Under the microscope: Shockwave Assault & Shock Wave (Saturn, PlayStation, 3DO)
Using Ghidra and Python to uncover cheat codes
Intro
The 3DO game Shock Wave was ported to the PlayStation in 1995 and to the Saturn in 1996. On those systems it was released as Shockwave Assault.
GameFAQs lists some cheat codes for the 3DO and PlayStation versions, but none for the Saturn version. And the PlayStation ones, uh, don’t work:
What’s going on? Let’s investigate…
The Saturn version
GameFAQs says the game needs to be paused for cheats to work, so let’s start there. Comparing memory snapshots from where the game is paused and unpaused leads to the address at 060f4ec8, which is 00000004 when you’re playing and 00000008 after you press Start.
Tracing writes to that address leads to the function at 06018538, which handles inputs while the game is paused. It’s got a section that looks like this (simplified pseudo-Python adapted from Ghidra’s decompilation):
counter = 0
if pressed_button != DATA_06059c62[counter]:
counter = 0
else:
counter += 1
if counter == 10:
play_sfx(...)
DATA_060f4bd8 = 1That is, if you press some buttons in the right sequence, a counter will increment. When that counter reaches 10, a sound effect plays and a flag gets set.
The sequence of buttons is:
Left, Up, X, Up, Right, Y, C, Left, Up, BAfter that’s entered, un-pause and then pause again. Then you can press R+A to jump forward one mission. You’ll see an FMV before the next mission starts:
Or you can press L+A to switch between Earth and Mars missions.
The PSX version — hacking
I loaded a memory snapshot into Ghidra (for PlayStation, you want to set the language to 32-bit little endian MIPS and use a base address of 80000000) and found that the function at 8002d6e8 is the only one that references the string PAUSED:
That function’s caller, which is at 8002c608, handles input while the game is paused in this version. It keeps track of a special value that changes when you press buttons. Each press shifts the value by two bit positions and then adds something to it. The code looks something like this:
def combine_buttons(seq):
ret = 0
for button in seq:
if button == 'X':
ret = ret * 4 + 1
elif button == 'Square':
ret = ret * 4 + 2
elif button == 'Circle':
ret = ret * 4 + 3
elif button == 'Triangle':
ret = ret << 2
return retPressing Start or Select breaks you out of the input handling loop. If you pressed Select, the value that was derived from your button presses is passed to the function at 8003cf0c.
That function transforms the derived value further. The transformation code looks like this:
def transform(x):
for i in range(10):
x = x << 1 ^ (x << 1 & 0x4000) >> 3
x = x ^ (x & 0x800) >> 5
x = x ^ (x & 0x20000) >> 2
x = x ^ (x & 0x10000) >> 0x10
return xThis transformed value is then compared to 11 different targets, each of which has a cheat effect.
We can’t easily turn the 11 target values into button sequences directly. But we can try every possible button sequence and see if it produces one of the target values. This code does that, and prints out the shortest code for each target:
def get_button_sequences():
found = 0
for i in count(1):
for seq in product(['X', 'Square', 'Circle', 'Triangle'], repeat=i):
x = combine_buttons(seq)
y = transform(x)
if y in TARGETS and TARGETS[y] is None:
TARGETS[y] = seq
found += 1
print(found, ', '.join(seq), sep='. ')
if found == len(TARGETS):
returnThe PSX version — results
It turns out that GameFAQs was close… you do have to put in an “unlock” sequence first. The first (short) unlock sequence is Circle, Square, X, Select. That sets the value at 8006e804, which enables these cheats:
“[Player name] is the best”: Square, X, Square, Select
Smart bomb: Square, X, Circle, Select
Invincible: Square, X, Triangle, Select
Xtra laser: Circle, Circle, X, Circle, Triangle, Square, Select
Xtra weapon: Square, X, Triangle, Square, Square, Triangle, X, Square, Circle, Circle, Triangle, Select
Bonus refuel: Circle, X, Square
The second (long) unlock sequence is Square, X, Square, Circle, Triangle, Circle, Triangle, Select and it sets the value at 8006e804. GameFAQs was missing the Select button! But it was missing something else, too: The values at either 8006e86c or 8006e870 need to be set. What does that?
These addresses track whether your laser blasts are firing. You need to fire the laser and then quickly pause, then put in the second unlock sequence.
After that, you can get some more effects:
Complete mission: Square, X, Square, Square, Circle, Select
Autopilot: Square, Square, Circle, Triangle,Circle, Triangle, X, Select
Next miss: Circle, Square, Square, Triangle, Triangle, Square, Circle, Triangle, Circle, Square, Select
“Next Miss” increments the number of complete missions.
It looks like Cheat Code Central has the right idea for some of these codes: it has the second unlock code and the has the “firing lasers” component, but is missing some of the effects.
These codes work on both the Invasion Earth and Operation Jumpgate discs.
The 3DO version
GameFAQs is missing the details of the unlock sequences for 3DO, too. This page has the second (long) unlock sequence right, plus most of the effects.
The PlayStation’s cheat code system is clearly derived from the 3DO version’s, but the original is a little different. For example, the combine_buttons function from above only operates on the A, B, and C buttons.
After modification, my script spits out these sequences:
“[Player name] is the best”: BABX
“90% Pure French”: BACACAX
Short unlock: BACCAAX
Mission complete: BACCAAAX
Xtra laser: CAABACAX
New life: CACABAAX
Next miss: ACABAACAAAX
Invincible: BABCCABACAX
Long unlock: BABAAABABACX
The “90% Pure French Code” is listed as “Display programmer's message” on GameFAQs. The first two credited engineers on the game are Philippe Tarbouriech and Laurent Benes, so I guess that checks out.
Outro
The scripts I used to recover the PlayStation and 3DO codes are available on GitHub for your enjoyment.
For more on 3DO games and ports, see the articles on:
See my archive for other cheat codes I’ve discovered for retro games. Which other ones should I be examining? Give me your suggestions in the comments.
Awesome. Shockwave Assault on Saturn is a guilty pleasure of mine.
Another quirk of Saturn SA is its compatibility with the floppy drive. Are you able to see anything different in how this random 3rd party game handles saves compared to other releases? Was always curious why this game worked with the fdd, no problems.
Thanks for your brilliant work. Cheers!