Under the microscope: Michelin Rally Masters (PlayStation)

Every cheat site has the wrong code for Michelin Rally Masters

Dec 02, 2025

The manual for Michelin Rally Masters has a table with the 18 cars you can drive in the game. Six of them aren’t available when you start playing, however – they have to be unlocked by winning Championship races.

From page 20 of the NTSC-U version manual

You can also use these bonus cars by entering a special code in the Options menu. Lots of cheat sites list one that purports to “Unlock Everything”:

From the Main Menu select Options and then choose the Code Entry screen. From there you can enter: J20X4CRFL4ZT
IGN’s cheats wiki

There’s one problem with this code – it doesn’t work! The game very clearly rejects it. Even so, the same mistaken value is listed on CheatCC.com, Supercheats.com, Cheat-Database.com, The PlayStation Data Center, and elsewhere. According to the Wayback Machine, the problem goes back to at least 2001.

What’s going on? I decided to investigate.

Code validation

My usual strategy for reverse engineering code screens like this is to start by putting in a distinctive string and then search for it in my emulator’s memory. That worked for this game: I found an ASCII version of my input at address 800d1eec.

The Mednafen emulator’s memory debug screen

I loaded a memory snapshot into Ghidra to see what code refers to the input buffer. Tracing references to it led me to the function at 800b967c, which executes after you press End on the Codes screen.

There’s a lot going on in this function, but we’ll start with the validation. Valid codes are 13 characters long and are drawn from this 32 character alphabet:

BCDFGHJKLMNPQRSTVWXZ0123456789%?

The game uses three checksums to determine whether a code should be accepted:

Checksum 1: The sum of the ASCII values of the first 10 characters, modulo 32, must match the index of the 11th character.
Checksum 2: The alternating sum of (character 1 + character 2 - character 3 + character 4 - character 5…), modulo 32, must match the index of the 12th character.
Checksum 3: OR together pairs of characters, then XOR the combined pairs with each other: ((character 1 | character 2) ^ (character 3 | character 4) …). The lower 5 bits of the resulting value must match the index of the 13th character.

If those three checks pass, the game uses the data from the code’s first 10 characters to see what should be unlocked. This is a surprisingly (and needlessly?) complex operation!

The code’s first character is used as the seed for a linear congruential pseudorandom number generator. The PRNG is used to produce mod 32 values for the code’s next nine characters.
The random values are used to shift the alphabet of possible characters. Each of the nine code characters are then located in their shifted alphabets. Their indexes are used for the next phase.

This table shows how the indexes are determined for the code BJTTVPQWVRNLM:

The highlighted values match the bold code characters.

The next phase of the algorithm works like this:

The indexes are then separated into three groups of three. For each group, the lowest bit of each index is concatenated together. If this results in 111, something gets unlocked.
The three groups of bits are then AND-ed together. For each bit that’s set in this combined value, something gets unlocked.

For our example code, one thing gets unlocked:

The third group of indexes unlocks something, since all its bits are 1.

I used Gemini 3 and Claude Opus 4.5 to help nail down the various operations here by feeding in the parts of Ghidra’s disassembly that I didn’t understand. As of this writing, these models excel at identifying the high level functionality, but struggled on replicating the details – not a lot of MIPS code in their training data?

Code generation

We can back our way into an “unlock everything” code by:

Choosing a starting letter – any will do.
Using the ASCII value of that letter as a seed value for the PRNG.
Using three groups of three 1’s for the shifted indexes.
Matching the shifted indexes with their associated letters in the alphabet.
Computing the checksums for the previous values.

Using J as the starting letter gives J20X4CRFL4ZT? – the code from the cheat sites, but with its final character restored!

Here’s an illustration of how the PRNG values for this code rotate the alphabet such that the code’s letters are all at index 1:

When all indexes are 1, the groups are (111, 111, 111) - unlock everything.

There are many other valid “unlock everything” codes. Anything that produces exclusively odd shift indexes will work. You can run my Python script, which includes an implementation of the PRNG and checksum calculator, to generate more.

Code effects

When you enter a valid code, the game says New cars and/or drivers available. Not very specific!

The unlockable cars are the ones shown above in the manual page: the Citroën Xsara, Hyundai Coupé, Mitsubishi Lancer Evo6, Lancia 037, Lancia Delta S4, and Lancia Stratos.

Some unlockable cars on the select screen

The WRC and Legends modes also become available in Single Player mode:

This seems to be everything you can unlock. Although the code screen refers to new “drivers” being available, no extra ones show up on the ROC Drivers screen – only the 30 mentioned in the manual appear:

From page 19 of the NTSC-U version manual

Outro

Although the cheat sites have the “unlock everything” code wrong, Reddit user Underkex remembered it correctly:

The code is incorrect in almost every site. Rally Masters’ codes are 13 symbols, not 12. The code is J20X4CRFL4ZT? Don’t forget the question mark.

My script above confirms that this is right!

For more adventures in passcode system reverse engineering, see my articles on Three Dirty Dwarves, The Lost World: Jurassic Park, Skeleton Warriors, Tony Hawk’s Pro Skater 2, and Tony Hawk’s Pro Skater 3.

Thanks for reading – subscribe to Rings of Saturn here at Substack to get the next post as soon as it’s available.

Rings of Saturn

Discussion about this post

Ready for more?