Skip to content

Easter eggs and puzzles

The credits puzzle, its AlienZooKeeper transition, and the two Survival weapon handouts are mapped. The puzzle's line flags are runtime state; Shrinkifier and Blade Gun grants last for the run. Splitter Gun availability comes from hardcore quest progression. See secret weapons. The relationship between the decoded riddle and the Blade Gun gate is an interpretation; the gate itself is established independently in native code.

Evidence: secret-hint string cluster

Source: analysis/ghidra/raw/crimsonland.exe_strings.txt and the startup log path inside crimsonland_main at 0x0042c450.

Strings (static addresses)

  • 0x00472e88 — "credits" (label used by credits_screen_update).
  • 0x00472e90 — "Secret" (button label used by credits_screen_update).
  • 0x00473a8c — "Brave little haxx0r aren't you?"
  • 0x00473b14 — :D line about "Wonder what he's up to now..."
  • 0x00473b38 — "This is all about fixing city walls with Magic Paint. To stop sinking, you know?"
  • 0x00473b8c — Secret Path hint: click each credits line containing letter o to start it.
  • 0x00473c3c — "Inside AlienZooKeeper..." + "CyanYellowRedYellow" + orthogonal projection hint.
  • 0x00473ce8 — "Do remember you're probably seeing something that not really meant to see!"
  • 0x00473d50 — "I'll tell you a little secret; there are few secret weapons hidden inside the game!"
  • 0x00473e34 — %ReDistrBuildXX% (build tag string)

Verified code path (startup console output)

The decompiled crimsonland_main (0x0042c450) prints the secret-hint cluster via console_printf in a guarded block right after grim_load_interface() succeeds and before the usual config load/flow. The decompiler shows the guard as:

  • if (grim_interface_ptr == grim_interface_ptr + 1) { ... print secret hints ... }

This condition is nonsensical as written (always false), so treat it as a decompiler artifact or an intentional debug/anti-tamper check that needs disassembly confirmation.

This guarded output is separate from the gameplay paths below. It is evidence for the embedded hints, not evidence that the credits or weapon gates are unknown.

Credits screen code (verified)

The credits screen logic is separate from the startup hint block. We can identify the credits update loop and its line builder in the .text section and verify that it renders the credits / Secret labels and consumes the credits line table.

  • credits_screen_update (0x0040d800): update/render loop for the credits screen. It draws the credits label (0x00472e88) and sets the Secret label pointer (0x00472e90). It calls credits_build_lines on first entry to populate the table, then loops over visible lines and handles clicks (including SFX feedback).

  • credits_build_lines (0x0040d090): populates the credits line table with headings, names, and trailing hint lines (including “Click the ones with the round on...”).

  • credits_line_set (0x0040d000): stores a single line + flags in the credits line table.

The click scan and Secret-button transition are described below; both are mapped to the credits routine.

Date-gated easter eggs (verified)

Statistics menu: "Orbes Volantes Exstare"

Decompiled main-loop logic (outside statistics_menu_update) shows a date + RNG gate:

  • if stats_menu_easter_egg_roll == -1, generate a one-shot roll in 0..31
  • when game_state_id == GAME_STATE_STATISTICS_MENU, month = 3, day = 3, and stats_menu_easter_egg_roll == 3, then:
  • reset stats_menu_easter_egg_roll = -1
  • set color to (0.2, 1.0, 0.6, 0.5)
  • draw "Orbes Volantes Exstare" at y=5.0 with x=rand % 64 + 16

Evidence anchor: game_frame_update at 0x0040c1c0, instruction 0x0040ccf1.

Startup prelude: date-gated balloon.tga

game_startup_init_prelude (0x0042b090) checks local date and conditionally loads a hidden texture pair:

  • accepted month/day pairs:
  • 9/12 (September 12)
  • 11/8 (November 8)
  • 12/18 (December 18)
  • on match:
  • set seasonal_balloon_load_active = 1
  • call texture_get_or_load("balloon", "balloon.tga")
  • then clear seasonal_balloon_load_active = 0

Evidence anchor: game_startup_init_prelude at 0x0042b090, instruction 0x0042b10a.

Cross-reference result (v1.9.93): all in-binary references to the balloon string literals and seasonal_balloon_load_active resolve back to game_startup_init_prelude only. No other decompiled function in this build references "balloon" as a texture lookup key.

Interpretation: this path is a one-shot startup preload gate in the main exe, not a mapped in-binary runtime draw/use path.

Puzzle and unlock logic

Secret Path (credits click puzzle)

  • Hinted precondition (string): click every credits line containing letter o and avoid clicking other lines; this should start “The Secret Path.”

  • Verified code: credits UI click handling lives in credits_screen_update (0x0040d800).

  • Static logic (clicks): the click handler checks for lowercase 'o' (0x6f) in the line text. If present it sets flag 0x4 (clicked) and plays the bonus sfx; if absent it calls credits_line_clear_flag, which walks backward to clear the most recently flagged line. This is the explicit misclick penalty.

  • Static logic (unlock scan): after the per-line loop, credits_screen_update scans the entire credits line table; if any line containing 'o' is missing flag 0x4, it skips the rest of the function, bypassing the Secret button update.

  • Secret Button Gating: The ui_button_update call for the Secret button is located after the unlock scan. Thus, the button is effectively hidden (not updated/interactive) until ALL 'o' lines are flagged. This resolves the gating question: the code path to the button is physically unreachable until the puzzle is solved.

  • Runtime capture (2026-01-19): when the last required line is flagged, the unlock flag credits_secret_unlock_flag is set and the secret lines are injected into the credits line table at base index credits_secret_line_base_index = 0x54. The injected lines (all flags 0x4) are:

  • "Inside Dead Let Mighty Blood"

  • "Do Firepower See Mark Of"
  • "The Sacrifice Old Center"
  • "Yourself Ground First For"
  • "Triangle Cube Last Not Flee"
  • "0001001110000010101110011"
  • "0101001011100010010101100"
  • "011111001000111"
  • "(4 bits for index) <- OOOPS I meant FIVE!"

  • "(4 bits for index)" This confirms the secret-line injection is gated by the credits line scan.

  • Secret button transition (static): the Secret button press sets game_state_pending = 0x1a, which maps to credits_secret_alien_zookeeper_update (AlienZooKeeper minigame). No other “Secret Path” branch is visible in the credits screen decompile.

Secret line decode (5-bit indices)

The hint line "(4 bits for index) <- OOOPS I meant FIVE!" indicates the binary strings are 5-bit indices into the ordered word list built from the five quoted lines:

  1. Inside
  2. Dead
  3. Let
  4. Mighty
  5. Blood
  6. Do
  7. Firepower
  8. See
  9. Mark
  10. Of
  11. The
  12. Sacrifice
  13. Old
  14. Center
  15. Yourself
  16. Ground
  17. First
  18. For
  19. Triangle
  20. Cube
  21. Last
  22. Not
  23. Flee

Decode:

  • 0001001110000010101110011 -> 00010 01110 00001 01011 10011 -> 2, 14, 1, 11, 19 -> "Dead Center Inside The Triangle"

  • 0101001011100010010101100 -> 01010 01011 10001 00101 01100 -> 10, 11, 17, 5, 12 -> "Of The First Blood Sacrifice"

  • 011111001000111 -> 01111 10010 00111 -> 15, 18, 7 -> "Yourself For Firepower"

Final decoded message:

"Dead Center Inside The Triangle Of The First Blood Sacrifice Yourself For Firepower"

Secret weapons

  • Hinted precondition (string): there are “few secret weapons” hidden in the game.
  • Verified code: survival_update grants Shrinkifier 5k and Blade Gun through runtime gates; they are not persistent save unlocks. Splitter Gun uses hardcore quest progression. See Survival handouts and secret weapons.

AlienZooKeeper combination puzzle

  • Hinted precondition (string): “Inside AlienZooKeeper” there are combinations; example combo “CyanYellowRedYellow” + “orthogonal projection” hint.

  • Verified code (minigame): the AlienZooKeeper credits secret is a match-3 board implemented in credits_secret_alien_zookeeper_update (0x0040f4f0). The board is a 6x6 int grid at 0x004819ec (values 0..4, -1 empty, -3 clearing).

  • Match Logic: Swapping tiles calls credits_secret_match3_find (0x0040f400), which returns the first 3-in-a-row match it finds. The logic is standard match-3 (horizontal and vertical scans).

  • No Unlock Found: The update loop handles scoring, timer (adds 2000ms on match), and "Game Over". No code path was found that sets a global unlock flag (like weapon_table modification) or writes to the save file upon reaching a score or matching a specific pattern. The minigame appears to be self-contained.

  • Runtime verification (2026-02-09): Frida harness scripts/frida/azk_verify_no_unlock.js auto-entered AZK (game_state_set(0x1a)), reset timer to 0x2580, then solved to a fully cleared board (36 cleared cells, score 12). Final verdict in C:\share\frida\azk_verify_no_unlock.jsonl reported:

  • no_external_effect = true
  • side_effects = []
  • unchanged credits_secret_unlock_flag (0x004811c4)
  • unchanged quest unlock ids (0x00482700, 0x00482704)

  • unchanged weapon_table unlock hash Later state transitions (4, 0, 10) were logged after verdict timing and correspond to normal UI navigation, not an AZK-completion trigger.

  • Color mapping (render tint): Confirmed via credits_secret_alien_zookeeper_update draw calls:

  • 0 = (1.0, 0.5, 0.5) Red
  • 1 = (0.5, 0.5, 1.0) Blue
  • 2 = (1.0, 0.5, 1.0) Magenta
  • 3 = (0.5, 1.0, 1.0) Cyan

  • 4 = (1.0, 1.0, 0.5) Yellow This maps the hint CyanYellowRedYellow to values [3,4,0,4].

  • Unlock logic: The hint string remains the only link to any external secret. The minigame itself may just be the "something more" mentioned on screen, or the "Orthogonal projection" hint requires interpreting the pattern 3,4,0,4 outside the game code (e.g. as part of the riddle).

“Brave little haxx0r” / “not really meant to see”

  • Observed logic: these lines are printed alongside the hint block under the same guard condition in crimsonland_main. They likely indicate a debug/redistribution build or an anti-tamper path.

  • Verified code: only the startup print path; the guard condition needs disassembly confirmation.

Open questions

  • Partially resolved (inference): the decoded line strongly matches the Blade Gun Survival handout gate (centroid of first 3 death points + low HP). See Survival weapon handouts.
  • Remaining ambiguity: no direct static xref ties the string block to survival_update.
  • "First Blood" is still interpretive wording; runtime logic is survival_recent_death_count == 3 using the first three stored positions.
  • Is the startup secret-hint block tied to a “redistribution build” check or another sentinel?
  • Are there any out-of-main-exe consumers (e.g., other modules/builds) for the startup balloon.tga preload gate?
  • Are any of these flags version-specific (v1.9.93 vs earlier)?