Hacking SimCity 2000 saved games

Continuing my personal history with computers, after the Commodore 64, this is the story of how I learned about bytes, as stored on disk, and hexadecimal. It's not a terribly engaging or important anecdote, but it's a vivid enough memory on my journey, that I wanted to record it.

Packard Bell desktop

Our family had a Packard Bell 386 SX desktop computer (beige, of course), with a CRT monitor, running MS-DOS (I remember versions starting with a 5 and a 6). Being a kid, of course, I considered the computer to be solely a gaming machine. I remember playing Carmen Sandiego, Operation Neptune, Oregon Trail, Scorched Earth, SimCity 2000, and many other games.

Scorched Earth (1991)

Wait, actually, it turns out that I didn't treat the computer as solely a gaming device. I remember using educational software as well, including Dinosaur Adventure (which had great music) and Orbits. Orbits had a fun visual demonstration of the relative effects of gravity on the surface of each planet, where it would simultaneously drop eggs at each simulated gravity, and you could see which one fell fastest. Apparently, an egg dropped on Pluto wouldn't even crack! Note to modern readers: Orbits was created back when Pluto was still considered a planet.

Orbits (1992)

My memory is a bit fuzzy, but I remember going to Egghead Software and Electronics Boutique and looking at games and software that came in both "big box" form (with enticing box art) as well as bare stacks of 3-1/2" floppies. Floppy disks were slow and would eventually stop working, but I still like the fact that you could actually own software (instead of being granted a limited license, or just renting everything, as seems to be the trend today).

One game we bought early on was SimCity 2000.

SimCity 2000

In actuality, I don't think I played a ton of SimCity 2000, but it led to a pivotal moment (in retrospect) of my origin story.

SimCity 2000 was an isometric city-builder game. I'm not sure if it was well received, but I thought the graphics were pretty, and it let me first experience the joy of sandbox games. Ostensibly, there were goals you were trying to achieve in the game, but I just liked messing around, building cities and seeing what happened.

SimCity 2000 (1993)

Unfortunately, I wasn't very good at the game, so I kept running out of money before I had actually accomplished my aims.

Saved games

SimCity 2000 stored saved games (cities) in files on the computer. At some point, I became aware that those saved game files on disk could be edited. I wish I knew how I found out about this, but I honestly have no idea. All I can say is that I'm 90% sure that I did not independently realize the implications of saved games being stored in files on disk.

Anyway, here's a thing you could do:

1. Note down how much money you had in the game
2. Save the game
3. Open that saved game file
4. Search for that value (in binary)
5. Increase that value and save
6. Load the saved game
7. Profit!

But wait, MS-DOS's built-in EDIT command could only edit text files.

Hexadecimal

Enter the "hex editor".

A hex editor is like EDIT for binaries. They usually default to hexadecimal for a compact (and byte-aligned) display (often with an ASCII display on the side). I'm not sure, but I think I used the hex editor from Norton Utilities, DiskEdit.

After learning that hexadecimal was basically just like decimal, only with "A" through "F" added to bring the base up to a nice power of two, I was able to search for my "money" value (in hex) and replace it with all "F"s, thus maximizing my money.

There was one final trick: the saved game format appeared to write the amount of money out using as few bytes as possible (well, not actually; see note below). If you started with $20,000 ("4E20" in hex), then there'd only be two bytes written, and increasing it to "FFFF" would get you up to $65,535. Being an enterprising individual, I would then load that game, do some trivial action to gain an additional few dollars, and then repeat the steps above, only this time I could get up to "FFFFFF" (~16 million) dollars.

Hex-editing a SimCity 2000 save file

Note: the description above (which is how I understood it at the time) is not entirely accurate. Someone reverse-engineered the SimCity 2000 file format, and what's actually happening is that the data is run-length-encoded, but the money value is always a (signed!) 32-bit value. It just happens that those top two bytes ("0000" in hex) get converted to "8100" (meaning "repeat the second byte, '00', one extra time"). Regardless, my childhood method works as advertised (I guess as long as you're not unlucky enough to have repeated bytes in your big-endian money value!).

$INT_MAX money in SimCity 2000

Hex conversion

I wish I remembered the details, but I believe my dad, at our request, created a decimal-to-hex converter. I think it was written in C, possibly using the Power C compiler. It might have used a for loop. Since I'm a fancy programmer now, here's my modern reimplementation, leaning heavily on the C standard library:

#include 

int main(int, const char**) {
    unsigned int n;
    scanf("%d", &n);
    printf("%X\n", n);
}

Note that it only does decimal-to-hex, because I didn't care about hex-to-decimal--I was just overwriting all the hex digits with "F"!

Revisiting the cheating

By the way, the previous section was completely superfluous. While double-checking my recollection of the process, I noticed that Norton DiskEdit already included a built-in hex converter. I wonder how I never noticed that!

Sorry, one more aside: if you want to try all this out yourself, note that DiskEdit only worked for me in DosBox-X and not the original DosBox, and you had to mount a raw image file (via IMGMOUNT). DiskEdit apparently manipulates the hard drive directly, instead of going through whatever DOS file API I assume must exist.

Beyond SimCity

Bits, bytes, and hexadecimal are second nature to me now, so this was a trivial exercise. But back then, it was a breakthrough! I could cheat at SimCity! Oh, and I also learned about bytes and hexadecimal. Armed with that knowledge, I wondered what other games I could "hack". I probably tried this on every subsequent game I played.

Eventually, I even found a tool that would let me search for and modify bytes of memory while in-game. I think the tool was called Game Wizard. This would let you find where e.g. your health value was stored in memory, so that you could put it back to full health whenever you wanted. I suspect that this is how the Game Genie for the Nintendo Entertainment System worked. Unfortunately, I'm too lazy to try and track this tool down and confirm if it functioned how I remember.

Learnings

Cheating at games helped me to understand that:

• Hexadecimal is convenient for displaying raw bytes
• Files on disk are readily accessible (at least under DOS--not so much on modern phones!)
• Bytes in memory and on disk can be modified

This fluency likely contributed to my eventual success with computers. This was a pretty small foundation to start from, but I guess that was all it took, because, having learned how to "win" at SimCity 2000, I wanted to put the computer to work toward a more ambitious goal: making my own games.