Hidden Treasure: Silhouette Mirage's trial disc

Unlocking a prerelease demo disc of Silhouette Mirage

Jan 26, 2024

What’s this? Another1 demo disc that has a full game hidden on it?

Today we’re looking at Sillhouette Mirage: Trial Version. It normally lets you play through level 2 before ending, but a quick look at the disc’s file system shows that it’s got resources for a lot more.

When the trial ends, you get this somewhat unsettling game over screen.

This version seems to have been built on 1997-07-16, a few weeks before the final version (1997-07-30). So it’s based on a late prototype of the game. And indeed, according to the people who have played through it2, it’s pretty close to the final game.

While this prerelease doesn’t seem to have a bunch of cut content to analyze, the way the demo restrictions worked were interesting to me. So we’ll examine those in this article. We’ll also peek at a couple other discs that have Silhouette Mirage trials on them.

The controls screen, from Flash Sega Saturn Vol. 20

Our clue that this demo has additional content was the extra files present on the file system. Those provide a good starting point for analyzing the game. At 060031c0 is the string STG21.BIN, which is referenced by the function at 060031f0. Here’s my translation of that function into pseudo-Python:

The level_selected and section_selected variables correspond to “globally” accessible memory addresses used by various game functions.

We can see this logic play out: the debug mode cheat code actually works on the demo. This gives us a handy level select menu. Selecting a level other than 0-0, 2-1, 2-2, or 2-9 kicks us back to the title screen:

Hold B+X+Z at the Treasure logo to access the OPTION MODE screen, and set DEBUG to ON for level select.

The corresponding function in the final game is at 06003380, and is of course much longer: it has references to all the files, and has logic for advancing from one level to the next.

It would be nice if we could replace the function from the demo with the one from the final. And… we sort of can!

The level selection logic exists in 0KRNL.BIN on the discs. When loaded into the Saturn’s memory, the two versions of that file are the same up to address 06003010, and then they diverge.

Around that address is where the final game starts making references to files that the demo ignores: BUP_CHK.BIN (Backup Check, for saved data), STG31.BIN, STG32.BIN, etc.

The two files sync back up again: by 06004000, they’re back to matching. The data just before that point seems to be garbage in both versions: it’s not referenced by anything and it’s not sensible code. So basically we have:

Demo version: a short level loading function and lots of garbage data
Final version: a long level loading function and a little bit of garbage data

So it should be OK for us to overwrite the level loading logic from the demo - the final version will just extend into garbage data.

Swapping code from the final game into the demo’s memory with Mednafen

I noticed all of the above a few months ago, and tried it out. But it didn’t work! The game crashed just after the Sega logo. I decided that I must have missed something and that the final version’s level loading logic must be incompatible with some other part of the demo’s code. So I gave up.

Then somebody prompted me to look again, and this time I found the issue: the demo crashes when processing that BUP_CHK.BIN file.

Oh, because you can’t save your progress in the sample version? Of course!

This screen exists in the trial version, but selecting either the internal memory or the cartridge slot crashes it

We can just patch out (with null operations) the calls that check the integrity of the save file, and the ones that ask you where to put your backup data.

Here are the changes - this fully unlocks the demo!

0600309e 0009
060030a4 0009
060030a8 0009

There are a few other demos of Silhouette Mirage that we can check:

Flash Sega Saturn Vol. 20 includes one with files dated 1997-07-15
Tech Saturn 1997-10 includes one with files dated 1997-07-17

Alas, both of those include only the files for the the tutorial level, 2-1, and 2-2. Unlike the demo disc, they disable the OPTION MODE screen.

It looks like their logic for restricting the demo more or less matches the trial version examined above. Which makes sense if these were truly built on three consecutive days!