Under the microscope: Kyuutenkai (Saturn, PlayStation)
Reverse engineering a 30 year old pinball game's passcode system
My favorite Japanese cheat site has a special password listed for the PlayStation version of Kyuutenkai, the Technosoft pinball game. Translated, it says:
Enter KYUTENKA4S on the password screen. You’ll start the game with more than 500 million points.
It works on PlayStation, but not on Saturn. What gives? I decided to investigate.
In doing so, I wound up reverse engineering the game’s password system. This led me to find four passwords that have special effects. These have somehow remained secret for three decades!
The special passwords work on both PlayStation and Saturn, so you can enjoy cheating on both platforms. Details are below…
Nine chances, maximum points, & everything clear
Choose the middle item from the last title screen menu to get the Password Continue screen. Enter SWSH YUTN MD there:
When you start the game, you’ll see that you have nine chances and 999,999,998 points. Get one more point and you’ll get a special Congratulations message:
You’ll also have all four “Clear” crystals, so you can fight the final boss. Get the demon at the bottom of the screen to open his mouth, then launch your pinball into it. This transports you to the boss arena:
Complete the boss fight to see the ending credits:
You’ll be able to keep playing after that as long as you have chances left.
More special passwords
If you feel like cheating, but not too much, try either of these passwords:
Nine chances:
CHANCEGAX9All clear crystals:
S1TENCLEAR
For an extra challenge, try this one:
Zero chances:
ABNA1YABA1
“Abunai yabai” means something like “risky situation.”
Technical details
The passwords above are ones that the game checks for explicitly; you wouldn’t be able to get them while playing normally.
On Saturn, the function at 06023d88 checks your password screen input. It does a bitwise NOT on each of the characters you entered and then compares the resulting value to the ones in a static list that starts at 0602b730.
I used this Python code to decode the special passwords:
name_data = (
b'\xac\xa8\xac\xb7\xa6\xaa\xab\xb1\xb2\xbb'
b'\xbc\xb7\xbe\xb1\xbc\xba\xb8\xbe\xa7\xc6'
b'\xbe\xbd\xb1\xbe\xce\xa6\xbe\xbd\xbe\xce'
b'\xac\xce\xab\xba\xb1\xbc\xb3\xba\xbe\xad'
)
for i in range(4):
encoded_name = name_data[i * 10:(i + 1) * 10]
decoded_name = [(~x & 0xff) for x in encoded_name]
print(bytes(decoded_name).decode())The function sets the number of chances, “Clear” crystals, and points based on which special password was matched.
Interestingly, the KYUTENKA4S password mentioned above isn’t one of the special ones. Instead, it’s one that could come up during gameplay. Passwords like this one encode how many chances you have remaining, how many “Clear” crystals you’ve obtained, and how many points you’ve scored.
For normal passwords, the game status data is XOR-ed with one of four special phrases before being incorporated into the password string. On PlayStation, the phrases are:
80026020 "QTENKAI PASSWORD"
8002600c "CONGRATULATIONS!"
80025ff8 "Get Your Dreams!"
80025fe4 "Dead? or Flip!! "And on Saturn, the phrases are:
0602b758 "Keep yourself.:|"
0602b76c "You/Get/Your/FFS"
0602b780 "Luck!_and_Pluck!"
0602b794 "Silent-sky,voice"This is why “natural” PlayStation passwords and Saturn passwords are incompatible – they use different XOR phrases. My original question is answered!
Outro
I’ll be back with more retro game reverse engineering articles soon! For the Christmas week, I’ll have something on Frame Gride for Dreamcast and Ford Racing for PlayStation – stay tuned!
Many thanks to Michael Stearns for the consultation on the zero chances password’s meaning.
