What the scene says

That "in September 2009 a Chinese man named rain published the Metin2 server files." That's true, and it's almost all that's known. The file name, game0901.tar.gz, and its fingerprints have been public since March 2024, when Exynox, a developer from the Western scene, revealed them after finding them again on his own backup DVDs. Before that, for fifteen years, the scene's founding object had no public fingerprint.

What the file says

A gzip archive carries in its header the time it was created. game0901.tar.gz's is 1251810149, that is September 1, 2009 at 13:02:29 UTC, Unix operating system. F It's not a forum date, not a memory: it's the moment someone, on a FreeBSD machine, ran tar and closed the archive. The file name is the date itself: 09/01.

Inside the tar there are 11,151 entries with their modification times, and they read like a diary:

Between the last modification and the compression, three and a half minutes pass. Shutting down the server and creating the file are the same act. F It's not a periodic backup, nor a copy stolen from a running server: it's someone stopping the machine and packing up its home directory.

Eighteen days of darkness, then Hong Kong

The file existed, finished, on September 1. rain published it on a Chinese forum on September 19 at 00:56 ("Mc倚天2一键服务端 (稳定版) — 更新为龙驹原版完整服务端"), eighteen days later. F On October 6 a Hong Kong forum moderator publishes a "半一鍵" FreeBSD guide that comes with game.tar.gz, 142,394,597 bytes, fingerprint 9e954c11cf065bdd647bfbb6d6fa9344. F It's the oldest public attestation of the fingerprint, and it matches the verified MD5 of the file the archive holds: the copy that circulated in Poland in 2010, Exynox's 2024 copy, and the 2009 Hong Kong one are the same file, byte for byte.

Why the number 404 is worth a chapter

The seven VERSION.txt files contain three lines: game svn revision 404, player count: 4, with new ai. F It's the first revision number of Ymir's Subversion repository ever read directly, written by the game process itself. The auth binary carries revision 407: it came from a different branch. The scene, for twenty years, has named its own packages after numbers ("34k", "40k", "40250") believing they were its own: they're the company's changelists. This is the oldest one we have.

Where the machine came from

The build is from Hong Kong: LOCALE = big5, hongkong locale, drop tables still under maintenance in August 2009, an OX quiz citing info@runup.com.tw. F But the machine wasn't: .cshrc sets LANG zh_CN.eucCN, simplified Mainland Chinese. F The 2009 operator was running the Hong Kong build on a Mainland Chinese machine. The memory images preserve the shell environment, and the environment preserves SSH_CONNECTION: two Shenzhen hosts (121.12.173.58 and .49, SSH on port 5573, hostname www.idc.com), administered from three Sichuan addresses. F Among the characters in memory are longju and longju33. T

It wasn't the publisher's own setup. It was a private server of the Longju pipeline, on rented iron in a Chinese data center, which shut down on September 1, 2009 to be reborn as a file.

What isn't there

No passwords, no emails, no account dumps. F There are 502 player IP addresses in the memory images, and the archive does not publish them; it geolocated them offline for a single reason: to know who was playing on that server in August 2009. China 49.2%, Poland 32.7%, Germany 3.6%. F A third of the players were in Poland. The West was already inside before the leak.