Expansion hack: Industrial Spy — Operation Espionage (Dreamcast)

The secrets of the Atypical Alchemists

Industrial Spy: Operation Espionage is a strategy/adventure game that was released for Dreamcast in Japan (as Espion-Age-Nts) and North America. It’s one of three Dreamcast games from Atypical Alchemists Associates.

Some interesting strings caught my eye in the game data:

8c08f054 "%c SOUND TEST..."
8c08f068 "%c ..."
8c08f070 "%c ???..."
8c08f07c "%c SYSTEM INFO..."
8c08f090 "%c MODEL TEST..."

A debug menu? Yes! I put together a patch to make it accessible. Get it from SegaXtreme. Details are below…

---

The debug flag

Using Ghidra, I traced the strings above to the function at 8c0688d0 (in the NTSC-U version). That’s called by the function at 8c0664a0, which has a big switch statement:

switch(DWORD_8c3949e4) {
    case 0:
        // game logic goes here...
        break;
    case 1:
        // more game logic...
        break;
    // etc...
}

The value at address 8c3949e4 determines which case executes. This value seems to indicate the current game mode. It’s 07 on the title screen, 09 on the mode select screen, 0a on the Option screen, etc.

The debug menu function call is in case 0a, so it seems to be part of the Option code. The 8c0688d0 function mentioned above takes one argument, which comes from the address at 8c1711bc. If that’s 00 we get the normal Option screen, but if it’s something else…

Left: Normal options. Right: Debug options.

We get the debug menu! 8c1711bc turns out to be the global debug toggle. It causes stats to be printed at the top of the screen.

---

The debug menu

The Sound Test and System Info items are more or less what you would imagine:

The Model Test is a 3D model and animation viewer, which is pretty cool. You can change characters and view them from different angles:

The … item seems to be unused. But the ??? item is, surprisingly, a fully functional Breakout-style mini-game! I don’t think this is accessible by other means, but tell me if you know otherwise:

The debug flag does something else. If it’s in its default state, you get a VMU selection screen when you choose Continue from the main menu. But if it’s set to something other than 00, you can go to the Briefing All Stage menu. This lets you skip to different missions:

---

Patch details

As mentioned above, to get at the debug features we merely need the address at 8c1711bc to be nonzero. It only gets written in one place during game initialization:

8c0104ec mov.l r2,@(0x8,r14)=>debug_toggle_01

Register r2 is used to zero several other addresses, so we can’t change it without messing things up. Fortunately, register r1 has a nonzero value at this point in the setup process, so we can patch the game to use it instead:

8c0104ec 221e  # Use r1 instead of r2

I’ve seen references to this hidden menu on Japanese language sites, so I’m not the first to discover it. I hope the patch makes it easy to access!

---

Outro

More retro game reverse engineering articles are coming soon — here’s a preview of the next few:

• Casper: Saturn, PlayStation, 3DO

• Jersey Devil: PlayStation

• Thunder Force V: Saturn

• Charge 'N Blast, Fighting Force 2, & Ready 2 Rumble Boxing Round 2: Dreamcast

Which other games should I be examining? Tell me your suggestions in the comments.

Logo by Ashlyn Anstee