Crusader_Decomp/docs/spanish-cheat-differences.md

Spanish CRUSADER.EXE Cheat / Debug Differences

This note records a focused live-Ghidra pass over the Spanish executable opened from /es/CRUSADER.EXE and compares the known English cheat/debug control areas against the Spanish build.

Scope

• Target analyzed in Ghidra MCP: /es/CRUSADER.EXE
• Comparison baseline: live English CRUSADER.EXE findings already recorded in docs/ne-segment1.md
• Goal: determine whether the Spanish executable changes the known -laurie, cheat-gate, F10, Ctrl+Q, Hack Mover, and secret-sequence lanes enough to support claims about different cheat behavior

Summary

Current best read: the Spanish executable does not show a materially different cheat/debug framework in the known control areas.

What changed is mostly address placement, not behavior:

• the broad cheat/debug gate, gameplay-input gate, and low-level keyboard-cheat latch all still exist
• the same hidden/debug event lanes are still present behind the broad gate
• the -laurie parser still exists and still uses English-facing text
• the Laurie hint string and multiple cheat/debug status strings are still English in the Spanish build
• the Ctrl+Q lane is still the CD transfer display toggle, not the immortality toggle
• the Hack Mover toggle lane is still present

What is not yet proven from this pass is the exact secret scan-code matcher table. No replacement secret sequence was recovered in the known cheat areas, but the secret-sequence table itself was not directly pinned down in this Spanish session.

Verified Spanish Mapping

Master Cheat / Debug Gate

• 1478:0910 is the Spanish build's broad cheat/debug master gate.
• It is written by the -laurie parser at 1050:0985.
• It is read by the same large hidden/debug event handler family inside World_HandleKeyboardInput at 13e8:14b4.

Recovered gated case sites include:

• 13e8:19da
• 13e8:1a0a
• 13e8:1a36
• 13e8:2211
• 13e8:243c
• 13e8:24a5

This matches the English-side model where one broad master gate enables several hidden/debug event handlers.

Gameplay Input / Option-Key Gate

• 1478:0927 is the gameplay-input / option-key gate in the Spanish build.
• It is set during Game_Start at 1028:0127.
• It is cleared in ComputerGump_CreateGump at 13a0:01f5.
• It is restored at 13a0:0233 during the paired computer-gump teardown path.

This is the same structural role already established in the English build: broader gameplay-input eligibility, not a separate cheat-state bit.

Low-Level Keyboard Cheat Latch

• 1478:5fb3 is the Spanish build's low-level keyboard-cheat latch.
• It is read repeatedly from 13e8:14b4 in the same family of keyboard/debug checks.
• Helper setters at 13e8:0071 and 13e8:0077 write 1 and 0 respectively, and are called from the Laurie-hint/computer-gump-side helper 13e8:0e31 setup path.

This no longer supports the older English-side -laurie plus ~ model by itself. The current Spanish pass found repeated reads of 1478:5fb3, but still no recovered runtime writer inside the normal keyboard handler family. The only recovered writes remain the tiny 13e8:0071/0077 helpers, and 13e8:0e31 calls them back-to-back inside the Laurie hint path.

Current safest read is therefore narrower: 1478:5fb3 is still a real gate byte in the Spanish keyboard/debug family, but the live Spanish session does not currently show the English-style runtime ~ toggle path that would make -laurie plus tilde a proven bootstrap for the broader keyboard-cheat state.

Verified Hidden / Debug Event Lanes

CD Transfer Display (Ctrl+Q Family)

The Spanish build still preserves the English-side Ctrl+Q conclusion:

• 13e8:2211 is the 0x410 event lane under the broad gate at 1478:0910
• it toggles byte 1478:5fb7
• it posts the same English strings:
  • 1478:6022 = CD TRANSFER DISPLAY ACTIVE.
  • 1478:603e = CD TRANSFER DISPLAY INACTIVE.

That is consistent with the English analysis: this lane is still CD transfer display state, not immortality.

Hack Mover

The Spanish build still preserves the Hack Mover toggle lane:

• 13e8:249b first requires 1478:8ad6 != 0
• 13e8:24a5 toggles byte 1478:5fb2
• it posts:
  • 1478:605c = HACK MOVER ON
  • 1478:606a = HACK MOVER OFF

The compiled runtime chain is now tighter too:

• 1478:5fb2 is the actual Hack Mover on/off toggle, not the unresolved unlock byte
• 13e8:0ef9 and 13e8:0f77 both clear 1478:5fb2, so normal modal/setup helpers can forcibly shut the feature back off
• 13e8:282f is the adjacent runtime helper that watches 1478:5fb2, uses temp/state byte 1478:8ad9, and can transition into the active move setup at 13e8:2f0e
• 13e8:2f0e captures cursor-to-object offsets into 1478:8acc / 1478:8ace and sets 1478:8ac0 = 1
• 13e8:3009 is the paired cleanup path that clears 1478:8ac0

So the live compiled split is now:

• 1478:8ad6 = unresolved precondition / unlock gate
• 1478:0910 = broad -laurie gate
• 1478:5fb2 = Hack Mover active toggle
• 1478:8ac0, 1478:8acc, 1478:8ace, 1478:8ad9 = downstream runtime state after Hack Mover is already on

So Hack Mover remains present and still uses English-facing status strings in this localized executable.

That extra 1478:8ad6 pre-check matters. In the English build, Hack Mover was already strongest as a two-latch feature: it wanted the broader Laurie/debug gate plus a second post-sequence latch. The Spanish build still shows that same two-stage shape at the branch level, even though the exact sequence writer has not yet been re-identified.

Overlay / Hidden Debug Toggles

The Spanish build keeps the same broad gated overlay/debug cases:

• 13e8:19da toggles byte 1478:0f40
• 13e8:1a0a toggles byte 1478:2be7
• 13e8:1a36 toggles byte 1478:2be8

These are the same structural hidden/debug lanes already identified in the English build.

Laurie Path

The Laurie hint path is still present and still English-texted:

• 13e8:0e31 is the Laurie-hint computer-gump path in the Spanish build
• 1478:5fc6 still contains FART ...TRY... -laurie (Have fun, Jely)

The startup-side cheat text also remains English:

• 1478:0b45 = Cheats are active.

This is strong evidence against any broad localization-driven rewrite of the cheat/debug feature family.

The command-line side is also tighter now:

• CommandLineArg_HandleLaurie at 1050:093d is the only recovered live writer of 1478:0910
• no second non--laurie writer of the broad gate was recovered in this Spanish pass

So -laurie still clearly enables the broad Spanish debug/event framework, but current live evidence does not show a second hidden input path that also raises that gate the way the English jassica16 matcher does.

F10 / Option-Key Side

The Spanish executable's option-key handler moved relative to the English live notes:

• the relevant function object lives at 1138:0896 in this build, not the English-side 1130:0896

But the structure is still familiar:

• it checks gameplay-input state through 1478:0927
• it reads surrounding controller/current-NPC state from the same neighborhood used by the English build
• the wider controller family around 1138:0896 / 1138:0b2d / 1138:0d34 still looks like the same option-key and movement/control subsystem, just relocated

This pass did not fully re-close the Spanish F10 immortality leaf the way the English build is already documented, but there is no recovered evidence here that the Spanish build replaced the F10 cheat/control family with a different system.

Follow-up tightening on that question now makes the old English comparison weaker rather than stronger:

• the old English immortality-string slots at 1478:2850 / 1478:2866 are not strings in /es/CRUSADER.EXE; live bytes there are now pointer-like words, not "Immortality disabled." / "Immortality enabled."
• MCP data-use queries on those two Spanish addresses returned no code uses at all
• no explicit scan-code 0x44 F10 comparison was recovered in the currently identified Spanish gameplay-input handlers during this pass

Current safest Spanish-side answer is therefore narrower than the English build:

• the Spanish executable still preserves the broad Laurie/debug family
• but this pass still did not recover a direct Spanish equivalent of the English F10 restore/refill branch or the modifier-gated immortality leaf
• so the old English F10 health-replenish folklore should currently be treated as unproven in /es/CRUSADER.EXE, not as a still-confirmed surviving cheat path

Secret Sequence Status

This pass now closes part of the Spanish-side uncertainty more tightly: the live Spanish build does not preserve the English jassica16 scan-code table as a static data object in the obvious old locations.

Direct live byte-scan results against /es/CRUSADER.EXE:

• the exact English table 24 1e 1f 1f 17 2e 1e 02 07 00 was not found anywhere in initialized data 1478:0000-8c3f
• the same exact table was not found in BSS / secondary data 1480:0000-1fff
• even the shorter jassica scan-code prefix 24 1e 1f 1f 17 2e 1e was absent from both of those Spanish data segments
• the old English-side matcher slot at 1478:2833 no longer contains the sequence bytes at all; it now reads as pointer-like words beginning 14 e8 11 3d 14 e8 11 02 05 28 10 ...

What can be said safely:

• no alternate replacement secret sequence was recovered yet
• the English jassica16 static data table is not present in the live Spanish data map where the English build keeps it
• the same surrounding cheat/debug framework remains intact
• the same -laurie parser, Laurie hint path, CD-transfer-display lane, Hack Mover lane, and broad hidden/debug gated event family all survive in recognizably the same form
• Hack Mover still has a second hidden precondition via 1478:8ad6 in addition to the broad gate at 1478:0910, which is consistent with the Spanish build still retaining some post-sequence-style latch

Additional live xref evidence from the current Spanish-only pass narrows that further:

• 1478:0910 currently has only one recovered write in the live Spanish database: the -laurie parser at 1050:0985. All other recovered uses are reads in the normal cheat/debug handler family.
• 1478:5fb3 currently has only two recovered writes: 13e8:0071 and 13e8:0077, and both helpers are only called from the Laurie-hint/computer-gump helper 13e8:0e31.
• 1478:8ad6 currently has only one recovered direct use: the Hack Mover pre-check at 13e8:249b. No direct writer was recovered through MCP xrefs, data-use scans, or operand scans in this session.
• the nearby state cluster does not currently explain that byte either: 1478:8ad7 and 1478:8ad8 are written by the gameplay-input modal helpers 13e8:0e7d / 13e8:0ef9, and 1478:8ad9 is the live temp/state slot used by the Hack-Mover-adjacent runtime helper 13e8:282f; but none of those neighboring compiled writes touch 1478:8ad6
• One explicit multi-key helper still exists in the Spanish build, 11d0:024b, but decompilation shows it is only a vararg is current key in this list? helper. Its only recovered caller in this session is the movement/control cluster at 1138:1b13, not a cheat-toggle lane.
• Full decompilation of World_HandleKeyboardInput (13e8:14b4) did not recover any translated ~ / 0x7e runtime toggle branch. The visible cheat/debug lanes still cover the broad 1478:0910-gated overlay/CD/Hack-Mover family, but no Spanish equivalent of the English event_0x7e_cheat_latch_runtime_toggle was recovered.

That matters because it removes one easy false positive: the Spanish build still has generic key-list helpers, but the current live evidence does not tie any of them to a replacement jassica16-style cheat matcher.

So the live evidence now splits cleanly into two layers:

• the framework still matches the English cheat/debug family
• the exact English jassica16 data table does not survive as the same static table in this Spanish target

Current best read:

• the online claim that the Spanish build still uses the exact same static jassica16 table is not supported by the live Spanish data-segment bytes
• this pass still does not prove a replacement code
• but the live xref picture is now narrower than before: no recovered Spanish writer currently toggles the broad gate 1478:0910, the keyboard-cheat latch 1478:5fb3, or the Hack Mover pre-latch 1478:8ad6 in a way that looks like a hidden input-sequence success path
• current best working hypothesis is therefore no longer "same framework, unknown moved matcher" by default; it is now same surrounding cheat/debug framework, but no recovered compiled Spanish replacement for the English jassica16 byte matcher
• the same correction now applies to the practical -laurie plus tilde folklore too: current live Spanish evidence does not support a surviving translated ~ cheat-latch toggle, so the old English-side -laurie plus ~ bootstrap should currently be treated as unproven and likely absent in /es/CRUSADER.EXE
• the same caution now applies to the English F10 replenish / immortality folklore too: the broad gameplay-input controller family is still present, but the old English immortality-string slots are repurposed in Spanish and no direct Spanish F10 cheat branch has been recovered in this pass
• the remaining possibilities are now: the Spanish build removed the hidden sequence entirely, moved it into an analysis-dark path MCP has not surfaced yet, or preserves only a dead/unused remnant such as the unresolved 1478:8ad6 gate

Comparison Outcome

The Spanish build differs from the documented English build mainly by address relocation, not by cheat/debug behavior.

Confirmed same-family behaviors:

• broad -laurie / hidden-debug gate still present
• gameplay-input suppression gate still present
• separate 1478:5fb3 gate byte still present and widely read in the keyboard handler family
• Ctrl+Q still maps to CD transfer display, not immortality
• Hack Mover lane still present
• Laurie hint path still present
• English cheat/debug strings still embedded in the Spanish executable

Current practical read for cheat use:

• -laurie still appears to enable the broad debug/event family in the Spanish executable
• current live Spanish evidence does not show the English-side ~ runtime latch toggle
• so the usual English -laurie plus ~ route to the broader keyboard-cheat state is not currently supported by the Spanish static analysis
• current live Spanish evidence also does not yet prove that the English F10 restore/refill or modifier-gated immortality path still survives in compiled form

Definitive Enable Model

Current strongest Spanish-side answer to "how are the cheats enabled" is now much simpler than the older folklore:

• the only recovered positive enabler is still -laurie
• CommandLineArg_HandleLaurie at 1050:093d writes 1478:0910 = 1
• every broad hidden/debug branch recovered in World_HandleKeyboardInput that still behaves like the English Laurie/debug family checks that same 1478:0910 gate

The supposed runtime latch at 1478:5fb3 no longer looks like an enabler in the Spanish build:

• all recovered keyboard-handler branches that consult 1478:5fb3 require it to be zero, not one
• the only recovered writes are still 13e8:0071 (set 1) and 13e8:0077 (set 0)
• Game_ShowLaurieHintComputerGump calls those two helpers back-to-back, so the Laurie-hint path pulses the byte and leaves it cleared

Current safest read is therefore:

• 1478:0910 is the only proven positive Spanish cheat/debug enable gate
• 1478:5fb3 is not a recovered "cheats on" latch in this build; it behaves more like a transient suppression/guard byte, and possibly a vestigial leftover from the English-side keyboard-latch design
• 1478:8ad6 is the only still-plausible unresolved secondary latch, because Hack Mover checks it directly before checking 1478:0910

That gives a more definitive practical answer than the earlier passes: the compiled Spanish build still contains cheat/debug hotkeys, but the only proven way to enable the broad gated family is -laurie. No second runtime input path that raises the gate or a full keyboard-cheat latch has been recovered.

Keyboard Hotkey Split

The main Spanish keyboard handler still contains a sizeable hotkey table, but it now splits into two different groups.

Proven -laurie-Gated Debug Lanes

These branches all require 1478:0910 != 0, so they are the clearest surviving Spanish cheat/debug hotkeys:

• 0x410: still toggles CD transfer display (1478:5fb7) and posts CD TRANSFER DISPLAY ACTIVE/INACTIVE
• 0x141, 0x241, 0x441: still toggle the same hidden overlay/debug bytes as the English build
• H / h: still toggles Hack Mover, but only if 1478:8ad6 != 0 as well as 1478:0910 != 0
• F: still toggles byte 1478:2d14 after NPC_SetAvatarInStasis(0)
• T: still has a direct 1478:0910 gate and acts on the current controlled NPC through 10a8:2667

Player-Only Selection / Debug Utilities

These branches do not prove a separate cheat-enable path. They mostly require the local local_3 player/controlled-NPC condition and also require 1478:5fb3 == 0, which is exactly the state left behind by the Laurie-hint helper pulse:

• R / r: toggles the targeting reticle byte 1478:28a5 and posts the Spanish active/inactive strings
• Q / q: cycles one 1..5 selector family backward through 13e8:0c07
• W / w: cycles that same 1..5 selector family forward through 13e8:0c72
• I / i: cycles one 0x0b..0x19 selector family backward through 13e8:0d5f
• O / o: cycles that same 0x0b..0x19 selector family forward through 13e8:0dc0
• C / c and S / s: enter the 13e8:3094 browsing/selection helper with mode 1 or 0, which also sets 1478:5faf while active
• E / e, M, and U / u: object/selection-manipulation helpers that also require the local player-controlled condition and 1478:5fb3 == 0

So the keyboard evidence no longer supports a Spanish equivalent of the English layered model master gate + tilde keyboard latch. It supports a narrower model instead:

• -laurie enables the broad Spanish debug/event hotkeys through 1478:0910
• several additional letter-key utilities still exist in the same handler, but they do not currently prove any second cheat-enable latch
• Hack Mover is the one conspicuous remaining exception because it still demands the unrecovered 1478:8ad6 latch as well

Unclosed item:

• direct proof of any live Spanish secret scan-code matcher routine at all, direct proof of a surviving Spanish F10 cheat lane if one still exists, plus the exact writer of the secondary latch at 1478:8ad6

Recommended Follow-Up

If the Spanish question is revisited, the next focused step should be a direct recovery of the writer for 1478:8ad6 and any non--laurie writer of 1478:0910, rather than another sweep of the already-stable broad cheat/debug event lanes. At the moment, those two missing writers are the strongest remaining path to proving whether the Spanish executable still has any hidden cheat-trigger sequence at all.