Martynas Šateika

Enabling thermal vision in early levels of Tom Clancy’s Splinter Cell

Having recently gotten into reverse engineering of video games, I was looking for a simple task to solve. The first Splinter Cell has got to be my favorite stealth game ever, and I immediately remembered the fact that although Sam Fisher’s multi-vision goggles have night vision available from the get go in the first game, thermal vision is not available until the fifth level - CIA HQ.

This limitation is a bit odd, as I don’t think it would make the player too over-powered, though one reason it is not available until later could be simply because there are no land mines in these levels.

The reversing process

Since whether thermal vision is available is based on the level the player is on, I first thought there was a check somewhere in the game’s executable or one of the dynamic link libraries. However, after investigating the executable through a debugger for a bit, I turned to the game’s map files, stored in the maps directory.

dir /b "<path-to-game>\Tom Clancys Splinter Cell\maps"
0_0_2_Training.scl
0_0_3_Training.scl
1_1_0Tbilisi.scl
1_1_1Tbilisi.scl
1_1_2Tbilisi.scl
1_2_1DefenseMinistry.scl
1_2_2DefenseMinistry.scl
1_3_2CaspianOilRefinery.scl
1_3_3CaspianOilRefinery.scl
1_6_1_1KolaCell.scl
1_7_1_1VselkaInfiltration.scl
1_7_1_2Vselka.scl
2_1_0CIA.scl
...

Since the files are binary, I used hex editor HxD to investigate. I opened up 2_1_0CIA.scl as it’s the first level where thermal vision is available, and searched for the word thermal, but no results were found. Other words like vision didn’t turn up any interesting results either, so I turned instead to an earlier level’s data file - 1_1_0Tbilisi.scl, containing the first section of the Police Station level.

HxD Search Result for “thermal”

Bingo.

Looking around the structure of the file a bit, I’ve noticed each entry had its length right before it. You can see it in the screenshot above, just before bNoThermalAvailable, as “14”, which is decimal 20. The reason it’s 1 more than the name of the flag is the strings are null terminated.

Not wanting to mess with the file structure too much, I simply changed one of the letters, turning the flag to bNoThermalAvailabl0. To test the change, I’ve opened up the game again and loaded up the Police Station level. It worked without crashing the game, though I had to restart the level.

Here is a short clip showcasing some of the early levels with thermal vision.

And here is a Python program that updates all files automatically. Make sure to back up the maps directory first!