In this edition we’re examining Shadows of the Tusk, the 1998 deck-building game from Digital Media Lab and Hudson Soft. It was originally released in Japan, but these days you can play it in English - Saturn hacker Knight0fDragon released a translation patch for the game in 2024.
As I often say, if a game presents me with a text box, I put something distinctive into it. This allows me to easily locate it in a memory snapshot. Half the battle in reverse engineering is finding some code whose purpose you understand, so if a game lets you name your save file, you’ve got a great starting point for analysis.
Let’s see where we can go from that starting point in Shadows of the Tusk…
Decoding a cheat system
The first thing Shadows of the Tusk has you do is create a player. After entry, the name you choose for this player can be found at memory address 0601c48c.
Ghidra finds an interesting reference to that location: it’s used as a parameter in a call to the function at 0605c9b0, which is an implementation of the standard strcmp string comparison routine:
strcmp_0605c9b0(player_name_01_0601c48c,"Ryoko ")The comparison target is "Ryoko ". What happens if you use that for your player name?
…well, nothing. That comparison is just one component of an extremely elaborate cheat system. There are 15 conditions in total.
The next two conditions are:
Does the string at
0601c4e9match"Hirosue "?Does the function at
06049fbcreturn 7?
The first of these is checking the name of your first player’s first deck. It’s called Starter by default, but you need to rename it to Hirosue.
The second of these is looking to see how many decks your first player has. It needs to be 7. The ones after the first can have any name.
The next condition is whether the value at address 0601d9a0 is 3. It’s normally 0, but it increments each time you return to the title screen by doing a soft reset (A+B+C+Start). So you need to leave the player management screen three times.
Five more conditions involve the array of 32-bit values starting at 0601ce50. These store the Environment Settings:
B.G.M. needs to be 0, i.e. OFF.
Sound Effect needs to be 1, i.e. ON.
Output needs to be 0, i.e. Stereo.
Help needs to be 1, i.e. ON.
Warning needs to be 1, i.e. ON.
Only the B.G.M. setting actually needs to be changed from its default value.
Three more conditions involve the array of 32-bit values starting at 060cd5c0. The target values are (0x7d1, 0x7, 0x15). This puzzled me, but once I converted the numbers from hex to decimal, their meaning became clear: 0x7d1 is 2001, 0x7 is 7, and 0x15 is 21. It’s a date!
So you need to set your Saturn’s clock to 7/21/2001. Reboot your Saturn while holding L or R and then go to System Settings > Clock in the BIOS menu to make the change.
The last three conditions are:
Does the function at
06049b90return 8?Does the string at
06083964match"Chuman "?Is the 16-bit value at
0609d7f2equal to0x870?
The function turns out to count how many players have been created. So we need to have a total of eight.
The string comparison is for the eighth player’s name. It needs to be "Chuman ".
The value comparison is for Controller 2’s buttons. 0x870 is the logical OR of the patterns for Start (0x800), X (0x40), Y (0x20), and Z (0x10). You need to be holding those buttons on the second controller as you press B on the first controller to confirm the name.
OK! Putting that all together:
Set your Saturn’s clock to 7/21/2001.
Leave and return to the player data screen three times.
Set B.G.M. to Off in the Environment menu.
Create your first player with the name Ryoko.
Rename that player’s first deck to Hirosue.
Give that player six more decks.
Create six more players.
Create an eighth player named Chuman. As you’re confirming the name hold Start+X+Y+Z on Controller 2.
Your reward for getting everything right is… everything! The game’s story mode will be marked Complete, and the Ante mode will be unlocked.
Furthermore, your Chuman player will have a complete card collection - 99 of each type.
I’ve seen some elaborate cheat entry systems in my day, but I think this one tops even the one in Shinobi Legions.
Outro
Ryoko Hirosue is an actress, famous in the 90s for appearing in dramas. I guess the programmer liked her? She seems to have run into a bit of trouble recently, alas.
It’s unclear what “Chuman” refers to, but one guess is the Japanese civil rights attorney Frank Chuman.
I’ve got no ideas on what the significance of 2001-07-21 is. If you have any, leave a comment!
Surely that was annoying even for the internal test team that presumably made use of it!? Crazy stuff.