Under the microscope: Aqua GT (Dreamcast, PlayStation)

Do you have what it takes to be a winner or will you be left drowning?!!!

Last week I covered the Europe-exclusive game Taxi 2 for Dreamcast and PlayStation. This week I’m looking at Aqua GT, another such game.

This is a powerboat racing game from East Point, and seemingly the last game from the studio. The Dreamcast version came out in the UK, France, and Germany in 2000. The PlayStation version followed in 2001.

You can enable extra boats and courses in this game by completing its various challenges. Or you can skip all of that and enter the cheat codes I found — there’s one for each version that unlocks everything.

Details on the codes and how I found them are below…

---

The Dreamcast version

At the title screen, hold Up+Left+A+Y. This will set the flag at memory address 8c06642c, which unlocks all of the boats in Arcade mode:

Left: The default boat selection screen. Right: Everything unlocked.

And it also unlocks all of the courses:

Left: The default course selection screen. Right: Everything unlocked.

Here’s the unlockable Behemoth boat racing in the unlockable Japan course:

---

The PlayStation version

For the PlayStation version, you enter the code at the mode select screen instead of the title screen:

Left, Left, Right, Right, Left, Right, Left, Right

The mode select screen

The effects are the same — after entry you can choose any boat and any course in Arcade mode.

The PSX version isn’t as pretty as the Dreamcast version, but it doesn’t look bad.

---

Technical details

Here was my process for locating the code for the Dreamcast version:

• I used the RALibretro Memory Inspector to determine which memory address stores the boat selection cursor (it’s 8c1161be).

• Right next to that in memory, at 8c1161bd, is the number of boats that are available — it caught my eye because it was set to 5, the same number of boats you can race by default.

• Tracing writes to that address in Ghidra led to the function at 8c034960, which sets it to 20 if the value at 8c06642c is nonzero.

• Tracing writes to 8c06642c leads to the title screen input handling function, which looks for the A+Y+Left+Up combination.

The final logic looks like this:

if (
    (unlock_everything == 0) and
    ((p1_held & 0x01) != 0) and # A button
    ((p1_held & 0x20) != 0) and # Y button
    ((p1_held & 0x40) != 0) and # Left button
    ((p1_held & 0x10) != 0)     # Up button
):
    unlock_everything = 1
    play_sfx()

By following the same process, I found the corresponding “unlock everything” flag in the PlayStation version — it’s stored at 800b966c. Tracing writes there led to the cheat sequence, which is stored like this:

800b9670 80  # Left
800b9671 80  # Left
800b9672 20  # Right
800b9673 20  # Right
800b9674 80  # Left
800b9675 20  # Right
800b9676 80  # Left
800b9677 20  # Right

For some reason the PlayStation version uses a standard mapping of bit patterns in memory for the controller buttons, but the Dreamcast version uses a custom one.

---

Outro

For past articles on using reverse engineering to discover long-unknown cheat codes, see my archive. And to get new ones as I write them, subscribe to Rings of Saturn here on Substack:

Logo by Ashlyn Anstee