Skip to main content
Public Access

Solution to Red Herring


by Maree Cassidy

Solvers are presented with an odd-looking image of some Red Herrings. Opening the image in your favorite image editor (GIMP or Photoshop are easiest) will show that it is an indexed color image which is unusual in modern times (but was common in the early years when GIF images were common). This is hinted at in the first part of the comment of the image: “Ugh, fish juice has seeped in and colored the table!”

Each color is made up of a red, green and blue component, and since we are looking at red herrings, the red component can be ignored. The first few colors in the palette have the red component set to 0x00 to confirm this (and this is what gives the image its odd green tint).

Looking at the green and blue components reveals hex (or decimal) values within the range for letters. Each text has several 0x00 entries following the end of the string to indicate string termination.

There are two ways to extract the text:

Option 1: In the image editor, view each hex code and translate it (this is the slow way!)

Option 2: (The quick way) Open the image in a hex editor, search for the magic bytes “PLTE” and change the width of the viewing window so only 3 characters are displayed.

In either case, solvers will extract the following messages:
Green = You will need the password gnirreh and to understand “magic bytes”.
Blue = Well done! Now find the hidden file… but where does the image end?

Where could a file be hidden in an image? There are a number of places (and many of them would be very difficult to detect), but in this case, finding the file merely requires understanding a little about the file format of a PNG image. For solvers who do not understand the file layout, the phrase “magic bytes” should lead to:

From there, the PNG page ( describes the critical chunks of the file. As hinted by “but where does the image end?”, a PNG image ends with a section identified by the magic bytes “IEND”, which is then followed by a 4 byte checksum of the image content. Anything following that 4 byte checksum is ignored.

Looking at that section of the file shows a suspiciously large number of bytes following the checksum, and a little research (back on the file signatures wiki page) will show that “PK” is the signifier for a zip file.

Copy everything from 0x50 (P of the PK) to the end of the file into a new file and name it with a file extension of zip. Opening the zip file displays a number of data (binary/hex data) files, and audio (MP3) files. Solvers will need the password from earlier (gnirreh) to extract the files.

Listening to each audio file, solvers will hear the same voice in each “This audio is a red herring”, but each also has a different semi-regular static behind the voice. The comments in the audio files can be linked together to provide a hint for the next step:

File nameComment
red herring 1.mp373 Listen behind the words...70
red herring 2.mp365... what else can you hear...63
red herring 3.mp374... you need to see the sound ...72
red herring 4.mp36F... the waveform won't help you...67
red herring 5.mp372... you need to read these audio files ...61
red herring 6.mp36D... put the characters in comments together. 2E

Putting the bytes together spells out: spectrogram.

Opening each audio file in Audacity (or other sound editing tool), and viewing the spectrogram will display something useful:

The text from each file is:

File nameText
red herring 1.mp3a red herring
red herring 2.mp3nope not here
red herring 3.mp3not this one
red herring 4.mp3RAW RGBA 78x43
red herring 5.mp3try again ...
red herring 6.mp3out of luck

The data files have names that are all fish, and they can be grouped into three of the same type of fish; one of each has “red” in its name. (Sometimes a fish has multiple common names.)

Fish nameCommon name
Acanthopagrus schlegeliiblackhead seabream
Evynnis japonicacrimson seabream
Pagrus majorred seabream
Oreochromis aureusblue tilapia
Sarotherodon melanotheronblackchin tilapia
Tilapia rendalliredbreast tilapia
Cymatogaster aggregatashiner perch
Macquaria australasicaMacquarie perch
Perca fluviatilisredfin perch
Oncorhynchus ketachum salmon
Oncorhynchus nerkared salmon (or sockeye salmon)
Salmo salarAtlantic salmon
Lutjanus lutjanusbigeye snapper
Lutjanus sebaeemperor red snapper
Ocyurus chrysurusyellowtail snapper
Etrumeus teresred-eye round herring
Lile nigrofasciatablackstripe herring
Opisthonema berlangaigalapagos thread herring

Examining the contents of these files will show that the files in each case are composed of a combination of 0xFF, 0xFE, and 0x00 bytes.

Combine the message from the audio (RAW RBGA 78x43) with a set of these files, pasting the three files for a fish together in alphabetical order by their scientific names. Open the subsequent merged file as a RAW image file (the .data extension is valid for RAW format) and select the setting for RGBA and a size of 78x43. This will produce a seemingly completely red rectangle for each set.

Using the magic wand selection tool with a threshold/tolerance of 0 will display a text in each image.

For each set of fish, these messages are:

Seabream404 Error Answer not found
TilapiaYour answer is not here. A red herring.
PerchOut of luck. Look elsewhere!
SalmonTry again not in this one.
SnapperWhoops! This isn’t right either.
HerringThe answer is an animal of order Tubulidentata.

There is only a single animal in the order Tubulidentata, and that is the answer: AARDVARK.