Under the microscope: The Magic School Bus

My perception in the 90s was that the Sega Genesis was supposed to be your older brother’s console. It didn’t matter whether you had an older brother, or were an older brother; Sega’s marketing always implied that Genesis was just slightly cooler than you were.

Sega did try to appeal to younger siblings, however. The company’s Sega Club imprint published several titles for little kids, some of which purported to be at least slightly educational.

Scholastic’s The Magic School Bus: Space Exploration Game was one of these Sega Club games. It’s a collection of mini-games focused on space, and is inspired by the 1990 book The Magic School Bus Lost in the Solar System.

Why examine a 30 year old edutainment game? It caught my eye because (a) I had the original The Magic School Bus space book when I was a kid, and my parents would never read it to me because it was too long; and (b) it was developed by Novotrade, and I’ve found interesting things in a few Novotrade games in recent years.

Below are details on how this game’s password system works, and notes on how to use a previously-unpublished cheat code to bypass it altogether.

The password system

Like many Genesis games, The Magic School Bus lets you “load” a previous session by putting in a password.

Letters you enter on the password screen get added to the buffer at memory address ffffb704. Pressing Start kicks off a sequence of function calls that results in that buffer’s contents being checked for validity.

The function at 00000ae2 reads the buffer 139 times. This function does a fixed-size memory comparison: it takes in two buffer addresses and a length. It loops through the two buffers, looking for a mismatch.

The first 90 comparisons are to successive chunks of six bytes from the block of gibberish at address 000030f4:

There’s nothing fancy to reverse engineer here – each six byte chunk is a hardcoded password. The first 30 are for easy mode, the next 30 are for normal mode, and the last 30 are for hard mode. Here’s the full set:

| Easy   | Normal | Hard   |
|--------|--------|--------|
| DHIAGC | FKJWEG | RUITYH |
| WKOJAV | HFRUIR | ERQUIH |
| QLDXYZ | EHFUIP | YUADSH |
| ERVTYH | HFGYUS | FGJKAD |
| SUPERR | DHYSDG | FUIGHE |
| AGFMHC | FYUGYT | RUIQGY |
| JIKQOA | WEFSDH | QWPOIW |
| SXQTWE | FJGSDF | GCVRBQ |
| WLMLBD | YUGWDY | BPYURU |
| IARDXC | UFWGYE | VREBUE |
| EDRPLS | FGYWEG | NCUEHG |
| MYKLRS | DFYUAW | CYFEFG |
| BIRYDF | HJDGSF | HJGYCN |
| ZAOEIU | EGFYUA | EFGYER |
| VERGQF | SDGFYU | WYFRBG |
| DULBWA | GYUSDG | WEYDRF |
| XQARYW | FYUSDG | DTWEGF |
| RFKSUW | YCFUGS | YUSDGF |
| SPBOQJ | HDGFWR | HJDHJG |
| ANFVRS | TDFWEU | SYDHFG |
| IRZPGS | IFVGLY | YUAERK |
| WOUQJM | UCBVFW | UTYWEU |
| BSJDGX | EHCFBV | WELKMD |
| BOLWGJ | YUGCRU | BFUISD |
| IKOYPS | IWRBUZ | UISEOI |
| UEZWHD | XVWERC | AHFGIA |
| SOAGRY | GUIEFQ | SDOQWO |
| SGEDEF | MQMCFB | ITHSDK |
| EOAGHI | UREYHT | AJTERU |
| HIRJKL | UIGYHE | ETRYUK |

The next five comparisons are for special passwords that take you directly into mini-games. These have been listed on cheat sites (e.g. GameFAQs) for years:

• Astro Blaster: ASTROB
• Reflector: REFLEC
• Orbiter: ORBITS
• Asteroid Insanity: ASTINS

The last 45 comparisons are for passwords that take you directly to different levels in the game. Here’s the full set – you can see the template they use pretty easily:

| Place / Game | Flying | Landing | Walking | Shuffle | Matching |
|--------------|--------|---------|---------|---------|----------|
| Moon         | FLYMOO | LANMOO  | WALMOO  | SHUMOO  | MATMOO   |
| Venus        | FLYVEN | LANVEN  | WALVEN  | SHUVEN  | MATVEN   |
| Mars         | FLYMAR | LANMAR  | WALMAR  | SHUMAR  | MATMAR   |
| Mercury      | FLYMER | LANMER  | WALMER  | SHUMER  | MATMER   |
| Jupiter      | FLYJUP | LANJUP  | WALJUP  | SHUJUP  | MATJUP   |
| Saturn       | FLYSAT | LANSAT  | WALSAT  | SHUSAT  | MATSAT   |
| Uranus       | FLYURA | LANURA  | WALURA  | SHUURA  | MATURA   |
| Neptune      | FLYNEP | LANNEP  | WALNEP  | SHUNEP  | MATNEP   |
| Pluto        | FLYPLU | LANPLU  | WALPLU  | SHUPLU  | MATPLU   |

I suppose Novotrade expended more effort on obfuscating passwords in their 32-bit era games because it was easier to pull data out of CDs than Genesis cartridges.

---

The cheat menu

What if you didn’t need passwords at all? None of the cheat sites have any codes listed for this game, but there is one lurking in the binary:

| Address  | Value |
|----------|-------|
| 000030be | 10    |
| 000030bf | 01    |
| 000030c0 | 01    |
| 000030c1 | 02    |
| 000030c2 | 02    |
| 000030c3 | 10    |
| 000030c4 | 02    |

Each of the values in the table corresponds to a controller button. 10 is B, 01 is Up, and 02 is Down. The function that handles input on the pause screen checks the most recent button press against the sequence in the table.

So to enter the code, pause during gameplay, and press B, Up, Up, Down, Down, B, Down. A special cheat menu will appear:

This allows you to jump straight into any stage (or bonus game) without a password. You can also use the menu to enable Unlimited Life or Unlimited Fuel – these do what you would expect. Furthermore, there’s a music and sound test feature.

---

Outro

That’s all for The Magic School Bus. I’ll be back with another examination of a Genesis game next week (hint: it involves a GWAR concert). For more retro game reverse engineering in the meantime, see my Rings of Saturn blog.