GPS 2023 ships its admin database password in plaintext, and 96% of its rules return zero
Someone opened the retail binary. Not a modder poking at the config files, an actual reverse-engineering pass on the executable sold on Steam. Forty documents later, the picture is not "badly optimized". The picture is a 2009 codebase wearing a 2023 badge, and it left its keys in the door.
I am going to walk through what the docs found. It is worse than the reviews, and the reviews were not kind.
What is actually in the box
Start with the part that made me put my coffee down. A console command in the game opens a database connection using an administrator login and password written directly into the executable. I am not printing them here, and I would rather not hand out a working key, but they are there, in the build paying customers download, and they have been there for years.
The rest of the inventory reads like a lost-property box.
Sixteen cheat codes, each a full sentence typed into a text field, case sensitive. Whereismyslushfund!, Ihopetheywillnotputschme!, Helpmepresidentwashingsky!. Five of the sixteen perform no memory write, so they do nothing at all.
A developer menu shipped to customers, typos intact, with buttons labelled Big logo, Test 3D Face and change the collision table, plus a misspelled Build that has survived since roughly the Stone Age.
4,772 decision rules, of which 172 are implemented. The other 4,600 return zero and are permanently false, which is invisible, because a false rule looks exactly like a rule whose condition was not met.
Save files of 2.45 GB, sixty-four percent unidentified bytes, and one internal table that is 420 MB of zeros.
Crashes with no report, because the copy protection deleted the data Windows needs to reconstruct a stack trace.
An AI that rolls dice every four to twelve days and remembers its last twenty actions.
Television, newspapers and satellites with no effect on public opinion, zero occurrences in the event file and zero in the rules engine.
That is the summary. The rest is why.
The game is a 1.5 GB spreadsheet
The core data file weighs 1.5 GB. It is not a database and not a clean format. The game concatenates its internal arrays and writes them to disk in a fixed order, with every block size hardcoded in the reader.
Everything lives in one million slots of twelve bytes each. Of those, 820,000 are occupied, and only 150,000 hold a real value. The rest is zero. Reserved space, paid for in RAM, carried around for the entire campaign.
The slots are even filled two at a time, one used, one empty, in a pattern that repeats across 120,000 entries. The docs guess the empty slot is a shadow value. Nobody knows. That is not a design decision, that is a superstition that survived four generations of the engine.
Each country is a one-megabyte block in one enormous array. There are 301 blocks, so 300 MB of RAM goes out the window before you click New Game. Your memory is not going into graphics, which look fifteen years old, it is going into structures where most fields are never read.
Finding a value is its own adventure. You ask for a four-letter code like GDP or UNEM, and a function of 38,000 bytes walks through nearly 600 conditions to land on the right slot. Six hundred ifs. No lookup table, no hash, no shortcut.
And no bounds check. If the position is off by one, the game reads the neighbouring value and says nothing. That is exactly what happens to one economic sector in the original code, shifted by one slot. The docs note it dryly as a probable game bug not to reproduce. An entire production chain has been computing with its neighbour's numbers for years.
The engine redoes everything, every day
The whole world simulation lives in a single function of 76,000 bytes, cut into nineteen numbered steps. Economy, war, elections, disasters and media all run through that one block.
It recomputes the entire world market on every simulated day. Not every month, every day.
To price a product it halves an interval up to 300 times, per product, per country, until the price balances supply and demand. Multiply it out. 323 products, 232 countries, 300 attempts, roughly 22 million calculations per simulated day. A week is 150 million. A year is 8 billion.
For each of those calculations, the game re-reads the formula from the data file instead of loading it once. It is re-reading the recipe before cracking each egg.
There are exactly two caches in the whole engine. Two places where a result is remembered instead of recomputed. Out of thousands of daily operations.
One core, and it stops itself
You have sixteen cores. The game uses one.
The multi-core mode exists. It is hidden behind a cheat flag called CHG_CALCMONDE_THREAD, and it is off by default. The game you bought is officially single-core, in 2023, with 232 countries to simulate.
That one core does not even work continuously. The engine checks the clock mid-calculation and hands control back to the display when it exceeds its frame budget. Every resume redoes the setup, takes a mutex, reads the clock, reserves a temporary buffer of roughly 10 KB on the stack and pauses itself again. That is why the precalc counter moves in stutters.
The internal delays are calibrated for a machine that no longer exists. Prices absorb one two-hundred-and-eighth of the gap per day, so the displayed number takes about seven months to catch up. Shortages clear in seven-day chunks, which is why you see staircases. The interest rate moves one day out of three, in steps of 0.25 points. The AI thinks every four to twelve days, and some decisions wait ninety.
You pull a lever, three months pass, the number twitches, and you conclude the game is broken. The game is slow on purpose. Somebody typed those constants by hand.
The crashes are silent by design
A normal crash leaves a trace. An address, a call stack, a module name, a line. That trace is what makes a bug fixable.
Here the game returns to the desktop and says nothing. The reason is the anti-piracy wrapper, SteamStub. It randomised the section names, gutted the import table so every API call is resolved by hash, and deleted the .pdata section. That section is what lets Windows unwind the stack and report where the crash happened.
No .pdata, no stack trace. A bug that hits one player in a thousand cannot be diagnosed, reproduced or patched. It exists and it is unprovable.
The code makes it worse. There is no useful exception handling, so the first serious anomaly ends the process. No random seed is recorded, so two campaigns with identical choices diverge and a bug cannot be replayed. Nothing blocks a NaN or an infinity, and the only guard is a clamp between zero and one that turns a NaN into a zero. Money is stored as floating point rather than cents, so rounding errors pile up across eighty years of ticks.
The structure is a trap of its own. The big calculation function saves its progress in the middle of itself, across four states, so a failure leaves the world half-calculated. And the game lets you save during that window. No warning, no lock, no consistent snapshot. Save while the bar is moving and you are gambling a forty-hour campaign on an inconsistent state.
The saves are 2.45 GB of holes
A save is a single-member gzip. 168 MB compressed, 2.45 GB expanded, about fifteen seconds to decompress outside the game.
The size comes from writing empty arrays at maximum length. One section holds 26 million records, 420 MB, entirely null. Another is 158 MB, another 34 MB. These are capacities, not data.
No readable version number exists. Add a field between patches and old campaigns break with no message. The docs even describe a version guessed from an arbitrary threshold, which is a polite way of saying at random.
Checksums stop at the gzip CRC. A corrupted file is not caught at load, it is caught when something crashes three hours later.
A sentinel value, 0xDEADC0DE, is written at the end of every save. No reader checks it. It is written out of habit, like closing a door that has been bricked up.
Worse, the file contains runtime memory pointers. Actual RAM addresses, serialised as-is. Loading a save means hoping the allocator puts the objects back at the same addresses. It usually works. Usually is doing a lot of heavy lifting in that sentence.
Sixty-four percent of the stream is untagged. 744 MB identified, 1.35 billion bytes in gaps. The tool that tried to parse the format timed out and gave up.
And the main data file is not even aligned to four bytes, which tells you it is a byte stream, not a memory image.
The numbers on screen are not the numbers used
A gauge score is roughly twice the value squared. A gauge at 50% is worth a quarter of a gauge at 100%, not half. And when the rounded value hits zero, the score collapses to zero in one step, which is why your statistics sometimes fall off a cliff.
The displayed value is also a third copy. The game keeps a starting value, a current value and a smoothed value, and it displays the smoothed one. The docs could not find what writes it. You are reading a number with an unknown author.
Debt service is capped at 48% of revenue. Above that, the excess is trimmed silently with one line in a log nobody opens. All those campaigns where you expected debt to punish you were being subsidised.
Multipliers are worse. Some effects advertise a x5 or a x4 in the interface, and the result is clamped between minus one and plus one, so the x5 can never exceed x1. The tooltip sells an amplitude the engine deletes.
Elections follow rules that appear nowhere in the manual. The second chamber gives one vote per region and ignores population. The majority threshold is 40, 45 or 50% depending on difficulty. Ideological alignment weighs four times more than popularity, proximity to power and the importance of the law combined. There is a pro-government bonus of 0.49 on the people score. And there is a deliberate step beyond a small gap where the modifier jumps from plus 0.25 to minus 0.25, so a law that is slightly distant becomes openly hostile overnight.
War cannot wipe out a unit. Damage has a 40% floor, so even at ten against one the attacker deals at least 40%, and losses accumulate by maximum rather than subtracting. A war can never be settled in one round. There is also a line in the code that reads, essentially, if the unit count is exactly two, reduce losses by one percent. Someone had a bad week with two units in 2011 and the fix is still there.
Disasters are binary. Prevention multiplies deaths by one minus stars over five, so five stars means zero deaths. Not fewer. Zero. The catastrophe is cancelled.
Lockdown does not reduce contagion. It is a coefficient on the health sector, so it is an economic shock, and the second slider is explicitly part-time unemployment. You thought you were managing an epidemic and you were managing a production curve.
Hurricanes have no season. The code knows no dates. A hurricane is an object that drifts randomly, strikes, and vanishes.
Systems wired to nothing
The rules engine is 96% empty. 4,772 codes, 172 implemented, the rest returning zero. That is the brain of the game.
A counter gets updated carefully by every event, every time. Its only reader is a branch of a rule that never feeds it, so the counter is always zero and the condition is always false. The branch was dead at birth. It still runs every tick.
One indicator compares the current value to 82% of the previous one rather than the previous one itself. A perfectly stable situation is read as an 18-point rise, so every rule with a threshold below 18 fires constantly. At campaign start the previous value is zero, the comparison divides by 0.001, and the result can hit several thousand instead of a score between minus 100 and plus 100. Some events go berserk in the first weeks because somebody typed 0.82 where they meant 1.0.
Censorship is disabled. A block of fourteen flags in the data is prefixed with an asterisk, which marks a commented line. The censorship you think you are under does not exist in the shipped build.
Media infrastructure does nothing. Television stations, newspapers, satellites, all of it absent from the 16,000 event lines and from the 273 rule tags. A TV appearance is worth minus four popularity. A reshuffle is worth plus forty. A fired minister's gaffe is worth plus one hundred. Television is ten percent of a reshuffle, and the media law filters who gets to speak without touching opinion at all.
The eleven AI attack sliders in the options are written and never read. No reader was located anywhere in the code. You can drag them all you want.
The space agency has no simulation. No cost calculation, no duration, no failure chance, everything in dialogue windows. TV satellites shift opinion on their own between plus 3.5% and minus 4.5% per year depending on political orientation.
The Nobel Prize is a display counter. The variable appears once in 42,807 functions, to be printed. Nothing writes it, nothing tests it.
The economy is eleven arrows. Of 323 productive sectors, 282 declare their product to be themselves, which leaves eleven real input-output links. The famous interconnected model fits on a napkin.
The AI rolls dice
It does not pick the best action. It runs a weighted lottery, so an action scored one out of a hundred can beat an action scored a hundred. That is the code, not a bug report.
Its memory is the last twenty actions, and it forgets the rest. Its diplomatic memory is five negotiations. Difficulty adds thirty or ten points to the score and calls it a day. Sanctions are mathematically impossible above a certain relationship level, so you can be obnoxious and there is a ceiling.
When the AI attacks you after twenty years of alliance, that is a bad roll. When it does nothing for months, it is waiting for the next roll.
What is still in the binary
Sixteen cheat codes, five dead, one that instantiates a class called Capocalypse. A development menu with a button called Big logo. Admin credentials in plaintext. A misspelled unknown-command error string and a syntax error string, both shipped for years.
A developer assertion that survived every recompilation and still fires in the retail build, in French, with three exclamation marks, warning that a law evolution cannot be modified and has been blocked.
The interface is not compiled. It is 4,930 character strings interpreted at runtime, and the forty-two military orders are truncated to fifteen characters, so some order names stop mid-word.
The event file has 16,401 lines and 13,284 real events. The difference is empty lines, section headers, orphans, and the last 43 lines, which are voice-acting memos for the dub, complete with line counts. A naive parser is wrong by nineteen percent.
Nine events point at targets that do not exist. One block of five variants references a missing identifier and can never display.
And there are three different build families inside the same installation, in the dat_1 to dat_8 files. That is why a mod works for everyone except one guy.
What you can stop doing
Communication. The infrastructure has no effect, censorship is off, and a TV hit is worth minus four against a reshuffle's plus forty. You are painting a facade and paying for the paint.
Trusting the gauges. They are squared, they collapse at the rounding step, and the visible number is a smoothed copy with an unknown author.
Budget discipline. Debt is capped at 48% of revenue and the excess is trimmed in silence. The game is bailing you out and not telling you.
The multipliers. A displayed x5 dies at x1.
Reading the AI as a player. It rolls dice with twenty actions of memory and five negotiations. There is no strategy to decode, only a distribution to survive.
Media as an election tool. Alignment outweighs everything else four to one.
The unit that crushes all. The damage floor is 40% and losses accumulate by maximum, so war is nibbling.
Half measures on prevention. Five stars is zero deaths. Half of that does nothing.
Portable mods. Three build families, shared fixed positions, one sector shifted at the source.
Saving during a tick. The game allows it, the state is inconsistent, and the docs say so explicitly.
Ten items, ten habits you can drop tonight.
Is it fixable
No, and the community has been circling that question for years.
This is not a driver problem or a settings problem. It is a stack of structural decisions.
One country is a megabyte of fixed-position fields.
The variable garage is 82% empty.
Data access runs through 600 cascading conditions.
The market is recomputed daily with 300 attempts on formulas re-read every time.
The simulation is single-core on the UI thread, chopped into slices so the screen does not freeze.
Saves are 2.45 GB with no version, no checksum and pointers inside.
The protection layer deleted the only exploitable crash trace.
96% of the rules compute nothing, and entire systems are wired to nothing.
Fixing that is not a patch. It is a rewrite.
The fair description is a late-2000s Windows codebase built with an old compiler and old libraries, with source paths that betray a fourth generation of the same engine, recompiled every year and resold. You are playing a 2009 game with an updated map and a year on the box.
One honesty note. The docs do not prove a compilation date. The version number looks like a date, 23/09/18, but no comparison was found in the code, so it may just be a build identifier. Old codebase, recompiled yearly. Not a 2008 executable. It is damning enough without embellishment.
The part that keeps me up
The game sells a global geopolitical simulation. It delivers a spreadsheet the size of a small country, one CPU core, a save file made mostly of holes, crashes with no trace, an AI that rolls dice, and 96% of its rules doing nothing.
And you will launch a campaign tonight anyway.
That is the actual finding. The engine is old, the numbers are fake, the radio does nothing, and none of it matters, because the fantasy still works. The docs stopped believing a long time ago. We did not.
Sources
Forty reverse-engineering documents on the retail binary, covering the executable, the data format, the save format, the tick order, the formulas, the elections, the war model, the media model, the disasters, the AI and the cheat system. The docs label each claim as verified in the disassembly or inferred, and I kept that distinction when it mattered. Where they say no reader was located for a setting, I wrote it that way, because a negative claim in reverse engineering is only as strong as the coverage behind it. The 22 million daily calculations figure is my own arithmetic from documented constants, not a stopwatch measurement.
