[Release] Evidence showing a possible LPGL violation in the Shaiya client

[pushedx]

About - short and sweet version:

- I am under the impression that there is a possible LGPL violation in the Shaiya client.
- I have put together a package of evidence supporting my claim.
- Anyone who is interested in taking the time to pursue the manner or investigate more can do so.
- Likely outcomes include (in order of most probable to least probable):
* No action taken (copyright holders ignore the issue, Aeria drags out a lengthy and time consuming legal process)
* A new client being released that does not violate the LGPL (another DLL would be added)
* Object files of the client + specific code of the LGPL library in use being released to satisfy the LGPL license terms.
* Source code of the client being released (won't happen).
+ As a bonus, the new client will probably be packed with themida or some other protector so they don't have to worry about more legal issues.

I will not be taking any action myself. I am only sharing what I have found for anyone interested. I really don't expect anything to come of this, but you never know if the right people press the issue.

About - tl;dr version:

As I was reversing some stuff in the client, I came across some things I decided to look up. Turns out, I found a lot of references to a LGPL library that has been statically compiled into the EXE. I decided to put together package of evidence and release it in case anyone was interested in this kind of stuff.

This package of information is collected evidence that strongly points towards a LGPL violation in AeriaGames's Shaiya MMO. Briefly described below is the contents of this package.

ss0.PNG - The current unmodified Shaiya directory. From this, you can see that there are only two DLLs and a number of data files.


ss1.PNG - A table compiled directly into the EXE. As shown in the source file, it is part of the GNU MP Library.


ss3.PNG / ss4.PNG / ss5.PNG - ss3 and ss4 are screenshots of code taken from the MP Library. When code is compiled strings are embedded into the EXE. ss5 shows these two strings in the Shaiya EXE. When code is compiled, compilers layout object files sequentially in memory. Notice how code is missing from the source, because DEBUG mode was not enabled (as it shouldn't be for a deployment version).


ss6.PNG - Another string embedded into the EXE and the reference source code. Following the JMP at the end of the code should land you into logic for abort().


ss7.PNG - Another table embedded into the EXE. This type of information cannot be "random", it is clearly part of the library.


ss8.PNG - More string data embedded into the EXE. As ss7 showed, this type of data could not be possibly random and coincidently lie in the EXE if the library was not used.


ss9.PNG - This shows a source file that was compiled directly into the EXE and the reference the compiler left. This happens when you statically link a library into an EXE.


ss10.PNG / ss11.PNG - These screenshots explain exactly why the evidence shown in this package is important and why I believe this is a clear LGPL violation.


gmp_homepage.txt - The home page of the library in question.

Using LGPL code for commercial application.txt - The link for ss11.PNG

Violations of the GNU Licenses.txt - A link to an important note about such
violations if the reader wishes to pursue action. Action will only be taken
against a violation if the *copyright holder*, in this case GNU MP, wishes
for such to be done.

ref - The folder or reference material taken at the time this evidence
was put together. The exact version of the library being used is unknown.

VirusScan:
(One funny false positive)

Download:
Attached (screens + code + binaries of the game version)

Just throwing this out there, as I said before, I don't expect anything to come from this. Basically, to pursue the matter you would have to:
1. Request object files or source of the Shiya client from Aeria games.
2. When denied, contact the GNU MP project reporting the possible violation and ask them if they would be interested in having action taken.
3. If they say yes, contact the team (after having carefully read that page).
4. Sit back and wait weeks, months, years... Yea, a lot of work for little reward, other than possibly have taken part in a David vs Goliath match.