8

Not sure if this is the correct place to post this, but I am having some questions regarding the legality of reverse engineering firmware.

Specifically, I was looking into the Nintendo 3DS firmware. The EULA clearly states:

You may not publish, copy, modify, reverse engineer, lease, rent, decompile, or disassemble any portion of the Software, or bypass, modify, defeat, tamper with, or circumvent any of the functions or protections of your Nintendo 3DS, unless otherwise permitted by law.

Code of Conduct:

To help keep the Network Services friendly and safe for all users, you will not engage in any harmful, illegal, or otherwise offensive conduct, such as:

Trying to modify or gain unauthorized access to another person’s Nintendo Device or Network Account or trying to modify, reverse engineer, or gain unauthorized or automated access to any of Nintendo’s computers, hardware, software, or networks used to provide the Network Services or any feature of a Nintendo Device;

Hosting, intercepting, emulating, reverse engineering, or redirecting the communication protocols used by Nintendo as part of a Nintendo Device or the Network Services, regardless of the method used to do so; or do anything that might bypass or circumvent measures employed to prevent or limit access to any area, content or code of any Nintendo Device or Network Services (except as otherwise expressly permitted by law);

And yet you see blog posts like these: http://gaasedelen.blogspot.ca/2014/03/depackaging-nintendo-3ds-cpu.html

My question is, what are the legal implications of reverse engineering the 3DS firmware and posting your finding in a blog post?

  • I'd argue that, since this was evidently done for academic purposes, different rules apply. – 0xC0000022L Dec 6 '19 at 7:48
8

This depends on a multitude oft things, especially your location, and you should really ask a lawyer. If Nintendo sues you, "a random guy in the internet said it was ok" won't help you anything; your lawyer can at least help you in court and should have insurance to cover up if things really go wrong.

There are limits to what an EULA can forbid you to do. But this depends a lot in your location. In the US, EULAs tend to overrule rights that laws give you, in EU, law tends to overrule EULAs. There is an EU directive that, greatly simplified, says you are allowed to reverse engineer stuff if you want to interface it with other stuff and the manufacturer doesn't give you neccesary documentation.

This is sometimes misinterpreted to mean "as long as you live in the EU, reverse engineering is ok". This is wrong. A EU directive is not comparable to US federal law; it just means the individual states have to pass laws with a general content. They have considerable leeway in doing so, and sometimes, EU directives don't get turned into national law at all. So what might be ok in one state might not be in another one. Or, you might be required to prove you asked for documentation and were refused before you reverse engineered anything.

And even the existance of a blog post does not mean the blogger isn't breaking any laws. Nintendo might just not know about the post, or not care, or not want to draw the attention a lawsuit means. This doesn't mean they won't sue you.

And of course, you may be doing something that turns out to be legal after a 3 year lawsuit that cost you several dozen thousand dollars. Companies have far greater resources than you do; winning your case in the end can still mean lots of trouble in the first place.

So, any advice you can get on the internet will be bad advice. Don't take it. Ask someone who can take into account the specifics of your situation, and whom you can hold responsible in the case of bad advice.

| improve this answer | |
  • 1
    Good summary. To boot, even if EU/local law allows us to stick our noses under the hood, that does not necessarily mean that we are allowed to tell third parties about what we see there (least of all the world at large). – DarthGizka Apr 3 '16 at 5:24
  • 2
    I really want to point out something: in a world controlled by code, reverse engineering creates transparency. If you REALLY need to put some information on the internet, creating a fake account with a proxy (Tor, whatever) and posting it is enough. If it's THAT important it'll get spread, and suing won't be an effective tool to censor it. They can't sue you (the author) because you're anonymous and they can't go around sueing everybody that shares the information. – rev Apr 3 '16 at 15:32
  • Law always overrules a EULA (it's why the salvatory clauses exist, usually at the end of contracts, so that some invalid provision in a contract doesn't invalidate the whole contract). Good point about EU directives not being law, though. Also I wholeheartedly agree that a lawyer needs to be consulted when unsure (which is, after all, why the question was posited). – 0xC0000022L Dec 6 '19 at 7:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.