Under the microscope: Unreal Tournament (Dreamcast)
Excavating cheat codes from a 25-year old Dreamcast game's data
In this edition, I’m examining the Dreamcast version of Unreal Tournament. The original game was of course developed by Epic, but the port was handled by Secret Level Games.
The Dreamcast edition has four well-known cheat codes. Each one is entered on the Pause screen:
How do these work? Is this the full list? I loaded up my debugging tools to check, and was pleased to discover two extra codes that have been hiding out for the last 25 years.
Below are nitty-gritty details on how the game processes cheat codes. After that is a description of how to use the new cheats.
The reverse engineering
I used the procedure described in the Batman Begins article to investigate out how the codes above work. These are the basic steps:
Pause the game.
Open the RALibetro emulator’s Memory Inspector.
Use it to filter out values in memory that change before I press any buttons on the controller.
Filter out values that don’t change after I press buttons.
This process revealed that the buffer starting at 8c94c524 changes in response to player input.
Tracing writes to that address in Ghidra led me to the function at 8c188ca0. Let’s look at the first part of its logic, which handles storing your most recent six button presses. I’ve added labels to Ghidra’s decompilation:
Each time you press a button, a numeric representation of it gets recorded in a buffer. Up is 0x01, Down is 0x02, Left is 0x04, and Right is 0x08. The most recent press pushes the previous entries back.
Once the buffer is updated, the function compares its contents to some static arrays:
Those arrays define cheat code sequences. The four from above look like this in the game data:
8c27cc44 [0x01, 0x02, 0x04, 0x08, 0x08, 0x04] # Skip level in Tournament mode
8c27cc5c [0x04, 0x04, 0x08, 0x08, 0x02, 0x01] # Invincible
8c27cc74 [0x04, 0x08, 0x04, 0x08, 0x08, 0x04] # Full ammo
8c27cc8c [0x02, 0x02, 0x02, 0x04, 0x01, 0x08] # Full healthIf the history buffer matches one of these arrays, the function constructs and executes a named command to apply its effect:
The cheat%d string template is filled in by the vprintf_01 call. For example: the first cheat’s index is 0. The %d is replaced with that value, so the command string is cheat0.
The execute_command_01 call interprets these command strings based on the current game context. The codes above can be entered any time, but they’ll be ignored if you’re not on the pause screen.
I showed four arrays above, but the code is looking at six of them. What are the other two? Here are the sequences:
8c27cca4 [0x08, 0x02, 0x01, 0x04, 0x04, 0x08] # New code 1
8c27ccbc [0x01, 0x02, 0x04, 0x02, 0x08, 0x01] # New code 2Let’s see what they do…
The new codes
The first new code is entered on the top level Tournament menu screen:
Right, Down, Up, Left, Left, RightIts effect is immediately visible: all of the modes become available to select.
Furthermore, all of the levels are unlocked in the Deathmatch, Domination, Capture the Flag, and Challenge modes.
All of the levels in Practice mode (leave Tournament mode to access it) also get unlocked by this code.
The second new code is entered from the main Practice menu screen:
Up, Down, Left, Down, Right, UpIf you entered it correctly, you’ll see the Player Limit Cheat message:
You can now select additional bots in the Game Setup screen:
Outro
Thanks for reading Rings of Saturn. As always, you’re free to use the information and screenshots in this article on your favorite reference site.
I’ll be back with more retro game reverse engineering soon. Subscribe here on Substack to get new articles delivered to you when they’re published, and check out the archive while you wait for the next one.
