The x8 demake zashiko mod situation

Hello, I'm Tchy, a "contributer" of the mod as zashiko calls us and also the main developer of the speedrun and awakening mods.

I would like to tell people the whole story and my history with zashiko:

I'm a speedruner for the original x8 demake, and back when version released 1.0.0.7, the game didn't have an in game timer and some people (including me) had very bad loading times, so I attempted to decompile x8d myself for datamining purposes (see damage values and whatnot), and to see if I could release a "speedrun version" myself with an in game timer (which I eventually did, but only after Alysson open sourced the game with an ingame timer already, so I just added features for the game to split on the timer automatically), after noticing how bothersome of a task it would be to make the decompiled game run again on other people's pc, I just gave up with the idea at that moment.

Then I learned about zashiko mod (which was known as "axl mod" at the time), so I went to the discord to ask if I could help on the coding side of things to add this timer. Then zashiko asked me if I had experience coding in godot and I sent him 2 games I made myself in the past, then through DMs he told me he actually had NO CODING EXPERIENCE WHATSOEVER, and that all of what he did was decompile the game with gdsdecomp, then made it playable again on other people's pcs and added axl with AI assistance (which nowadays I'm starting to doubt, he might be getting aid from a third party or is really good at playing dumb). Then he proceeded to hand me the same code I already had ripped straight from gdsdecomp, because he "didn't want people to see his code while it was unfinished". I edited the relevant files to add an ingame timer (which was different from what alysson ended up making) and also other files to add an option to trigger a glitch that skips the gateway stage almost entirely (on demake 1.0.0.7) but had a pretty convoluted setup. He manually added those in into his mod, and never actually gave me his code.

Alysson knew the mod existed, he was even in the mod's discord, and it was because of the mod's existence that the game was open sourced with its license stating that derivative works must be open sourced as well, this was, of course, a jab at zashiko so he would release the code as well. Zashiko promised to open source his mod "when it was finished", we now clearly know this will probably never happen, I was even willing to teach him git and github.

After that, I dedicated myself to help translate the new axl dialogues into spanish alongside Mint who wa translating them to Portuguese and the meme "hue br", so far no problems here. Then he started making zero for the mod, and asked me for advice. The code was awful, and I told him it was, then he got mad at me and never asked for code advice again.

At some point he released a beta build that had "an easter egg" that let you unlock zero (the one you see on 1.0.0.3 of the mod), and this beta was leaked, presumably by ruben (which was factually true, confirmed by himself), and Mint (he says he didn't and I trust him). At first zashiko didn't know this, and the ones who got their hands on this leaked version were quiet about it. Then he released 1.0.0.3, and some people instantly found the easter egg, which made zashiko suspicious and had an outrage banning people left and right, including testers like henry.

From this point on, zashiko went really silent, then started giving beta builds through dm to only a select few, one of those few was someone I knew and he told me about it, I wasn't really bothered by it, I just thought it was a bit childish.

Eventually zashiko started releasing these beta builds that had a server verification to see if you were a tester. Through the use of wireshark I found where the game was connecting to, and it was a barebones express.js server hosted on a site called glitch.me, I could see almost all files except an env file (which has configuration secrets), I even saw the json files where he stored the data. The data he stored were sha256 hashes of people's hardware_id (as printed by godot), and a sha256 hash of their ip address. I won't explain what a hash is here, but know that it's something easy to get from original -> hash, but near impossible to get from hash -> original. He actually has no idea of what your ip actually is in his records.

One of these builds with server verification was leaked, and zashiko made the rookie mistake of only verifying once and not removing a quick reset feature planted by alysson that would send you back to the disclaimer screen once you held F12.  So a lot of people got to play this leaked build, and whoever says "they had no idea it was leaked" are blatantly lying, because it has this same "enter your username" screen the public version has, and it would tell you "this build is for authorized testers only" if you weren't on zashiko's whitelist json.

Zashiko got wind of this and sent those messages with screenshots being spread around to Mint, calling him a monkey "like ruben" (both brazilians).

Around new year's, zashiko released one final test build that has the zero you see on the public build minus the zero weapons (and does make the server check several times through the game) and disappeared for months.

I did not play this last test build when zashiko released it to the testers, so after trying in vain to play it a couple of times, the server decided to blacklist me.

During zashiko's absence I tried many things to bypass the server verification, I used ghidra, wireshark, and even burpsuite to fool the game into connecting to a local instance of the same server, but not even that worked because the game employs certificate pinning (people who know will understand what this means). I could have tried harder to bypass it but just gave up. Zashiko heavily modified godot to keep his code as hidden as possible, he also changed the magic value of godot that spells something like "GDSC", to "FUCK" so gdsdecomp wouldn't even be able to parse it, and he also changed the way encryption works, and planted a dud encryption key that is just the sha256 hash of "look at that butt", it serves no purpose but to fool people of course. I know this fact about the key because zashiko was so sure I wouldn't be able to crack it that he told me himself.


Many months later, zashiko appears and releases a new test build and claimed that he would remove languages different from English and that he would not remove server verification from the public version just to gatekeep blacklisted people who got the leaked build from playing, but that he wouldn't store the hashes of people's ips anymore. He even hard coded some hardware ids, including mine so the game instantly closes, but since I already knew what it was, I just told him what mine was to delete it and I could play. Many of us told him this was a bad idea, but he wouldn't listen, I even told him the game would effectively die when the server doesn't exist anymore, but he claimed that there is a measure in place to bypass the server verification that "only a select few know of". Even though I got to play again, this was not the case for mint, they spoke through DMs, and zashiko sent mint that program that writes your hardware id to a text file and opens it (that's really all it does, it's made in godot as well), but mint refused due to security concerns. A bit later, Mint said he would leave the discord saying that he could not reason with zashiko about this verification measure, his general attitude and refusing to support multiple languages, accused him of being racist, then left.

A while later zashiko released this public build you see now.

TL;DR:
- Is the game malicious? Not really, or at least it won't do any real harm to your computer, just delete it if you want to be sure.
- Does it track my ip? No, it never had stored your actual ip address, only a value that can be obtained from it, but not the other way around (hash), and he's not doing it anymore (supposedly), play on a different computer if you're banned and the game should work (except steam deck, has to be windows).
- is zashiko a narcissist idiot? Definitely yes