The fun ones are the studios who are really good at stubbing debug stuff out. Guitar Hero II for PS2 was released in November 2006. it took 14 and a half years before someone stumbled on a prototype GH80s disc that just happened to be a debug-enabled build of the game, that also just happened to contain a debug-enabled executable for GH2 sitting in the root of the disc (which kind of makes sense, GH80s was a slightly modified and bugfixed version of GH2, so earlier versions of GH80s were probably built as GH2 discs before the executable was finalized). But there are certain key routines in GH2 that are completely stubbed out in the retail builds, such as the routines to read USB keyboard input, or display the actual debug traces. They're present by name, and the rest of the code will call them when needed, but then they just return without doing anything (and thus if a true exception was thrown the game will then halt in retail versions where the debug version would print a data and code stack trace before halting). Harmonix did this continuously throughout Rock Band development as well, even as far as stubbing out routines only needed on a single platform unless the build is for that platform (Rock Band 3 on PS3 makes use of the hdd1: cache, but all code for that is completely stubbed out with return-only funcs in the 360 build). We wouldn't have any knowledge of Rock Band 3 debug if it weren't for a dev Wii we found with five builds of RB3 (including a slightly post-final build, but all debug-enabled).

But then they were sloppy enough to use the 360-based audio encryption path (which had an extra step versus the PS3) on later non-360 consoles and include the needed HvKeys to decrypt the keymask in cleartext, even though they could have successfully decrypted every single audio file that wasn't RB1 on-disc or early DLC by using the PS3 path and not revealing those keys. I don't care about public discussion of this at this point because there are a dozen tools that can decrypt every single Rock Band audio file ever created (and even audio for games that aren't RB but used "mogg" format which is just multichannel Ogg Vorbis with a Harmonix-specific header with security values and an OggMap to aid in seeking). There's even one tool that can decrypt audio that uses the "red" keys which have never been seen to be used publicly. Game dev is fun.

If you've ever heard of Guitar Hero II Deluxe, that debug ELF made that possible. Also if you've played it, you're welcome.

Unearthing a 31 year old Easter egg in Ecco the Dolphin