Reverse-Engineering Micro Machines V4's Bonus Code System
My First Experience with Ghidra, Runtime Debugging and Decompilation
Introduction
While playing Micro Machines V4 on PlayStation 2 with a friend, we found its bonus code menu. Instead of using universal cheat codes, the game displays a window where the user can input codes generated by Codemasters to unlock content in the game.
A service that is no longer available.
As a game developer who had never experienced reverse engineering game assembly before, it was a great opportunity to understand how things work under the hood.
A first lead to investigate
I started searching for information about the bonus code generation system used by this game, and I found this article: Under the Microscope: LMA Manager 2003–2006.
It talks about the same topic in a game published by Codemasters, during the same period.
The author explains that LMA Manager 2006 uses an RSA public key, a custom Base32 encoding and an XOR mask before verifying the codes. Since its RSA modulus was tiny, it could be factored to recover the private key and then generate the correct codes to enter.
It was a great starting point, and after reading it, I started with the hypothesis that the system could be the same for Micro Machines V4. Let’s dig into it.
Started with the PC version
Since Micro Machines V4 was released on PC, I started working on this version because using Ghidra, debugging tools and memory inspection tools was easier on this platform. I also know the PC architecture much better than the PS2 architecture.
I opened the .exe using Ghidra and started searching for the Bonus keyword. Fortunately, it was referenced directly in the assembly.
From this point, I tracked the conditional calls related to it and found a candidate function for the code-verification process.
Since I am not very experienced in reading decompiled code, I used AI to help me understand it. It confirmed that this was the bonus code verification method.
After saving the memory address of the method, I used x32dbg to set a breakpoint at this location and inspect the registers and call stack.
Got it! One of the arguments contained the memory address of an 80-byte block of data.
From bytes to algorithm
The 80-byte block contained two values stored in a custom big-integer structure called HugeNum. Thanks to the LMA Manager article, I already knew how this structure was organized.
Each HugeNum occupied 40 bytes and contained metadata followed by the integer itself. The first one was the RSA modulus, while the second one was the public exponent. (Understanding public/private RSA keys)
N = 0x108CA8D04BBC15C91
e = 65537The modulus was only 65 bits long. This is extremely small by modern cryptographic standards, so it could be factored almost instantly. From its two prime factors, I calculated the corresponding private exponent, d.
Get LoganDev’s stories in your inbox
Join Medium for free to get updates from this writer.
The decompiled verification function then revealed how the expected value was built from three pieces of information:
- The bonus index selected by the user in the game
- The profile identifier generated by the game
- The 16 lower bits of the RSA modulus
With the help of AI to understand the function, here is the process used by the algorithm:
Profile ID + bonus index
↓
Build the payload
↓
XOR with the mask (A fixed mask found in memory)
↓
Sign it with the recovered RSA private key
↓
Encode the result using Codemasters' custom Base32 alphabetThe final integer was encoded as a 13-character string using the following alphabet:
0123456789ABCDEFGHJKLMNPQRTUVWXYAfter several hours of analysis and investigation, the logic of the code-generation function was reconstructed.
The first generated code candidate was accepted by the PC version of the game. Yay!
From PC to consoles
After these steps, I confirmed that I was able to generate codes for every Micro Machines V4 bonus on PC. I then tried to do the same on PS2, but unfortunately, it did not work.
Since the logic of the verification method was the same as in LMA Manager, I wondered whether the RSA key was different on each platform.
Fortunately, since I had already investigated the PC version and understood the structure of the key, I tried searching directly for its binary signature inside the PS2 game executable extracted from the ELF file:
41 00 00 00 01 00 00 00 ...And indeed, I was able to retrieve a different key from the PS2 version and use it in my algorithm.
I then applied the same process to the PSP version by searching inside its decrypted EBOOT.BIN.
Finally, the keys appear to be platform-specific rather than region-specific, since the same PSP generator worked on both PAL and NTSC-U releases.
Available generator tool
As I wanted to make these findings useful to other players, I created a small web tool that generates the bonus codes for you.
You can check the GitHub repository to learn more about the algorithm and use the generator directly through its GitHub Pages website.
Simply select your platform, enter the access code shown in your profile and choose the bonus you want to unlock. The generator supports the PC, PlayStation 2 and PSP versions of Micro Machines V4.
Conclusion
This small project was my first real introduction to binary reverse engineering. In a few hours, a simple question raised during a game session became a working generator.
More importantly, it gave me a practical reason to learn Ghidra, x32dbg, runtime debugging, binary representations and the basics of RSA signatures.
Many thanks to Bo from Rings of Saturn for the LMA Manager article. It provided the key starting point for this investigation and made it possible to recognize the Codemasters bonus code system.
AI Usage
I used an AI assistant as a reverse-engineering copilot. It helped me interpret Ghidra’s decompilation, recognize the serialized big-integer structures and verify the RSA calculations. I found it very relevant for this kind of tasks.
I still had to locate the relevant functions, inspect the runtime state, extract the bytes and validate each hypothesis inside the game.
