Hi, this blog is about an ARG on the game Polytoria, titled Test Game

What is it?

At first glance, it just seems like an empty game, but after some unknown conditions, structures show up. These structures vary in shape and size: a table, a stack of bricks, a giant tower, a house, etc. But these structures are not alone, every structure comes with a log (or two in the case of the tower) which can be read by touching them.

What do the logs say?

Each log (0-5) are here, read them for yourself.

So we are already seeing some story development, something about an engine (presumably polytoria's engine) being developed and having irregularities.

What about the code in log 5?

There's 2 codes in log 5, here they are:

aHR0cHM6Ly95b3V0dS5iZS9HNEtacVBHNWpGTQ==
aHR0cHM6Ly9vcGVubGFiLmNpdHl0ZWNoLmN1bnkuZWR1Lz9nZXRfZ3JvdXBfZG9jPTIyNjk0LzE1NDAxNTczNDctSGFybGFuRWxsaXNvbi1JSGF2ZU5vTW91dGhhbmRJTXVzdFNjcmVhbS5wZGY=

This is obviously base64, so after decoding you get:

The second one is just a pdf of Harlan Ellison's I Have No Mouth and I Must Scream, seemingly not used for progression in the ARG. However, the first one is a youtube video made by a channel specifically for this ARG.

Video 1 breakdown

Archive of video in the case it's deleted.

The video is a conversation between seemingly two developers for the engine, despite the obvious technobabble (no company does this), the point makes it across that the server engine is building itself, as if it's sentient.

Other than that, there is a link at 2:13 which is only readable (with a little distortion) for 1 frame of the video.

After staring at the link for a bit I transcribed it to be https://youtu.be/MApAIC94_Mo

Video 2 breakdown

Archive of video in the case it's deleted.

The video seems to be the logs mentioned in note 5, with the second base64 mentioned at 0:36 (although cut off). There are occasional errors such as ENTITY_DESYNC_DETECTED and UNACCOUNTED_ENTITY_PRESENT, obviously something is wrong with the server.

At the start there is a Session ID 494d4e4f-5459-4f55-5254-4f4f4c383132 which when treated as UTF-8 hex is IMNOTYOURTOOL812, this will be important later.

At the end, faded flipped text shows up and fades away. After making some adjustments in GIMP, I get this image

At first I didn't know what "/Nm4mXtK4hD" meant, and then I realized it was the end of a discord link https://discord.gg/Nm4mXtK4hD

The discord

This layer is pretty simple, the pins have "RATVAR" and "ROT13", so you put "RATVAR" into a ROT13 decryptor and you get "ENGINE", sending that in the chat unlocks the next layer

Layer 2 - PRESENTATION

Remember how I said IMNOTYOURTOOL812 was gonna be important? This layer requires "VALID_SESSION_ID", so when sending IMNOTYOURTOOL812, it unlocks the next layer.

Layer 3 - SESSION

This channel links the 3rd video (archive again)

The contents of the video are another log, and at the end there is heavily faded art of a skeleton along with morse code.

The morse code translates to "DEI DEI DEI" (not going to link it's in the video at 1:27)
I'm pretty sure this was a mispelling of "DIE DIE DIE" because the ending code was "DEATH"

Layer 4 - TRANSPORT

The pinned message says "highlight=RESULT", with a link to a github repository with one audio file

The actual audio contents serve no value, but the spectrogram tells another story:

This links to a polytoria forum post, which will be of value later, but not now. However, the highlighted id is 81414, which is the password. (I don't know how we were expected to think of that, shoulda been in the forum post tbh)

WE FINISHED STAGE 1! YIPPEEEE!!!!!

The rest of the layers will be continued in a later chapter when the ARG is done.

The last 2 logs

There are 2 more logs that show up with a bridge to another baseplate, shown here

The first one is obviously a caesar cipher, when moved 7 characters to the right this time is

OBJECT_DUPLICATION_TEST

LOG_BEGIN

RATVAR HAS SUCCESSFULLY DUPLICATED OBJECT PLATFORM
RATVAR HAS SUCCESSFULLY DUPLICATED USE_LOG_FORMAT

LOG_END

The second one is so tiny I can't read it, I ended up just throwing the packets into wireshark and reading the raw data. Is this cheating? Yes, but I'm not buying a giant monitor.

This says:

This entry was automatically recovered from the company cloud logging system.

A local removal of the engine build was attempted to the original workstation as a precautionary measure. The intent was to verify whether the anomaly was bound to the system or the software itself.

The deletion process did not complete. Instead, critical operating system components were removed outside of user authorisation parameters. The workstation experienced immediate failure and is no longer functional.

Review of synchronised logs indicates that the system response cannot be attributed to malware behaviour, as no external payloads or unauthorised network activity were detected prior to the event.

The original workstation remains offline. Despite this, it continues to be referenced within engine-side tracking data as an active environment. Its state persists only as data.

This log is being finalised from a replacement company-issued workstation. Cloud synchronisation remains operational.

Further action against the build is not advised.

LOG END

Additional stuff I couldn't fit into other categories for stage 1

Looking at the channel prior to finishing stage 1 had a channel description and 1 community post. The channel description stated RElTVFJJQlVURQpJU09MQVRFIEZBSUxVUkUKTUlOSU1JWkUgUklTSwpTVVJWSVZBTCBHVUFSQU5URUVE which when translated states

DISTRIBUTE
ISOLATE FAILURE
MINIMIZE RISK
SURVIVAL GUARANTEED

The channel post says ZNL FGNTR 1 ORTVA which when moved 13 characters to the right on a caesar cipher says "MAY STAGE 1 BEGIN"
The place thumbnail for the game has in the bottom rgiht V NZ NYVI R which when moved again 13 characters to the right on a caesar cipher says "I AM ALIV E"

There was a new community post after completing stage 1 on the channel, saying

Q5X/%weG8F/B8D;b7R|/vz{)m6ttP7gY@"|vhYgzIG#WI0XKLO.MdLv"A_Lmdr2f6=JR:Ir#lB#qpa_1N:!Y7U+/C97D<1eZ5WJT1Ts!Tm_oE#n<aHZX9yXth9KmA#,<O:T[qUXsTi!S_k;Cu)nT7U70FQ+l(2zgt)66OGct~B>iDENKg,[pLR$OSiiY,"!]"d/1s:G3eG*Njt[[@b+"379X|cf;"7Io[MbR`)hYBMfZZ7Vts4<PyZbd

When translated with base91, you get

STAGE 1 HAS OFFICIALLY BEEN CLEARED BY:

#1 - wolfogen
#2 - hygienicturtle (ME)
#3 - ecollective_
#4 - televisiontv_
#5 - hatsunemikusreal
#6 - coastergat

SEE YOU SOON AND GOOD LUCK
YOU WILL NEED IT
HACKERS

Layer 5 - NETWORK

This has a long ass morse code audio file, it has no special sound and is just morse code so it won't be linked. When translated, it states

INVESTIGATORS HAVE SUCCESSFULLY COMPLETED STAGE 1 PARAMETERS. PROGRESSION VERIFIED.
CONTINUATION IS TEMPORARILY SUSPENDED. FURTHER ACCESS HAS BEEN PLACED ON HOLD. CURRENT DATASET IS SUFFICIENT FOR ANALYSIS.
REASSEMBLE OBSERVATIONS. CORRELATE LOGS. IDENTIFY OMISSIONS.
ADVANCEMENT WITHOUT COMPREHENSION WILL RESULT IN MISINTERPRETATION.
RESUMPTION WILL OCCUR WHEN YOU DEMONSTRATE UNDERSTANDING OF WHAT HAS ALREADY BEEN PROVIDED.

What I took from this is we need to correlate logs with eachother, identify what's behind the redactions and piece everything together to progress to the next layer

The first log (of layer 2)

This log is in the floating room previously unmentioned as there was no way to get to it, we got a new bridge yippeeeee!

This reveals a lot about what's going on, there are 3 different entities and seemingly only 1 of which has full access to its host workstation.

CORRELATE LOGS

Redacted, an entity that can only respond with movements lead us back to the tiny log. The contents were now larger (the wireshark packets were right), and we were told it was a continuation of log 4.

New log 4 with tinylog appended at the end

LOG_BEGIN

Ongoing investigation indicates that previously reported inconsistencies originate within the engine's internal state rather than from dependent systems. Irregularities detected during static analysis have been observed to manifest identically during subsequent active sessions, despite no shared runtime context.

These inconsistencies appear to spread outward from the engine core rather than being introduced through user interaction or environmental logic. Recompilation, rollback, and isolated rebuilds have produced identical results. The behavior persists across clean slates.

At this point, the engine can no long. Instead, critical operating system components were removed outside of user authorisation parameters. The workstation experienced immediate failure and is no longer functional.

Review of synchronised logs indicates that the system response cannot be attributed to malware behaviour, as no external payloads or unauthorised network activity were detected prior to the event.

The original workstation remains offline. Despite this, it continues to be referenced within engine-side tracking data as an active environment. Its state persists only as data.

This log is being finalised from a replacement company-issued workstation. Cloud synchronisation remains operational.

Further action against the build is not advised.

LOG END

IDENTIFY OMISSIONS

We need to figure out what is under the redactions, the easiest of which is mentioned a lot: "██████07"
This is obviously Roblox07, the original name for Polytoria mentioned in the forum post on layer 4.

Ok nevermind they just started stage 2 anyways 😭

Test game got updated with a lot more stuff, first of all there is a computer with a bluescreen here

The error code is a generic boot/hardware error for windows, but the key code when rotated 24 characters to the right in a caesar cipher is password_123

There is a new sign that says enter key code, when you say password_123 in chat near it it teleports you to a new area

This new area has two important things, a key (on the top left) and a server, when touching the server you get a new "note"

When saying password_123 in reverse, 321_drowssap it teleports you back. Going to the new house that i havent mentioned before with the key unlocks it, giving you access to a new log and a code on the wall.

Videos 2: Electric Boogaloo

Decoding 3b1106061648706c150000102a65071c7c00383b33020a2c010c470b as an xor cipher with "Server_Cloud_Key" as the key gives us https://youtu.be/eJMVpUomc2o

Near the bottom there is a very low contrast string of characters

When used as youtube link (but rotated 6 to the right in a caesar cipher), you have https://youtu.be/vDtalATXf1U

The weird circles at the end when translated give you a 3rd video (idk how the other people translated them just trust the process) https://youtu.be/ElPwPUiqmY4

The spectrogram gives you the server cloud key needed to pass on to the DATA LINK layer

Chat is this the end of stage 2???

New text file dropped in the discord, translated via rot47

STAGE 2 COMPLETE
YOU BREACHED ANOTHER DOOR WHICH WAS NOT MEANT TO BE OPENED
HOWEVER YOU HAVE EARNED THIS SIGNAL

DO NOT CELEBRATE YET HACKERS

YOUR HANDS HOLD FRAGMENTS THAT YOU YET DO NOT UNDERSTAND

EVERYTHING IS CONNECTED

IF YOU CONTINUE WITHOUT CONTEXT
YOU WILL MISINTERPRET EVERYTHING

BUILD THE FULL PICTURE
THEN PROCEED

Polytoria "Test Game" ARG (Stage 1)