SimCity 2000のセーブデータのハッキング (schemescape.com)
原題: Hacking SimCity 2000 saved games (schemescape.com)
日本語訳
# SimCity 2000のセーブデータをハックする (schemescape.com)
コンピュータとの個人的な歴史の続きとして、Commodore 64の次は、ディスクに保存されたバイトと16進数について学んだ物語です。それほど面白くも重要でもないエピソードですが、私の歩みの中で非常に鮮明な記憶なので、記録しておきたいと思いました。
**パッカードベルのデスクトップ**
我が家にはパッカードベルの386 SXデスクトップ(もちろんベージュ色)があり、CRTモニターを備え、MS-DOS(バージョン5か6だった記憶があります)が動いていました。子供だった私は、当然ながらコンピュータを単なるゲーム機だと思っていました。Carmen Sandiego、Operation Neptune、Oregon Trail、Scorched Earth、SimCity 2000など、多くのゲームをプレイしたのを覚えています。
**Scorched Earth (1991)**
待ってください、実際にはコンピュータを単なるゲーム機として扱っていたわけではありませんでした。Dinosaur Adventure(素晴らしい音楽でした)やOrbitsといった教育用ソフトウェアも使っていたのを覚えています。Orbitsには、各惑星の表面における重力の相対的な影響を示す楽しい視覚的デモンストレーションがありました。シミュレートされた各重力下で卵を同時に落とし、どれが一番早く落ちるかを見ることができたのです。どうやら、冥王星に落とした卵は割れさえしないようでした!現代の読者への注釈:Orbitsが作られた当時は、冥王星はまだ惑星とみなされていました。
**Orbits (1992)**
記憶は少し曖昧ですが、Egghead SoftwareやElectronics Boutiqueへ行き、魅力的なボックスアートが付いた「ビッグボックス」形式のものや、3.5インチフロッピーディスクが積み重なった状態のゲームやソフトウェアを見て回ったのを覚えています。フロッピーディスクは低速で、いずれ動かなくなるものでしたが、ソフトウェアを(今日のトレンドのように限定的なライセンスを付与されたり、すべてをレンタルしたりするのではなく)実際に「所有」できるという事実は、今でも気に入っています。
初期の頃に買ったゲームの一つがSimCity 2000でした。
**SimCity 2000**
実際には、SimCity 2000をそれほどたくさんプレイしたわけではないと思いますが、それが(振り返ってみれば)私の原点における決定的な瞬間へとつながりました。
SimCity 2000はアイソメトリック(等角投影法)の都市建設ゲームでした。評判がどうだったかは分かりませんが、グラフィックは綺麗でしたし、サンドボックスゲームの楽しさを初めて体験させてくれました。表向きにはゲーム内で達成すべき目標がありましたが、私はただ街を作って何が起こるかを見る、そんな試行錯誤が好きでした。
**SimCity 2000 (1993)**
残念ながら、私はゲームがあまり上手くなかったので、目標を達成する前にいつも資金が底をついてしまいました。
**セーブデータ**
SimCity 2000は、セーブされたゲーム(都市)をコンピュータ上のファイルとして保存していました。ある時点で、ディスク上のそれらのセーブファイルが編集できることに気づきました。どうやってこれを知ったのかは分かりませんが、正直なところ全く見当がつきません。言えるのは、セーブファイルがディスク上のファイルとして保存されていることの意味を、自力で導き出したのではないことは90%の確信を持って言えます。
とにかく、次のようなことができました。
- ゲーム内の所持金を確認する
- ゲームをセーブする
- そのセーブファイルを開く
- その値を(バイナリで)検索する
- その値を増やしてセーブする
- セーブしたゲームをロードする
- 儲けもの!
しかし、MS-DOSに組み込まれているEDITコマンドは、テキストファイルしか編集できませんでした。
**16進数**
「ヘキサエディタ」の登場です。
ヘキサエディタは、バイナリ用のEDITのようなものです。通常、コンパクト(かつバイト単位)に表示するために、デフォルトで16進数が使われます(多くの場合、横にASCII表示も付きます)。
原文(英語)を表示
Continuing my personal history with computers, after the Commodore 64, this is the story of how I learned about bytes, as stored on disk, and hexadecimal. It's not a terribly engaging or important anecdote, but it's a vivid enough memory on my journey, that I wanted to record it.
Packard Bell desktop
Our family had a Packard Bell 386 SX desktop computer (beige, of course), with a CRT monitor, running MS-DOS (I remember versions starting with a 5 and a 6). Being a kid, of course, I considered the computer to be solely a gaming machine. I remember playing Carmen Sandiego, Operation Neptune, Oregon Trail, Scorched Earth, SimCity 2000, and many other games.
Scorched Earth (1991)
Wait, actually, it turns out that I didn't treat the computer as solely a gaming device. I remember using educational software as well, including Dinosaur Adventure (which had great music) and Orbits. Orbits had a fun visual demonstration of the relative effects of gravity on the surface of each planet, where it would simultaneously drop eggs at each simulated gravity, and you could see which one fell fastest. Apparently, an egg dropped on Pluto wouldn't even crack! Note to modern readers: Orbits was created back when Pluto was still considered a planet.
Orbits (1992)
My memory is a bit fuzzy, but I remember going to Egghead Software and Electronics Boutique and looking at games and software that came in both "big box" form (with enticing box art) as well as bare stacks of 3-1/2" floppies. Floppy disks were slow and would eventually stop working, but I still like the fact that you could actually own software (instead of being granted a limited license, or just renting everything, as seems to be the trend today).
One game we bought early on was SimCity 2000.
SimCity 2000
In actuality, I don't think I played a ton of SimCity 2000, but it led to a pivotal moment (in retrospect) of my origin story.
SimCity 2000 was an isometric city-builder game. I'm not sure if it was well received, but I thought the graphics were pretty, and it let me first experience the joy of sandbox games. Ostensibly, there were goals you were trying to achieve in the game, but I just liked messing around, building cities and seeing what happened.
SimCity 2000 (1993)
Unfortunately, I wasn't very good at the game, so I kept running out of money before I had actually accomplished my aims.
Saved games
SimCity 2000 stored saved games (cities) in files on the computer. At some point, I became aware that those saved game files on disk could be edited. I wish I knew how I found out about this, but I honestly have no idea. All I can say is that I'm 90% sure that I did not independently realize the implications of saved games being stored in files on disk.
Anyway, here's a thing you could do:
- Note down how much money you had in the game
- Save the game
- Open that saved game file
- Search for that value (in binary)
- Increase that value and save
- Load the saved game
- Profit!
But wait, MS-DOS's built-in EDIT
command could only edit text files.
Hexadecimal
Enter the "hex editor".
A hex editor is like EDIT
for binaries. They usually default to hexadecimal for a compact (and byte-aligned) display (often with an ASCII display on the side). I'm not sure, but I think I used the hex editor from Norton Utilities, DiskEdit.
After learning that hexadecimal was basically just like decimal, only with "A" through "F" added to bring the base up to a nice power of two, I was able to search for my "money" value (in hex) and replace it with all "F"s, thus maximizing my money.
There was one final trick: the saved game format appeared to write the amount of money out using as few bytes as possible (well, not actually; see note below). If you started with $20,000 ("4E20" in hex), then there'd only be two bytes written, and increasing it to "FFFF" would get you up to $65,535. Being an enterprising individual, I would then load that game, do some trivial action to gain an additional few dollars, and then repeat the steps above, only this time I could get up to "FFFFFF" (~16 million) dollars.
Hex-editing a SimCity 2000 save file
Note: the description above (which is how I understood it at the time) is not entirely accurate. Someone reverse-engineered the SimCity 2000 file format, and what's actually happening is that the data is run-length-encoded, but the money value is always a (signed!) 32-bit value. It just happens that those top two bytes ("0000" in hex) get converted to "8100" (meaning "repeat the second byte, '00', one extra time"). Regardless, my childhood method works as advertised (I guess as long as you're not unlucky enough to have repeated bytes in your big-endian money value!).
$INT_MAX money in SimCity 2000
Hex conversion
I wish I remembered the details, but I believe my dad, at our request, created a decimal-to-hex converter. I think it was written in C, possibly using the Power C compiler. It might have used a for
loop. Since I'm a fancy programmer now, here's my modern reimplementation, leaning heavily on the C standard library:
#include <stdio.h>
int main(int, const char**) {
unsigned int n;
scanf("%d", &n);
printf("%X\n", n);
}
Note that it only does decimal-to-hex, because I didn't care about hex-to-decimal--I was just overwriting all the hex digits with "F"!
Revisiting the cheating
By the way, the previous section was completely superfluous. While double-checking my recollection of the process, I noticed that Norton DiskEdit already included a built-in hex converter. I wonder how I never noticed that!
Sorry, one more aside: if you want to try all this out yourself, note that DiskEdit only worked for me in DosBox-X and not the original DosBox, and you had to mount a raw image file (via IMGMOUNT
). DiskEdit apparently manipulates the hard drive directly, instead of going through whatever DOS file API I assume must exist.
Beyond SimCity
Bits, bytes, and hexadecimal are second nature to me now, so this was a trivial exercise. But back then, it was a breakthrough! I could cheat at SimCity! Oh, and I also learned about bytes and hexadecimal. Armed with that knowledge, I wondered what other games I could "hack". I probably tried this on every subsequent game I played.
Eventually, I even found a tool that would let me search for and modify bytes of memory while in-game. I think the tool was called Game Wizard. This would let you find where e.g. your health value was stored in memory, so that you could put it back to full health whenever you wanted. I suspect that this is how the Game Genie for the Nintendo Entertainment System worked. Unfortunately, I'm too lazy to try and track this tool down and confirm if it functioned how I remember.
Learnings
Cheating at games helped me to understand that:
- Hexadecimal is convenient for displaying raw bytes
- Files on disk are readily accessible (at least under DOS--not so much on modern phones!)
- Bytes in memory and on disk can be modified
This fluency likely contributed to my eventual success with computers. This was a pretty small foundation to start from, but I guess that was all it took, because, having learned how to "win" at SimCity 2000, I wanted to put the computer to work toward a more ambitious goal: making my own games.