I'm Reverse Engineering Crusader because I'm still obsessed about the game

[MaddoScientisto]

There's at least one more invisible wall. In the first level of mission 14 you can walk on a wall and then jump off it at a certain point to a hidden teleporter. It takes you to a hidden section. From there there is a teleport to the "Asylum BBS" room which has a large photo of I believe Jason Ely (the guy with the guitar)

I'm going to check on this ASAP.

You are right, there are two teleporters that have the Ely room as a destination in map 27 (mission 14)

This is the place, but I don't really see a way into the room yet, but it looks like that wall might open somehow, I have to investigate what triggers it



There's an extremely interesting place in the same map

This weird room has a gap in the invisible walls that allows jumping into it from somewhere, it contains an egg trigger that activates something when jumping inside, likely making the ceiling tiles disappear

https://imgur.com/a/367FJFx

 

[MaddoScientisto]

I'm still massively stuck on trying to uncover the Jely bathroom.

https://imgur.com/a/ZUhuNxn

According to the red arrows these CMD blocks are computing some sort of combination out of these eggs in front of the door but it's really hard to figure out what exactly triggers the door.

Analysis suggests that these two line eggs (both have ID 5) need to be triggered either together or in a specific order and then the egg trigger line has to be left in the direction of the door (north-east). Supposedly doing so would open the door but I haven't been able to get it to move at all in practice.

I gave up for now and switched my efforts to reverse engineering the map format for the PSX version in order to view the PSX maps in the viewer. It's going pretty slow because that version does everything completely different, it's basically a whole new game and I still haven't found anything in common with the original at all

 

[The Silencer]

Keep moving through the corridor and get passed the forcefield. There is a wall switch hidden by generators. Of course I fell into the goo while walking back but I hope you get it from this.

 

[MaddoScientisto]

Keep moving through the corridor and get passed the forcefield. There is a wall switch hidden by generators. Of course I fell into the goo while walking back but I hope you get it from this.

Yep that switch did the trick, looks like I'll have to update the map viewer to properly track that because my analysis completely missed it, MAYBE the two eggs DO need to be triggered before the switch works but I need to check that in more detail

 

[The Silencer]

I'm not sure, I triggered most of the hidden stuff before getting there, including the telepad hidden under the grate. However, this switch is mentioned in the official Origin Guide and doesn't list anything special you need to do first.

In regards to level 14, you can move on the ledge and jump down from the spot indicated. I moved through the level normally without triggering anything special.

BTW, I love the "Danger" sign with the skull in the toilet.

 

[MaddoScientisto]

I DID IT!!!

For the first time ever: this is the usecode debugger built into crusader!
No Remorse was missing a critical bootstrapper that no regret instead has, so now by changing some bytes around in no regret I was able to redirect the loosecannon16 cheat to launch the debugger instead! And this is the window that pops up inside the game

Bytes to change in REGRET.exe:
0x7BB25: 03 00 79 36 5C 00 D0 04 -> 03 00 79 36 74 00 00 00
0x7BB05: 03 00 03 37 6B 00 46 00 -> 03 00 03 37 74 00 0D 02
Then ingame trigger the loosecannon16 cheat and this will show up



The debugger wants me to open a .unk file, I'll have to figure out what that even is or how to create one now

Update:
I was able to manufacture an artificial .unk file out of decompiled usecode and load it in the debugger, but running it crashes the game.



This is really exciting, I have to go to sleep, I'm so looking forward to playing with this some more and try to make a script that generates valid debugger files for each usecode script.

Update
I ran into annoying issues: the remorse Usecode has line numbers in it but it's Debugger is missing the bootstrapper so it cannot be launched properly. The regret Usecode is missing line numbers but the executable has the bootstrapper intact so the Debugger can be loaded.

A solution for regret could be adding line numbers to the Usecode based on the decompiled pseudocode, but that involves shifting data and various references so they still match.

Also having line numbers is not enough, some live Debugger data needs to be seeded so that the Debugger knows what to do and I'm investigating if that's something that is done automatically or if I have to inject stuff in memory. Maybe they had an external process that injected Debugger information into the game and also launched the Debugger.

Investigation continues

 

[MaddoScientisto]

I moved away from the debug menu because I wasn't really making much progress, every time I try to make a patch to make it properly initialize the debug data the game just crashes.

Instead I moved into analysis of the PSX version, I still want to have the map viewer support it (it's not going well, the map format is insanely different compared to the original).

However I did find something!

So the game strings mention two interesting weapons: the JL-2 and JL-9. I also remember a dev in the dev level mentioning something like "have you found the JL-9 yet?" and that has been quite a mystery for me, especially because there's absolutely NOTHING about it online.

Disassembly confirmed that the JL-9 is available through some method still unknown to me but it probably involves an undocumented button combination, JL-2 is documented like this on gamefaqs:

Ignore the invalid passcode message. During gameplay hold R1 and press Circle to refill health and energy, get 2000 credits and all the items.

All the items include the JL-2 as the last weapon, it's a weapon that takes a moment to fire and lays massive devastation and has a huge cooldown.

Eventually, through good old RAM searches in the emulator, I found that address 14577E holds the 1 byte ID of the current weapon, so freezing it at 0D reveals... the JL-9!

It's basically a JL-2 that shoots really fast and has more potential for devastation.

Now seeing this I'm flooded by a flashback, I must have seen this image somewhere already but I have absolutely no idea where, apparently there's some way to upgrade the JL-2 to JL-9 or something? Right now I don't know but I'm working on getting to an actual answer




Oh also now I'm trying out all the values and WTF IS THIS??


I might have found another unused weapon, this might be the RP-16 but I don't think I've ever seen this sprite... or have I?? Once again I have that weird sense of deja vu

here's a table:

00	No weapon (internally labeled as INVALID GUN)
01	RP-16?
02	RP-22
03	RP-32
04	SG-A1
05	AC-88
06	PA-31
07	EM-4
08	PL-1
09	UV-9
0A	GL-303
0B	AR-7
0C	JL-2
0D	JL-9

Analysis update

Unlocking the JL-9 normally involves:

1. Warping to the final mission on HARD with code MFM4 (I'm not sure if it's Loose Cannon or No Remorse difficulty because the password lists on gamefaqs don't use the proper names). This sets a flag that contributes to the unlock.
2. There's some kind of event in the level that needs to be triggered and sets the next flag. I still don't know if it's just beating the level or something else but sounds like it's going to be really difficult to check, but I might try that by freezing my health to max
3. Once back at the main menu, likely after beating the game, go back to the password screen and insert the L0SR code. Fun fact: inserting the L0SR code without the flag set by warping to the last level in hard mode specifically disables the JL-9 from unlocking, another fun fact is that the first letter in the code is optional and could be anything, only 0SR is considered for the enable condition.
4. Load a level and press R1 + Circle (that's the normal button combination to trigger cheats when L0SR is active). The JL-9 should be awarded.

There are still many unknowns because I'm still investigating this, since it requires decoding level script code and I haven't even managed to get halfway to properly parsing levels yet. Still the hard mode completion looks like something interesting to try.


I managed to do an emulator confirmation:
Setting main memory address 6739D to "01" and then inserting L0SR in the password screen and starting the game does indeed put the JL-9 in the inventory right next to the JL-2, so that's ONE part of the mystery solved, the only thing left to find is what sets that byte to 01 in that level

 

[MaddoScientisto]

So I'm hitting diminishing returns on several areas, it's 1am and I can't sleep so let's recap my progress

1. Usecode debug menu: found in no regret but cannot do anything useful with it until I figure out how to do modifications to the executable without crashes.
2. Psx map support: the map format is so incredibly complex and messed up it's really hard to extract useful information from it. The most I can do is see the rough shape of the levels
3. Usecode decompilation: Usecode can be decompiled to readable pseudocode but editing and recompiling it back is still a far off dream, not impossible
4. Map support for pc: very advanced, modification of teleport destination eggs is possible and has been attempted with success. However the whole event system is still not fully understood, many editor objects are a jumble of supposition and it's impossible to properly track what a given cluster of object is doing. Eventually solvable with enough work.
5. Map editing: it's definitely possible and relatively easy to edit a map by moving shapes around and creating new ones, it's just going to be complex to code but I might attempt a basic proof of concept
6. JL-9 research: almost compete. The weapon was found, just needs a confirmation in the emulator that beating the last mission on hard is the trigger to unlock it
7. Windows 9x support hack for no remorse: stalled due to not being able to find the U8 9X patch to use as reference. While the Japanese version is a full windows 9x app with directx support, the changes are too extensive to retrofit into the original no remorse. The U8 hack only did the bare minimum to make the game playable on windows
8. Full decompilation and recompilation of the disassembled source: with less than 68% of the assembly being mapped it's not really a thing that can happen yet. Also trying to recompile out as-is sounds like a nightmare, it would need substantial modernization

Bonus things one day I would love to do:
1. Smooth camera movement like in the Psx version
2. Forward roll in no remorse
3. Restore the Observer enemy
4. Restore the emp/fragmentation/nerve gas grenades
5. Make a completely new map with events

I suppose these could be made using scummvm as a base, if really wanted to

 

[MaddoScientisto]

@The Silencer I finally found out why it was possible to jump through that one wall in the secret room: it was a clever parallax trick all along and the wall was actually placed on the floor in the secret room

https://imgur.com/a/YNXm7de

Oh yes by the way I made a 3D renderer for the maps, it automatically tries to convert textures on the fly, very janky, but fun. I think scale is kind of messed up but I'm working on it, I still haven't done a pass through regret to identify walls and floors, I have to do that by hand.

Will be published and available for everyone to play... now! https://maddoscientisto.github.io/Crusader-Map-Viewer

Load a map and hit the 3D button

 

[Keenan]

Just incredible. The 3D renderer is so cool! Nice work.

 

[MaddoScientisto]

And 3D for No Regret is in too, have fun exploring the maps

https://imgur.com/a/40bHRxb

https://imgur.com/a/dndCpxa

I got to say that it's No Remorse that has the most weird 3D stuff going on, unlike No Regret most maps are pretty much unhinged

https://imgur.com/a/bkCmLFq

 

[The Silencer]

Wow, just wow. And nice find about the jump.

 

[MaddoScientisto]

I finally had a breakthrough for psx map exporting, finally identified where the palettes are stored, got some map data to render, even though there are still a lot of misalignments, but it's the best they have looked so far

https://imgur.com/a/6p1lpIF

https://imgur.com/a/eVKANBH

https://imgur.com/a/09fNonx

 

[Skoffer]

Hi all,

I played this game back when it originally came out and was blown away by it even then. Recently, with LLMs around, I finally had the tooling to actually attempt reverse-engineering it myself — so I started digging into it independently, and only just found this forum and this thread.

@MaddoScientisto, good to see someone else digging into this game's internals — I came at it from a different angle: started with the asset/data side (maps, video, audio formats) and worked toward a full 3D scene reconstruction. Here's where I've landed so far:

- Reconstructed the full map data
- Wrote a converter for the game's video format to MP4
- Got sound playback working — turns out it's not Sonarc-compressed like I assumed, just raw PCM with its own header format and loop point support
- The big one: figured out how to reconstruct real 3D geometry from the original sprite data (not billboards — actual 3D boxes with correct proportions and collision), which let me load the game's assets into Godot as a fully walkable 3D scene

A couple of screenshots attached.
- first is a reconstructed map (I just generate huge png image - not super useful, but give me a map overview)
- next one is 3d reconstruction as it can be seen in godot
- and godot playthrough, just walking around the scene, bumping into everything.

Next interesting step would be hooking up the usecode/bytecode scripts to get a fully playable version out of this. Happy to go into more detail on any of this, or even open up the tooling if there's interest.

 

[MaddoScientisto]

Hi all,

I played this game back when it originally came out and was blown away by it even then. Recently, with LLMs around, I finally had the tooling to actually attempt reverse-engineering it myself — so I started digging into it independently, and only just found this forum and this thread.

@MaddoScientisto, good to see someone else digging into this game's internals — I came at it from a different angle: started with the asset/data side (maps, video, audio formats) and worked toward a full 3D scene reconstruction. Here's where I've landed so far:

- Reconstructed the full map data
- Wrote a converter for the game's video format to MP4
- Got sound playback working — turns out it's not Sonarc-compressed like I assumed, just raw PCM with its own header format and loop point support
- The big one: figured out how to reconstruct real 3D geometry from the original sprite data (not billboards — actual 3D boxes with correct proportions and collision), which let me load the game's assets into Godot as a fully walkable 3D scene

A couple of screenshots attached.
- first is a reconstructed map (I just generate huge png image - not super useful, but give me a map overview)
- next one is 3d reconstruction as it can be seen in godot
- and godot playthrough, just walking around the scene, bumping into everything.

Next interesting step would be hooking up the usecode/bytecode scripts to get a fully playable version out of this. Happy to go into more detail on any of this, or even open up the tooling if there's interest.

Hey that's great, you did a better job than me on the 3D renderer, I didn't feel like investing a lot of time on it.

On the Usecode side I have a lot of progress, if you check my repository I have a work in progress Usecode decompiler and it's all integrated within my map viewer, you can check out decompiler human readable Usecode, sadly it's not a two way process yet because I didn't get far enough with decoding everything .

The game's scripting system is very complex, I managed to reverse engineer a lot of behaviors of the map objects but it's still incomplete