Under the microscope: FireBlade (Xbox, PlayStation 2, GameCube)

Reverse engineering three versions of a 2002 helicopter game

FireBlade is a helicopter game from Kuju Entertainment. It was released for PlayStation 2, Xbox, and GameCube in 2002. Although cheat sites and magazines don’t seem to have ever listed any codes for it, there are some suggestive strings in the game data. Here’s one from the Xbox version’s GLOBENGL.str file:

0000c43a "LEVELS UNLOCKED"

I wondered if I could make this message show up by putting in a special player name, since that’s the first thing the game has you do when you start a new save.

The name entry screen

This turned out to be a dead end – there aren’t any special player names. But exploring this dead end was fruitful. On PS2, the letters you put in appear (encoded as UTF-16) at memory address 00362f80:

A view of the PS2 version’s memory

Setting a write breakpoint for that address (using the PCSX2 emulator) reveals that the function at 00310ac0 services input on the name entry screen. And tracing references to that function with Ghidra (using the Emotion Engine plugin) reveals that it’s called by another function (at 0030dad0) that handles input on most of the menu screens.

Some menu screens associated with this function have items that can’t be selected until they’re unlocked. The Campaigns screen, for example, only allows you to choose its first item.

Campaigns 2, 3, and 4 are grayed out

Here’s some pseudo-Python (adapted from Ghidra’s decompilation of the menu input handling code) that shows a bit of the menu navigation logic:

if (
    (player_pressing_down != 0) and
    (menu_cursor < menu_item_limit) and
    (check_unlocked(menu_data) or (DAT_0035bb55 != 0))
):
    menu_cursor += 1

That is, the menu cursor moves down if you’re: (1) pressing down, and (2) not on the last item, and (3) the item is unlocked, OR the single byte value at 0035bb55 is nonzero.

I suspected that this single byte value corresponded to the effect associated with the LEVELS UNLOCKED string from above. And indeed, it is: setting it to 1 makes all of the Campaigns and Missions available:

Left: The Campaign select screen with all available

How do you set this value from within the game? Tracing writes to it in Ghidra leads to the function at 0030cfa0, which has big "cheat code listener" energy:

• Memory addresses associated with input are compared to an array of static values.

• If an input value matches the first element of the array, the starting index for the array increments.

• After 8 matches, the "levels unlocked" value gets set.

The array of static values is:

[0x800, 0x800, 0x800, 0x400, 0x400, 0x400, 0x10, 0x40]

These values correspond to the following buttons:

R1, R1, R1, L1, L1, L1, Triangle, X

Entering that sequence on any of the menu screens unlocks all Campaigns and Missions! The FMVs under Extras > Movies > Game Movies also get unlocked.

A still from the final campaign’s movie

I repeated the investigation above for the GameCube version of FireBlade (using the GameCube loader Ghidra plugin) and found that its "levels unlocked" sequence is:

Up, Up, Down, Down, Left, Right, Left, Right, B, A, Start

A Konami code! It’s easiest to enter this by starting on the Extras menu item, because pressing A when highlighting Campaigns changes the input handling function.

What about the Xbox version? It turns out to be totally different. There’s no function that corresponds to the simple "cheat code listener" described above. However, its menu handler still checks for a "levels unlocked" value. Tracing writes to that value (using the ghidra-xbe plugin) reveals a more general sort of cheat management system:

• Rather than comparing player inputs to a static array of values, seven different ones get checked.

• Cheat “toggling” is supported. That is, if you enter a sequence once, its associated effect gets set. If you enter it again, it gets cleared.

• After entering a sequence, a string gets loaded and displayed onscreen.

• You can enter cheats anywhere, not just on the main menu.

Our "levels unlocked" function corresponds to this array:

[0x7, 0x7, 0x7, 0x6, 0x6, 0x6, 0x2, 0x3]

This matches the PS2 version’s pattern. The buttons are:

RT, RT, RT, LT, LT, LT, X, Y

The Xbox version shows the LEVELS UNLOCKED message

The cheat system checks for six more sequences. The first one displays the message INVULNERABILITY ENABLED, and indeed you are immune to damage while this cheat is active. Its buttons are:

RT, LT, RT, LT, RT, LT, X, Y

If you would like INFINITE AMMO, enter:

RT, RT, RT, RT, RT, RT, X, Y

And to get INFINITE TURBO, enter:

LT, LT, LT, LT, LT, LT, X, X, X, X

Infinite turbo enabled!

The fourth cheat changes the game’s frame buffering strategy. Entering it once shows the message 0 FRAMES. Entering it twice changes it to 1 FRAME. Entering it three times makes it 2 FRAMES. The buttons are:

LT, LT, LT, LT, LT, LT, X, Y, X, Y

One cheat has no effect at all. Maybe it was never implemented? Its buttons would have been:

Y, Y, Y, Y

And finally, the best cheat of all. It enables all levels, invulnerability, infinite ammo, and infinite turbo, and displays the message MEGA CHEAT ENABLED. The sequence is:

A, B, X, Y,
RB, LB, RB, LB,
X, Y, A, B,
LT, LT, RT, RT

The Mega Cheat message shown while playing the last mission

Here are all of the cheats in one table:

---

Outro

It seems like the Xbox version of FireBlade was made by the same team at Kuju Entertainment that did the PS2 and GameCube versions, so it’s a little surprising that it has more cheat codes! I checked to see if there was an alternate method for enabling them, but didn’t come up with one.

Thanks for reading Rings of Saturn. I’ll be back with more retro game reverse engineering finds soon – subscribe to get the next one as soon as it comes out. And see the archive for hundreds of other articles on cheat code archaeology.

Logo by Ashlyn Anstee