78

During the last few years, alongside with me diving into programming area, I've been playing some games of one company. Expectedly, two interests collided and part of my experience grew from the interest of exploring games. I began to reverse-engineer them and while reading binaries assembly is still impossible for me, what I did includes:

  • data mining;
  • files parsing (3D models, archives, data files, etc);
  • netcode RE;
  • MITM-ing game servers and altering the data passed between.

Some of the information I could find I released to public, including the last tool that enabled players to do things that are legal in game but developers could not enable them, and is capable of doing things that are illegal in terms of game logic, but of course, those are not included in the release.

In the nearest future, I plan to apply for a C++ developer job at this company and I wonder if and how should I mention these details.

Additional information:

  • mentioned games are online games (think of MMO);
  • the company has offices in many countries but the office in my city is not the one responsible for the mentioned games;
  • while some of the data was exposed, the tools used to extract it and tools' sources never went public;
  • game's sensitive data is kept private, such as items drop rates or certain values for damage calculations;
  • game's ToS explicitly forbids reverse engineering it, but from what I've read it would only lead to game account suspension;
  • no lawyer's advice was taken on this matter.

Some extra details:

  • might this be an important detail (in certain ways), the company is mainly a mobile developer;
  • the games are abandoned by 95% for a about year already due to the closure of responsible development offices.

Addressing some of the comments:

  • people do release hacks for some of their games, and scripts for models extracting, however I never heard of their request to take such posts down;
  • ToS forbids alterations and RE of the game, however there was a WoW-head-like site created by player, and company:
    1. Used it as a reference within game support over email;
    2. Wanted the player to keep developing the website;
    3. Did nothing to help him.
  • the game is either not very popular among tech people as I've only seen a very few tools and only heard of a few people capable of doing it, or all of that is private as well;
  • I consider my "hacks" to be more of a finding flaws in games logic, not actual cracks;
  • "If you don't tell them and get the job, you risk someone finding out later" is a very good point since when publishing information, I used either my in-game nick or my real name whilst I checked every released stuff to not contain either of those.

One of the long-lasting projects that provides some of the information to the public (mostly the one that is actually in-game) is in my resume as it gives ~2 years of experience before my first real job. I used it to apply to my current job but obviously no one asked about "How did you get information needed?", but I always could reply "Manual gathering, y'know."


Update: I've tried to get in contact with office HR via their social media group, but they reply ~ once in a month hence late update here.

Asking them direct question about their attitude to reverse-engineering lead to answer to look for jobs positions at their website. Ugh. Without any clear reply from them I guess I'll stick to silent position. Chosen answer provides some great ideas on how to nicely present the mentioned facts and I might follow them, I still have time until my possible application.

Here are key points from the answers:

  1. Three possible scenarious exist:
    • Breaching the ToS is unacceptable.
    • It doesn't matter.
    • It depends.
  2. Thoroughly read the ToS and EULA for explicit mentioning of RE.
  3. Research about company's bug bounty programs, industry, their attitude for other people doing RE, if their posts get deleted, etc.
  4. While the process of RE might be a good point on interview, what also matters is how you use obtained data and abilities.
  5. It's better not to use your widely known usernames and/or real name if you decide to publish something, i.e. do not use your main GitHub account to post different projects.
  6. If your information found associated with the data that shouldn't be publicly available, possible questions might be:
    • Why did you think that was okay to do?
    • If hired, why should we be confident that you won't violate your terms of employment?
  7. If possible, you may try to find out their attitude by asking HR or someone who works there (and is your friend) some hypothetical questions.
  8. If you found any flaws, security issues and any other unexpected behavior, considering reporting it to the appropriate game department.
  9. If you decide to mention this on the interview, frame it in a positive way.
  10. If you aren't sure how would they react, don't mention this.

Feel free to add more points or edit out the ones I understood wrong and that do not belong here.

  • 1
    Comments are not for extended discussion; this conversation has been moved to chat. – Snow Jan 10 at 7:20
  • 1
    I wonder if it makes any difference whether you hacked the games of the same company or not. If the hiring manager is going to scrap your application because you've broken their ToS, I don't think he will be happy to hear that you've broken someone else's. – Dmitry Grigoryev Jan 10 at 9:14
  • @DmitryGrigoryev it's about one company and their games only. I don't see a valid reason to tell about RE of unrelated games – lolbas Jan 10 at 17:34
85

I work as a Software Engineer turned Security Engineer at a computer games company.

Obviously, our ToS forbids people from reverse engineering things (and if you are reading this, don't take this as an admission that our ToS is not binding. Please do not break our stuff without our permission).

That said, we have to be intellectually honest about this sort of thing when we hire new engineers: You've, on balance, likely broken into our stuff, reverse engineered it, tinkered with it, etc. Reverse engineering is interesting! So, certain allowances have to be made: If I was interviewing a candidate who had reverse engineered our game (And I have interviewed someone who has done that in the past), I would be more concerned about whether or not their efforts had harmed the business or our customers rather than immediately ending the interview if they mentioned they had reverse engineered our stuff.

I don't put too much stock in "Violating the ToS is a bad thing and will immediately fail the interview". In my field, if no one violated ToSes as they were learning, no one would get hired. Every product has a "do not reverse engineer" clause in their ToS as a matter of course.

You have to make sure you frame it as a positive and and it can be difficult to do that. If you can use it as a way to say, "Here's all the cool things I've done that demonstrate my ability" then that's great. But if you bring up the fact you broke into our stuff as a way to somehow insult the competency of your potential future colleagues, that's not a good idea.

I'd say at least in the security field this could go either way and it'd either be a good thing or a bad thing depending on how you brought it up in an interview. I can't see the software field being all that different, but it really depends on:

  1. The company culture (Does the company have a Bug Bounty program?)
  2. The industry (Some industries are a lot more litigious than others)
  3. Will you interview with a recruiter (who is more concerned with legality) or an engineer (who is probably more concerned with technical ability)?

As with any character trait that can be either a positive or a negative, if you aren't sure you can spin it as a positive in an interview, I would omit it.

The only one I think is a definite no in your question is this:

MITM-ing game servers and altering the data passed between.

This is definitely bad because it sounds like it altered other players experience. Once you go from simple exploration and self-education to altering the game experience, that's when you start getting into trouble.

  • 6
    In my experience, reverse-engineering the company's code shows both skill and interest! What OP did after reverse-engineering might be a showstopper, but up to that point, it's a big positive for most software companies. – Michael W. Jan 9 at 19:14
  • 6
    Reverse engineering some code shows technical skill and a level of interest and passion that I as a hypothetical hirer would be very pleased with, even or perhaps especially if that code belonged to my company. However, if the person doing the reverse engineering also publically distributed what they gained, that is a completely different matter as it shows a lack of respect for ethical and legal boundaries, and I wouldn't touch that person with a ten-foot pole (and depending on the severity of it I might even consider contacting the legal department). – Abion47 Jan 10 at 7:10
  • 1
    @Abion47: Developers would certainly object to many of the things that one might do as a consequence of reverse-engineering, such as publishing the results. As to whether developers would rather receive money from a sale to a person that reverse-engineers it but doesn't use any information gleaned in any fashion that would affect anyone else in any way, or whether they would rather not get money from that sale, however, I think that most developers would be just as happy getting the money. I think the normal boilerplate about reverse-engineering is primarily intended... – supercat Jan 10 at 21:54
  • 1
    ...to block the adverse ways in which people might make use of information gleaned from reverse engineering. It's much easier to forbid reverse-engineering entirely than to identify all objectionable uses of information gleaned thereby, but that doesn't mean that one would be bothered by someone who reverse engineered their software without using or revealing the result in any way. – supercat Jan 10 at 22:00
  • 2
    Thanks Dan, you saved me the effort of typing a very similar answer. As someone who's been both developer and interviewer, I would be quite interested to hear that a candidate has interest in "taking things apart to see how they work". I would suggest OP not imply that activity is solely focused on a single company's game(s) but more "I've even looked at your game, 'Foo of Bars'". As others have said, I'd be less pleased to hear about sending crafted data to our production servers, if only because it's a bit... disrespectful? Inspecting packets would be fine. YMMV, be sure to read the room – A C Jan 11 at 2:50
85

Should I mention I've reversed engineered games of the company I interview at?

You are likely already in a position to judge this for yourself, based on what you already know about the company and their game community.

Do lots of folks release game hacks publicly for this company's games? Do others reverse engineer their products and release tools? Most importantly, is that sort of activity celebrated by the company or discouraged? (As @BenBarden wisely points out ‘...and “game's ToS explicitly forbids reverse engineering it” suggests that this is probably not one of the companies that celebrates such activity.’)

If you are one of many that are encouraged in this arena then go ahead and tell them about it. If not, keep it to yourself.

If you aren't sure, then err on the side of caution and don't bring it up.

Some of the information I could find I released to public...

If what you already released to the public contains your name, then be prepared to answer questions about it during interviews. One obvious question would be "Why did you think that was okay to do?"

  • Comments are not for extended discussion; this conversation has been moved to chat. – Snow Jan 11 at 14:35
39

While doing what you did shows a good technical aptitude (and a strong interest in the companies products) the ethical concerns in your described scenario would be a showstopper for me.

While I doubt that you had any malicious intent someone willing to play fast and loose with ToS to the extent where they are (my emphasis):

MITM-ing game servers and altering the data passed between.

Assuming that's a live public server on an active game, well I can't see any benign reason to do that and that sort of thing would have me wondering what other rules and agreements they might decide don't apply to them. NDAs to control leaks of product info during development? How about peeking at sensitive data not needed for their job?

I'm not a rules-are-rules-are-rules person - someone who was saying how they reverse engineered an older game to see how it ticked (one that was no longer in active MMO-type use or heavy retail sale at the time) might still be a violation of license agreements etc but it's something I'd readily see as a positive, someone who was just keen to learn and in a way that couldn't impact the company or other users.

  • Comments are not for extended discussion; this conversation has been moved to chat. – Snow Jan 10 at 7:21
  • "I can't see any benign reason to do that ". Well, it's an interview setting. Why make assumptions? You may not be able to see them, but I can. To name an entirely harmless example: I could imagine making a profanity filter that censors incoming chat messages. And If I did that, I would have no hesitation in bringing that up in interviews. – MSalters Jan 10 at 19:10
  • To be fair, ToS/EULAs generally include a generic term of the form “you are not allowed to reverse engineer the binaries” and it’s generally understood that this term (a) will be ignored, and (b) is generally legally unenforceable. – Konrad Rudolph Jan 11 at 14:41
  • @KonradRudolph Except of course for the instances where it a) hasn't been ignored and b) has been enforced? While I'm sure there's many, many more instances where companies haven't pursued it or been unaware of violations. I'm not so sure that I'd be happy to call a term that has history of being upheld in both Fed. Cir. and the 8th Circuit Appeals Court as "generally legally unenforceable" - at least on that side of the pond. – motosubatsu Jan 11 at 14:54
  • @motosubatsu My point is that the clause might as well not exist, it’s a fundamentally unreliable signal on all fronts, be they ethical, legal or social acceptability. I’d be curious about instance where that clause (and not, in reality, something else) has been enforced successfully in the software space, and before John Deere (I’m aware that John Deere is a game changer in this regard). For what it’s worth, the US are also not the whole world: in the EU the clause is essentially legal smokes and mirrors: complete baloney. – Konrad Rudolph Jan 11 at 15:31
14

Tricky, this could go either way and you need to play this carefully.

I've certainly seen a case where this worked: a candidate had hacked into a fairly complicated audio effects processors and made some changes for himself. He showed that at the interview and they hired him on the spot.

On the plus side: you demonstrate very strong technical skills with a clear proof of success and you show passion for the industry and the specific product(s) of the company. These are very strong plus points

On the downside, it could be viewed as unethical, intrusive, a break of confidentiality and playing loose and fast with the rules. These can be show stoppers.

Ideally you remove and/or hide your Internet footprint on this (if possible). If there is anyone at the company you already know, it would be good to have casual chat and get a sense of the corporate culture.

  • Exactly correct. It can work, just as in the second paragraph here. – Fattie Jan 9 at 13:53
  • 6
    I think you mean, "playing fast and loose with the rules"? – Meg Jan 9 at 14:13
  • "made some changes for himself." Read: I know how to do this, but I also understand that we, in our profession just like everybody else's, do things like this to make a living, not to take: 'information that I could find and release it to the public'. – Mazura Jan 9 at 21:22
  • @Meg: I think he's playing loose and fast with the rules of the English language ;) – MSalters Jan 10 at 19:11
  • I suspect that hacking audio effects is considered differently from hacking a multiplayer game. – immibis Jan 10 at 22:44
10

I'd advise you not to mention it.

It's anecdotal, but I did that for that very popular RTS in 1998. Created a random map generator, so I could LAN-play on unknown maps, as opposed to those same-old maps. This was used on local network, an existing feature of the game and couldn't mess in anyway with the other users (as opposed to MMO). After mentionning it in my job application, I received a cease-and-desist letter treathening legal action if this random map generator was ever published on the internet.

  • 10
    Interesting. But is another way to spin this is that you got lucky - you dodged a bullet in terms of signing up for a company whose culture may not have suited you? – Keith Jan 9 at 22:34
  • 2
    ^ agreed, talk about a place that doesn't encourage engineering culture – forresthopkinsa Jan 9 at 22:34
  • @Keith That was my thinking but is not quite an answer given how competent the exisiting ones are: By all means, mention it (perhaps sans the publishing) as a litmus test; if they stop the interview the company was not meant for you. – Peter A. Schneider Jan 10 at 1:22
  • @forresthopkinsa Encouraging engineering culture inside and to the outside are two different shoes and typically fall into different departments of a larger company, I'd not judge how it is working there based on how their legal department handles external issues. That being said, I do feel it was a bit heavy handed unless they'd decided the candidate doesn't fit anyway. – Frank Hopkins Jan 11 at 9:55
8

I would not hire you if you told me, and honestly, it boils down to one sentence you said: "game's ToS explicitly forbids reverse engineering it, but ..."

Were I a recruiter, that would be a deal-breaker to me. You'd be admitting to me that you see fit to bend our rules and terms if you think it's ok. Why would I possibly be inclined to give you even more access to our trade secrets when you've already taken actions to abuse the terms of agreement you entered into when downloading the game?

If you told me you deliberately ignored our ToS because you figured it was harmless, I'd ask you two questions:

How do you decide which parts of an agreement you accept are essential and which aren't?

If hired, why should we be confident that you won't violate your terms of employment?

If I had responses I thought were acceptable, this is the part of the answer where I'd offer them, but quite frankly, I don't. You've already done something this company probably views as directly harmful to them. Plus, from their perspective, you already don't care about their rules. It's a tough sell at that point to say "well, from now on I'll listen to the rules!" and anything short of that mindset just isn't hireable.

Everything below this is my personal opinion

Having said all that, you might think the company is going to find out one way or another, and that hiding it just delays any consequences. If that's the case, then the one possible out I see here is: "I consider my "hacks" to be more of a finding flaws in games logic, not actual cracks;"

If I were you, and there were a public footprint online disclosing that I knowingly violated the terms of agreement of the company I wanted to work for, I'd establish a compelling case for the italics quote above before applying.

Is there a "report bug" feature? Is there contact information to the game developers anywhere? Great! Send them the flaws you found. Report everything you've found. Establish a trail as a user out there who cares about the company and its products.

Because the way I see it, there's three positions this company can have on what you did: Either breaching the ToS is unacceptable, it doesn't matter, or it depends.

If the company has either of the first two perspectives, then however you approach this is irrelevant. However, if the company is willing to handle that on a case-by-case basis, make your case really strong! There's a huge amount of gray area between reverse-engineering a game so you can redistribute it and reverse-engineering a game for a personal mod (I don't believe Feral Interactive would blacklist me if I told them I tweaked a .txt file for Rome: Total War so I could play as Macedonia). So try your best to get in as light a gray area as possible.

Like I said "well, from now on I'll listen to the rules!" is a tough sell. But "I've had an interest in [company] games for years now, and I have an established record of helping improve them however I can. I'd love an opportunity to work with this team, and to be a direct part of producing the best games we can" just might work.

  • As of now, this is the only answer that actually suggests how can I present actions I've done and it also brings up an important point to report found flaws. – lolbas Jan 9 at 17:14
  • 7
    On a side node, do I break the ToS if I didn't accept it, i.e. did not play the game? – lolbas Jan 9 at 17:14
  • 2
    @lolbas That's a darn good question, and I'm afraid I can't help you there, but the Law Exchange might know. – Lord Farquaad Jan 9 at 17:20
  • @lolbas I think you know you're being a smartass, I'm guessing you're not supposed to have installed and kept the game on your disc if you didn't agree to the terms. Of course as Lord Farquaad said, you could ask the law SE network. – Pierre Arlaud Jan 10 at 8:48
  • 2
    I have very little issues breaking such ToS, given that they are already null and void in my jurisdiction. What makes the company think they even have the right to forbid reverse engineering?The whole reason that there's a law against such ToS in local legislation is exactly because these terms are actively user-hostile. As for other company policy that's explicitly banned by law, I will there respect the law too instead of company policy. Only looking to hire people that are willing to follow company policy and break the law? We don't call them companies, we call that organized crime. – MSalters Jan 10 at 19:17
1

The developer team might even like your attitude.

However, there is a huge risk of there being one or more persons in that company who think that acknowledging any tolerance of such behaviour would have far reaching negative consequences for their own legal standing, and would feel their hand forced to make a cruel example of you.

It doesn't matter what that group personally wants or thinks: They will be held responsible if a show of tolerance that becomes public knowledge is later used against the company (as proof that they did not defend their intellectual property) in court when it comes to more serious copyright/patent/insurance/trademark disputes. They could also be held responsible if truly unwanted behaviour (eg commercial piracy) is aided or encouraged by what you did or what they chose to tolerate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.