In this edition, I’m going to reverse engineer the password system for Disney’s Hercules for PlayStation. The manual explains its use:
If you can find all four Mystery Password Vases in selected levels, then a password (in the form of a series of four pictures on vases) will be offered upon the completion of the level.
To rejoin your adventure at a later time, use the [Square] and [Circle] buttons to turn the vases, and then press the [X] button to select. Meg will assist you by turning the vases.
Select the correct picture on each vase, and be sure they are in proper order, so they match the password you received. Once the correct pictures are chosen, and they are in the proper order, press the Start button to take up your adventure at the beginning of the next level.
Passwords for each level have been known for ages, but I found some that enable cheat effects. These don’t seem to have been published before! They give you:
Unlimited lives
Unlimited continues
All password vases
FMV skip
Below, I’ll describe the reverse engineering involved in finding these passwords and detail what they do.
Finding the passwords
The manual doesn’t tell you what to call the password symbols, but I’ll try to use the same names that are listed in the cheats on GameFAQs:
Row 1: Hercules’s head, Archer, Pegasus, Nessus
Row 2: Hydra, Medusa, Coin, Helmet
Row 3: Lightning, Gladiator, Minotaur
I used the DuckStation emulator with the RALibretro Memory Inspector to take memory snapshots while I changed the vases. I took some snapshots while the first vase was showing Hercules’s head and filtered for the values that stayed the same. Then I switched the vase to show the Archer and filtered for values that changed. After many rounds of this, I came up with this table:
I used the DuckStation CPU debugger to set a read breakpoint on the addresses holding these values. This led me to the function at 8003830c
, which executes after you enter a password. Then I loaded one of the memory snapshots in Ghidra to investigate it.
The function implements this logic:
First, it reads in groups of six 32-bit values from a table with 42 entries. The first four columns represent vases and the last two columns represent effects.
Next, it subtracts a position-dependent constant from each vase value you entered. The four constants are:
0x01e3
,0x0121
,0x0182
, and0x00c0
.After that, it compares the four modified vase values to the vase values from each row of the table. If there’s a match on the rows between 1 and 36, the effect values are used to set a difficulty level and a level target.
Finally, if there’s a match on rows 37 through 42, it sets values that enable the cheat effects described below.
Here’s a decoding example:
The player enters Helmet, Medusa, Hydra, Helmet. The game encodes these as
(0x0223, 0x0151, 0x01aa, 0x0100)
.The game subtracts the constant
(0x01e3, 0x0121, 0x0182, 0x00c0)
element-wise from the encoded player value. This produces(0x0040, 0x0030, 0x0028, 0x0040)
.The game checks its password table for matches on the vase values. One of the entries is
(0x0040, 0x0030, 0x0028, 0x0040, 0x000c, 0x0000)
, which is a match.The effects values are then interpreted.
0x000c
is level 12 and0x0000
is the Beginner difficulty level.
There’s an appendix at the end with a table of all the valid passwords
The cheat effects
Six special passwords are used to enable cheat effects. Each cheat effect requires you to enter two of them.
For the first cheat effect, enter these passwords:
Gladiator, Minotaur, Hydra, Coin
Coin, Hercules's head, Medusa, Gladiator
The first password sets the value at 8007d8e8
to 1. The second sets a bit on the flags field at 80034dc8.
Exit the password screen to return to the main menu. Press Down until the cursor goes past Load game to reveal the Cheats menu item:
This gives you the option to enable unlimited lives, to enable unlimited continues, and to have all password vases collected:
For the second cheat effect, enter these passwords:
Helmet, Hydra, Minotaur, Coin
Hydra, Medusa, Medusa, Gladiator
The first password sets the value at 8007d8ec
to 1. The second one alters 80034dc6
and sets a flag on the 80034dc8
field. This changes the Cheats menu into a level select menu:
The third cheat effect is a little strange. These passwords enable it:
Medusa, Nessus, Minotaur, Coin
Minotaur, Medusa, Minotaur, Nessus
The first password sets the value at 8007d8f0
to 1. The second one changes 80034d9e
to 3 and sets flags on the 80034dc8
field.
As far as I can tell, this cheat (1) Skips the FMVs that play before a level begins, (2) Enables the Cheats menu, and (3) Gives you unlimited lives.
I’m not sure why this was implemented, because you can skip FMVs easily enough already. Also, the Cheats menu already lets you turn on the unlimited lives effect.
Outro
For more articles about decoding game password systems, see these from my archive:
And to get new articles about retro game reverse engineering every week, subscribe here on Substack:
