Holiday Hack Challenge 2023 Report Cody Travis <cwtravis@gmail.com>
Top

Game Cartridge: Vol 2

Difficulty:

Description:

Find the second Gamegosling cartridge and beat the game


Solution

Solution

Found the 2nd Gamegosling cartridge at Driftbit Grotter on Pixel Island, just to the left of door in Driftbit Grotto.

Gamegosling Cartridge Location

Once the cartridge is picked up, you can play it by clicking your badge, then clicking items, then clicking the cartridge you want to play. A web-based Gameboy emulator will launch the game. For Elf the Dwarf's Gloriously Unfinished Adventure Vol 2, I did use an emulator, but only because I had to manipulate the rom file itself.

When the web-based emulator launches, if you watch which files are downloaded in the Network tab of your browser's developer tools, you will see that the rom is being downloaded.

Rom File: game0.gb

The URL of the rom is here:
https://gamegosling.com/vol2-akHB27gg6pN0/rom/game0.gb

When I spoke to Tinsel Upatree he mentioned that there may be a 2nd version of the rom available.

Tinsel Upatree Hint

I just took a guess and tried the file name "game1.gb" and it worked!

The URL of the 2nd version of the rom is here:
https://gamegosling.com/vol2-akHB27gg6pN0/rom/game1.gb

I ran both of these roms in my emulator and they seem to be pretty identical except that when you are outside, the y-axis of the map has been inverted. In both versions there is a wizard that blocks your path. When the wizard blocks your path you get push backward toward the way you came.

You Shall Not Pass!

I wrote a quick python script to call out the byte by byte difference of the two files. My script pointed out that only 12 bytes were different between the two roms.

  </>
Python
File Diff: game0.gb - game1.gb

Offset          game0.gb        game1.gb
0x0014f         0xb3            0x86
0x00593         0x0b            0xd2
0x00594         0x4b            0xac
0x00595         0x9a            0x3d
0x00596         0x23            0x2d
0x16a84         0x03            0x0b
0x16ab8         0x09            0x06
0x17c80         0x02            0x01
0x1850e         0x02            0x03
0x1850f         0x80            0x00
0x18513         0x0b            0x04
0x18514         0x80            0x00
Diff of game0.gb and game1.gb
I was looking for bytes to trade between the two roms. I took a guess and swapped the game0.gb value at offset 0x17C80 with game1.gb value. This means that I edited the game0.gb file and changed the byte at 0x17C80 to 0x01. Then I saved the rom file and launched it to see if I could see any differences.

You Shall... Pass?

When the wizard goes to push me backward, he instead pushed me forward. This pushed me past the wall so I could walk to the portal!


Morse Code

Solution

Inside the portal, if you activate the radio, it will begin to play a morse code message. I recorded this message and decoded it. You can listen to the message here:


Morse Code Audio

Morse Code Message Decoded

The message is "gl0ry". I put that in my badge to complete the objective.