Under the microscope: MDK (PlayStation)

Un-hashing some hidden cheat codes in the console port of MDK

After developing two Earthworm Jim games, Shiny Entertainment made MDK for Windows PCs in 1997. The game was ported to PlayStation by Neversoft, who had previously developed Skeleton Warriors and would go on to develop the Tony Hawk games.

The Internet has lots of cheat codes for MDK — see, e.g. IGN’s list. But one thing that cheat code hunting has taught me is that games with many known cheats often have a few overlooked ones.

MDK is one of these! I found a handful of previously unreported codes. This article describes what they do and how I went about finding them. For one of them I got a hint from Mick West, Neversoft co-founder!

---

Where the codes live

The function loaded to 8008d698 (in the NTSC-U version of the game) listens for controller input when the game is paused¹. Here’s an interpretation in Python of what the MIPS assembly code is doing — I adapted this from Ghdira’s decompilation:

psx_letter_map = {
    "Left": 1,
    "Right": 2,
    "Up": 3,
    "Down": 4,
    "Triangle": 5,
    "Square": 6,
    "Circle": 7,
    "X": 8,
    "L1": 9,
    "L2": 9,
    "R1": 9,
    "R2": 9,
}

def process_sequence(code_buttons):
    buffer_01 = 0x00000000
    buffer_02 = 0x00000000
    buffer_03 = 0x00000001

    for button in code_buttons:
        index = letter_map[button]

        buffer_03 = (buffer_03 * (index + 1) + buffer_02) & 0xFFFFFFFF
        for __ in range(4):
            if (index & 1) != 0:
                buffer_02 = buffer_02 ^ 0xA001

            x = (buffer_02 & 0x80000000) != 0
            y = (buffer_01 & 0x80000000) != 0
            buffer_01 = (buffer_01 * 2 + x) & 0xFFFFFFFF
            buffer_02 = (buffer_02 * 2 + y) & 0xFFFFFFFF
            index = index >> 1

    return buffer_03

In short, each button updates the value at 800bd850, which is a sort of hash of the input sequence. The function at 8008d7d4 compares the has value to a set of ones associated with cheat effects.

The game also updates a buffer at 800be3c0 with a text version of your input:

So if you enter, say, the “Earthworm Jim Cow” cheat, which us Up; Down; Down; L1; Right, you’ll see UDDER in the buffer.

---

Finding the code sequences

If you read the earlier article on Skeleton Warriors, you’ll notice that the hash calculation is almost identical. Recovering that game’s missing cheat codes required some advanced math, but the task turned out to be easier for this game: brute force enumeration worked just fine.

Here’s some Python code for a single-threaded search of all possible button presses.

from itertools import count, product

# Generate an infinite stream of button presses
def get_button_stream():
    for r in count(1):
        yield from product(letter_map, repeat=r)

# Check their hashes and print out any hits
def main():
    for code_buttons in get_button_stream():
        result = process_sequence(code_buttons)
        if result in targets:
            print(
                format(result , "08x"),
                "".join(code_buttons),
            )

A more efficient approach would have been to use the restricted alphabet to mount a dictionary attack, but this search produced all of the hashes the game cares about in a reasonable amount of time. I recovered all of the ones available on the cheat sites, plus some new ones! They are:

• TROUT

• TERROR

• SUTURE

• ODDTEST

• EXODUS

---

New code effects

The TROUT code has to be unlocked first. Pause the game, enter L1, Up, Square (DEUS), then pause again and enter Triangle, Right, Circle, Up, Triangle. The camera will change to a top down view! This changes the gameplay quite a bit:

The TERROR code also needs to be unlocked with the DEUS code. Entering Triangle, L1, Right, Right, Circle, R on the second pause screen upgrades your main gun — you can see the shrapnel go from green to blue:

The SUTURE code needs the DEUS code. Entering Square, Up, Triangle, Up, Triangle, Right, L1 removes some enemies’ heads? I don’t really understand this one!

ODDTEST (requires the DEUS code) makes the game display hit boxes. It’s not super stable after that; it crashed for me any time too many were on the screen:

I couldn’t figure out what EXODUS (which requires DEUS code) actually did when playing. Entering L1, X, Circle, Down, Up, Square changes the value at 800baac4 from 3 to 4, but then what? The developer, Mick West, told me the answer! It gives you an extra difficulty option:

---

Magazine codes

Two cheat codes don’t seem to be online, but based on what they print to the screen, I think they were printed in game magazines?

Pause and enter Square, Circle, Left, Down, Circle, Up, Triangle (SOLDOUT). You’ll get a Happy Christmas from the Gamesmaster / Super Chain Gun message:

Pause and enter Triangle, X, Triangle, Right, Down, Right (TXTRDR) to see Welcome Tricks and Tips Reader / Hand Grenade.

I checked archive.org for scans of these magazines, but didn’t come up with these cheats. Let me know if you find them!

---

Outro

Here is the full list of codes the game recognizes from the pause menu:

If you like finding long lost cheat codes, see my archive for many more articles on the topic. Many thanks to Mick West for pointing me in the right direction on the EXODUS cheat.

Which other games should I be examining? Tell me in the comments! My specialty is the Sega Saturn, but I can do 3DO, PlayStation, and Dreamcast games, too.

Logo by Ashlyn Anstee

1. As usual, I found this by comparing emulator memory snapshots taken before and during a button press. This locates the addresses where input is stored. After that, setting a read breakpoint for those addresses reveals the code that accesses them.