546 - bombShield(int a, int script)

Sets the bomb invulnerability flag (a=0 false, a=1 true), the caller's ANM script will change to script when a bomb is active.

611 - etEx(int etId, int async, int type, float a, float b)

Adds bullet transformation to bullet manager etId, Transformation of flag type determines the specific behaviour of the bullet. Documentation can be found here.

BulletEffectType-67108864 - etExDelay(string et, string isAsync, string time)

Hide the bullet for time frames. During this time, it will not move, will be invisible and won't have a hitbox. If used as a first transformation, can be used to delay when the bullet actually appears.

6 - isDelayedSpawn

While this flag is set, the bullet will be invisible and not have a hitbox. This flag is cleared once the delay timer ends.

4 - short_timer

Integer value between -1 and 15 inclusive (by default -1). If non-negative, shooters using short_timer shoot their bullets and timer increments by 1 per frame until 15 is reached. Once 15, timer reset to -1 or 0 depending on Z key state.

5 - long_timer

Integer value between -1 and 120 inclusive (by default -1). If non-negative, shooters using long_timer shoot their bullets and timer increments by 1 per frame until 120 is reached. Once 120, timer reset to -1 or 0 depending on Z key state.

503 - flagClear(int n)

Clears flag(s) according to n. Refer to the flag table here for exact values.

91 - floatTime(int slot, float var, int time, int mode, float start, float final)

In time frames using mode mode, variable var changes from start to final. slot is used to set the slot to be used by this ins, every enemy has 8 slots.

-9980 - F1

Local float variable, inherited by spawned enemies.

-9984 - I1

Local integer variable, inherited by spawned enemies.

-9989 - ANGLE_PLAYER

Angle from the enemy to the player.

-9962 - BOSS_Y

Final Y position of the boss.

-9990 - PLAYER_Y

Player's Y position.

-9963 - BOSS_X

Final X position of the boss.

-9991 - PLAYER_X

Player's X position.

81 - circlePos(float varX, float varY, float angle, float radius)

Performs following operation: varX = cos(angle) * radius and varY = cos(angle) * radius

-9981 - F0

Local float variable, inherited by spawned enemies.

300 - enmCreate(string sub, float x, float y, int hp, int score, int item)

Creates an enemy using subroutine sub at coordinates (x, y) (relative to position of the parent), health of created enemy is hp, score bonus is score and item drop is item.

601 - etOn(int etId)

Shoots bullet(s) using properties from bullet manager etId.

23 - wait(int time)

Stops sub execution for time frames.

1 - delete()

Returns to the top of current call stack.

2 - GAME_SPEED

The value controls by how much faster the game speed is run. This variable is often set to a number between 0 and 1. This value is often changed when a (final) boss dies or when a photo is taken. Its default value is 1.

-9985 - I0

Local integer variable, inherited by spawned enemies.

-9983 - I2

Local integer variable, inherited by spawned enemies.

-9982 - I3

Local integer variable, inherited by spawned enemies.

-9954 - ENEMY_HP

Enemy's current HP.

3 - goheiExists

A flag that determines if a gohei exists on-screen or not. Flag is set to true by active gohei. Flag is set to false if gohei goes off-screen or is despawning.

-9926 - GI0

Global integer value. Value is initialised to 0 on stage load but not on stage reset.

-9925 - GI1

Global integer value. Value is initialised to 0 on stage load but not on stage reset.

-9924 - GI2

Global integer value. Value is initialised to 0 on stage load but not on stage reset.

-9923 - GI3

Global integer value. Value is initialised to 0 on stage load but not on stage reset.

17 - distortion(int a)

Triggers distortion effects on the edge of the screen. The meaning of the argument is not entirely clear. SA uses a value of 1 to create distortion at the bottom of the screen, while UFO uses this same value to create distortion at the top.

539 - spell3(int id, int timeRate, int unused, string name)

Declares a spell-card with id id and name unused. The ID passed to the spell-creating function is id + difficulty - 2 (with easy=0, normal=1, ..., overdrive=5). timeRate determines how much time the spell circle takes to shrink (in frames), as well as how fast the spell bonus decreases.

514 - setInterrupt(int slot, int hp, int duration, string subroutine)

Sets an interrupt on slot slot. Once caller's HP reaches hp or duration frames have passed since this instruction was called, the caller will terminate all subroutines it's currently running and execute subroutine subroutine.

270 - enmCreate270(string sub, float x, float y, int hp, int score, int item)

Creates an enemy using subroutine sub at coordinates (x, y) (relative to position of the stage background camera), health of created enemy is hp, score bonus is score and item drop is item.

The 2038 problem

Specifications

  • Versions: 1.00 - 1.00a - 1.00b - 1.00c - 1.00d
  • Difficulty: Easy - Normal - Hard - Lunatic - Extra - Last Word
  • Mode: Main game - Practice mode - Spell Practice
  • Shottype: Border Team - Magic Team - Ghost Team - Scarlet Team - Reimu - Yukari - Marisa - Alice - Youmu - Yuyuko - Sakuya - Remilia

What happens

If your operating system's time is after the timestamp 19th of January 2038, 03:14:07 UTC, your game will likely crash.

xkcd 607 is shown, describing the issue of the year 2038.
Figure 1: Relevant xkcd (https://xkcd.com/607/).

How it happens

This happens if your operating system's time is after the timestamp 19th of January 2038, 03:14:07 UTC. The crash only happens once finishing a credit, whether it is a gameover or a 1cc. Attempting to go to the Results screen crashes the game.

Why it happens

When saving player data, one of the values needed is the current time. For the game to get your operating system's current time, the following code is run when it needs the current time:

using time32_t = int32_t;

time32_t __time32(time32_t* out)
{
    FILETIME ft;
    GetSystemTimeAsFileTime(&ft);

    // Official Windows way to convert FILETIME -> 64‑bit integer
    ULARGE_INTEGER u;
    u.LowPart  = ft.dwLowDateTime;
    u.HighPart = ft.dwHighDateTime;

    uint64_t filetime = u.QuadPart;

    static const uint64_t EPOCH_DIFF = 116444736000000000ULL;

    uint64_t unixSeconds = (filetime - EPOCH_DIFF) / 10000000ULL;

    // The 2038 overflow happens here !!!
    time32_t result = static_cast<time32_t>(unixSeconds);

    if (out)
        *out = result;

    return result;
}

(For technical readers, the assembly code can be found at an offset 0x4a5ac0 in 1.00d.)

This code fetches the operating system's time, converts it to Unix time based on the Unix epoch, and returns this 32-bit Unix timestamp.

Overflow

The Unix time32_t data type that represents a point in time is a 32-bit signed integer. A signed 32-bit time value covers about 68 years before and after the Unix epoch (Jan 1st, 1970): the minimum date is Friday 1901-12-13, and the maximum date is Tuesday 2038-01-19. One second after the 19th of January 2038, 03:14:07 UTC, time32_t overflows. This issue is also known as the Year 2038 Problem.

When time32_t overflows, the signs "flips", meaning that the time time32_t actually represents is now in the year 1901. Below is a table showing the correct time along with the bugged time.

Actual time Unix time Bugged time
2038-01-19 03:14:05 UTC 2147483645 (0x7FFFFFFD) 2038-01-19 03:14:05 UTC
2038-01-19 03:14:06 UTC 2147483646 (0x7FFFFFFE) 2038-01-19 03:14:06 UTC
2038-01-19 03:14:07 UTC 2147483647 (0x7FFFFFFF) 2038-01-19 03:14:07 UTC
2038-01-19 03:14:08 UTC -2147483648 (0x80000000)
1901-12-13 20:45:52 UTC
2038-01-19 03:14:09 UTC -2147483647 (0x80000001)
1901-12-13 20:45:53 UTC
2038-01-19 03:14:10 UTC -2147483646 (0x80000002)
1901-12-13 20:45:54 UTC

For the first 2^31 - 1 values of unix time, the value is displayed correctly. When it surpasses 2^31 - 1, the integer overflows and wraps around to a negative value.

The Crash

This crash only happens when going to the Result screen. This is because when going to the Results screen, internally the following code is run:

void GetMonthDay(char *buffer)
{
    __time32_t t;
    struct tm *tm_info;

    // Get current time as 32-bit time_t
    __time32(&t);

    // Convert to local time structure
    tm_info = _localtime32(&t);

    // Format the date as "MM/DD"
    _strftime(buffer, 6, "%m/%d", tm_info);
}

(For technical readers, the assembly code can be found at an offset 0x456938 in 1.00d.)

As established before, t, would have a negative value. This in itself doesn't crash the system. When t is passed into _localtime32, it returns null as its value. When this null pointer value gets passed into _strftime, it eventually leads to a crash.

Replays

Since this bug involves a consistent crash at a given time, it is not possible to create a replay that comes from after 2038.

Videos

Other