Under the microscope: Scud: Industrial Evolution (SegaSoft PC)

Locating scrambled cheat data in a 29 year old PC game

In this edition, we’re examining Scud: Industrial Evolution, the 1997 PC game from Syrox Developments and SegaSoft. It’s one of the two video games starring Scud: The Disposable Assassin, the comic book character created by Rob Schrab.

This game uses a password system. Before you start a mission, an overview screen tells you the code that will let you start at that mission the next time you play:

Mission 16’s overview

The cheat sites (e.g., GameFAQs) have lists of codes for all 21 missions. But if you search the disc image for the one in the screenshot above, jallaballabon, you won’t find anything. So where are they in the game data?

While answering this question, I found a cheat code for this game that’s stayed hidden for 29 years. Details are below!

---

Technical details

Lots of games obfuscate passwords and cheat codes to prevent casual snooping - I’ve covered such scrambling schemes in previous editions. But what scheme does Scud use?

My buddy Derek Pascarella maintains a tool called TextSleuth that is good at locating strings with unusual encodings. I tried it on a few of the level passwords, and kept getting hits in the file SCUD.MCG.

TextSleuth v1.1
Written by Derek Pascarella (ateam)
> Worker threads: 15 (default calculated based on number of logical CPU processors minus one)
> Character byte length: 1
> Wildcard byte count: 0
> Direct search pattern: 1 2 3 3 4 5 6 6 4 3 7 2 8 9 2 10 10 5 3 11
> Initiating scan process against 1 file...
> C:\Program Files\SegaSoft\Scud IE\data\scud.mcg
  - Offset 0xBF (decimal 191)
    33 26 2f 2f 22 2a 34 34 22 2f 24 26 01 38 26 25 25 2a 2f 28

Using Ghidra to search for that filename in the main game executable leads to the function at 004289b0, which decodes it. The decompiled version of the code is a little messy, but reading it reveals:

• There are 22 passwords to decode, and they’re delimited by null bytes.

• To decode a password to ASCII, add 0x1f to each of the bytes of its encoded representation.

This Python code does the necessary decoding (the obfuscated data is omitted from the snippet):

all_records = data.split(b'\x00')
for i, record in enumerate(all_records[:22]):
    letters = [chr(x + 0x1f) for x in record]
    print(i, ''.join(letters))

The output contains the same passwords that are on the cheat sites, plus two more. What do these new ones do?

---

The level select cheat

The two extra passwords produced by my decoder both do the same thing. They are:

• OUT THE WINDOW

• END

Enter one of them, and… nothing happens. At least, not immediately.

Entering the password

But if you leave the main menu and come back (by going to the Configuration screen), you’ll get the effect - a level select menu.

The level select menu replaces the Password entry form

This lets you choose a starting level. It also purports to allow you to change your character and which “hostage” you’re in charge of protecting. However, you wind up playing with your selected level’s default characters regardless of your choices.

Starting on the last level, playing as Scud

Perhaps the menu code is unfinished? This might be why these two codes never made it into game magazines in the 90s.

---

Outro

The full version of my decoding script is on GitHub.

Thanks for reading! Rings of Saturn will return with more from my retro game reverse engineering vault soon.