Under the microscope: Newman/Haas Racing (PlayStation)

Reverse engineering a PlayStation game with an unusual cheat code entry system

In this edition I’m examining Newman/Haas Racing for PlayStation. This was developed by Studio 33 and Bizarre Creations, both of which had some racing game cred in the 90s and 2000s.

This game has a cool cheat code entry system that I don’t think has been documented elsewhere. The main menu has its items arranged around a circle:

When the menu first starts up, you have a moment to use it to enter letters:

• Repeatedly pressing Right advances through the alphabet – once for A, twice for B, etc.

• Pressing Left locks in the letter and starts the next letter.

• Pressing right again locks in that letter, and so on.

The game is looking for two special words to be spelled out. Each one enables a hidden feature.

---

Unlock all tracks

The first special word is AGE:

Right (x1), Left (x7), Right (x5)

This unlocks all of the bonus tracks: Kahoona Massive , Pennsylvania Speedway, Woodshole 200, and Hill Fields 200.

Racing on the last unlockable track

Normally you have to complete the Championship mode to unlock these tracks.

---

Race as a double-decker bus

Now try entering the word COCKNEY. That is:

Right (x3),  Left (x15), Right (x3), Left (x11),
Right (x14), Left (x5),  Right (x25)

When you start racing, you’ll be driving with a double-decker bus!

Metropolis Street Racer for Dreamcast, also by Bizarre Creations, has similar unlockable bus.

---

Technical details

The function at 80046a44 calls attention to itself by referring to the string CHEAT:

8007adcc "CHEAT"

It reads the buffer at 8008a398, which has the number of consecutive right/left presses you’ve made. For AGE it looks like this:

8008a398 01  # A is the 1st letter
8008a399 07  # G is the 7th letter
8008a39a 05  # E is the 5th letter

The contents of that buffer are continually processed like this:

• Each element is added to 0x40 to produce an ASCII letter. 0x41=A, 0x42=B, etc.

• The resulting string is first compared to COCNKEY. If it matches match, the flag at 8007b664 is set.

• The string is then compared to AGE. If it matches, the four bytes starting at 8001368a are each set to 01. This unlocks the four extra courses.

You have 250 frames after you start entering a string before the game stops paying attention. Pressing Left or Right resets the frame timer.

Here’s a video of the code entry process for COCKNEY that shows how the buffer fills up as you move the menu wheel:

I added labels to all of the variables in Ghidra’s decompilation, which makes it pretty readable. You can check out the code here.

---

Outro

For more on games with unusual cheat code entry systems, see the articles on Jet Moto 3 and Nectaris: Military Madness.

I’ll be back with more Rings of Saturn this week! Subscribe to the newsletter on Substack to get the next edition delivered to you as soon as it’s published:

Logo by Ashlyn Anstee