View difference between Paste ID: zuWrnkdd and p4jen38n

 Mario Multiverse - Should you trust it?
 
 TL;DR - No.
 
 
 
 If you're reading this, you're likely a fan of Mario. You likely enjoy Super Mario Maker, or if not, it's fangame equivalents.
 
 There's many. Super Mario Remaker, Super Mario UniMaker, and so on. But one of them that rose to popularity recently is Mario Multiverse.
 
 
 Mario Multiverse, while in beta, has been promoted very much via the method of Youtube Videos. The game has spread quite a bit because of this.
 
 Despite being in a beta, it's quite impressive. A full level editor, many themes, assets, as well as a full online system for sharing Super Mario courses.
 
 You can obtain this impressive, expansive fangame, not through a website, not through a download link, but by sending an email.
 
 
 By sending an email, you probably won't acknowledge, but will benefit from the fact that you likely won't get a reply. It can be days, weeks, or longer until you get a response.
 
 But when you do, you won't get a download link, however, you WILL get a discord server invite.
 
 This discord server is the Gateway server, where you will insert the reason why you want to get into the game. The way it gets chosen is not by how well you can beta test, but if you want to get in. The game accepts anyone who applies, undetermined by whether you can actually test a product out. After the gateway server, you will get sent a link in Direct Messages (which means you will have to enable DMs for the server) to the main server, but your adventures are not done yet.
 
 The process to play the game is strange. For starters, you will need to go to a channel and write your country and timezone.
 
 Next, you'll need to go through a google form. It'll need your e-mail address, ask what method you came to the game, who told you or invited you to play the game, your real name, your discord name, your age, your country, the reason you want to become a beta tester, and what you'll do as beta tester.
 
 When you're done with this, you'll want to ask a moderator to check it, or the creator. After they check, you'll become a beta tester!
 
 Next, you can download the game! Hooray! A bit of work, huh? At least it's about to be all worth it.
 
 When you download the game and run it, insert your information, and you'll obtain a.. registration ticket and the game asks you for a code.
 
 Next step is to send the developer the ticket, and they'll give you a code. Insert the code, and the game will autoupdate and be functional.
 
 
 
 
 
 
 ...man, that was quite a bit
 
 
 If you're still reading, congratulations. Now it gets interesting.
 
 
 In rules, it's specified that you should "not try to hack the game's memory by using external tools", and "the game will detect it and then you'll use your account."
 
 Huh?? You may be asking how this will make you lose your account. Well. The activation process ties into this. When you play the game, it gathers your Discord user data, caches it in an encrypted json file, and utilizes it to play the game. If the game cannot verify a discord account connection, it will utilize the cache.
 
 From the generated log file.
 
 22:37:59][ ] =============================================================
 [22:37:59][ ] Hello!
 [22:37:59][ ] - Version = 5.8.0.3461
 [22:37:59][ ] - RootDir = C:\Users\<REDACTED FOR PRIVACY>\Desktop\Games\Mario Multiverse
 [22:38:01][ ] Joystick enabled: false
 [22:38:03][ ] [00000][Game] InitState: [7]Logo
 [22:39:06][ ] [Auth] Discord connection failed!
 [22:39:06][ ] [OldAuth] Get ticket.
 [22:39:07][ ] [OldAuth] Load user from cache.
 [22:39:07][ ] [OldAuth] User's permission: 1
 [22:39:07][ ] [OldAuth] Updating some user info.
 [22:39:07][ ] [OldAuth] Checking users cache.
 [22:39:07][ ] [OldAuth] Done.
 
 In addition, if you change your password, your discord token (pretty much the key to obtaining your discord account) will change. If this happens, Mario Multiverse will detect this.
 
 From the generated log file.
 
 [15:09:25][E] [Auth] User ID mismatch! (Auth != Config) <Auth=<nope>, Config=>[15:09:25][ ] [00146][Game] ChangeState: Logo -> RegisterUser
 [15:09:25][ ] [00146][Game] InitState: [16]RegisterUser
 [15:09:25][ ] [Register] Checking ticket
 [15:09:25][ ] [Register] Registering user (Updating permission) <LoadedUid=, Ticket.Uid=<nope>>
 [15:09:25][ ] [Register] (Case2) Updating permission
 [15:09:26][ ] [00187][Game] ChangeState: RegisterUser -> Logo
 [15:09:26][ ] [00187][Game] InitState: [7]Logo
 
 
 But Wait! IT GETS WORSE!
 
 
 Imagine the setting. Power outage. Everything's black, you head for your laptop in the dark for some games for some entertainment until the lights return. "Hmmm," You think. "I think I'll play some Mario Multiverse!" You load the game, and.. it doesn't work.
 
 
 DRM.
 
 
 If your discord account or internet is not available for whatever reason, Mario Multiverse will not function. It seems, somewhat understandable. After all, if someone just decided to leak the game, there's nothing stopping someone from just playing it, right? Well, not quite. That whole lengthy activation process? This was it's purpose. It requires your discord account to function properly. Not only that! It scans your entire Discord Server list, checking for Multiverse's server, and then it checks if you have the beta tester role. If you don't, the game won't function, because you're not authorized. This can be proven by looking at the first Mario Multiverse log file also known as the one you get when you download the game for the first time.
 
 From the generated log file.
 
 [00:38:19][ ] [Auth] Beta Tester confirmed.
 [00:38:20][ ] [Auth] Cannot find AuthInfo, checking ticket.
 
 When it says that Beta Tester is confirmed, that means that it has successfully found that you are in the server. But how so? It checked your discord client server listing. To add proof to this, the game didn't ask for your discord ID until later on in the process
 When it says that it cannot find AuthInfo, it means that it couldn't find the verification code.
 
 However, remember that about leaking? What if you DID leak the game? Well, let's just say, well, according to the creator, that they can "find you." It's unclear if this means the creator will identify who you are by Discord account or real life location.
 
 
 It doesn't end at Discord data.
 
 
 What if you installed a program one day, and it randomly started attempting to write to system32? Weird, right? Wait, why am I mentioning this? put the pieces together, yes, Mario Multiverse's exe file did attempt this.
 
 https://media.discordapp.net/attachments/318573709948485632/567909548497567744/unknown.png
 
 In the creators' words,
 
 "Game doesn't write file into your system directory
 it's supposed to write game folder.
 but with your privilige, some system API returned wrong path".
 
 Not only this. Imagine if you closed a program, and it seemed to do so, but it lingered in the background, watching, but you found it in task manager? That also happened. (I would post proof, but the user was too freaked out and panicked and killed the process.)
 
 The game also scans folders, and will detect if one has been modified. Lets say you had all your stuff at C:\Users\MarioMultiverseUser\Desktop\MarioMultiverse\minimal and you moved it all to C:\Users\MarioMultiverseUser\organize\MarioMultiverse. The game will detect that and give you the following error
 
 [18:01:44][ ] [!FIX!] Invalid filetime detected: C:\Users\MarioMultiverseUser\Desktop\MarioMultiverse\minimal\D3DX9_42.dll
 
 In addition, the creator states that in a newer version of the game, titled the "minimal package", that it will "have more information about you".
 
 The game also requires admin permissions to work properly, plus, despite gathering information, does not have a privacy policy.
 
 proof: https://cdn.discordapp.com/attachments/371531450182402081/581356433501585408/unknown.png
 
 Hey! Remember that encrypted json that stores user data? With the game pretty much gathering your discord token, IP address, discord server list, discord roles, and likely MUCH more personal data, it should be noted you won't be able to decrypt that json. It is encrypted in a format that only the creator, neoarc, knows how to decrypt. Which means that the game is obtaining your personal private data, encrypting it in an unknown format, and doing god know's what with it. And if Sonic Gather Battle is any example, there's nothing stopping neoarc from uploading it to a server and keeping it there, and using it for unknown purposes. (It should be noted neoarc DOES own a server for game courses, etc.)
 
 
 If you're still reading this, congratulations. I shouldn't have to tell you this, but please, DO NOT DOWNLOAD THIS GAME. As if all of this wasn't enough, I ask you for your own privacy to not download the game.
 
 
 Thank you for reading this.