Legality of reverse engineering firmware

Question

Not sure if this is the correct place to post this, but I am having some questions regarding the legality of reverse engineering firmware.

Specifically, I was looking into the Nintendo 3DS firmware. The EULA clearly states:

You may not publish, copy, modify, reverse engineer, lease, rent, decompile, or disassemble any portion of the Software, or bypass, modify, defeat, tamper with, or circumvent any of the functions or protections of your Nintendo 3DS, unless otherwise permitted by law.

Code of Conduct:

To help keep the Network Services friendly and safe for all users, you will not engage in any harmful, illegal, or otherwise offensive conduct, such as:

Trying to modify or gain unauthorized access to another person’s Nintendo Device or Network Account or trying to modify, reverse engineer, or gain unauthorized or automated access to any of Nintendo’s computers, hardware, software, or networks used to provide the Network Services or any feature of a Nintendo Device;

Hosting, intercepting, emulating, reverse engineering, or redirecting the communication protocols used by Nintendo as part of a Nintendo Device or the Network Services, regardless of the method used to do so; or do anything that might bypass or circumvent measures employed to prevent or limit access to any area, content or code of any Nintendo Device or Network Services (except as otherwise expressly permitted by law);

And yet you see blog posts like these: http://gaasedelen.blogspot.ca/2014/03/depackaging-nintendo-3ds-cpu.html

My question is, what are the legal implications of reverse engineering the 3DS firmware and posting your finding in a blog post?

Answer 1

This depends on a multitude oft things, especially your location, and you should really ask a lawyer. If Nintendo sues you, "a random guy in the internet said it was ok" won't help you anything; your lawyer can at least help you in court and should have insurance to cover up if things really go wrong.

There are limits to what an EULA can forbid you to do. But this depends a lot in your location. In the US, EULAs tend to overrule rights that laws give you, in EU, law tends to overrule EULAs. There is an EU directive that, greatly simplified, says you are allowed to reverse engineer stuff if you want to interface it with other stuff and the manufacturer doesn't give you neccesary documentation.

This is sometimes misinterpreted to mean "as long as you live in the EU, reverse engineering is ok". This is wrong. A EU directive is not comparable to US federal law; it just means the individual states have to pass laws with a general content. They have considerable leeway in doing so, and sometimes, EU directives don't get turned into national law at all. So what might be ok in one state might not be in another one. Or, you might be required to prove you asked for documentation and were refused before you reverse engineered anything.

And even the existance of a blog post does not mean the blogger isn't breaking any laws. Nintendo might just not know about the post, or not care, or not want to draw the attention a lawsuit means. This doesn't mean they won't sue you.

And of course, you may be doing something that turns out to be legal after a 3 year lawsuit that cost you several dozen thousand dollars. Companies have far greater resources than you do; winning your case in the end can still mean lots of trouble in the first place.

So, any advice you can get on the internet will be bad advice. Don't take it. Ask someone who can take into account the specifics of your situation, and whom you can hold responsible in the case of bad advice.