Under the microscope: Toy Commander (Dreamcast)

Cheat at a Dreamcast game like it's 1999

In this edition, we’re examining Toy Commander, the 1999 Dreamcast game from Sega of Europe’s No Cliché studio.

There are several cheat codes already known for this game - Sega Retro has a nice list:

Cheats courtesy of Sega Retro stalwart BlackSquirrel

However, there are more lurking in the game data. I found the full set by analyzing an emulator memory snapshot in Ghidra. Below are details on the new codes and some notes on how the cheat detection system works.

---

Access the final mission

Normally, the final “Cellar” mission is locked until you’ve finished all the bosses, even if you use the Unlock all missions cheat from above.

Left: The Cellar area. Right: The entry denied message.

However, you can jump straight into it if you enter this sequence at the mode select screen. While holding L, enter Y, X, B, A, A, B.

Left: The mission briefing. Right: The beginning of the mission.

You’re meant to fly to the hangar in the games room and pick up the toys inside. This triggers the ending sequence.

Left: Approaching the hangar. Right: The beginning of the ending.

Update: Reader foxx points out that this cheat code appears on ConsoleDB.com, but with the wrong description. Odd!

---

Unlimited special weapons in boss fights

Hold L on the main menu and enter this code: A, B, X, X, Y, X.

This gives you unlimited special weapons to use in boss fights.

Left: 99 weapons available. Right: Unlimited weapons.

Normally this is unlocked by finishing the race in the Hidden Area in one of the top three places.

Left: The Hidden Area. Right: The snail race.

---

Unlock boss trophies

You can mark each boss as complete by entering these codes on the main menu while holding L:

Cyclone: A, B, B, X, X, X

Roly Poly: A, B, B, X, X, Y

Vroom Vroom: A, B, B, X, X, A

Blackjack: A, B, B, X, X, B

Buggy-wug: A, B, B, X, Y, X

Peggy: A, B, B, X, Y, Y

Sir Aldarak XIII: A, B, B, X, Y, A

Each of the codes adds a trophy to the mission select screen.

Left: The Cyclone boss. Right: The Cyclone boss is marked as complete.

If you enter all of the trophy codes, you unlock the Huggy Bear boss battle.

The Huggy Bear mission briefing

---

Technical details

The function at 8c0144da (NTSC-U version) handles cheat input. It checks to see whether you’re holding down the L trigger to at least 20% of its full range. If you’re not, it doesn’t bother looking for code sequences.

When L is being held down, the 24-byte buffer at 8c0c6bf0 (NTSC-U version) gets updated when you press a face button. Everything that was already in the buffer gets pushed back one position (4 bytes), and a new item gets pushed in. The code looks like this with variable names added:

/* Move everything back */
memmove_8c0681cc(&cheat_buffer_8c0c6bf0, &cheat_buffer_8c0c6bf4, 20, 0);

/* Push in the new value */
cheat_buffer_8c0c6c04 = p1_pressed_8c0fd7cc;

Here’s how the buffer looks as the Access the final mission code above is entered:

|...|...|...|...|...|...|  # Empty buffer
|...|...|...|...|...| Y |  # Pressed Y
|...|...|...|...| Y | X |  # Pressed X
|...|...|...| Y | X | B |  # Pressed B
|...|...| Y | X | B | A |  # Pressed A
|...| Y | X | B | A | A |  # Pressed A
| Y | X | B | A | A | B |  # Pressed B

You’ve gotta go fast when entering the codes. Each time you press a button, the value of the timer at 8c0a76c4 is recorded. After 1.5 seconds, the buffer clears and you have to start over.

Once there are six buttons in the buffer, the function at 8c0144da checks its content against 17 different values. Since the buffer pushes back old entries, the comparison just uses a version of memcmp:

memcmp_8c068198(cheat_buffer_ptr, &cheat_buttons_8c0a3f08 + cheat_offset_1, 24);

If one of the comparisons succeeds, the index of the match is used to determine which cheat effect is implemented. The new cheats above work like this:

• Cheat index 6 sets the value at 8c0a40a4 to 1. The game reads this value to determine whether to launch the final mission.

• Cheat index 7 sets the value at 8c0a5b04 to 1. The game uses this to check whether you’ve cleared the Hidden Area.

• Cheat indexes 9 through 15 set bits on the fields (by OR-ing their current values with 0x3000) starting at 8c0c7dc4. Each of those fields records trophy progress.

---

Outro

Below (in the Appendix) is the full set of cheat codes recognized by Toy Commander.

Thanks for reading! If you like cheating at toy-themed games from Sega, check out my article on Clockwork Knight 2 for Saturn. I’ll be back with more retro game reverse engineering articles soon.

---

Appendix

Here is the full set of codes that the game recognizes. Items in bold are new.