FANDOM


On 19th February 2015, Black Mesa Research Facility website (http://bmrf.us/) was modified to redirect to http://www.kxbm.net/article/?10360/all-clear-given-for-black-mesa-evacuation-zone.

AnalysisEdit

Below is a summary of what is going on, thanks to forum user "Shadowhand". [1] [2]

I went digging around the sites, and here is what I found:

http://KXBM.net/article :

There's literally just this page, it's called "index.html", not even PHP, so it's not dynamic. Keep in mind that the site is hosted on nginx which can be configured to send php as html. Literally anything after "?" is just fluff.

There's an /assets/ under /article/, but it throws out forbidden error. Fine, okay!

But here's the kicker: Literally every image on the page (and one script tag) has their names in Base64 text.

Below is the every Base64 line on the page:

  1. SSBzdXNwZWN0ZWQgdGhpcyB3b3VsZCBoYXBwZW4sIGJ1dCB0aGUgYWRtaW5pc3RyYXRvciBqdXN0IHdvdWxkIG5vdCBsaXN0ZW4u
  2. SXQncyBub3Qgb3VyIGZhdWx0Lg==
  3. RmF0IGxvdCBvZiBnb29kIHRoYXQgUGguRCBkb2VzIG1lIG5vdw==
  4. SSd2ZSBiZWVuIHdhaXRpbmcgaGVyZSBmb3IgYWdlcywgaG9waW5nIHNvbWVvbmUgd291bGQgY29tZSBhbG9uZyE=
  5. R2V0IHVzIG91dCBvZiBoZXJlIGJlZm9yZSB0aG9zZSBtaWxpdGFyeSBkcm9uZXMgZmluZCBvdXQgd2hlcmUgd2UncmUgaGlkaW5n
  6. SWYgeW91IGxldCB1cyBhbGwgZGllLCBGcmVlbWFuLCB5b3UnbGwgbmV2ZXIgZ2V0IG91dCBvZiBoZXJlLg==
  7. SWYgeW91IGludGVuZCB0byBnbyBvbiwgdGhlbiwgSSBiZWcgb2YgeW91LCBwcm9jZWVkIHdpdGggZXh0cmVtZSBjYXV0aW9uLg==
  8. VGhlIGRpbWVuc2lvbmFsIGJyZWFjaCBpcyBkZWZpbml0ZWx5IHRyYW5zbWl0dGluZyBvcmdhbmljIG1hdHRlci4=
  9. SSBjYW4gc2VlIHlvdSBhbHJlYWR5IGtub3cgYSBncmVhdCBkZWFsIG1vcmUgdGhhbiBhbnkgb25lIG1hbiBpcyBzdXBwb3NlZCB0by4=
  10. VGhlIHNjaWVuY2UgdGVhbSBoYXMgYmVlbiB0cmFja2luZyB5b3VyIHByb2dyZXNzIHdpdGggdGhlIEJsYWNrIE1lc2Egc2VjdXJpdHkgc3lzdGVtLiBVbmZvcnR1bmF0ZWx5LCBzbyBpcyB0aGUgbWlsaXRhcnku
  11. V2l0aCBteSBicmFpbnMgYW5kIHlvdXIgYnJhd24sIHdlJ2QgbWFrZSBhbiBleGNlbGxlbnQgdGVhbS4= (Script file's name)
  12. SXQgY2FuJ3QgZ2V0IGFueSB3b3JzZSB0aGFuIHRoaXMu (In CSS)
  13. VGhlIGFsaWVuIHNwZWNpZXMgY2FuJ3QgcG9zc2libHkgYWxsIGJlIGhvc3RpbGUsIGNhbiB0aGV5Pw== (In CSS)
  14. V2h5IGRpZG4ndCB0aGV5IGxpc3Rlbj8= (In CSS)
  15. SSBuZXZlciBzdXNwZWN0ZWQgc3VjaCB0aGluZ3MgY291bGQgYmUuLi4= (Turned on radio, with morse code)

And here's what they mean:

  1. I suspected this would happen, but the administrator just would not listen.
  2. It's not our fault.
  3. Fat lot of good that Ph.D does me now
  4. I've been waiting here for ages, hoping someone would come along!
  5. Get us out of here before those military drones find out where we're hiding
  6. If you let us all die, Freeman, you'll never get out of here.
  7. If you intend to go on, then, I beg of you, proceed with extreme caution.
  8. The dimensional breach is definitely transmitting organic matter.
  9. I can see you already know a great deal more than any one man is supposed to.
  10. The science team has been tracking your progress with the Black Mesa security system. Unfortunately, so is the military.
  11. With my brains and your brawn, we'd make an excellent team. (Script file's name)
  12. It can't get any worse than this. (In CSS)
  13. The alien species can't possibly all be hostile, can they? (In CSS)
  14. Why didn't they listen? (In CSS)
  15. I never suspected such things could be... (Turned on radio, with morse code)

When the page is first loaded, browser tries to load a file, file name is in, again Base64: RGllLi4ueW91IGFsbCBkaWUuLi55b3UgYWxsIGRpZS4uLg==

Which translates to: 

"Die...you all die...you all die..."

It's an MP4 file without any video layer. It's just audio.

Here's the mediainfo output for it:

General
Complete name                            : RGllLi4ueW91IGFsbCBkaWUuLi55b3UgYWxsIGRpZS4uLg==.mp4
Format                                   : MPEG-4
Format profile                           : Base Media
Codec ID                                 : isom
File size                                : 147 KiB
Duration                                 : 9s 211ms
Overall bit rate mode                    : Constant
Overall bit rate                         : 130 Kbps
Writing application                      : Lavf55.19.104

Audio
ID                                       : 1
Format                                   : AAC
Format/Info                              : Advanced Audio Codec
Format profile                           : LC
Codec ID                                 : 40
Duration                                 : 9s 211ms
Duration_LastFrame                       : -8ms
Bit rate mode                            : Constant
Bit rate                                 : 128 Kbps
Channel(s)                               : 2 channels
Channel(s)_Original                      : 1 channel
Channel positions                        : Front: C
Sampling rate                            : 44.1 KHz
Compression mode                         : Lossy
Stream size                              : 144 KiB (98%)

And it's nothing special. It's just the static noise from the top directory kxbm.net.

Although, it might have hidden audio clues, and that's as far as my knowledge goes, so please, someone else pick it up.

There are reports of this file being an SSTV signal with an image, but it's from 8chan so its authenticity is questionable.

Five things are left on this page:

1) Headcrab ASCII art in console.
Headcrab

2) Clicking any of the top links (menu, set your weather, etc) sends you to base domain, which literally has 10 JavaScript files, 1 jpg (same file from bmfr.us EAS image), a "thumbs.db" file (which shows the page has been accessed locally on a Windows computer), and one mp4 file.

Now the main thing on the page is the mp4 file. It's called background.mp4 and it's 1 minute long. The TV static and deformation effect is dynamically added on the page with JavaScript.

G-Man

There's nothing else to this file, or the page, other than the Gman ASCII art in the console.

[ However, forum user CPU later did some work on the audio track and believed he had found a voice [3] [4]. At the time of writing, this is still unresolved. --Flavrans9 (talk) ]

3) Clicking Thomas' name sends you to localdesertsingles.com, which says the server is overloaded, but once again, it's just another index.html file, which means it's not dynamic. 

What's weird about this page is the console output, which shows Nihilant, and prints one line:
Nihilanth

"Alone...aren't you alone..."

And prints another line every 2000ms (2 seconds) forever:

"...aren't you alone..."

The script that does this is written in-line, and is encoded. I decoded it and it has nothing of value inside.

4) You can click the button on the radio to turn it on, and it will relay a morse code (found by the forums user "CPU"), which translates to:

<SOS> <SOS> <SOS> DE AI5BM AI5BM AI5BM BLACK MESA RESEARCH FACILITY BIODOME LABS. TRAPPED, NEED RESCUE. EVAC ZONE NOT SAFE. MILITARY HOSTILE <AR> K

5) You can click "Contact Us" at the footer, which takes you to http://steampowered.com/.

6) The radio has a comment in the div container. It reads: "Get away from there, Freeman! I'm expecting an important message"

External linksEdit

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.