Under the microscope: Championship Motocross & Championship Motocross 2001 (PlayStation)

The Internet was wrong about cheat codes again

We talk a lot here about how Internet cheat sites aren’t always accurate. There’s a decades-long game of telephone going on, and sometimes things get garbled.

The cheat code situation for the two Championship Motocross Featuring Ricky Carmichael games on PlayStation is a good illustration of this:

• GameFAQs doesn’t list anything for the first game, but lists five codes that don’t work for the second game.

• IGN has the same five codes listed for the first game and none for the second.

The GameFAQs listing for the first game

The majority of cheat sites agree that the five codes are really for the first game, and indeed, they do work. But let’s dive into the game data and see what the whole story is, shall we?

---

Championship Motocross Featuring Ricky Carmichael

When you start a new game in Championship mode, you’re prompted to enter a name:

The name entry screen

I put in a distinctive string and then searched for it in the game’s memory. I got a hit at 80181b2c:

80181b2c "32BITS"

Then I set a read breakpoint for that address. After pressing End, the function at 800bbc44 tripped it. Ghidra decompiles it like this:

undefined4 FUN_800bbc44(byte *param_1,byte *param_2)
{
  byte bVar1;
  
  bVar1 = *param_2;
  while( true ) {
    if (bVar1 == 0) {
      return 1;
    }
    bVar1 = *param_2;
    param_2 = param_2 + 1;
    if ((byte)~*param_1 != bVar1) break;
    bVar1 = *param_2;
    param_1 = param_1 + 1;
  }
  return 0;
}

The function loops through two data arrays and compares them byte-by-byte, but it inverts (logical NOT) the bytes from the first array.

The function’s first argument is a pointer to the name buffer. Its second argument is a pointer to this array of data:

800b4a0c [0xAC, 0xB2, 0xBE, 0xAC, 0xB7, 0xBA, 0xAD]

Inverting these bytes yields the string SMASHER:

>>> bytes(~b & 0xFF for b in [0xAC, 0xB2, 0xBE, 0xac, 0xB7, 0xBA, 0xAD])
b'SMASHER'

What’s that do? Well, it unlocks all of the classes in Championship mode:

All classes open

It also unlocks all of the tracks:

One of the unlockable tracks

It also makes the mirror setting available (under Options > Race Settings):

And it unlocks the Fox Movie (under Options > Extras):

Ricky Carmichael in the Fox Movie

That is, SMASHER is the “unlock everything” code.

The game also checks for inverted versions of these strings, which each unlock some subset of what SMASHER does:

• DIRT BIKES: Unlocks the 250 and 500 Championship classes.

• DIRT TRACKS: Unlocks all tracks.

• ALL EVENTS: Unlocks all classes.

• LIVE ACTION: Unlocks the Fox Movie.

• OPPOSITE LOCK: Unlocks Mirror Mode.

There’s one more inverted name in the comparison list: GROSSE TETE. This enables “big head” mode (which was already listed on the cheat sites):

Big head mode in action

---

Championship Motocross 2001 Featuring Ricky Carmichael

Are there actually any cheats for the 2001 entry in this series? Yes!

I used the same trick above – entering in a distinctive name, searching for it in memory, then catching reads to its location – to find a couple of special effects.

Enter a rider name in Career mode

This game doesn’t bother with inverting the special names’ bytes. It just checks for the plain text string DIRTTRAK, which unlocks all tracks.

Selecting an unlocked track

And then it checks for the string ALLEVENT, which opens the 250 class.

250 class unlocked

The game uses the BIOS-provided strcmp function (see here) to do the checks.

The game’s code can call into the BIOS for utility functions like strcmp

---

Outro

Thanks for reading. I’ll be back with another retro game reverse engineering article later in the week. Subscribe to get it as soon as it’s published:

Which other games have dubious listings on the cheat code sites? Leave a comment if you know of any, and I’ll put them on my list.

Logo by Ashlyn Anstee