Hi everyone. Jason Scott, software curator at the internet archive.
I'm sure I'll get in touch with these folks to understand details, but I just wanted to make it known that if you do encounter what you think are false spam or malware issues, you can always email me directly at jscott at archive.org.
It sounds like they've been having these issues for a while now, why is it that they had to get the attention of "the manager" in order for anything to be done?
Not just for this instance, but in general... should I start emailing bank CEOs every time I get rejected for a house loan, or Henry Ford's children every time my mechanic refuses to service my car because of a defect they refuse to acknowledge?
The internet archive has a little over 100 employees and a smallish team to deal with issues. I'm no manager, just the person who helps folks with software upload issues.
Also, you should always mail the ceo of a bank if you get rejected for a loan if you think it was done unfairly.
It's a bunch of people doing non-profit work. This comment reminds me of that Microsoft SWE posting on ffmpeg that they had to fix a high priority issue.
It's especially bizarre that ROMhacks would be suppressed from IA, when IA has played host to plain-old 100%-infringing ROMs for years now, with nobody seeming to care.
(I will not directly link to these collections, for the fates are cruel. I'll just say that these IA collections are 'complete' per-console ROM collection archives created by "GoodMerge", a ROM collection validation and repacking tool — and are named very intuitively given that.)
Per the post, the takedowns are due to false positive malware flags, not because of copyright takedowns. So I guess the unmodified, 100% genuine ROMs don't trip the malware detection, whereas the mods do?
The mention that it is the patchers for the ROMs that AVs/Antimalware are flagging, presumably due to them employing similar methods to those employed by malware.
It’s probably too long form and stream of consciousness, but a few weeks ago I looked at GameShark “codes” and what they look like in when we having matching decompiled code and can we decompile a GameShark modded function. https://m.youtube.com/watch?v=h4398rWE1kg
Short answer is that no compiler would produce similar code and it’s probably a red flag that there’s odd dead code, jumps, or places where padding or nops are expected but there is code.
Rom hacks are more in depth, but often play the same tricks because they need to fit into possibly sections they shouldn’t exist in (say, code in BSS), encode instructions in a way that known compilers wouldn’t, long jumps to odd places.
No virus scanner understands how to run game console executables and could detect unusual code layout in ROMs, nor do they want to because those aren't viruses.
I’m not sure which rom hacks were being flagged, but most consoles use CPUs that were also at one point used in computers or phones as well. Is it likely that a virus scanner is going to flag a MIPS binary (PS1, PS2, N64)? Probably not. But what’s the difference to a virus scanner whether an x86, PowerPC, or ARM binary is meant for a console, phone, or a computer.
Or more simply, it could be packed with a README that links back to a modding group that hosts stuff on a site with malware or other “hacker” tools.
I thought ROM hacks were just modified ROMs, not programs that modify ROMs. In any case, that still wouldn't make much sense. Surely an automatic patcher is a pretty trivial piece of software, system-wise. It just reads a binary file and writes out a different binary file after doing some in-memory manipulations. Why would a an AV flag such a program? I don't buy this explanation.
EDIT: Furthermore, what's the proposed workflow? Does the Internet Archive run AVs over its collections? There's no way, right? That would be a massive compute expense.
> I thought ROM hacks were just modified ROMs, not programs that modify ROMs.
Distributing a modified ROM is as much copyright infringement as distributing the base ROM itself, so generally hacks are distributed as just the patch file and you have to provide your own copy of the base ROM and patch it from there.
It sounds like this site is packing the two together, and the patchers are causing the flagging issues. That also to me seems like the simple solution is to not do that and just distribute the patches without the software and have a note in the description pointing to a separate source for the patcher.
> Surely an automatic patcher is a pretty trivial piece of software, system-wise. It just reads a binary file and writes out a different binary file after doing some in-memory manipulations. Why would a an AV flag such a program? I don't buy this explanation.
A virus that wants to infect other executables on the system is going to have patching code in it where it's relatively rare in "legitimate" software so it makes sense for antimalware heuristics to find it suspicious.
I think you're just guessing here without an accurate mental model of what is being described.
> It sounds like this site is packing the two together,
1. No; as you said, no ROM hacking site distributes the original ROM. This one is no exception. They don't want to flagrantly violate copyright. (And in fact, modern patch formats — xDelta, UPS, BPS — are designed to avoid even minor "quotations" of the original copyrighted material, by using "copy offset:length" ops, or by storing partial/sparse patch segments as XOR deltas of the old and new files.)
> and the patchers are causing the flagging issues
2. No ROM hacking site distributes a patcher executable along with the patch. It'd be a huge waste of both bandwidth and storage space on their CDN. Besides the very reason coming up here (novel archives containing executables make anti-virus programs unhappy), there's also the fact that modern emulators, when loading a ROM, will auto-apply a patch in-memory if one is found in the same directory + with the same basename as the ROM. (Similar to how VLC auto-loads subtitle files if found beside a video file.) Creating an on-disk modified ROM using an explicit patcher utility is, for the most part, unnecessary today.
FYI, I downloaded the first ROMhack I saw from the referenced site (romhack.ing). It was a .zip file. Decompressing it, all it contained was a set of .ips files (variants of the patch) and a README.txt.
In short, there is no inherent, structural reason that a site hosting only archive files like this one, would trigger any anti-virus system.
>A virus that wants to infect other executables on the system is going to have patching code in it where it's relatively rare in "legitimate" software so it makes sense for antimalware heuristics to find it suspicious.
Sure, but what an AV is going to look for is code that manipulates executable files, not random binary files. If the patchers are designed to apply patch files to ROMs rather than having the patches embedded then it makes even less sense that they get flagged.
IA has always been a little haphazard with regards to copyright. Console ROMs aren't the half of it; they have an absolutely massive collection of old movies and TV shows.
Did they host the full ROMs or patch files? Seems to me the patches would be safe to host ... but I could still see legal action taken even if the patches were legal and non-infringeing.
ROMs, both modded and unmodded. For years, the most reliable way to get Fire Red (U) (Squirrels), which is one of the most used base Pokemon ROMs for modding is the Archive. Luckily it's still there with 1,574,966 views.
How expensive is it to run these archives through a zipping software with encryption as part of the mirroring process? I don't have any real context to know how large these file archives are...
In that case, how about using extremely trivial encryption (eg., XOR every byte with 0x3B) and on the website give a one-line perl command to decrypt. Now it's random data and not a known format (like a password-protected zip file).
Of course, any AV company could add a rule to their signature checking to undo the XOR if they were targeting the romhack.ing site, but it sounds like they aren't being targeted but just getting caught up in the dragnet.
The founder of romhacking.net announced it was shutting down in August 2024 due to some kind of internal drama. Romhack.ing was established as a spiritual successor shortly thereafter. However, romhacking.net appears to have avoided shutdown after all, and is still operating and accepting submissions as of August 2025.
Hi everyone. Jason Scott, software curator at the internet archive.
I'm sure I'll get in touch with these folks to understand details, but I just wanted to make it known that if you do encounter what you think are false spam or malware issues, you can always email me directly at jscott at archive.org.
Update, we're good.
It sounds like they've been having these issues for a while now, why is it that they had to get the attention of "the manager" in order for anything to be done?
Not just for this instance, but in general... should I start emailing bank CEOs every time I get rejected for a house loan, or Henry Ford's children every time my mechanic refuses to service my car because of a defect they refuse to acknowledge?
The internet archive has a little over 100 employees and a smallish team to deal with issues. I'm no manager, just the person who helps folks with software upload issues.
Also, you should always mail the ceo of a bank if you get rejected for a loan if you think it was done unfairly.
It's a bunch of people doing non-profit work. This comment reminds me of that Microsoft SWE posting on ffmpeg that they had to fix a high priority issue.
https://trac.ffmpeg.org/ticket/10341#comment:4
> should I start emailing bank CEOs every time I get rejected for a house loan
That's literally how customer service in many industries works, yes.
Consider writing an actual letter to the CEO instead. I suspect it will more likely stand out.
It's especially bizarre that ROMhacks would be suppressed from IA, when IA has played host to plain-old 100%-infringing ROMs for years now, with nobody seeming to care.
(I will not directly link to these collections, for the fates are cruel. I'll just say that these IA collections are 'complete' per-console ROM collection archives created by "GoodMerge", a ROM collection validation and repacking tool — and are named very intuitively given that.)
Per the post, the takedowns are due to false positive malware flags, not because of copyright takedowns. So I guess the unmodified, 100% genuine ROMs don't trip the malware detection, whereas the mods do?
The mention that it is the patchers for the ROMs that AVs/Antimalware are flagging, presumably due to them employing similar methods to those employed by malware.
I half read that but didn't absorb it fully. I wonder what about a ROM matches the signature of malware.
It’s probably too long form and stream of consciousness, but a few weeks ago I looked at GameShark “codes” and what they look like in when we having matching decompiled code and can we decompile a GameShark modded function. https://m.youtube.com/watch?v=h4398rWE1kg
Short answer is that no compiler would produce similar code and it’s probably a red flag that there’s odd dead code, jumps, or places where padding or nops are expected but there is code.
Rom hacks are more in depth, but often play the same tricks because they need to fit into possibly sections they shouldn’t exist in (say, code in BSS), encode instructions in a way that known compilers wouldn’t, long jumps to odd places.
No virus scanner understands how to run game console executables and could detect unusual code layout in ROMs, nor do they want to because those aren't viruses.
I’m not sure which rom hacks were being flagged, but most consoles use CPUs that were also at one point used in computers or phones as well. Is it likely that a virus scanner is going to flag a MIPS binary (PS1, PS2, N64)? Probably not. But what’s the difference to a virus scanner whether an x86, PowerPC, or ARM binary is meant for a console, phone, or a computer.
Or more simply, it could be packed with a README that links back to a modding group that hosts stuff on a site with malware or other “hacker” tools.
A ROM does not. A ROMhack, however, might. A ROMhack injects code into a ROM, the same way a virus or Trojan might inject code into an executable.
I thought ROM hacks were just modified ROMs, not programs that modify ROMs. In any case, that still wouldn't make much sense. Surely an automatic patcher is a pretty trivial piece of software, system-wise. It just reads a binary file and writes out a different binary file after doing some in-memory manipulations. Why would a an AV flag such a program? I don't buy this explanation.
EDIT: Furthermore, what's the proposed workflow? Does the Internet Archive run AVs over its collections? There's no way, right? That would be a massive compute expense.
> I thought ROM hacks were just modified ROMs, not programs that modify ROMs.
Distributing a modified ROM is as much copyright infringement as distributing the base ROM itself, so generally hacks are distributed as just the patch file and you have to provide your own copy of the base ROM and patch it from there.
It sounds like this site is packing the two together, and the patchers are causing the flagging issues. That also to me seems like the simple solution is to not do that and just distribute the patches without the software and have a note in the description pointing to a separate source for the patcher.
> Surely an automatic patcher is a pretty trivial piece of software, system-wise. It just reads a binary file and writes out a different binary file after doing some in-memory manipulations. Why would a an AV flag such a program? I don't buy this explanation.
A virus that wants to infect other executables on the system is going to have patching code in it where it's relatively rare in "legitimate" software so it makes sense for antimalware heuristics to find it suspicious.
I think you're just guessing here without an accurate mental model of what is being described.
> It sounds like this site is packing the two together,
1. No; as you said, no ROM hacking site distributes the original ROM. This one is no exception. They don't want to flagrantly violate copyright. (And in fact, modern patch formats — xDelta, UPS, BPS — are designed to avoid even minor "quotations" of the original copyrighted material, by using "copy offset:length" ops, or by storing partial/sparse patch segments as XOR deltas of the old and new files.)
> and the patchers are causing the flagging issues
2. No ROM hacking site distributes a patcher executable along with the patch. It'd be a huge waste of both bandwidth and storage space on their CDN. Besides the very reason coming up here (novel archives containing executables make anti-virus programs unhappy), there's also the fact that modern emulators, when loading a ROM, will auto-apply a patch in-memory if one is found in the same directory + with the same basename as the ROM. (Similar to how VLC auto-loads subtitle files if found beside a video file.) Creating an on-disk modified ROM using an explicit patcher utility is, for the most part, unnecessary today.
FYI, I downloaded the first ROMhack I saw from the referenced site (romhack.ing). It was a .zip file. Decompressing it, all it contained was a set of .ips files (variants of the patch) and a README.txt.
In short, there is no inherent, structural reason that a site hosting only archive files like this one, would trigger any anti-virus system.
>A virus that wants to infect other executables on the system is going to have patching code in it where it's relatively rare in "legitimate" software so it makes sense for antimalware heuristics to find it suspicious.
Sure, but what an AV is going to look for is code that manipulates executable files, not random binary files. If the patchers are designed to apply patch files to ROMs rather than having the patches embedded then it makes even less sense that they get flagged.
An executable is a random binary file...
Every file is binary. So are AVs going to start flagging every program that does anything to any file?
IA has always been a little haphazard with regards to copyright. Console ROMs aren't the half of it; they have an absolutely massive collection of old movies and TV shows.
IA works the same way as much of the internet, they allow users to upload whatever and respond to DMCA claims.
Congrats for making 45 millionth comment on HN
What do you mean?
Your comment was 45 millionth one.
https://news.ycombinator.com/item?id=45000000
Did they host the full ROMs or patch files? Seems to me the patches would be safe to host ... but I could still see legal action taken even if the patches were legal and non-infringeing.
ROMs, both modded and unmodded. For years, the most reliable way to get Fire Red (U) (Squirrels), which is one of the most used base Pokemon ROMs for modding is the Archive. Luckily it's still there with 1,574,966 views.
I don't see any ROMs and the ToS say no uploading modified or unmodified ROMS.
https://romhack.ing/help/rules
they=IA
How expensive is it to run these archives through a zipping software with encryption as part of the mirroring process? I don't have any real context to know how large these file archives are...
A password protected zip file is just as suspicious to AVs as the original rom
In that case, how about using extremely trivial encryption (eg., XOR every byte with 0x3B) and on the website give a one-line perl command to decrypt. Now it's random data and not a known format (like a password-protected zip file).
Of course, any AV company could add a rule to their signature checking to undo the XOR if they were targeting the romhack.ing site, but it sounds like they aren't being targeted but just getting caught up in the dragnet.
No av company is detecting roms. They aint pc executables
Blog post says at the bottom: >We are open to alternative solutions and support on the matter.
None of this make sense.
Did they check to see if their service has been compromised?
Why would Windows Defender flag GameBoy ROMs as malware?
Does a GameBoy ROMs website really mirror all 45 petabytes of Internet Archive?
Is this site relating to romhacking.net? It seems very similar. I know they only hosted patches.
The founder of romhacking.net announced it was shutting down in August 2024 due to some kind of internal drama. Romhack.ing was established as a spiritual successor shortly thereafter. However, romhacking.net appears to have avoided shutdown after all, and is still operating and accepting submissions as of August 2025.