV static and deformation effect is dynamically added on the page with JavaScript.
There's nothing else to this file, or the page, other than the Gman ASCII art in the console.
[ However, forum user CPU later did some work on the audio track and believed he had found a voice [4] [5]. At the time of writing, this is still unresolved. --Flavrans9 (talk) ]
3) Clicking Thomas' name sends you to localdesertsingles.com, which says the server is overloaded, but once again, it's just another index.html file, which means it's not dynamic. Forum user JohnNotJohn pointed out that Thomas Lee is an anagram of “Meet Halos.”
What's weird about this page is the console output, which shows Nihilant, and prints one line:
"Alone...aren't you alone..."
And prints another line every 2000ms (2 seconds) forever:
"...aren't you alone..."
The script that does this is written in-line, and is encoded. I decoded it and it has nothing of value inside.
4) You can click the button on the radio to turn it on, and it will relay a morse code (found by the forums user "CPU"), which translates to:
<SOS> <SOS> <SOS> DE AI5BM AI5BM AI5BM BLACK MESA RESEARCH FACILITY BIODOME LABS. TRAPPED, NEED RESCUE. EVAC ZONE NOT SAFE. MILITARY HOSTILE <AR> K
5) You can click "Contact Us" at the footer, which takes you to http://steampowered.com/.
6) The radio has a comment in the div container. It reads: "Get away from there, Freeman! I'm expecting an important message"
External links[]
- The developer's own notes, found on his GitHub account.