The Hanover Collaboration

Game makers these days have got to realize that the first thing people are going to do is look at the whole thing with HexEdit. In some cases like Quake 3, that was welcome. All the data for was stored in a .zip archive in individual recognizable files. If you wanted to add bots that looked like, say, girls on the ski team or put writing on the walls in some level it took very little effort to figure out how to do that.

The first game that I hacked on Xbox was Leasure Suit Larry, Magna Cum Laude (nothing modivates a man like sex). There were censor bars on the private parts so I grepped the disk for the ascii representation of “nudity”. It apeared a couple of times. There was a file \data\jamfiles\xbox\AppInit.jam containing the following gem.

// Nudity Setting—set this value to 1 to remove censor bars (for european version) DataLink { Name “NudityMode”Type BooleanData 1 }

Except it used to say “Data 0”. After that, I always looked at my new games to see if there was easily unlockable stuff. It’s nice being rewarded with unlocks but if I’m just renting a game for the week, and I’m not really into it, I definitely don’t feel like putting in the time to beat it on kill your friends hard just to see the alternate ending. But if the game itself doesn’t have something obvious, like the ascii string “unlock” in someplace decypherable (i.e. not the executable) or “hard_mode_finished” in the save game memory, I don’t put more effort into it.

But the buzz surrounding GTA:SA was so much, I had to investigate. If I were the sort who grepped for “sex”, I would have found many many appearances, most of them they are either inocuous like “sex_appeal”, “sexywoman.mdl”, or non-obvious like “SEX” without anything decypherable nearby. But then there is this one, in the file \data\scripts\scripts.img

gf_date.scm00AC00AD00AE00AF00B000B1008800000004000000
gf_meeting.scm000000AE00AF00B000B1008C00000007000000
gf_sex.scm0000AC00AD00AE00AF00B000B1009300000005000000
Here is where I lose the trail. This looks to me like padding, a base address and an offset, but I can’t find what it referrences.

There is an appearance of the same three things, “GF_DATE… GF_MEETING…GF_SEX” in the file \data\scripts\main.scm which suggests to me those files are in there except it is not clear to me how to find them. But it is also not surprising that someone else figured it out.

Finally I get to my whole motivation for posting. I just got Karaoke Revolution Party. It is pretty sweet. They didn’t screw anything up from Karaoke Revolution and the added 1) more songs 2) duets and 3) DDR and singing at the same time.

I wanted to just drop it in and have all the songs. I don’t want to have to gradually earn them. I was also hoping that I could also play the songs from the first one without changing disks or anything. With the first one, it wasn’t a problem. It wasn’t hard to find this in config\db.dta

;; initial unlocked songs are these, plus all showtime songs

(kUnlockSong believe bornto
...

But now I’m looking at the second one and there is no such file. Well, there is, it’s just in an .ark file somewhere. All of the important game data (except it seems, the dancing steps) are in these archive files—sort of like quake 3 except these don’t appear to be standard files. They are compressed and have the file info obfuscated (though I think still present). There is a separate file that gives the filenames and structure for what is clearly in there. We know (some of) what is in there because, people have already found playable .ogg files in continuous blocks (I guess since .ogg doesn’t compress further?). But the key is to be to figure out the compression scheme and dig out the file “unlock.dta” that is surely in there.

Now there is a separate tack to take. When you unlock a song and then save your game, the song stays unlocked. Clearly then, there is an unlock record on in the savedata. But it isn’t obvious how that data is organized. I’m going to start over and play and save and check a few times to see what changes. I’ll let you know.