We looked at Puyo Puyo Tsuu for Saturn in a last week and found some long-kept secrets. The question naturally arises: are the same ones hiding out in the PlayStation version?
The short answer is no: the name-based Easter eggs in the Saturn version aren’t present in the PlayStation “definitive edition.” But the longer answer is: no, but the PlayStation version has its own secrets.
Before we get to those, let’s talk about the MIPS instruction set’s “global pointer” register.
The global pointer
Many games take advantage of the PlayStation CPU’s $gp register. This “global pointer” can be used by applications as a base memory address. This speeds up execution by saving instructions.
Here is some assembly code from Puyo Puyo Tsuu that reads from memory address 800b0aa4. This stores which gameplay mode you’ve selected - single player, multiplayer, etc.
80057734 lui v1,0x800b # Load the first half of the address. $v1 gets 800b0000.
80057738 lbu v1,0xaa4(v1) # Read at 0xaa4 bytes past the address in $v1.Two instructions are needed to do the read. Contrast that with this code, which reads from memory address 800b0c7c, which stores the state of controller 1’s buttons.
800470d0 lhu v1,0x63c(gp) # Read at 0x63c bytes past the address in $gp.This only takes one instruction, so it’s twice as fast. It works because the programmers organized the game’s memory usage such that frequently-accessed values (like player input) are near a fixed address. Early in the game’s initialization code, they set the $gp register to point to that fixed address.
80032114 lui gp,0x800b # Load the first half of the address. $gp gets 800b0000.
80032118 addiu gp,gp,0x640 # Load the second half of the address. $gp gets 800b0640.By default, Ghidra won’t be able to trace references to memory locations that are accessed with the $gp-relative addressing mode. But if you highlight some code, and press Ctrl+R, you can set Ghidra’s assumption for the gp register to match the one used by the game.
Once that’s done in Puyo Puyo Tsuu, Ghidra’s Auto-analysis can find all of the code that reads the state of controller 1’s buttons. That leads us to…
Cheat mode
The first controller button check this game does is just before the Act Against AIDS advertisement screen pops up.
If you were holding Select+Square+L1, the game starts looking for another button combination while the advertisement is visible: Up+L1+R1+Start.
Getting the second combination right activates a special cheat mode. During gameplay, you can trigger an instant win by pressing Circle+L1. Or, if you’re feeling self-destructive, you can trigger an instant loss with X+L1.
In cheat mode, the Options > Sound Test menu will get three extra items: Manzai, XA, and Ending.
The Manzai item lets you play the animations that are displayed before battles in single player mode. They show Arle meeting her opponent.
The Ending item lets you view the pre-credits animations, similar to the ending test we saw in the Saturn article.
The XA item lets you listen to more game sounds - there is dialogue, music, and more.
Further research
The Act Against AIDS screen checks for an additional button combination. If you didn’t hold Select+Square+L1 before it came up, but instead hold Square+X+Circle+Start while it’s visible, memory address 800b0649 gets set from 0x00 to 0x01.
Several game screens read this memory address, but it wasn’t clear to me what they do with its value. The only effect I could pin down is this: if you lose a two player match, the "knocked out” screen won’t ever time out - it will wait for you to press Start.
Strange! If you’re a Puyo Puyo fan and can figure out what else is going on, leave a comment.
Outro
Thanks for reading Rings of Saturn. Feel free to use the information and screenshots in this article on your fan site, reference page, etc. I’ll be back with more retro game reverse engineering posts soon - subscribe to get them as soon as they’re published.
