Under the microscope: Three Dirty Dwarves (Sega PC)

Using Ghidra to recover a secret in a 30 year old PC game

The first article in this blog’s Under the microscope series was on the Saturn version of Three Dirty Dwarves, the 1996 beat-’em-up from Appaloosa Interactive. We’re returning to the Streets of Bronx in this edition for another first: this blog’s first post about a PC game.

The Saturn version of Three Dirty Dwarves turned out to have several special passwords that enabled cheat effects. Does the PC version have the same functionality?

At first glance, the answer is no. The Saturn version has a dedicated password entry screen, but there’s no equivalent on the PC version. But if you trawl the Usenet archives for mentions of the game, you’ll find this 1998 post that alludes to a different way of putting in passwords:

1) Go to WINDOWS directory.
2) Edit DWARVES.INI file.
3) Type in Password=AAAAAAAA. Only the 8 A's replacing the old one.
4) Save.
5) Start the game and you'll have all the stages/level ready to play.

The DWARVES.INI file in Notepad

This works, sort of. Follow those instructions and you’ll be able to select most levels from the Game menu. But not all of them - Barney’s Machines and Game End won’t be available.

The Game menu with password=AAAAAAAA

Is there a better way? Yes, there is - I found a cheat code. Details on how it works are below…

---

The reverse engineering

If you load the main game executable, DWARF.EXE, into Ghidra, you can find this logic in the function at 0046601a (I’ve added the variable labels):

          if (listen_for_cheat_004b78f0 == '\x01') {
            if ((char)wParam_1 == 'D') {
              cheat_counter_004b78f4 = 0;
            }
            counter_1 = cheat_counter_004b78f4;
            cheat_counter_004b78f4 = cheat_counter_004b78f4 + 1;
            if ((uint)(byte)SPECIAL_STRING_004b7984[counter_1] == (int)(char)wParam_1)
            {
              size_1 = strlen_00497580(SPECIAL_STRING_004b7984);
              if (size_1 <= cheat_counter_004b78f4) {
                passcode_data_02_004bda4e = 0xf;
                passcode_data_01_004bda4d = 0xf;
                passcode_data_00_004bda4c = 0xf;
                update_menus_0046aa75();
                listen_for_cheat_004b78f0 = '\x02';
              }
            }
            else {
              cheat_counter_004b78f4 = 0;
            }

This is checking to see whether a sequence of characters has been typed in. But it only starts listening for key presses if the listen_for_cheat_004b78f0 variable has value 0x01.

Tracing writes to that variable’s address leads to the function at 00468705, which is used as the lpDialogFunc argument to a DialogBoxParamA call.

DialogBoxParamA’s parameters. Screenshot from Microsoft.com.

Which dialog box is that? I clicked them all to find out - it turns out to be Game > About.

About Three Dirty Dwarves

Clicking on the interior of that box sets the correct value.

---

Unlocking all levels

To use the cheat code:

• Go to Game > About.

• Click on the interior of the dialog box that comes up (say, on the names of the programmers).

• Press OK.

• On the title screen, type in DWARVES TEAM (including the space).

If you got it right, the Game menu will now have all levels listed, including Barney’s Machines and Game End.

All levels available

This doesn’t affect the DWARVES.INI file, so you’ll have to put in the code again if you exit the game.

---

Outro

There’s one lingering question: why does the AAAAAAAA password sort of work? The answer seems to be this: the game validates passwords by setting the 4th character aside and computing a checksum from the rest. If the 4th character matches the checksum, the password counts as valid. So 1 in 26 codes are valid by chance!

I’ve uploaded a script that replicates the password system’s logic to GitHub. The real “unlock everything” password for the .ini file is SZTHRQND.

Thanks for reading, and extra thanks to Dan H. for testing out the DWARVES TEAM code.