A Moogle  🏳️‍🌈 💻 🎮 🎶 🇸🇪

This was easier than one might expect, as I had a copy of Phantasy Star Online and a Broadband Adapter, so running trojan code was relatively easy. Legendary Gameshark hacker "Parasyte" came through in a clinch, and whipped up a quick utility to dump the full RAM space.

My next port of call was the @dolphin_emu folks - yes, it was in development even then. One of their senior devs, Costis, was kind enough to whip me up a custom build that let me load this RAM image, disassemble code, and manually set register contents.

The last key to the puzzle was Nintendo themselves, as they left the linker .map file on the disc when it was authored. I therefore had the address of every function in the game, and, well, those "mMpswd" functions sure look like "password", don't they?

This kicked off a 2-3 month period where I did little other than go to university, take my courses, get home, and work on painstakingly translating every function, instruction by instruction, into pseudo-C code.

After having every function reversed, I converted it into proper C. It required a good bit of debugging - fortunately, I had Dolphin to check my results against on a per-function basis - but at the end of it all, I was able to generate arbitrary trade codes.

It's now time for some info on the algorithm itself. It comprises many, many layers of obfuscation. A 21-byte buffer is assembled consisting of 8 bytes for the town, 8 bytes for the player, 2 item bytes, 2 info bytes, and a checksum byte.

These 21 bytes are subjected to a transposition cipher, a substitution cipher, random bit shuffling, being shifted like a massive barrel shifter, a cut-down version of RSA encryption, and finally converted into 28 6-bit characters and printed on-screen.

In summation, there was no way that this sort of algorithm could be brute-forced, simply due to the sheer number of transforms applied to the data. But it wasn't designed to withstand a university student with a surfeit of time and a working debugger. ~Fin