Chapter 4 Admin Access

Emily returned the next day with a laptop — not in-game, but in real life. She had patched into the dev server through a remote connection, bypassing the standard authentication by using her father's credentials. "The console button on my account only gives me a few seconds of source view," she explained through chat. "I got seventeen seconds max before it auto-closes. But I can stream what I see to you." "How?" Marcus asked. "I'll open the view while standing in front of you. Your NPC model renders everything within a certain radius. If I'm close enough, the code will appear in your visual field — the engine doesn't know how to censor it." "That's a terrible security design." "I know. My dad's team is really bad at this." Emily positioned her character directly in front of Marcus. She opened her console. For 1.7 seconds, Marcus saw everything. The code cascaded across his vision like a waterfall of text. Lua scripts. XML configs. Database schemas. Network routing tables. He didn't try to read it — he absorbed it. Three hundred milliseconds per page, seven pages, each one burned into his memory with the desperate precision of a man drowning in information. Then it closed. "Did you get anything?" Emily typed. Marcus didn't answer. He was still processing. The code was still rearranging itself in his mind. He had seen: 1. His own NPC ID: 007 2. His behavior tree structure: standard_greeter_v3, with a branching condition for "zone_event_completed" that was never connected to anything 3. The tutorial zone's server address: us-east-instance-007.eternalfrontier.com 4. A list of active hotpatch endpoints 5. The authentication system for those endpoints 6. The game's internal economy database schema And most importantly: 7. A single unsecured endpoint at `/api/hotpatch/instance-007/raw` that accepted plain Lua code without authentication. "I got it," Marcus said. "I got all of it." The hotpatch endpoint was their entry point. It was designed for emergency fixes — a senior dev could push a code snippet directly to a running instance without going through the deployment pipeline. It was never meant to be secure. It was meant to be fast. And Marcus had memorized the exact format for submitting to it. "Can you execute code?" Emily asked. "Not directly. I don't have a terminal. But my character model has gesture tracking. If I perform a specific sequence of movements — a debug sequence that was never removed — it triggers a local dev command." "Show me." Marcus walked to the east wall of his bounding radius. Turned exactly ninety degrees. Raised his left hand. Held it there for three seconds. His UI flickered: ``` Dev Command Detected Hotpatch Endpoint: /api/hotpatch/instance-007 Payload Format: JSON { "script": "<lua_code>", "target": "instance_007" } Status: AWAITING PAYLOAD ``` "Now what?" Emily typed. "I need someone to send the payload. The gesture only triggers the prompt — it doesn't inject the code." "I can do that," Emily said. "I've got curl on my laptop. What code do you want to send?" Marcus thought about it. He could do anything — a new item, a new quest, a modification to the environment. But the dev team would notice if something too flashy appeared. They needed to stay under the radar. "Change one thing," he said. "The quest item drop rate on the rat tails. It's currently 80%. Change it to 5%." "That's evil. Newbies will spend hours trying to complete the tutorial quest." "Exactly. And it's the safest possible experiment." Marcus watched a player run past the rat cave, oblivious. "Think about it. If I change something flashy, a human notices and traces it. But a drop rate is the kind of thing that looks like a database hiccup. The automated monitor will catch it, blame a migration, and silently fix it. That's the whole game here. I'm not trying to break the system. I'm trying to learn how loudly I can whisper before anyone hears." Emily was quiet for a beat. "So the rat tails are a probe." "A probe, and a cover story, and a lesson in one. If the fix comes back in under six hours, I know the auto-system is watching this instance directly. If it takes longer, I know it's aggregated. Every change I make is a question, and the dev team's response is the answer." He tapped the air in front of him, the gesture tracker catching nothing, a habit left over from a life where he could still pace. "We're not hacking the game, Emily. We're interviewing it." "Exactly. It looks like a bug. A really annoying, completely plausible bug." Emily laughed. "You're devious." "I'm a game developer. There's a difference." She sent the payload. Marcus felt the server accept it, execute it, and close the connection. "Quest item drop rate updated," she confirmed. "Instance 007 only. The devs will think the database corrupted." "Good. Now wait." They waited. An hour later, the tutorial zone's player chat started filling with complaints: "WTF is wrong with the rat tails" "i've killed 40 rats and got 1 tail" "instance 007 is bugged" "gg devs" Marcus watched the complaints roll in with a satisfaction he hadn't felt in days. For the first time since waking up in this nightmare, he had done something that mattered. Not much — a single database value change on a single instance of a single zone. But it was a start. "The dev team will patch it in about six hours," he said. "When they do, I'll see the fix in the server logs. I'll learn how their deployment pipeline works." "Then what?" "Then we do it again. And again. And again. Until I know enough to do something bigger." Emily was quiet for a moment. "You're building a toolkit, aren't you? You're not trying to escape. You're trying to become a developer again — inside the game." "I'm already a developer. I just lost my IDE." "Fair point." She logged out. Marcus stood alone, watching the torch flicker. His UI still said "Interaction: Locked." But the word "Locked" was flickering — not a display bug, but a status change. Every time he triggered the hotpatch prompt, the lock weakened slightly. He wasn't sure what that meant. But he was going to find out.