People have been using legal.exe for a few years now to weed out hacked pokemon, and in that time it has done an extraordinary job. The question remains, though, how exactly does it do the excellent job that it does? Myself and Kaphotics had been wondering for awhile exactly what it looked for, which pieces of data were culled from the pkm to determine its status.
On Friday, as many are already well aware, an extremely rare event pokemon, the JEREMY Oddish, was leaked from an older collector's hands and began to spread rapidly. On checking in legal.exe, one was greeted with "JEREMY (Static)", thus verifying the pkm file.
Knowing that legal is an app written in .NET 2.0, I began to disassemble legal and break it into classes. Eventually I had it deobfuscated and disassembled so both myself and Kaphotics could have a look. Over the last 2 days we've been going through and documenting what we could with help from a couple of other people. What I have hosted here is what we've managed to find thus far. This includes static JEREMY lists, in-game trades and wondercard lists, possibly the sync check and the 3rd gen event RNG.
Hopefully this might spur along anyone thinking about possibly continuing Sabresite's excellent work, or at least working together with us to more thoroughly document Legal.exe's functionality.
http://pokemon.thundaga.com/reflect.zip