Two events, not one

September 2009: the binaries come out, and the figure of the private server administrator is born. January 2014: the sources come out, and the figure of the developer is born. Whoever conflates the two understands nothing of the scene. The second event has a name, kraizy.tgz, 2,792,119,901 bytes, SHA-256 fa557c38…, which appeared on an international private-server forum on January 2, 2014, with the fingerprints made public six days later. F

Where from

The email of November 25, 2013, 12:34, from Christopher Chia (TEC Interactive, the Singapore licensee) to Webzen Ymir, subject "SERVER FILE LEAKAGE", reproduced in full with headers on a Brazilian forum in 2014, says where they were taken from: Ymir's Korean patch server. F Where is not a mystery: when is.

The window

It was only known that the theft happened somewhere between September 11, 2013, the last dated line left by the developers in the code (battle.cpp), and November 25, the day of the report. Ten weeks of darkness. F

The answer was in a derived package, a tar archive that still preserves the original modification dates. 76% of the files carry 2013 dates, and the last ones, in order, read:

2013-09-24  22:14   share/data/monster/spider_egg/motlist.txt
2013-09-24  21:50   ...
2013-09-24  12:11   ...
        (four months of absolute silence)
2014-01-22  12:54   game/ch1/ch1_core1/data

The last touch of a Ymir hand is on September 24, 2013, at 22:14. F Then nothing, until the scene starts working on it, on January 22, 2014.

The proof by absence

There is a second piece of evidence, made of what is missing. Among the material there is event_easter_2013.quest, the Easter 2013 quest: the last server-side event content with a date. F There is nothing for Halloween 2013, and nothing for that year's Christmas. A server alive in November would have had at least the Halloween quests. That server had stopped living before autumn.

The window narrows from ten weeks to two: between September 24 and early October 2013.

The Korean context

Metin2 had shut down in Korea on March 7, 2013, at 15:00, without appearing in any Webzen corporate filing. F In July, Ymir's CEO after the acquisition, Kang Ji-hoon, leaves and founds another company. F In August the old Gameforge 4D is merged into Gameforge Berlin (formerly Frogster). F On October 11, 2013, in Seoul, 中广网 obtains for China the exclusive rights to "倚天2 Europe 2.0 and subsequent versions": six weeks before TEC's email, the "Europe 2.0" branch was being handed over to Beijing. F September 24, the last modification; November 25, the report; January 2, the file goes public. A game in retreat is not watched over: it had already happened in 2009.

One single tarball in twelve years

No new source leak is recorded after 2014. F The "Vanilla" core was in turn stolen in 2015; the derived packages (mainline server + novaline client, formula coded on 8/29/2014) circulate as "34k", "40k", "40250", numbers that are Ymir's Perforce changelists (Version.py calls p4 changes -m1). F Modern assets reach the scene within days (Yohara: three days before launch; Aamon: six days after), but only client-side: the assets leak, the server never does. F Twelve years of a worldwide scene rest on 2.79 GB identical bit for bit to itself.