Under the Microscope: Time Bokan Series

In this edition, we’re examining Time Bokan Series: Bokan to Ippatsu! Doronboo Kanpekiban, the 1997 shoot-em-up for Saturn from Eleven and Banpresto.

Japanese cheat sites (like this one and this one) don’t have any codes listed for this game, but they do note these unlockable features:

• If you clear the game on the difficulty level 2, the maximum credits you can set in the Options menu increases from 9 to 50.
• If you clear the game on difficulty level 3, you’ll get access to three additional characters.
• If you clear the game on difficulty level 4, you’ll be able to choose your starting stage.

I looked at the game data and found a shortcut that unlocks all three of these features in one go. Details on how it works are below…

---

Unlocking everything

On the main menu, highlight the top item (Start). Hold Left+X+Z and tap C. Keep holding Left, X, and Z until the opening FMV starts.

If you got it right, you’ll see two of the effects mentioned above. There will be a Stage (Change L/R) badge on the vehicle select screen, and there will be three extra vehicles shown in front of the default set of six.

If you do a soft reboot and choose the last item on the main menu (Options), you’ll be able to set the number of credits (the second item) to any value between 0 and 50.

In short, this button code unlocks everything. Handy!

---

Technical details

I tracked this cheat code down by looking at the credits effect in the Options screen code.

The code at 0606852e executes when you press Right on the credits item in the Options menu. Let’s break down the disassembly.

First, the credits value is incremented:

0606852e mov.b @r3,r1  # Read the current credits value into r1
06068530 mov r1,r2     # Copy that value into r2
06068532 add 0x1,r2    # Add 1 to the value in r2
06068534 mov.b r2,@r3  # Write the incremented r2 value back to memory

Next, the game checks to see whether any “clear” flags are set. These track which difficulty modes have been completed, and are stored at memory address 06058ca4. If any are, the maximum credits value gets set to 50. Otherwise, it gets set to 9:

06068538 mov.b @r1,r1     # Read the clear flags from memory
0606853a cmp/pl r1        # Check whether the value is greater than 0
0606853c bf/s 0x06068544  # If it is, jump down to the last line of this block
0606853e _exts.b r2,r2    # Extend the sign of the credits value
06068540 bra 0x06068546   # If the value wasn't greater than 0, get ready to jump...
06068542 _mov #0x32,r1    # ...but set the maximum credits value to 0x32 (50) first.
06068544 mov #9,r1        # Last line: set the maximum credits value to 9.

This is exactly the logic described on the Japanese cheat sites.

The underscores before_exts.b and _mov indicate they occupy a “branch delay slot.” When a branch instruction (like bra or bf/s) forces the program counter to make a discontinuous jump, the processor has already fetched the very next instruction in line. Rather than throwing that instruction out and wasting a cycle, the CPU executes it anyway before making the jump.

Using Ghidra, I was able to trace writes to the “clear” flags memory address. It found one right after this block of code:

0600ae3a mov.w @r1,r1              # Read the bit field for controller input
0600ae3c mov.w @(0x600aeda,pc),r2  # Read in the constant 0x4050
0600ae3e extu.w r1,r1              # Extend the sign of the input value
0600ae40 cmp/eq r2,r1              # Check whether the input value matched the constant
0600ae42 bf/s 0x0600ae4e           # If it did, get ready to jump
0600ae44 _mov r15,r14              # ...but use this post-jump slot to do another move
0600ae46 mov.l @(0x600aef8,pc),r1  # If we didn't jump away, get the address of the clear flags 
0600ae48 mov.b @r1,r0              # Read the clear flags value into r0
0600ae4a bra 0x0600ae54            # Get ready to jump...
0600ae4c _or 0x10,r0               # But first, set a bit on the clear flags value

This is implementing the check described above: does the bit pattern associated with buttons currently pressed on the controller match the static value 0x4050? That value is the logical OR of the bit patterns for D-pad Left (0x4000), the X button (0x0040), and the Z button (0x0010).

If there is a match, the game sets clear flag associated with difficulty level 4. This update value gets written back to the clear flags’ memory address.

---

Outro

A version of this game was also published for Japanese PlayStations in 1996. It has the same bonus features, but no apparent cheat code for unlocking them. Another win for the Saturn!

Thanks for reading. There will be another Saturn game under the microscope next week. In the meantime, check out my blog for more retro game reverse engineering.