During the last few years, alongside with me diving into programming area, I've been playing some games of one company. Expectedly, two interests collided and part of my experience grew from the interest of exploring games. I began to reverse-engineer them and while reading binaries assembly is still impossible for me, what I did includes:
- data mining;
- files parsing (3D models, archives, data files, etc);
- netcode RE;
- MITM-ing game servers and altering the data passed between.
Some of the information I could find I released to public, including the last tool that enabled players to do things that are legal in game but developers could not enable them, and is capable of doing things that are illegal in terms of game logic, but of course, those are not included in the release.
In the nearest future, I plan to apply for a C++ developer job at this company and I wonder if and how should I mention these details.
- mentioned games are online games (think of MMO);
- the company has offices in many countries but the office in my city is not the one responsible for the mentioned games;
- while some of the data was exposed, the tools used to extract it and tools' sources never went public;
- game's sensitive data is kept private, such as items drop rates or certain values for damage calculations;
- game's ToS explicitly forbids reverse engineering it, but from what I've read it would only lead to game account suspension;
- no lawyer's advice was taken on this matter.
Some extra details:
- might this be an important detail (in certain ways), the company is mainly a mobile developer;
- the games are abandoned by 95% for a about year already due to the closure of responsible development offices.
Addressing some of the comments:
- people do release hacks for some of their games, and scripts for models extracting, however I never heard of their request to take such posts down;
- ToS forbids alterations and RE of the game, however there was a WoW-head-like site created by player, and company:
- Used it as a reference within game support over email;
- Wanted the player to keep developing the website;
- Did nothing to help him.
- the game is either not very popular among tech people as I've only seen a very few tools and only heard of a few people capable of doing it, or all of that is private as well;
- I consider my "hacks" to be more of a finding flaws in games logic, not actual cracks;
- "If you don't tell them and get the job, you risk someone finding out later" is a very good point since when publishing information, I used either my in-game nick or my real name whilst I checked every released stuff to not contain either of those.
One of the long-lasting projects that provides some of the information to the public (mostly the one that is actually in-game) is in my resume as it gives ~2 years of experience before my first real job. I used it to apply to my current job but obviously no one asked about "How did you get information needed?", but I always could reply "Manual gathering, y'know."
Update: I've tried to get in contact with office HR via their social media group, but they reply ~ once in a month hence late update here.
Asking them direct question about their attitude to reverse-engineering lead to answer to look for jobs positions at their website. Ugh. Without any clear reply from them I guess I'll stick to silent position. Chosen answer provides some great ideas on how to nicely present the mentioned facts and I might follow them, I still have time until my possible application.
Here are key points from the answers:
- Three possible scenarious exist:
- Breaching the ToS is unacceptable.
- It doesn't matter.
- It depends.
- Thoroughly read the ToS and EULA for explicit mentioning of RE.
- Research about company's bug bounty programs, industry, their attitude for other people doing RE, if their posts get deleted, etc.
- While the process of RE might be a good point on interview, what also matters is how you use obtained data and abilities.
- It's better not to use your widely known usernames and/or real name if you decide to publish something, i.e. do not use your main GitHub account to post different projects.
- If your information found associated with the data that shouldn't be publicly available, possible questions might be:
- Why did you think that was okay to do?
- If hired, why should we be confident that you won't violate your terms of employment?
- If possible, you may try to find out their attitude by asking HR or someone who works there (and is your friend) some hypothetical questions.
- If you found any flaws, security issues and any other unexpected behavior, considering reporting it to the appropriate game department.
- If you decide to mention this on the interview, frame it in a positive way.
- If you aren't sure how would they react, don't mention this.
Feel free to add more points or edit out the ones I understood wrong and that do not belong here.