All That’s LeftTo Do is Extract

Written by Ivan Wang, Alex Irpan, and Rachel Wei

Answer: MIGRATE

We are presented with a series of pre-solved clues and a request for help to extract. Though it’s hard to glean much from this data, one common extraction method is taking the first letters1; doing so gives us the phrase ERRATA TIME.

This puzzle suspiciously unlocks with three errata. Unlike most times rendered on the site, we might note that the errata times are rendered in GMT, and thus are the same across any time zone. The times are also at exact increments of 15 minutes. By looking at the times on a clock, and taking the hour and minute hands as flag semaphore2, we can extract the letters FAQ.

This hints us to look at the FAQ page of the website. Using the first errata message, we can search for the sixth section of the penultimate link on the page-- this leads us to a page titled Have You Tried, which lists common steps to take when you’re stuck on a puzzle. In the sixth section, If all else fails…, we can find the contents of the latter two errata.

Taking a look at the errata, we might note that South Atlantic Treaty can be corrected to North Atlantic Treaty, or NATO, while “a crossword boundaries” might be a typo of “across word boundaries.” This hints that we should be looking for letters of the NATO alphabet across word boundaries3. Performing this extraction step gives us a new clue phrase, UNZIP TEAM PIC.

We should now proceed to our team page and upload a team pic, if we have not yet done so! By downloading the profile picture we uploaded, renaming it to the .zip extension, and unzipping it (either via Windows GUI, command-line or a suggested online utility website in the Have You Tried page, extract.me), we can find a top secret folder with a file named donotread.txt.

Inside this file is a message with a suspicious number of hyphens and periods. Treating this as Morse4, another common extraction encoding, we can extract the message FIND BUTTERFLIES.

The search for butterflies on the website eventually takes us to the Story page, where keen observers might see butterflies across a number of story cards. These butterflies are drawn with dots and lines inside their wings. Yet another extraction method, Pigpen5, is the encoding of choice, giving us KONAMI CODE.

The Konami Code is a classic cheat code found in many old Konami video games (and included as an Easter egg in many later ones). Typing the sequence of inputs (up, up, down, down, left, right, left, right, B, A) brings up the Playmate with a single game: Tateroids NaNo. This is a reference to an interactive game from last year’s hunt which involved counting asteroids.

For this version, asteroids with math questions fly across the screen. After solving the equations, we must pull out another puzzle encoding: atomic numbers6 (clued by the capitalization of Na and No as well as the suggestive range of the numbers).

The element symbols in order of appearance read FlYEr TeN CHAr WDs, or “flyer ten char(acter) w(or)ds.” The next place to search is the login or registration flyer, also seen on the very first story image (which suggests to us we should log out and ”register” for the hunt). The flyer is decorated with a number of words around the border, but exactly ten of them are ten characters long. From this ten-by-ten grid, we can diagonalize7 to find the phrase SEE FAVICON.

The favicon of the website is a 16x16 pixel image of a carnival. After downloading and blowing it up in an image viewer or editor, we should notice tiny pixels darker than the surrounding background. Reading them as Braille8 is the next step, netting us the clue phrase SHIFT RESET PW TOKEN. (Our website actually has four different favicons - one for the first round, one each for Matt and Emma’s rounds, and one for the final meta. All four of these icons have the same hidden Braille message.)

We can reset our password by going to the “Forgot password” section of the login flyer and entering our team username. We should receive an email that gives us a link with a token to reset our password. By applying a Caesar shift9 to the token, we can see the words SUBMIT RED HERRING at the start of the shifted letters.

Taking this to the puzzle’s submission box, we are given one final message suggesting a number of animals other than red herrings. Looking at each animal (including HERRING), we might notice that each contains a double letter10. These letters form a final clue phrase: REDO STEPS ONE PER ORIG CLUE.

We can now revisit the puzzle page and the original clues we were told to extract from! It turns out that each clue can extract a single letter by applying one of the unique steps we took through our journey. While there are some ambiguities (multiple ten letter words to diagonalize, multiple clues with numbers, multiple clues with a first letter), we can deduce through some process of elimination which extraction method applies to which clue.11 This awards us with ANS MIGRATE, cluing the final answer to this puzzle and referencing the long journey we took to get there.

Author's Notes

This puzzle was inspired by “Over 9,000: an Abbreviated Yet Awesome Tour Of Your First Equally Excellent Puzzle Mechanic” from the 2021 Mystery Hunt, as well as “Puzzle Not Found” from last year’s Teammate Hunt. A major design choice of the puzzle was to hide puzzle content in “plain sight”-- in fact, the profile picture zip files, the first story art butterfly, the Konami code Playmate (without the numbers), the flyer words, the favicon Braille, and the reset password tokens were all available as soon as our site went public for signups. Judging by the number of teams that submitted RED HERRING to this puzzle before doing anything else, several people managed to find them ahead of time, which we were very happy to see!

As a secondary aim of the puzzle, we also hoped to provide a useful “Have You Tried” page for puzzlers to replace the somewhat dated and MIT-specific guide typically linked in puzzlehunt FAQs. We hope that this page (barring the last section) was useful, especially for later stages of extraction in this puzzle!

One of the biggest technical issues came with encoding a user-uploaded PNG or JPG image as a valid zip file. While it’s fairly straightforward to concatenate bytes, it turned out that while Windows and Linux support unzipping this directly, the default Mac GUI rejects such inputs. As a failsafe, we had to include the thematically-titled extract.me website in the “Have You Tried” page12.

Alex: I've once heard someone from Galactic Puzzle Hunt joke that their lasting legacy is every hunt copying their FAQ. I'd like to think Teammate Hunt's legacy will be forever ruining solver's expectations about where puzzle content may be hiding. Have fun trying the Konami Code on every hunt until the end of time!

Appendix 1: First letters

ClueLetter
Essential fatty acidE
Romans 7:21R
Richmond SixteenR
Aide-de-campA
TNTT
Apollo 7A
TerrariumT
InterpunctI
MusicalityM
ExtravaganzaE

Appendix 2: Errata times

TimestampFlag SemaphoreLetter
6:15 GMTF
7:30 GMTA
1:45 GMTQ

Appendix 3: NATO letters across word boundaries

Have You Tried...NATO letterLetter
… looking at bus or train maps, like the Boston T, London Tube, or San Francisco Muni?
forming letters…
UNIFORMU
… taking a break from the hunt and taking another look in November?NOVEMBERN
… reading The Art of War by Sun Tzu?
lucking out…
ZULUZ
… checking social media sites, like Facebook, Twitter, Tinder, or LinkedIn?
diagonalizing…
INDIAI
… figuring out how to flip a palindrome?PAPAP
… looking for references to famous people, mythology, fictional characters, Greek gods, or Satan?
going to…
TANGOT
… reading words as a different part of speech, or in a different accent?ECHOE
… looking for a specific country, state, or capital?
fact-checking…
ALFAA
… folding 1000 origami keepsakes for good luck?MIKEM
… taking a break and going to the spa?
paying attention…
PAPAP
… searching for clues in dialogues, scripts, and song lyrics?INDIAI
… reading some Charlie Brown?CHARLIEC

Appendix 4: Morse

LineMorseLetter
..h-hello...-.F
is anybody there....I
can some-one hear me.-.N
this team-photo you uploaded..-..D
is that y-you...-...B
..is this your self-image..-U
listen--T
this hunt is booby-trapped-T
i cant escape..E
im fading. this will be short-lived..-.R
..im encoding this e-message now...-.F
its up to you. de-code it before its too late...-..L
i believe in you....I
your teammate..E
good luck......S

Appendix 5: Butterflies

The dark pink outlines on the wings and presence of dots encode Pigpen. Note that a fully enclosed wing represents the center square letter, even though the wing is not rectangular.

Appendix 6: Equations and Atomic Numbers

EquationAnswer / Atomic No.Element
57 × 2114Fl
42 - 339Y
4 × 1768Er
24 + 2852Te
4² - 3²7N
log₂(64)6C
i⁴1H
90 ÷ 518Ar
81 - 774W
10 × 11110Ds

Appendix 7: Registration Flyer

This flyer can be accessed by clicking the Login or Register link in the navbar while signed out.

There are exactly 10 words in the flyer that are length 10. By writing them down from the top (going clockwise from SUMMERTIME FUN) and reading down the diagonal, we can extract:

SUMMERTIME
RECREATION
SPECTACLES
PERFORMING
CHARACTERS
VAUDEVILLE
MYSTERIOUS
THEATRICAL
DIVINATION
ATTRACTION

Appendix 8: Braille

Each of the four favicons (light, Matt, Emma, and finale) is encoded with the same message. When zoomed in at a high resolution, the Braille can be parsed as darker dots read left-to-right, top-to-bottom.

Appendix 9: Reset password tokens

Upon requesting a password submit, we would receive an email of the format:

A request was made to reset the password for [team name]. Please click the link below to reset your password:

https://teammatehunt.com/reset_password?token=YaHsOzxkJnKXXOtm_TkOknZhhOOJU5NogzbQ-bA&username=[team name]

Sincerely,
teammate

Each token is randomly cased and Caesar shifted between 1-25 letters. In this example, the token should be Caesar shifted by 20.

YaHsOzxkJnKXXOtm_TkOknZhhOOJU5NogzbQ-bA
SuBmItreDhERRIng_NeIehTbbIIDO5HiatvK-vU

Appendix 10: Double letters

Note that the double letters also includes the initial submission, HERRING.

AnimalDouble letter
HERRINGR
DEERE
TEDDYD
MOOSEO
OPOSSUMS
CATTLET
REINDEERE
HIPPOP
FOSSILS
KANGAROOO
BUNNYN
CHIMPANZEEE
PUPPYP
SHEEPE
FERRETR
BABOONO
SQUIRRELR
SHIITAKEI
EGGSG
BROCCOLIC
ALLIGATORL
EQUUSU
MANATEEE

Appendix 11: Final extract

ClueExtraction stepLetterExplanation
Essential fatty acidNATO across word boundariesAEssential fatty acid
Romans 7:21Time SemaphoreN
Richmond Sixteen*Atomic number / element symbolS16 (S)
Aide-de-campMorseM--
TNTCaesar shiftIshift TNT to EYE and read as the letter I
Apollo 7PigpenGAs drawn on the original image. (Fun fact: Apollo is a type of butterfly.)
TerrariumDouble lettersRTERRARIUM
InterpunctBrailleAInterpunct is a single dot ( · ) which is A in Braille
MusicalityDiagonalizeTTake the 9th letter since it's in the 9th position
ExtravaganzaFirst letterEBy process of elimination, this one must be first letter

* Note: at the beginning of hunt, this clue read "Russian four square" to hint at the math done during Tateroids. Unfortunately, this led to ambiguities due to "square" being a valid Pigpen encoding.

While we had originally planned to use the time 4:45 (S) for additional errata (leaving the cluephrase "FAQS" relatively unchanged), we decided against displaying the erratum on the site in case it negatively affected the NATO solve step.

Appendix 12: The gory details on how UNZIP TEAM PIC worked

(Alternate title: Alex rants about file formats because there is no one else to rant to.)

Why does appending a ZIP file to an arbitrary PNG or JPEG image work? It has to do with file headers.

At a high level, file headers are a special sequence of bytes that represent metadata about how the rest of the file should be displayed. Display programs read these headers to parse the rest of their content. Most file formats like JPEGs and PNGs have these at the start of the file.

For historical reasons, the ZIP format has its header at the end of the file. A central directory at the end of the ZIP file is made of multiple file entries, that each point forward to a local file header.

According to the ZIP file spec, you can have arbitrary bytes between each file, as long as the central directory and local file headers are consistent. So if you concatenate an image in front of a ZIP file, image readers will read the start of the file, see it's an image, and stop reading before the ZIP content. And ZIP file readers will start from the end, see it's a ZIP file, read the ZIP data, and ignore all the extra image data. Success!

...Or at least, that's the theory. There is a difference between the file format as stated, and the implementation of the file reader.

  • The unzip command line tool (on all operating systems) scans forward from the start of the file, extracting all local file headers it finds along the way, then verifies this lines up with the central directory it sees at the end. This works if you naively concat the image and ZIP together.
  • The built-in archive extractor on Windows will read the central directory first, then the rest of the ZIP if that's valid. Parts of the central directory file header contain the offset relative to the start of the file, and the original offset is no longer valid after we prepend image data to the ZIP. (Evidently, unzip just doesn't care.) To make the Windows unarchiver happy, we manually bit-hacked this part of the ZIP file header in our payload before appending it to the image.
  • Finally, the Mac OS unarchiver uses ditto under the hood. After some reverse engineering, we believe that ditto works identically to unzip by scanning forward - except, if the file does not start with a ZIP local file header, it assumes it is malformed and refuses to extract it. This extra check is not part of the ZIP file spec, and unfortunately makes it impossible to hide the ZIP file in the image data - we can't make the file both start with the PNG/JPEG file header, and a ZIP local file header.

This last issue is why we needed a pointer to extract.me as a fallback. We explored some alternatives like the RAR file format, but it worked less reliably than ZIP if we used any unrar tool besides command line.