Under the microscope: Kinetica (PlayStation 2)
A brute force attack against a PlayStation 2 game's cheat code system
Let’s take a look at Kinetica, shall we? This was released in 2001 for the PlayStation 2. It was developed by SCE Santa Monica, who would go on to make the God of War games. It’s a racing game that features cyborg characters speeding through futuristic tracks while wearing disturbingly little clothing.
A good place to start looking for hidden secrets is to ask, “what happens when you press a button on the controller?” I used the RALibretro Memory Inspector1 to explore this question. It told me that, among other things, the value at 001e6f38 changes in response to player input.
I set a write breakpoint for that address in the PCSX2 debugger and then pressed some buttons. The breakpoint triggered on the function at 00183c6c, which has logic like this (pseudo-Python adapted from Ghidra’s decompilation):
That is, pressing L3 clears the value at our target address. Pressing any other button shifts by 3 bits, then ORs it with a bit pattern that corresponds to the button. Because of that, I called this value acc for accumulator.
What reads the accumulator? A breakpoint showed that the function at 00183cc4 compares it to a target value when the title screen is being displayed. That function’s caller is using a target value of 0x2108840.
I wrote a Python script to check all possible arrangements of eight button presses to see which one(s) set the accumulator to this target value:
The full script is available on GitHub.
This is the sequence that popped up2: L3, Right, L1, Down, R1, Left.
What’s the effect? Everything is unlocked! This includes Season 2 and Season 3 in Single Player mode:
And it includes the bonus characters, Crank, Grek, and Siba:
It also includes the Suicide Slide and Orbital tracks:
And finally, it includes the Kinetica History movie that’s in the Options menu:
Not a bad haul!
Outro
Before we go, here are a few other things that I found interesting:
Kinetica also checks for the target value
0x860004. This corresponds to the button sequence Down, Start, Left, L1. Based on the value that gets set when you enter it, I think this was supposed to show biker coordinates on screen. But there isn’t any visible effect during gameplay.God of War and God of War II use the exact same system for their cheat codes. These have already been documented, however.
Thanks for reading! I’ll be back with more retro game reverse engineering articles soon. Subscribe here on Substack to get the next one as soon as it’s published:
See the mini tutorial in the Batman Begins article on how to use the RALibretro Memory Inspector.
The leading L3 clears the accumulator so previous button presses don’t interfere with the code entry.