Under the microscope: Ford Racing 3 (PlayStation 2, Xbox)
Using Ghidra to correct 20 year old mistakes
I’ve now covered a few titles in the Ford Racing series – the original (2000), the Mustang-specific one (2005), and the versus Chevy one (2006). I skipped over Ford Racing 3, however, because the cheat sites already have “unlock all cars” and “unlock all tracks” codes listed for it. Here’s what GameFAQs has:
Hmm, why are there more downvotes than upvotes? Do these codes work?
It turns out that they don’t. Let’s correct the record, shall we?
The reverse engineering
First things first: import something into Ghidra for analysis. I usually use a memory snapshot for this, but it’s fewer steps to use the main game executable instead. On the disc image is a file called SLUS_209.7.
With the Emotion Engine plugin, Ghidra will recognize this file as an ELF file with the right processor and language specification:
After running the Auto Analyzer, Ghidra will have identified lots of functions and defined lots of strings. Searching for the word Cheat yielded good results when looking at one of the previous games, so let’s do that:
002af560 "UI_MAIN_CHEAT_ACTIVATED"
002b13d8 "Cheat Events"
002b14c0 "&driver_profiles [profile_index].cheat_flag"The Cheat Events string has a single reference in the function at 0018ac30. It’s used as the second argument to a function call:
FUN_0015c2d8(FUN_0018a8d8,"Cheat Events")That first argument, which Ghidra calls FUN_0018a8d8, is another function. It makes several calls itself, but the first interesting one is to FUN_0018aa50:
Why is that interesting? Well, it’s got a counter that goes up when an equality condition is satisfied and resets to 0 when it’s not. If the tracker reaches 10, a function is executed. Let’s add some labels…
This is the cheat code tracker! It’s looking for this sequence:
002902dc [0x02, 0x03, 0x04, 0x05, 0x04, 0x03, 0x02, 0x05, 0x03, 0x02]Like Ford Racing 2, this tracker only executes while you’re holding the Select button at the main menu.
I set a breakpoint for the “correct button pressed” branch of the code. Then I pressed buttons until I worked out the mappings. That gives us…
The unlock everything code
At the main menu, hold Select (PS2) or Black / RB (Xbox) and enter this sequence:
Up, Down, Left, Right, Left, Down, Up, Right, Down, Up
You’ll hear a sound effect if you got it right. After that, all of the cars will be available in Challenge mode:
As will all of the competitions in Competition mode:
And all of the race types in Ford Collection mode will be available:
That’s everything!
Outro
Interestingly, this game has space for another cheat code:
002902b0 [0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02]That’s the Down button, 10 times. It doesn’t do anything, however – the game has a null pointer instead of a pointer to a function that would apply an effect.
I also checked out the Nintendo DS version of this game. It’s derived from a different code base, of course, but its menus are similar to its console siblings. It doesn’t seem to have any cheat codes – alas.
Many thanks to Blaze from the Sonic Weekly Discord for prompting me to look at Ford Racing 3. Which other games have missing or bogus cheat codes? Leave comments with your suggestions.
Very good find!