This ARG Hub has been archived and locked to preserve historical integrity. Go back to the Main Dashboard

Investigation History

From Portal 2 ARG Wiki - Valve ARG Network

Jump to: navigation, search


This page is an attempt to document what was discovered when, and how one clue led to another (at least within the community that's using this wiki). You can also go here for a complete in depth history up until April 11th.

If you were around for the discovery of any of the clues, please help fill in this page with info on what happened and how, keeping it concise but detailed!

A rough timeline of the ARG solution


April 1

The Potato Sack, a collection of thirteen indie games, was released on Steam by Valve. An IRC channel and this wiki was created by forum members at SPUF and FacePunch soon after the #PotatoFoolsDay updates were released. Updates to the 13 games included a plethora of odd references and media related to potatoes.

April 2

Several strange symbols are seen in the games of the updated packs. See the history of the glyphs page for more information.

April 3

Super Meat Boy glyph, pointing to Audiosurf.

Super Meat Boy's glyph on its Super Meat World level browser screen, recognized as Mono from Audiosurf, leads to playing various tracks from the Meat Boy soundtrack in Audiosurf. The song "... And Potatoes" was played from the Super Meat Boy soundtrack, with surprisingly "no abnormalities" (however, it is generally agreed upon that this track is unrelated to the ARG, as the song was released some time ago).

April 4

Coordinates in Braille, located in Toki Tori's third secret level, were found to lead to the Amersfoot headquarters of the game's developer, Two Tribes. Upon visiting this location, Jake_R found text and a glyph stuck to a pole (as well as actual potatoes around the area).

In Audiosurf, it's discovered that playing a specific track from the Super Meat Boy soundtrack, The Battle of Lil' Slugger, displays a giant potato when near completion. When the track is played perfectly, a glyph appears, pointing at RUSH, starting another link in the Glyph chain.

April 5

A new promotional video for Portal 2, Aperture Science Investment Opportunity #3: Turrets, appears on Valve's YouTube channel. Sneakily disguised as noise in a scene transition, two frames contain information about the ARG.

Frame one.
Frame two.

The equation in the first frame points to the 16 letter/glyph pairs, along with 13 cyphers.

Around 22:30, Sandy's Blog was found - "Sandy May Or May Not Be Fictional", a phrase found in Kick It's secret potato level (first thought to be a cypher). Notably, Sandy talks about actually entering some chat channel and it being overwhelming - there are multiple places where she seems to reference player activity.

Sandy mentions in one post that her friend Steve sent her "like fifteen links" that all used a link-shortener. At 23:10, someone industrious in the #valvearg2 channel started plugging some of the nonsense phrases into and found the first AaAaAA!!! video from Steve as well as his YouTube profile.

Around 23:17, CrimeFlyerIntimidator's TinyURL (phrase hidden in TWEOTW) was found to be the break-in video that Sandy referenced on her blog, posted by YouTube user HubertUberson. The break-in video provides a new glyph pointing to Super Meat Boy.

It was also discovered that "ProcyProxyManatee" (one of the other hidden phrases, found in AaAaAA!!!) was a valid TinyURL, and that watching that video provided "ProcyProxyCricket" which was also a valid video. This led to a chain of related videos which either sent us to more videos and provided us with more letter grids. Sandy's blog also mentioned a Twitter account. This was quickly found to be Hubert's account, from the YouTube account name, which also led to his brother Rube Uberson through Hubert's Twitter followers.

From the various prose and clues we had so far, it appeared that Rube has been kidnapped or is otherwise missing. Rube's final tweet "Oil you above eyes. So, be bossy! A hobo yam?" is another 16-consonant phrase!

The letter grids in the ProcyProxy videos from Steve were overlaid to create another 16-consonant phrase, "Lo-fi wave tossed! It is a sad hoop game." At 23:42, another glyph, was linked incorrectly on Steve's YouTube profile, which suggests pointing at Toki Tori. He mentions it being next to the letter V and mentions the number 6: "They draw it next to a bunch of V's but maybe they're trying to draw an anarchy symbol and they're just stupid. Anyone know what this thing is? I see it like six times on my morning commute, which isn't that long".

April 6

At around 04:10, Sandy posted to her blog, further addressing the players as well as mentioning that she had received an e-mail from someone (possibly a player).

A few hours later, at 09:20 every post on Sandy's blog was deleted. Twitter Status updates on Hubert's Twitter account from Sandy soon followed, one of which confirming these deletions were part of the ARG. Tweets apparently from Hubert resumed just five minutes later but are perfectly spelled and thought to be highly suspicious. Three tweets then came from the account giving a code consisting of interlaced letters and numbers. When the tweets were combined they translate to "?meht yrram uoy t'nod yhw ,hcum os meht ekil uoy fI .srebmun tsuj era esehT" (Or "These are just numbers. If you like them so much, why don't you marry them?" in reverse).

Nearly four hours after this, at 13.48, Beta Codes for updates for some Potato Sack games began surfacing. However, the ability to use these betas was sporadic, hinting that we - at least right now - shouldn't be needing to access them.


April 7

The proper letter for every glyph.

Through editing of Cogs Beta game files, at 02:00 the seemingly impossible (with the information at hand) was solved. Upon completion, it leads to an Aperture Science login page. An hour later, the page was taken down and replaced with a image of potatoes. This is thought to be because we "got ahead of ourselves and Valve", as the Cogs puzzle was essentially cheated through.

Team Meat, via their Twitter account gave the code "7fa6ce99d281" posing it as a code for an activation of Super Meat Boy. However, upon being asked if it's to do with the ARG, they replied with "im just glad it got into the right hands".

At 11:35, five new Killing Floor achievements were released, containing an encoded message. By 14:00 the message was decoded through the use of an Enigma cypher with the the letters H, E and X (hinted from the achievement titles) as keys. The message produced was ONGRATULATIONS YOU FOUND THE MESSAGE OOD JOB PUZZLE HUNTER ERE IS YOUR CLUE IXTEEN AND FOUR IS THE WAY ESSAGE TRANSMISSION COMPLETE. Combining the letters associated with the glyphs used as achievement icons (C, G, H, S and M when in order) we obtained a new message and learned that the letter for the Audiosurf letter is M.

An example of a Login screen, found in Toki Tori.
The release of the Killing Floor achievements were quickly followed by the release of one BIT.TRIP BEAT achievement, titled LONG.FALL. The icon greatly resembles the Dejobaan developer's logo.

All Potato Sack games got an update at 14:20, many of which resembling the Steam Launch Parameter Betas found the previous day. Defense Grid's update revealed a video which shows Jake_R climbing the pole when he discovered the Toki Tori Glyph. The surveillance video included a glyph string on the side of a passing truck. Letters matched to glyphs, it read FLP NTL TH DTS MTCH or Flip Until The Dots Match if vowels are inserted.

A new item is introduced to Team Fortress 2: the Resurrection Associate Pin. In addition, a mysterious Potato Badge appears on the profiles of those that receive the item. Aperture Science Login Screens start to be noticed in some of the Potato games. They appear in the Steam Overlay once a player of a game has completed an unmentioned task.

ARG player and lead editor of, HecticGlenn, receives an email from Gabe Newell containing an image titled "berrets or scoop". The image contains some 20-odd numbers. Joystiq also reports receiving a similar, but different image.

The numbers appear to be ASCII numbers XORed with 0xFF. Despite still waiting for the final image to emerge, a translation of the numbers in the images has been made, giving the result shown in the Emails from Gabe Newell page.

"Flip Until The Dots Match" was sussed to be the various sets of four lights across one of the new Toki Tori levels from the 7th April update. When flipped correctly, a QR code is made. The QR code linked to a zip file with 3 images inside.

April 8

Current state of the Gabe Bathysphere Puzzle

Hubert's Paper Flower, found earlier on his Twitter account, was decoded using Morse to reveal the phrase THERE CERTATAINLY SEEMS TO BE HHYYRV A LOT OF MORSE GOING ON LATELY.

HHYYRV was used in URL shorteners to arrive at - a google news page with the words Bilty's not here, man which rearranged spells Bitly shorten name. This led to which goes to a password-protected ZIP file from Razer. The ZIP file is named Roughly two hours later Jake_R arrives in IRC to tell the players he has received an OGG audio file via E-mail from a YouTube user named everythingisfinehere (with the return email The file is a heavily distorted version of "The Wedding March". everythingisfinehere references the latest Sandy blog post. Spectrogram analysis of the file yielded the message WhyMustThereBeSiblingRivalry (referencing the Uberson brothers). This turned out to be the password to the containing the MP3 file Searching. Emergence. Discovery.mp3.

Meanwhile, a TWEOTW secret level filled with colorless crates was found. To get into the level, hold Shift + I while entering Word Forge (hold down through the Loading screen until the level actually appears).

Hube and Sandy were both "acting strangely", while Rube seemed to have escaped. In their fiction, Hube was doing something odd in the warehouse, assumedly the secret TWEOTW level. Mikaxsus later received an e-mail () from the same address as Jake_R. Soon after a third E-mail was received by chrisrandazzo.

Playing Searching. Emergence. Discovery.mp3 in Kick It brought up Kick It's Aperture Science Login.

The Defense Grid Flower Puzzle was solved and it led to a new "folder" in their console, jsharman.

everythingisfinehere cropped up again as the Google Profile and linked Picasa album of the account is uncovered by mynameismonkey. This led to a discovery of a Picasa album containing a profile picture with a chat session encoded on it revealing the correct way to enter the secret level on TWEOTW, leading to another Aperture Science login page. The only three logins remaining to be found are Amnesia, Defense Grid and RUSH.

An update to Amnesia hit, before the previous update's puzzle could be started on. On the Frictional Forum, a fictional (confirmed canon) story is unfolding involving someone named Harold (HELPr) and his escape from Razer's lab.

The File:Cave.mp3 is finally found, in the new level in TWEOTW. After the ARG, Ichiro stated that the real name of the song is "Hole in the Ground".

Killing Floor continues to send out irritated messages about how little attention we're paying it, after it gave away its glyph, cypher and Aperture Science login.

Hidden Path, a much nicer company, invited ARG-players to their office for clues on their mosaic puzzle. What they got was legoes. Through these legoes and fancy imaging, they got the pass "NoCake" from this. Entering NoCake into the console gave a hex code. Decoded, it gave a pass for the jsharman folder. There was a small puzzle game inside, and winning it gave Defense Grid's Aperture Science Login.

Kotaku - in true Kotaku fashion - published the last piece of the bathysphere, several hours after the other sites. The Inverse-ASCII message seems to imply Portal will get an early release.

Some Wiki users and IRC clientèle receive strange emails from the gmail user "everythingisfinehere".

April 9

Very late at night, Amnesia's Omen was finally cracked, leading to a cryptic tale that pertains to RUSH.

Defense Grid started a "recruitment" drive for players. Upon running id_scan, a character is randomly generated, then running sign_up, players were be told what the current two criteria were (out of a rather large pool). The community was required to find players that matched the current requirements and have them sign up. Upon doing so, the player who signed up would receive a trivia question to answer. Upon answering it, the player would be "Recruited".

"everythingisfinehere" continues to send emails to people, with cryptic pictures attached. They've yet to give any useful information. Sandy managed to make a blog post and tweet saying she was being held captive and severely injured, but they were quickly deleted by "Hube" who apparently broke her leg.

The Blue Text puzzle in Amnesia is solved, and it led to a password for the first much-debated encrypted rar. It in turn has led to a pass for the second, which led to the third.

Toki Tori's psuedo-code puzzle is solved, leading to the words "Movable Panels". RUSH's level code puzzle is solved (without help from the Omen) , leading to the words "Rail Rider".

The bathysphere's real location was determined, but when we sent operatives there, it was clue-free.

Suddenly, it was discovered that we did in fact have passwords for the Aperture Science login pages. AaAaAA!!!'s password was "long fall," which was a phrase we'd had for days from bit.trip's achievement. When entered, the Aperture Science screen gives you a small congrats and a DLC for AaAaAA!!! is downloaded. The DLC was an encrypted zip file.

In short order many more logins were cracked using clues from other games. Audiosurf's was "rail rider," from RUSH. Killing Floor's was "failed experiments" a string found in Audiosurf after playing AdFurious.mp3 from Bit.Trip. TWEOTW's was "every piece," from morse code found in Cogs. Cogs' was "movable panels," from Toki Tori's psuedo-code puzzle. Toki Tori's is "bird eggs," which we got from Team Meat's Curious Tweets. SMB's was correctly guessed to be "death traps," but it turns out this was a clue in The Ball nobody wrote down. RUSH's was "conveyer belts," which came from Amnesia's Unexpected Omen (we don't yet know the legit way to GET to the login). Defense Grid's was "deadly lasers," which is from a Razer message, which counts as being from Kick It. Bit.Trip's was "chips challenge," which came from TWEOTW. The Ball's was guessed to be "weighted companion". While clever, we now knew the reward to a puzzle we hadn't solved yet.

Each encrypted zip had a hint for its password in its file name. No zip took more than 10 minutes to crack. Inside each one were three pieces of Portal 2 concept art, and a piece of another zip. These zip files had no file type and a name consisting only of a single letter. Their password was determined to be "collaboration" but without all 13 pieces of the archive all the files could not be extracted. Some of the concept arts had pictures of Seattle hidden inside them. The hidden pictures were obtained by using Alpha Channel. The locations of these pictures were plotted on a Google Map (Link).

IRC user "Joelpt" and his girlfriend headed to some of the various Seattle Locations that were hidden in the pictures. Although the spots in which the picture took place were found, there was no further evidence to lead us in a new direction in our investigation.

The Defense Grid recruitment drive ended with 100 "participants" which went into "processing". A live stream of DG recruitment was provided by IRC user "Lattyware".

April 10

The Amnesia The Dark Descent 3rd password is solved "endoftheline"; .rar file 4 contains an image that contains what appears to be a RUSH map. Putting tiles down as given accesses the RUSH Aperture Science login page.

All passwords and login pages are discovered, allowing for all DLC archives to be downloaded, and the final secret archive to be pieced together from the 13 parts hiding in each DLC archive. Each of the 13 files has a single letter name as mentioned; when combined, we get the name "CONNECTDADOTS".

Egged on by Hidden Path, those looking at the Defense Grid solution discovered that the 13 cyphers could be envisioned as letters when placed in 4x4 grids and ignoring the "S" small dot glyph (see Glyph squares). In order, these give the word "collaboration", the password on the grouped single letter archive files. This, however, is still under discussion.

All 83 images from all archives are now available for analysis. As mentioned some of these images have pictures of locations in Seattle encoded in the alpha channel; connecting the locations on a map as instructed seems to spell the word "PRELUDE" (See Map Locations).

It has been discovered that each glyph represents a 2x2 black/white image. Substituting the gylphs for these images in the glyph squares now clearly shows the word "collaboration".

April 11

The day started slowly with a common belief that all problems had been solved. However, Tentacle Beasties were sighted in AaAaAA!! It is assumed they will lead to the Aperture Science login password of The Ball, 'weighted companion', but the search was fruitless. As the day progressed the chat grew louder and the crowd grew restless, leading one player to faithfully the scene from the table top Zombies! game that proved once and for all what FakeHubert could see through the window.

As patience grew thin, many users received an email from everythingisfinehere stating that "You have earned a rest", and to "relax for a few days", followed by a mysterious unique number counting down from 99,999. Speculation abounds that the game is on a time-out pending the completion of the DG recruitment process. Moreover, while several players had been tracking the location of everythingisfinehere one user made public the IP address of the computer being used by FakeHubert leading to speculation that Dejobaan computers had been compromised in Boston. The second installment of the comic was released, and a hungry crowd devoured it for clues, to no avail.


April 12

Dejobaan struggled to release spurts of information regarding some form of cyber-attack. A new Portal 2 trailer was released: - the sequence of numbers seen in this video has been decoded. These frames were followed by three frames which may or may not be meaningless.

Updates were released for all of the Potato Sack games, containing spurious code allegedly inserted by a malicious entity. All updates are strongly Portal-themed. Social media from the developers claim they are crying for help against this attack by an external entity. New login screens and profile potatoes began to appear. Successfully reaching the login screens give sound bites from GLaDOS pointing to more locations around Seattle. A few additions (such as one from The Ball point to additional puzzles to be solved.

April 13

Work continues to discover all login screens and sound bites. Several games have two such bites to be found.

Around 11:00 PDT , several players of the ARG find the Steam or Wiki pages altered, and some later even "disappear" from the game, leaving with the message "There's a hole in the sky... through which I can fly". The Wiki itself appears to be under attack by an outside force...

At 2:00 PDT a video was posted on LLLLongJumper's Channel. Information about the video are being posted here. Using this hint from Steve, user HatsALEsman identifies the correct password to the AaAaAA!!! login screen. Throughout the night, Steve became heavily drunk, frustrated that he could not access the ATM (which, from his YouTube video, appears to be the AaAaAA!!! login screen). What happened to him afterward is unknown.

Ichiro of Dejobaan Games went missing. The author of this blog received a message from Ichiro, with one code saying "help me" and another linking to information about potato blight. He also encountered Steve breaking into his office to try and access his bank's website. Later updates became stranger and he began to write like the infected users, posted images from TWEOTW and AaAaAA! concluding with "everything is fine."

April 14

All Aperture Science Login Screens and Audio Clues are discovered and linked to Seattle locations. Connecting these points gives the word "nelipot", which is the name of a Steam group. Joining this group adds another potato to your profile. Users with all 35 potatos get a Golden Potato as a reward.

The Nelipot group is administered by a user named Dinosaur. His screenshots appear in thumbnails to be images from the original Portal demo, but when viewed are actually Portal 2 screenshots. In the background of each shot is a pattern of tiles, which can be assembled into a QR code, leading to this page with a countdown to April 15th.


April 15

At precisely 9:00 AM PST, the countdown ends to reveal this charming message, presumably GLaDOS. It then redirects to the distributed computational grid status, revealing a countdown to Tuesday, April 19 (the current Portal 2 launch day) and progress bars for all of the games in the Potato Sack, as well as a total potato counter. The progress bars were determined to represent in-game hours, meaning that the more people play Potato Sack games, the more likely Portal 2 releases earlier.

April 16

By the end of the day, over 50% of the 'reboot' was completed. Also, Doug pointed out a cryptic file, with the password 'hurricane', that seems to hint at the Borealis, possibly linking the ARG to the Half Life Universe.

April 17

By the end of the day, over 75% of the reboot was completed, and users, thanks to the help of Valve employees, began to understand how the countdown was working.

April 18

Countdown finished. Portal 2 released.

Ryukaki finds a link to another trailer clip behind a boxcar in the Super 8 trailer...detailed investigation here: Super8

Personal tools
Misc. Tools