The 2038 problem

Specifications

Versions: 1.00a
Difficulty: Easy - Normal - Hard - Lunatic - Extra
Mode: Main game - Practice mode
Shottype: ReimuA - ReimuB - ReimuC - MarisaA - MarisaB - MarisaC

What happens

If your operating system's time is after the timestamp 19th of January 2038, 03:14:07 UTC, your game will likely crash.

xkcd 607 is shown, describing the issue of the year 2038. — Figure 1: Relevant xkcd (https://xkcd.com/607/).

How it happens

This happens if your operating system's time is after the timestamp 19th of January 2038, 03:14:07 UTC. The crash has multiple ways of taking place, which are listed as follows:

The crash happens on writing to the scorefile (if score is in top 10) (offset: 0x421fa0)
The crash happens on replay save (non-extra credit clear) (offset: 0x433570)
The crash happens on replay save (stage practice, extra credit clear) (offset: 0x4236f0)

Why it happens

When saving player data, one of the values needed is the current time. For the game to get your operating system's current time, the following code is run when it needs the current time:

using time32_t = int32_t;

time32_t __time32(time32_t* out)
{
    FILETIME ft;
    GetSystemTimeAsFileTime(&ft);

    // Official Windows way to convert FILETIME -> 64‑bit integer
    ULARGE_INTEGER u;
    u.LowPart  = ft.dwLowDateTime;
    u.HighPart = ft.dwHighDateTime;

    uint64_t filetime = u.QuadPart;

    static const uint64_t EPOCH_DIFF = 116444736000000000ULL;

    uint64_t unixSeconds = (filetime - EPOCH_DIFF) / 10000000ULL;

    // The 2038 overflow happens here !!!
    time32_t result = static_cast<time32_t>(unixSeconds);

    if (out)
        *out = result;

    return result;
}

(For technical readers, the assembly code can be found at an offset 0x452b71 in 1.00a.)

This code fetches the operating system's time, converts it to Unix time based on the Unix epoch, and returns this 32-bit Unix timestamp.

Overflow

The Unix time32_t data type that represents a point in time is a 32-bit signed integer. A signed 32-bit time value covers about 68 years before and after the Unix epoch (Jan 1st, 1970): the minimum date is Friday 1901-12-13, and the maximum date is Tuesday 2038-01-19. One second after the 19th of January 2038, 03:14:07 UTC, time32_t overflows. This issue is also known as the Year 2038 Problem.

When time32_t overflows, the signs "flips", meaning that the time time32_t actually represents is now in the year 1901. Below is a table showing the correct time along with the bugged time.

Actual time	Unix time	Bugged time
2038-01-19 03:14:05 UTC	2147483645 (0x7FFFFFFD)	2038-01-19 03:14:05 UTC
2038-01-19 03:14:06 UTC	2147483646 (0x7FFFFFFE)	2038-01-19 03:14:06 UTC
2038-01-19 03:14:07 UTC	2147483647 (0x7FFFFFFF)	2038-01-19 03:14:07 UTC
2038-01-19 03:14:08 UTC	-2147483648 (0x80000000)	1901-12-13 20:45:52 UTC
2038-01-19 03:14:09 UTC	-2147483647 (0x80000001)	1901-12-13 20:45:53 UTC
2038-01-19 03:14:10 UTC	-2147483646 (0x80000002)	1901-12-13 20:45:54 UTC

For the first 2^31 - 1 values of unix time, the value is displayed correctly. When it surpasses 2^31 - 1, the integer overflows and wraps around to a negative value.

The Crash

There are four parts in the code where time32_t is used (For technical readers, their offsets can be found at 0x4236f0, 0x421fa0, 0x433570, 0x41a200 in 1.00a.). However, for simplicity we will only focus on one part.

Consider the following code, which is run when saving a replay (stage practice, extra credit clear):

void FormatString(char *buffer)
{
    __time32_t t;
    struct tm *tm_info;

    // Get current time as 32-bit time_t
    __time32(&t);

    // Convert to local time structure
    tm_info = _localtime(&t);

    // Format the string in some way
    format_string(buffer, tm_info);
}

(For technical readers, the assembly code can be found at an offset 0x456938 in 1.00d.)

As established before, t, would have a negative value. This in itself doesn't crash the system. When t is passed into _localtime, it returns null as its value. When this null pointer value gets passed into format_string, it eventually leads to a crash. (To be more specific, the crash happens at 0x422848 because the eax register is null and the code attempts to read from a field from the returned struct)

The 2038 problem

Specifications

What happens

How it happens

Why it happens

Overflow

The Crash

Links

Replays

Videos

Other