Under the microscope: Three Dirty Dwarves
Hidden secrets in Three Dirty Dwarves
In this edition:
A cheat code for Three Dirty Dwarves that stayed secret for 28 years
A cool development feature for recording auto-demos
Cracking the game’s password encoding system
Check out the video, and play Superhero mode with this password: GUNHILL
Appaloosa Interactive was best known for their Ecco the Dolphin series, but the company developed quite a few games - particularly for Sega systems. One of their Saturn titles was Three Dirty Dwarves, a beat-em-up with a unique aesthetic:
I really mean unique here: I don’t think anything looked like this before, and nothing has looked like this since.
The game has a hidden password screen. Press L+R on the Options screen to access it. To my knowledge, the only code that’s ever been known to work is MOSHOLU. It enables CHEAT MODE, which allows you to select your starting level.
I’m not sure how people found out about this feature. The earliest reference I found to it was in October 1997’s issue of EGM2. In any case, I think MOSHOLU is the only valid password that’s ever been known.
…until now!
The first hint that there are more things to discover is the presence of these strings in the game data (starting at 06060e90):
SUPERHERO
CHEAT MODE
JOYRECORDWe know about CHEAT MODE, but what are SUPERHERO and JOYRECORD?
By diffing memory snapshots, I found that the MOSHOLU code sets the value at address 06051e61 to 01. If we look in that region of memory, we’ll see similar blocks of values:
It turns out that SUPERHERO is enabled by setting 06051e58. Cool! What does it do?
Playing the game a bit makes things clear: when you take a hit, your character switches out like normal, but isn’t knocked unconscious. You can’t lose! Furthermore, you’ve always got a minimum of three red Power Skulls, which means you can always do the special moves.
Like Ecco, Three Dirty Dwarves is quite difficult - this is a pretty useful cheat.
I noticed right away that these two special passwords weren’t present in the game’s memory, at least not in plaintext. Are they encoded some other way? Stepping through the password checking function at 06062394, it became evident that they were not just encoded, they were scrambled. Weird!
The decompiled function is over 300 lines long, and not at all straightforward. So rather than try to understand it, I did something else: the game temporarily stores unscrambled passwords in memory just before checking them for validity. I set a breakpoint where that process completed (06062834) and then read the passwords out of RAM:
ZEREGAA is the first one. And then… there are a lot more?
| ZEREGAA | ZEREGAI | MOSHOLU |
| ZEREGAB | ZEREGAJ | NORWOOD |
| ZEREGAC | ZEREGAK | PELHAM. |
| ZEREGAD | ZEREGAL | FORDHAM |
| ZEREGAE | ZEREGAM | DYREAV. |
| ZEREGAF | ZEREGAN | TREMONT |
| ZEREGAG | ZEREGAO | FREEMAN |
| ZEREGAH | GUNHILL | NEREID |That was unexpected! Putting them in one by one, it’s GUNHILL that enables SUPERHERO, as mentioned above. We know MOSHOLU is CHEAT MODE. None of the rest enable JOYRECORD - what are they for?
There are two prototype builds of Three Dirty Dwarves circulating on the Internet. Remarkably, one of them has an archive with source code in it! There is code for scrambling and descrambling of passwords. But the scheme seems to have changed after this prototype build - the algorithm doesn’t work for the final game’s data.
The source code suggests that each of the 15 levels was supposed to be accessible by password at some point. That matches with the number of ZEREAGAA through ZERAGAO passwords, so presumably that’s what their original function was.
The source code gives us a hint about JOYRECORD, too: it calls the controller input input joy, presumably for “joypad.” So it probably refers to recording joypad information?
Indeed, that’s the case: turning JOYRECORD on (set 06048c68 to 01) lets you control the demo that plays if you don’t press Start at the title screen. Cool!
We actually do have enough information to figure out the password scrambling algorithm. The ZERAGA* passwords all vary only in their last character. Looking at how they’re stored, we can see this pattern:
ZERAGAA: 10 f1 ff fb f3 ee f7
ZERAGAB: 10 f1 ff fb f3 ee f8
ZERAGAC: 10 f1 ff fb f3 ee f9
ZERAGAD: 10 f1 ff fb f3 ee fAOnly the last character is changing. But the A character in position 4 doesn’t match the one in position 6, so there’s a different mapping for each position. Let’s make a translation table with some known values…
OK, that’s pretty clear. There’s an initial value for each position, and it increments by 1 for each letter, wrapping around after 255. Let’s fill in the rest…
Indeed, this matches the rest of the passwords. Mystery solved!
The Three Dirty Dwarves manual is quite the read. It’s got a list of facts about the game’s setting, Bronx, New York:
If you search for the password names, you’ll find that they’re all locations in the Bronx. Here they are mapped out.
That’s a wrap. I think the purpose of several of the passwords is lost to time (unless one of the game makers wants to tell us!), but at least we got one working one.
I hadn’t played Three Dirty Dwarves since experiencing the demo on Sega Screams Vol. 1. I had forgotten about it entirely until I saw a screenshot of it, and decided to investigate. Send me suggestions for what to check out - what other games might have similar secrets?