Every year at ShmooCon, one of the handful of official events is a puzzle contest. Traditionally this has been a "badge contest", where most of the clues come from the conference badges, but at the past two cons there has been a website with all of the puzzles, a leaderboard, and a much broader range of puzzle genres.

This year, the first year Decipher has gone as a group to ShmooCon, we won this contest! To celebrate, with the permission of the organizers ("Team Flowers By Irene", who had won the contest every year for the previous four cons), we present a description of our solutions to each genuine puzzle.

First, the cycling-themed ShmooCon program contained links to http://tourdeshmoo.shmoocon.org, http://twitter.com/ShmooConPuzzle, and an explanation of how the contest works. When you arrived at the site, you would see this bike path, and each node was clickable to retrieve a leg of the contest.

Of course we didn't arrive at the site the first time to discover that we were winning, but you get the idea.

Many of the legs involved just a bit of manual labor, like the one pictured above which required us to build a tower from the items in our bag. I'm going to skip those legs in this post. I'm pretty sure you could figure out how to make a tower of swag at a conference.

Here are each of the puzzles, in the order we solved (got credit for solving) them, plus any hints that were announced (and when they were announced). We were also told that the organizers had EE backgrounds, and that puzzle names and icons on the map were hints. If you don't want to know how we did it, just stay above the ####s in each case.

Snail - Solved 4:15PM Friday

######################################

######################################

######################################

We solved this one during the single-track talks on the first day. We recognized that this is a kind of barcode typically used to encode postal codes on letters. Using the chart on Wikipedia, we were able to mostly decode the numbers 20009, which was the zip code for the Washington Hilton, the venue for the conference. We figured it was just slightly corrupted and didn't bother to figure out what was wrong. It was revealed later that we could have read a bit further and used the check digit to recover the corrupted bit, but 20009 was indeed the answer.

Flip out - Solved 4:17PM on Friday

88777077773388999077776777802663022255533 88833777066666908335555550633094428099933 27770844330333444777777780899806777740927 7770777733668

@ShmooConPuzzle hints:

8:18PM Fri: Some bricks have numbers!

7:09AM Sat: When solving Flip Out do not cell yourself short. Press on and call it like you see it.

9:36AM Sat: How is Flip Out going? A lot of teams stuck there it seems. How many different digits do you see? Press 0 for assistance.

######################################

######################################

######################################

And the answer is... They're numbers from a phone keypad. This was also solved in the single-track of talks on Friday. If you translate each of the numbers into the possible letters it represents, you can work out the message:

"UR pretty smrt and clever now tell me what year the first txt msg was sent"

1992.

Codename - Solved 6:10PM Friday

@ShmooConPuzzle hints:

12:29PM Sat: Codename: The picture looks similar to one you have seen, are they DIFFerent?

######################################

######################################

######################################

This was a bit more puzzling. The image is a slightly corrupted version of the banner image at shmoocon.org this year. At the very end of this version, there is actually some ASCII data, visible by simply dumping the image into a text editor, that reads

-.. --- - -.. --- - -.. .- ... .... / -.. --- - -.. --- - -.. .- ... .... / -.. .- ... .... -.. --- - -.. --- - / -.. .- ... .... -.. --- - -.. --- - / -.. --- - -.. .- ... .... -.. --- - -.. --- - / -.. --- - -.. .- ... .... -.. --- - / -.. --- - -.. .- ... .... -.. --- - -.. --- - / -.. --- - -.. .- ... .... -.. --- - / -.. .- ... .... -.. --- - -.. --- - -.. --- - / -.. --- - -.. .- ... ....

Clearly that's Morse code, so if you translate it you get

DOTDOTDASH DOTDOTDASH DASHDOTDOT DASHDOTDOT DOTDASHDOTDOT DOTDASHDOT DOTDASHDOTDOT DOTDASHDOT DASHDOTDOTDOT DOTDASH

Ha. OK... Clearly that's Morse code, and when you translate it you get

UUDDLRLRBA

This is "Konami Code" which turned out to be the answer!

Stop - Solved 6:46PM Friday

######################################

And the answer is... resistor color codes. Use this chart as a reference to the numerical value that each resistor band color code maps to. Once you have that, it's as simple as going through each column in the Stop table and mapping that color to a resistor color code. So... It starts out "red orange blue green brown red brown red..." That is the resistor numerical equivalent to 23051212. Group the numbers into pairs and you get 23-05-12-12. Take the simple substitution cipher where 01=A, 02=B, etc and you get W-E-L-L. Keep going with that throughout the whole page and you get the message: "Well done. It looks like you passed electronics one hundred and one."

Football - Solved 11:38PM Friday

######################################

It's funny how we can sometimes look at a puzzle, think to ourselves, "that's this", and then put it aside and forget about it for half a day. Arguably, this could be the first one for which we had the correct idea.

Synchronous communications often have clock (very predictable pattern that both the sender and receiver can reproduce) and a data waveforms. The idea is that on the rising or falling clock edge, or at the center of the peak or trough, you poll the data waveform and interpret it as a digit. If you poll at the center of the peak here, you get

Binary: 0100110101001111010011110100001101011001010000110100110001000101

Hex: 4D 4F 4F 43 59 43 4C 45

ASCII: MOOCYCLE

Pretty straightforward.

Port - Solved 12:11AM Saturday

original:

What is

updated:

What is

@ShmooConPuzzle hints:

4:11PM Fri: Port Puzzle image has been updated for clarity. :)

8:19PM Fri: Port: Have you see the port icon's dot arrangement anywhere?

12:09PM Sat: Port: Good Shmoos always eat their serial!

######################################

The image is a waveform from a serial port. Googling "serial port outputs" gave us waves that looked like what we were seeing in the puzzle. From what we understood, it looked like what we were seeing could be ASCII characters transmitted along a serial port. The protocol is something along the lines of, "There's a start bit, a 7 bit encoding of an ASCII character, and then and end bit. So you divide up the wave and read off 0110001, 0101011, 0110001, which gives you "1+1". The question asks "What is...", so the answer is 2.

7-bit codes are weird because of the way that computers are built now, but apparently that's all the ASCII standard requires, and it came from a time when this sort of thing was still in question.

Polymorph - Solved 1:49AM Saturday

( http://tourdeshmoo.shmoocon.org/poly_.bmp )

@ShmooConPuzzle hints:

1:34PM Sat: Polymorph: show your truecolors and remember to factor in the size of the image to resolve the hidden message.

######################################

This one was quite tedious. The original file is a bitmap, clearly corrupted in some way. The barely-legible repeated word "Good!" and slanted nature of the upper section suggested that perhaps something had been done to the dimensions in the header. We used this site to figure out where in the header the dimensions were stored, popped it open in a hex editor, and started messing with it.

The width and height start with the 19th byte. If you reverse the nibbles in the 19th byte and reload the image, here's what you see:

Then it got painful. We needed to adjust both the width and the height, but most adjustments were nowhere near legible. After an enormous amount of trial and error, we got these width+height/image combinations:

From which we pieced together

THEY ARE

Hex editors are excellent sleep aids. By now those of who hadn't already passed out went to sleep. Zzzzz...

But not for too long.

Get On Track - Solved 9:41AM Saturday

But a couple of us are familiar with some classical ciphers, and the icon looked like a rail. They hinted more strongly at the "rail" thing in a tweet. Turns out it's a rail fence cipher, of the zig-zag variety. Order and space them like so to solve:

Zap - Solved 10:32AM Saturday

######################################

We actually figured out what this was by dragging it into Google Image Search, which returned results for "Telex punched tape", and after a bit more googling, we found the Baudot code and were able to decode it:

Welcome to Shmoocon 2016, Less Moose Than Ever%

In puzzle contests, Google is your best friend.

Phasor - Solved 12:06PM Saturday

??? [ that is, there were three question marks where there should have been a clue ]

There were also some interesting looking waves decorating our programs and on the signs outside each of the break-out rooms at the con:

From the programs:

From signs:

@ShmooConPuzzle hints:

8:43PM Fri: [Reply to "Any clue's for Phasor?"] Have you asked Google?

9:35PM Fri: We are about to sine off for the night. Please don't ASK about Phasor anymore.

3:39PM Sat: Looking for phasor hints? Look for the sines signs?

######################################

We needed the hints on this one. "ASK" was the important one, though we got stuck trying to interpret it as amplitude-shift-keying for a while. It turns out that the waves are digital signals encoded with Binary Phase-Shift Keying (BPSK):

When you decode the waves, you get two characters per wave (replacing spaces with _ so you can see it):

I_

nt

o_

de

_m

cl

_t

cy

bi

y_

ri

e!

We actually missed finding a wave there somewhere, but it doesn't really matter. We were able to assemble these into "I want to ride my bicycle!" just fine.

Toyota - Solved 7:43PM Saturday

BDB6BCA6BCB3B5538938B26CF1503617C9236C0

9D855F7C1A2831944BDB9BCAA5D243EB2323D3E

37F2A92D8606D324B3CADD892002ACEE38B61F7

D236EB5F8552C3DA384B344543EBCA6BCB3BABD

@ShmooConPuzzle hints:

2:28PM Sat: Toyota: use the hint from Get On Track literally.

2:33PM Sat: Toyota: there are two parts to this. You will know you have completed the first when it looks like you failed.

3:08PM Sat: Remember hints that are given out to a team are not Exclusive Or meant to give one team an advantage.

3:33PM Sat: Toyota step 2: x = y = sqrt(len(bin)+1)

And the solution to Get On Track (above) was meant to be a hint to this puzzle.

######################################

This was the hardest puzzle for us. The clue from Get On Track was FIRST LEG COMPLETE LOOK WITH YOUR HANDS AT THE KEYS THEN SCAN THE BITS TO ADVANCE X, and we spent ages puzzling over this, trying to come up with something reasonable. Without the hints, we would never have solved it.

Anyway, "Look with your hands at the keys" was supposed to mean look at our badges and think, "ah, the key must be 'BICYCLE'"! Sure. So you XOR (that hint from Twitter was handy here) BICYCLE with the hex characters of the puzzle. Then what you've got is a bunch more gibberish, but here's where it gets cool.

The first characters we got out of the XOR were 0xFFFFFFFFFFFFFF, so... all whited out. Their other hint: "...then scan the bits to advance" (the X at the end was just padding) plus their "Toyota step 2: x = y = sqrt(len(bin)+1)" tweet suggested that we lay the bits out on a grid and hope for a QR code. Charles to the rescue with some Ruby ( https://gist.github.com/cstrahan/bd75dcc2c72c31fea93e ). It was pretty fun because we started out using "bicycle" instead of "BICYCLE", and because ASCII lowercase and uppercase letters are just a linear translation away from one another we could kind of see the mangled QR code, and had to figure out what was wrong. When we uppercased, it jumped out at us instantly and beautifully:

Which scans to produce

http://shmoocon.org/velo

Finally.

That URL just had this on it:

Jetsetter

ICOIDZFECRT,GAOHXHVIVVVVILGYUDRXJEDWIGQY

Ah, good, a clue for Jetsetter to replace its ???s.

At this point we got dinner and went to the Saturday-night party to relax a bit, listen to some nerdy stand-up, and... keep working on the puzzles.

---

Jetsetter - Solved 10:14PM Saturday

???

@ShmooConPuzzle hints:

5:54PM Sat: Keep the theme in mind the theme of this puzzle when completing Jetsetter.

And of course, the ??? got filled in with the solution to Toyota above.

######################################

We couldn't get reliable Internet access in the party, so like nerds a few of us grabbed beers and went to hang out in the lobby instead. We solved this one relatively quickly. The URL was /velo, which is French for bicycle. The theme of the conference was "Tour de Shmoo" or "Tour de France" or some such thing involving moose riding bicycles and a lot of French. So we did the obvious thing, and started discussing the puzzle in French accents.

A classical cipher with a French name is the Vigenère cipher, so it made some sense to try it on the Jetsetter letters. The second key I tried was "tourdefrance", which yielded "pour avancer, changer devitesse dans sequence", which Google Translate tells me means "to advance, in sequence, speed change".

Importantly, when we submitted Jetsetter, the organizers responded with a corrected translation:

"'To move forward, shift gears in sequence' use this translation for next stage."

---

Lying Pasta - Solved 12:26AM Sunday

MDVQ GWT NK QDGHU RPCJ GZ A AJEW QDBSQNQ GTHJ MBCC BNE QNDD JL OPH CIKRE

######################################

Things were getting scary here, because the organizers had tweeted that rpisec (our rivals) had already solved Lying Pasta and Equality, so we were behind.

We had tried to solve Lying Pasta several times earlier using some form of substitution cipher, because there are spaces, and that just screams substitution. Turns out it's not that at all. Darth Null, the constructor of many a ShmooCon puzzle before wandered by, and made us think a lot about pasta. Finally: Lying ~= fibbing, we're supposed to "shift gears in sequence", pasta comes from Italy, like a guy named... Fibonacci. We're supposed to shift each letter by its corresponding number in the Fibonacci sequence.

1 1 2 3 5 8 13... Actually, this blows up very quickly. Time to break out the Ruby again. First, though, notice that the first few characters done manually are looking good:

M+1 = N

D+1 = E

V+2 = X

Q+3 = T

Boring bits removed:

$> s = "MDVQGWTNKQDGHURPCJGZAAJEWQDBSQNQGTHJMBCCBNEQNDDJLOPHCIKRE".split(//).map {|ch| ch.ord - 'A'.ord + 1}

=> [13, 4, 22, 17, 7, 23, 20, 14, 11, 17, 4, 7, 8, 21, 18, 16, 3, 10, 7, 26, 1, 1, 10, 5, 23, 17, 4, 2, 19, 17, 14, 17, 7, 20, 8, 10, 13, 2, 3, 3, 2, 14, 5, 17, 14, 4, 4, 10, 12, 15, 16, 8, 3, 9, 11, 18, 5]

$> alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ".split(//)

=> ["A", "B", "C", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M", "N", "O", "P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "Z"]

2.2.1 :049 > s.each_with_index.map{|x,i| (x+fib(i+1)) % 26}.map{|x| alphabet[x-1]}

=> ["N", "E", "X", "T", "L", "E", "G", "I", "S", "T", "O", "U", "G", "H", "D", "O", "N", "T", "B", "E", "A", "F", "O", "O", "L", "P", "R", "O", "T", "E", "C", "T", "Y", "O", "U", "R", "H", "E", "A", "D", "A", "N", "D", "P", "L", "A", "Y", "B", "Y", "T", "H", "E", "R", "U", "L", "E", "S"]

2.2.1 :050 > s.each_with_index.map{|x,i| (x+fib(i+1)) % 26}.map{|x| alphabet[x-1]}.join("")

=> "NEXTLEGISTOUGHDONTBEAFOOLPROTECTYOURHEADANDPLAYBYTHERULES"

---

Equality - Solved 12:56AM Sunday

Of course the previous leg's result is a hint for this one.

######################################

Still trying to catch up to rpisec, but there hadn't been anything about them winning, so we press on (which, of course, we would have done anyway, but with less moral).

The previous leg's result was NEXT LEG IS TOUGH DONT BE A FOOL PROTECT YOUR HEAD AND PLAY BY THE RULES. Play by the rules? There's one classical cipher that almost always makes an appearance in crypto contests, and it's called Playfair. But what to do for the key? We figured it was probably hinted, so what's striking in here that we haven't used yet? Protect your head. The key is "helmet".

Decrypting with those parameters yields "youplayedfairsoimustconfessthecakeisalieyoubestskipdessertthefinallegiseasyaskoaszlugsifex".

---

Piece of Cake - Solved 1:58AM Sunday

???

There was also this tantalizingly as-yet-unused bit of our program full of messages and people's names:

######################################

The previous solution had been "you played fair so i must confess the cake is a lie you best skip dessert the final leg is easy as koaszlugsifex". What the heck is a koaszlugsifex? At least some things were clear, though: this puzzle involves pie. The cake is a lie? You best skip dessert? The final leg is easy as ______? Pie, definitely. Delicious, and also a number. But how to use it?

We spent an enormous amount of time thinking about "confess" (church? priests? confession, catholicism... Is there an especially catholic cipher...?) and portal because of "the cake is a lie" (is there a cipher really relevant to portal that would take pi as a key?).

"...you best skip dessert". At some point, one of our guys thought to try skipping through the unused text in the program by each of the digits of pi. If you start doing that you get "CONGRATS YOU..." Holy macaroni batman... better finish up quick...

"Congrats you finished the race now tell us in email the GPS address of this shmoocon xiin

CONGRATS YOU FINISHED THE RACE NOW TELL US IN EMAIL THE GPS ADDRESS OF THIS SHMOOCON XIIN

So we looked up the latitude of the Washington Hilton on Google Maps, and sent it in. So... we won? It's pretty dang early in the morning to be second-guessing ourselves, but... what the heck is a koaszlugsifex?

---

koaszlugsifex? - Solved 11:20AM Sunday

Don't worry, we did actually decide around 2:30AM or so to get some sleep. We went home thinking we'd lost, and came back the next morning early to keep attacking this final problem. We were encouraged to hear that rpisec hadn't solved it, but when we told them we didn't know what koaszlugsifex meant they said, "yeah, that's a fun one". More work to be done, it seemed.

Because knew we had gotten something significant out of the block of text in the program, we imagined several things that koaszlugsifex might mean, and tried to guess the cipher and key from that. The organizers had quipped the night before that the final puzzle was unusual, unlikely to be on rumkin.com (a puzzle site), so we were going through every obscure cipher we could think of looking for a decryption.

At 11:20AM in the Chill-Out room, however, they took pity on us and came over to tell us that we had won the night before with the GPS coordinate of the hotel. What was koaszlugsifex?

Consider the sentence it had come from:

"you played fair so i must confess the cake is a lie you best skip dessert the final leg is easy as..."

So we went and picked some locks to unwind and bask in our victory.

We won 3 tickets to ShmooCon 2017, and our pick of some sweet swag (I picked up Python For Kids) at closing ceremonies.

THANK YOU

See you there next year!