Bytes	142,394,597
MD5	9e954c11cf065bdd647bfbb6d6fa9344
SHA-1	e5df2443f7997f4ed034590fd8dca9d133dac1b4
Internal date	gzip header: September 1, 2009, 13:02:29 UTC (mtime 1251810149, OS=Unix). Oldest internal file 26/2/2008 03:38:03; most recent game/auth, 12:58:59 of that same September 1: 3 minutes and 30 seconds pass between the last modification and the compression.
Possession	In the museum archive; bytes and MD5 verified. The same MD5 is independently attested in Hong Kong from 6/10/2009 (under the name game.tar.gz and the same 142,394,597 bytes), in Poland in April 2010, and in 2024 from Exynox's backup DVDs.
Preservation	Private museum archive, a single copy on an external drive. Never executed: only the tar's metadata, text files under 4 KB, and the strings of the three ELF binaries were read. It is not distributed.

What it is

It is the tarball from which the entire worldwide Metin2 private-server scene descends. It is not «the server»: it is the entire home directory of a FreeBSD user (/home/game), with auth, db and seven game channels (first, game1_1, game1_2, game1_3, game2, game61, game99), their CONFIG files, the auto.sh scripts, the logs, six memory images (game.core) from 60 to 353 MB, and the drop tables of the hongkong locale still under maintenance in August 2009.

The seven VERSION.txt files written by the game process at 12:48 on the last day say game svn revision 404 («with new ai»): the first Ymir repository revision number ever read directly. The auth carries revision 407. The compiler is GCC 3.3.3 FreeBSD from 2003; the db binary is compressed with UPX 3.00.

In the strings of the game binary there remain modules no private server would ever use: matrix_for_runup.cpp (the matrix card custom-built for the Hong Kong licensee), passpod.cpp with the address of the Korean one-time-password service, NETMARBLE_JP::Connect('210.174.197.180:10220') for Japanese billing, input_teen.cpp for Korean minor protection, and a private IP of the development network (192.168.16.53, devel). This is not a copy of the game: it is a copy of the workshop. Twenty-two modules present here (castle, monarch, roulette, block_country, TrafficProfiler…) no longer exist in the source that came out in 2014.

The machine it came from had LANG=zh_CN.eucCN (mainland Chinese) while the game data is in Hong Kong Big5; the memory images retain SSH_CONNECTION entries to two hosts in Shenzhen (121.12.173.58 and .49, port 5573, hostname www.idc.com) administered from three Sichuan addresses. This was not the publisher's own installation: it was a Longju-chain private server on rented hardware in a Chinese data center.

The evidence

• F Identical MD5 and byte count in three independent attestations: Hong Kong, 6/10/2009; Poland, 29/4/2010; Exynox, 17/3/2024.
• F Packaging date read from the gzip header; internal dates range from 26/2/2008 to 1/9/2009 12:58:59.
• F The name game0901 is the date: 09/01. The server was shut down (.killscript at 12:58:53) and packaged in the same gesture.
• F The 502 player connections in the memory images, geolocated offline: China 49.2%, Poland 32.7%, Germany 3.6%. In August 2009 a third of that server's players were in Poland: the West was already in before the leak.
• F No passwords, no emails, no account dumps: the tarball contains no personal data beyond the connection IP addresses, which the archive does not publish.

What it is NOT

• It is not yt2.rar (155,567,047 bytes), the parent archive published by rain: in all likelihood, it is its main content. See yt2-rar.
• It is neither «Korean» nor «mainland»: it is Run Up's Hong Kong/Taiwan build (LOCALE = big5, locale hongkong, OX quiz with info@runup.com.tw).

« back to the showcase