Under the microscope: The Weakest Link (PlayStation, PlayStation 2)
Using Ghidra to uncover hidden testing functions in a 2001 quiz game
Imagine being a game tester at Traveller’s Tales in 2001. You’re assigned to the studio’s next title, an adaptation of the game show The Weakest Link. It’s advertised as having 100,000 questions1. There are 24 characters and three modes to examine. You’re going to want to take some shortcuts, aren’t you?
I took a look at the PlayStation versions of this game and found some previously undocumented cheat codes for it:
One allows you to adjust the position of the menu screens.
Another shows you the correct answers during gameplay.
Two more let you end a round early.
These all seem to be leftovers from development, codes designed to make the QA team’s life a little easier.
While I was at it, I decoded all 72 passwords that the game recognizes for resuming a session, since I don’t think the full set has been published before. Furthermore, I checked the PlayStation 2 version to see if any secrets are hiding in the upgraded edition.
Read on for details!
Adjusting the screen
One of the most useful tricks for finding hidden things in old games is looking at all the places input is handled. I use the method that I described in the Batman Begins article to determine which memory addresses hold player input (essentially: compare memory snapshots before and after holding down a button). Then I use Ghidra to find the locations that refer to those addresses.
Input handling code that looks for multiple buttons at once is usually interesting. Here’s an adaptation of some code that’s running on The Weakest Link’s main menu. This pseudocode is adapted from Ghidra’s decompilation of the function at 800b3060:
if (held_button & 0x1700) == 0x1700:
if (held_button & 0x0080) != 0:
DWORD_80079024 -= DWORD_800795ec
if (held_button & 0x0020) != 0:
DWORD_80079024 += DWORD_800795ecThe game is looking to see whether you’re holding certain combinations of buttons. Depending on which ones, a value gets decreased or increased. The buttons are L1+L2+R2+Triangle and either Left or Right:
0x1700is the logical OR of the patterns associated with L1 (0x0400), L2 (0x0100), R2 (0x0200), and Triangle (0x1000).0x0080is D-pad Left, and0x0020is D-pad Right.
The value that’s decreased/increased turns out to be the screen’s horizontal position. Hold L1+L2+R2+Triangle and Left to move it to the left. Switch the last button for Right to move it to the right. Up and Down work, too – they adjust the vertical position (stored at 80079028):
Cheating to win
Moving the screen around is mildly interesting, but this code (in the function at 800520dc) that’s executing during gameplay is much more compelling: Its logic is something like this:
if (
(held_button & 0x0900) == 0x0900 and # Holding L2+R1
(held_button & 0x8000) != 0x0000 and # Holding Square
(held_button & 0x2000) != 0x0000 and # Holding Circle
(question_index == 3) # Fourth question (0-based index)
):
if (pressed_button & 0x0010) != 0x0000: # Pressing Up
DWORD_800796c4 = 0x0001That is:
Start a game.
Wait for the fourth question.
Hold L2+R1+Square+Circle and press Up
This sets the value at 800796c4. What’s that do? It shows you the correct answers! They are marked with an asterisk:
The next check in the same function is for holding L2+R1+Square+Circle while pressing Right (during the fourth question):
if (pressed_button & 0x0020) != 0x0000:
DWORD_80079b80 = 0x0258 # 600 in decimalThis sets the value at DWORD_80079b80 to 600. This value turns out to be the game timer – it is reduced to 10 seconds, cutting the round short:
The last check is for L2+R1+Square+Circle while pressing Down (during the fourth question). This marks the round as complete, and gives you a password for resuming your session.
The championship passwords
How do these championship passwords work? Setting a read breakpoint for the memory addresses that store input leads to the function at 800af5c0, which runs on the Championship Character Select screen that’s mentioned along with the password.
After you press Circle on that screen, you’re meant to enter a password sequence. Each position you visit on the grid is stored in the ring buffer that starts at 800b7c80. As you make moves, the function at 800af494 gets called to check the buffer against an array of 72 targets.
The 72 targets are stored starting at 800b7810. Each one is encoded as a 32-bit value. After subtracting 1 from this value:
The lower 5 bits are used to encode the character for starting the passcode. Angela at position (1, 1) in the grid is 0; Karen at position (1, 2) is 1; etc.
The next lowest 2 bits encode the direction to move from the starting position. Up is 0, Down is 1, Left is 2, and Right is 3. The remaining 7 moves are also encoded as 2-bit values.
The target character and the round are determined by the index in the array. The value divided by three is the character; the remainder is the round.
Here’s an example decoding:
target_data = bytes.fromhex('8e 54 14 00') # Value from game memory
target_int = unpack('<I', target_data)[0] - 1 # Interpret as 32 LE
lower_5 = target_int & 0b11111 # Starting position: 13
start_y, start_x = divmod(lower_5, 8) # (1, 5) => Row 2, Col 6
upper_27 = target_int >> 5 # Get "move" bits
(upper_27 >> (7 * 2)) & 0b11 # Move 1: 2 (Left)
(upper_27 >> (6 * 2)) & 0b11 # Move 2: 2 (Left)
(upper_27 >> (5 * 2)) & 0b11 # Move 3: 0 (Up)
(upper_27 >> (4 * 2)) & 0b11 # Move 4: 2 (Left)
(upper_27 >> (3 * 2)) & 0b11 # Move 5: 2 (Left)
(upper_27 >> (2 * 2)) & 0b11 # Move 6: 2 (Left)
(upper_27 >> (1 * 2)) & 0b11 # Move 7: 1 (Down)
(upper_27 >> (0 * 2)) & 0b11 # Move 8: 0 (Up)So the code is: Highlight Ruth, then enter Left, Left, Up, Left, Left, Left, Down, Up
The full set of passwords, plus the script I used to decode them is available here. Several of these are on cheat sites like GameFAQs already, but I don’t think the full set has been available previously.
The PlayStation 2 version
A PlayStation 2 version of The Weakest Link also came out in 2001, at least in the UK and France. It’s got better graphics, but otherwise resembles the PlayStation version pretty strongly. Does it have the same hidden features?
The screen adjustment code isn’t present in the PlayStation 2 version of The Weakest Link, nor are the “end early” cheats. However a variant of the “show answers” cheat is. While the clock is between 1:20 and 1:15, tap R1+R2+Square+Circle all at once (you really have to nail the timing).
In this version, the correct answer will be the one that’s blank in the multiple choice list:
The logic for this cheat is in the function at 00125ed8, which the game calls INGAME_InGame.
All of the Championship Mode passwords work in this version. The logic in the check_password function at 00112a48 is identical to the PlayStation version.
Outro
For more adventures in retro game reverse engineering, see my archive here at Substack. I’ve covered some Traveller’s Tales games before – Toy Story 2 and Buzz Lightyear of Star Command.
More articles are coming! Subscribe to the newsletter version of this blog to get the next one as soon as it’s published.
I think there are only 18,000 questions! More on this later…