{"id":1202,"date":"2015-05-12T10:38:08","date_gmt":"2015-05-12T16:38:08","guid":{"rendered":"http:\/\/www.bunnyboi.com\/?p=1202"},"modified":"2015-05-14T23:01:45","modified_gmt":"2015-05-15T05:01:45","slug":"bad-dragon-error-emails","status":"publish","type":"post","link":"https:\/\/www.bunnyboi.com\/?p=1202","title":{"rendered":"Bad Dragon “Error Emails”"},"content":{"rendered":"

Yesterday Bad Dragon<\/a>\u00a0sent out 3 emails to their user base, 1 from the main list, 2 to the forum list. These emails appeared to be automatically generated\u00a0error messages filled with cryptic messages and encoded hints. Being a\u00a0generally inquisitive rabbit, I’m trying to figure out what it all means. In this post I’ll share the emails, and everything I’ve been able to decode so far<\/p>\n

<\/p>\n

Lets start with the main one, witch went out to the full Bad Dragon<\/a>\u00a0Mailing list though\u00a0icontact.<\/p>\n

\"\"<\/a><\/p>\n

This is the only email most people received, and it contains the most information<\/p>\n

QR Code:
\n<\/strong>This seams to be the main clue, and the only thing most people have decoded. Scan the QR code, and you get
\n
\nSubj: Alarm Condition
\nMSG: KG7NPM-H;
\nPoint value: Off ;
\nIN ALARM;
\n5\/14\/15 09:00:00 PM;
\nPoint Id: 39\u00c2\u00b031'25.3\"N;
\nPoint Id: 119\u00c2\u00b046'45.9\"W;
\nChannel Id: 145.126 Mhz;
\nChannel Encoding: Scot\/S1;
\n<\/code>
\nSome parts of this are easy. The Time, Date, Point ID GPS coordinates all point to Biggest Little Fur Con<\/a>.\u00a0The frequency in Channel ID is an Amateur Radio band in the 2 meter range. Often used by hand held radios or for “Fox Hunt<\/a>” style games. The rest of the information looks like gibberish, but I hope I’m wrong<\/p>\n

Binary Code:<\/strong>
\n01000011010100100100111101
\n00111000100000011001100100
\n0101101001011010001100101011
\n00100<\/p>\n

Putting this into any Binary Decoder, and it spits out more gibberish. ”\u00a0CRON fE\ufffd\ufffd+\u0004 ”<\/p>\n

Links:<\/strong>
\nEvery link in the email points to an Guest Access Error<\/a> page on the new Dragon Island website. No clue if you can do anything else from this URL to get more information,\u00a0But I hope there is.<\/p>\n

Other:
\n“A: \/> setup.bat” – \u00a0<\/strong>Just for show, or hints on a URL file location?
\n“Updating Setting Files 165<\/strong> . . .” – The “165” in this is colored to match the background of the email, making it invisible, Could just be a coding error when they built the email. I don’t think it has any other meaning.
\n“Fatal system error: CRON has malfunctioned, please evacuate the island as soon as possible!<\/strong>” – Another bit of hidden text. The email has the word “Cron” a lot in it, at first I though it\u00a0was to make the email look like it was automatically generated by a cron job. Now I think this is the name of the next toy to be released from Bad Dragon’s Dragon Island campaign.\u00a0<\/span><\/p>\n

\n

The next email went out to their forum list
\nT\u032e\u0329\u032d\u0329\u0332\u0339H\u0309\u0312\u0363\u0363\u0307\u0351\u030dE\u0338\u0320\u032d\u035a\u0346\u0363\u0313R\u033c\u0348\u036a\u030d\u036e\u0358E\u032b\u0353\u032e\u0347\u0366 \u0336\u031f\u0354\u034d\u0318\u0355\u0313\u0306\u035b\u0363\u030cI\u0336\u0333\u034e\u0355\u032d\u0329\u0330\u0346\u036bS\u035a\u0326\u0318\u0354\u0308 \u0327\u0329\u030f\u0308\u034b\u036d\u036c\u1e46\u0353\u0347\u0323\u0355\u0317\u031f\u034c\u0365\u0301\u036b\u0363O\u0318\u0305\u033d \u0337\u0320\u0363\u036c\u036b\u0308\u0301\u0350\u030aE\u0320\u032e\u035b\u0314\u0363\u0309\u033f\u0369X\u0333\u0306\u0311\u0351\u0350\u034b\u033d\u0301I\u0319\u0318\u034e\u0310\u031aT\u033b\u0313\u0369\u0312\u0351\u0314\u034a\u031a
\n
\n[05:24:10] >start system rerun program: whiterabbit.obj
\n[05:24:32] >system FAIL: corruption detected
\n[05:24:47] >unusual seismic activity detected
\n[05:25:12] >system movement determined fatal
\n[05:25:15] >early disaster alert system malfunction
\n[05:24:10] >release message from local host QR<<\/code><\/p>\n

S\u0354\u0317\u032c\u035fY\u0317\u0331\u032c\u035e\u015e\u0318\u0349\u031c\u034d\u0349\u031d\u032bT\u0317\u032e\u0359\u0358E\u0316\u0319\u0339\u0325\u0356\u0354\u0325M \u032aE\u0324\u0317\u0326\u032a\u032f\u0349\u0330R\u0328\u032e\u0354\u0345R\u0322\u0317\u0325\u0348\u0319\u0319OR,\u0353\u0320\u0317\u031d\u032c
\nS\u031d\u0355\u032cE\u031e\u0320\u0331I\u0332\u0359\u032b\u034d\u0339\u032c\u035eS\u0335\u0339\u0329\u0331\u033c\u0330\u0339\u0317M\u032a\u0354\u0353\u031c\u0323IC\u033a\u031c\u0325\u034e\u0323\u0356
\n\u0322\u034e\u0359\u0353A\u0332\u0353\u032d\u0353C\u0353\u032d\u033b\u0356\u032dT\u033a\u031c\u0339\u032a\u032c\u032c\u0329\u0361I\u0347\u031f\u0331\u0320\u0326\u0345V\u0327\u032aI\u034d\u0329\u0348\u033a\u032c\u0326\u032cT\u0360Y\u0327
\n\u0324M\u033a\u034e\u0316\u0345\u0345A\u0356L\u034d\u0329\u032e\u0348\u032dF\u0327\u0316\u032b\u0353UN\u0317\u0323\u032b\u034e\u032e\u0362CT\u032f\u034e\u031f\u033a\u0319\u0356\u012eO\u031c\u0318\u0323\u0349\u0324\u0348N\u0338\u0332\u0330\u0356\u0359\u031e\u0318\u032d, \u033a\u0356\u035f\u0345E\u0329\u035a\u0362\u1e48\u034d\u0348\u033a\u0329\u034e\u0319\u1e0c
\nM\u032e\u0339E\u0331\u0326\u034d\u0324S\u0354\u0359\u0345S\u0348\u0317\u035c\u0345A\u0354\u032a\u032a\u033a\u0353G\u0316\u0326\u034e\u031dE\u035a\u0324\u0331\u0347\u0345<\/p>\n

l\u0354\u0348\u033a\u0317\u035a\u032d\u033c\u0345o\u033c\u0355\u0347\u0354\u0330a\u0333d\u0347\u0320\u033c\u0323\u0355\u0317i\u032d\u032b\u0317\u1e47\u0330\u031d\u031d\u035a\u0353\u0359\u032dg\u0355\u0359\u0345
\n\u0354\u032a\u035a\u032b\u034e\u0329\u031d\u0345i\u0318n\u032f\u032f\u033b\u031c\u0348\u0355\u0317\u031c\u0318d\u032c\u034e\u0319\u034e\u035ae\u033b\u032b\u033b\u0332\u032ax\u031c\u0318\u0320\u0318
\n…..
\nf\u032e\u0331\u032c\u033a\u033a=\u0348\u0331\u0325\u0333\u03451\u034e\u0333\u032e\u031c\u0319\u032d\u03202\u031e\u032c\u0348\u034e6\u0353\u0332&\u0359\u032e\u0320\u031c\u0333\u0348t=3\u034f\u031e\u0316\u0318\u03450\u0325\u0329\u0316\u0326\u03552\u0326\u0318\u031c\u032a\u03006\u0339\u0353\u031e\u0317\u032d\u0329\u03235\u0321
\nLots of garbled text, It brings up the QR code and has what looks to be 2 URL query parameters “f=126&t=30265” After some work I found out they are used in the forums
\nhttps:\/\/forums.bad-dragon.com\/viewtopic.php?f=126&t=30265<\/a><\/p>\n

This is a post about a “Mile High Airlines Conspiracy” A very cute post, but not sure how it fits in with “Cron”<\/p>\n

 <\/p>\n

\n

The 2nd forum email came an hour later.
\n
\n\/\/\/WARNING\/\/\/
\ncron malfunction pattern recognized
\nsubsume E:\\ override pattern: cauterize and expunge
\ngenerate readout log:[05:24:10] >start system rerun program:
\nwhiterabbit.obj
\n[05:24:32] >system FAIL: corruption detected
\n[05:24:47] >unusual seismic activity detected
\n[05:25:12] >system movement determined fatal
\n[05:25:15] >early disaster alert system malfunction
\n[05:24:10] >release message from local host
\nQRS\u0354\u0317\u032c\u035fY\u0317\u0331\u032c\u035e\u015e\u0318\u0349\u031c\u034d\u0349\u031d\u032bT\u0317\u032e\u0359\u0358E\u0316\u0319\u0339\u0325\u0356\u0354\u0325M \u032aE\u0324\u0317\u0326\u032a\u032f\u0349\u0330R\u0328\u032e\u0354\u0345R\u0322\u0317\u0325\u0348\u0319\u0319OR,\u0353\u0320\u0317\u031d\u032c
\nS\u031d\u0355\u032cE\u031e\u0320\u0331I\u0332\u0359\u032b\u034d\u0339\u032c\u035eS\u0335\u0339\u0329\u0331\u033c\u0330\u0339\u0317M\u032a\u0354\u0353\u031c\u0323IC\u033a\u031c\u0325\u034e\u0323\u0356
\n\u0322\u034e\u0359\u0353A\u0332\u0353\u032d\u0353C\u0353\u032d\u033b\u0356\u032dT\u033a\u031c\u0339\u032a\u032c\u032c\u0329\u0361I\u0347\u031f\u0331\u0320\u0326\u0345V\u0327\u032aI\u034d\u0329\u0348\u033a\u032c\u0326\u032cT\u0360Y\u0327
\n\u0324M\u033a\u034e\u0316\u0345\u0345A\u0356L\u034d\u0329\u032e\u0348\u032dF\u0327\u0316\u032b\u0353UN\u0317\u0323\u032b\u034e\u032e\u0362CT\u032f\u034e\u031f\u033a\u0319\u0356\u012eO\u031c\u0318\u0323\u0349\u0324\u0348N\u0338\u0332\u0330\u0356\u0359\u031e\u0318\u032d, \u033a\u0356\u035f\u0345E\u0329\u035a\u0362\u1e48\u034d\u0348\u033a\u0329\u034e\u0319\u1e0c
\nM\u032e\u0339E\u0331\u0326\u034d\u0324S\u0354\u0359\u0345S\u0348\u0317\u035c\u0345A\u0354\u032a\u032a\u033a\u0353G\u0316\u0326\u034e\u031dE\u035a\u0324\u0331\u0347\u0345<\/code><\/p>\n

f\u032e\u0331\u032c\u033a\u033a=\u0348\u0331\u0325\u0333\u03451\u034e\u0333\u032e\u031c\u0319\u032d\u03202\u031e\u032c\u0348\u034e6\u0353\u0332&\u0359\u032e\u0320\u031c\u0333\u0348t=3\u034f\u031e\u0316\u0318\u03450\u0325\u0329\u0316\u0326\u03552\u0326\u0318\u031c\u032a\u03006\u0339\u0353\u031e\u0317\u032d\u0329\u03235\u0321<\/p>\n

l\u0318\u032b\u034e\u033c\u032c\u0349\u0300o\u0355\u0333\u034e\u0326\u033c\u0348\u035ea\u0324\u034d\u034e\u0332\u031c\u0355d\u0339\u032f\u0301i\u0317\u035cn\u0335\u0354\u034d\u0317g\u031e\u0331\u0354\u0316\u034e\u0320\u0355
\n\u0356.\u0336\u033a\u033c\u0330\u032d\u0356.\u0323\u0318\u0329.\u0323\u0359\u0316\u0333\u0323\u0300.\u0316\u0333\u031d\u0324\u0339\u034d.\u0325\u032a
\n\u031c\u032e\u033b\u0339\u033bF\u0333\u0339\u032e\u0355\u0358A\u0347\u032b\u012eL\u0319\u035a\u0356\u0349\u032c\u0355UR\u0489\u0356\u0323\u033c\u031c\u032eE\u0336\u034d\u031e\u032f\u0329\u032b\u034d\u0345
\n\u0328\u0325F\u0335\u0339\u0355\u0323A\u032a\u032a\u0347\u0331\u034e\u0345\u0345I\u0335\u034e\u0353\u0331L\u034f\u0332U\u0318\u035f\u0345R\u031b\u033a\u0349\u1e18\u031d\u0349
\n\u033a\u0349\u031eF\u031c\u0349\u0316\u035fA\u0329\u0355\u0348\u0329\u032c\u0358I\u0333\u0347\u031f\u033b\u0354\u0326L\u0339\u0348\u0330\u031c\u0317U\u0332\u0324\u031e\u0317\u035c\u0345R\u0317\u031d\u034e\u032c\u031d\u035a\u0362E\u0316 \u0323\u035a\u035c
\n\u032a\u0339\u0326\u032d\u033a\u0301
\n\u035a\u0326\u0326\u034e\u032dr\u032f\u0362e\u034ddi\u0317\u0319\u032a\u0318\u032b\u0353\u0320\u035cr\u031d\u0359\u0356\u032c\u032de\u0325\u0348\u034e\u031c\u032dc\u0334t\u0317\u0318\u0355\u0347\u0345
\n\u035ef=\u0335\u032b1\u0356\u0339\u03252\u0347\u0316\u032f\u03586\u0319\u0356\u0325\u032f\u0358\u0345&\u0354\u0333\u0347\u0356t\u031d\u0325\u0323\u0316\u0320\u0345=3\u0355\u033c\u0349\u0320\u0317\u0355\u0331\u03620\u0359\u03322\u0336\u032d\u032d\u0316\u0339\u0331\u031665\u032d\u0316\u033b\u0345<\/p>\n

\u0361b\u032e\u0354\u034d\u0318\u031e\u0354i\u0321\u0316\u0348\u032at\u0322\u032c\u0318\u033a\u032a\u033a\u0353\u032e.\u035el\u0326\u033b\u0319\u0347y\u032d\u032f\u031c\u0317\u0347\u034e\u0361\/\u04891\u031b\u0359\u0359\u0319\u031cH\u0330\u032d\u0316d\u032c\u0332\u0353q\u0489\u0320\u034d\u0349\u035a\u035aj\u031f\u0360\u0345d\u0328\u0359\u035a\u0333\u0320\u031f\u032a\u0355Y\u0324\u0359\u032a\u032a\u032d\u031e\u0315
\n\u031e\u0325G\u033b\u032a\u034e\u0316\u0347U\u034f\u0316\u0354\u0329\u031c\u0325E\u0316S\u0320\u0354\u0326\u031e\u032d\u033a\u035fT\u0334 \u0353\u0330\u0339\u033a\u035e\u00c0\u032a\u0339\u0356\u0345C\u032a\u035dC\u031e\u032a\u034e\u0353\u0360ES\u031c\u034d\u0326\u032dS\u034d\u032d\u0348\u034d\u035a
\n\u0320\u0319\u0319\u0345N\u032a\u0324\u0347\u0358\u01a0\u0347\u032b\u0349\u0332\u0324T\u0322\u0355\u0347\u0316 \u0353F\u0330\u033a\u035cO\u0489\u0332\u0359\u0316\u0359\u032b\u0359U\u0319\u0332\u0318N\u0339\u031d\u0318\u0317D\u034f\u0354\u0339\u032f\u0320\u0349\u0348
\n\u032c\u0316\u031f\u0354\u0324\u0318\u035f\u0345
\n\u0347\u0317\u034d\u0356E\u0337\u031f\u0355\u032aR\u032f\u033cR\u0356\u031e\u033b\u0320\u033b\u0326O\u0335\u0324\u0347\u035aR\u0489\u0316\u0359\u0318\u0325\u0320
\n\u1e18\u031b\u034d\u032c\u0323\u0345R\u0337\u0348\u033c\u032b\u0318\u031f\u0339\u0355R\u0324\u031d\u0355\u0318\u031d\u0317\u031cO\u0337\u0319\u0347\u033bR\u0338\u0330\u0339\u031d
\n\u0326E\u0359\u0354\u0339\u0333\u0349\u031e\u0318\u0315R\u034f\u031dR\u0326\u1ecc\u035dR\u032f\u0318\u0349\u032d\u0332\u0358<\/p>\n

Now this email has a lot to decode.<\/p>\n

“cron malfunction pattern recognized<\/strong>” – Another references to “Cron” witch sounds like a name rather then a program term.
\n“whiterabbit.obj<\/strong>” – Being a white rabbit my self, this part really got me excited. In the first Jurassic Park movie;\u00a0Whte_rbt.obj was a computer virus-like backdoor programmed into the system by Dennis Nedry, which led to the Isla Nublar Incident. Dragon Island being a\u00a0Homage to the Jurassic Park series and the upcoming Jurassic World movie, this connection makes sense.
\n“f=126&t=30265<\/strong>” – Same Url query parameters we saw in the last email.
\n“bit.ly\/1HdqjdY<\/a><\/strong>” – Leads to the same QR code from the main email.
\n“Guest Access Not Found<\/strong>” – Same as the link from the main email as well<\/span><\/p>\n

Conclusion<\/h2>\n

Cant be sure, but I believe that at the date and time listed in the QR code a new toy will be announced, Cron’s toy. As for the radio channel and encoding, I could see them doing a “fox hunt” and the first person to find the transmitter getting the first Cron, or a coupon.
\nThe only problem I have with this theory is it that a lot of the encoded hints would just be useless, and sending out 3 emails to your entire fan base when only a few will be at Biggest Little Fur Con; even fewer will have the necessary equipment for a Fox Hunt to begin with (I only know of 2 people going who do.) Would give this marking plan a very limited scope.<\/p>\n

But hay, the fun is in the figuring it out. I guess we’ll see what happens on the 14th at 9pm<\/p>\n

Update!<\/h1>\n

We have some photos, looks like Cron is a Utahraptor!<\/p>\n