# Dreams kept in a secret place

**Updated 2022-12-****31**: We know a lot more now! See below.

Each time you start a mission in *Burning Rangers*, you get a different level map with a different set of survivors. After you finish, you're presented with a password that lets you play it again. This "generate" system is why the game is so replayable. As a kid, I always wanted to have a list of every password.

How does this password system work? I asked Akio Setsumasa, the person that wrote it, and he said he didn't remember the details. But thanks to Andreas Scholl, the patron saint of *Burning Rangers*, we now know some of them.

**The special passwords**

When you rescue members of Sonic Team in the game, they sometimes give you special passwords. Most of them allow you to play as different characters - this is the only way to control Big, Lead, Iria, and Chris.

These passwords have been on the Internet since the game's release. But are there any hidden ones? Loading a save state into a disassembler reveals three fairly obscure ones:

*BRANGERS11**BRANGERS22**BRANGERS33*

If you've read the game's manual, you've seen the first of those before - it's in a shot of the mission completion screen. It lets you replay Mission 1 with its original layout. Unsurprisingly, the other two let you replay the original maps for Missions 2 and 3.

**Normal password structure**

How about the passwords that aren't "special?" The ones you get after completing mission are 10 characters each, and can use the letters A-Z and numbers 0-6. That's 32 characters, a conspicuously computer-friendly power of 2.

If we take A to be a 5-bit binary 0 (00000), B to be a 5-bit binary 1 (00001), etc. we can try to analyze these passwords for structure. This table has five passwords from each mission:

We do see some interesting things:

Bit positions 0 and 1 seem to be constant.

Bit positions 18, 19, and 20 also seem to be constant.

Bit positions 36 and 37 appear to indicate which mission the password is for.

**Disassembly and decompilation**

By analyzing the game's machine code, Andreas pointed out two key facts about the passwords:

The lower 32 bits need to be XOR-ed with a magic constant

The result of that operation must match the checksum in the upper 16 bits

When given a password, the game first compares it to the table of special ones mentioned above. If there's no match, it applies the magic constant to the lower 32 bits. Then it computes a checksum from that value and compares it to the upper 16 bits.

The picture shows Ghidra using the Sega Saturn Loader on a Mednafen save state. The magic constant is highlighted.

**Generating valid passwords**

I was able to take Ghidra's decompilation of the checksum function and reproduce it in Python (it's an implementation of CRC-16-GENIBUS, if that helps). That takes care of 16 of the upper 16 bits.

Of the 32 remaining bits, 3 seem to always be constant (positions 18, 19, and 20 above) and 2 indicate which mission the password is for. That leaves us with 27 free bits. Are they all valid?

It seems like it! The game evidently doesn't verify anything but the checksum, so you can pick a number below 2^27, generate the appropriate bit pattern and checksum, and you've got a playable level.

Some passwords are more valid than others, however. The one shown in the screenshot claims there were 16 people to rescue. But mission 3 has a maximum of 7! It's not yet clear which password bits control the survivor placement.

**What does it all mean**

We've got: 2 unused bits, 16 checksum bits, 3 unused bits, 15 unknown bits, 2 mission bits, and 12 more unknown bits.

If we set all the unknown bits to 0 and vary the mission bits, we can recover the passwords you get when you first clear each mission:

Mission 1: D2H5P4IO2V

Mission 2: DYJSP4IK2V

Mission 3: D42GP4IG2V

That makes sense! The decompilation helps reveal some more structure to the password. The 15 unknown bits are processed as 5 sets of 3 bit values. The 12 unknown bits are processed as 4 sets of 1 bit values and an 8 bit value.

Changing bits affects the level layout and survivors in non-obvious ways. It seems like the different values are used as table indexes. So it's possible that most of the meaning is actually in the tables rather than being encoded into the password.

**The Yuji Naka bits**

One thing we do know is how to generate passwords for Mission 3 that contain Yuji Naka.

For unclear reasons, Naka will appear if the third set of 3 bit values is *001*. So I think that means there are 16 million different ways you can save him. Here are a few for your enjoyment:

EXDOP3YG2V

B5XKP3IG2V

CXUOAEHVEK

EADGHUBGVP

CHLWNEIXU1

Ami Shibata can similarly be placed by setting the third set of 3 bit values to *010*. Alas, you can't place Naka and Shibata together with *011*.

**Other things we know**

Trial and error has shown a few other things about the passwords (after applying the magic constant *0x9fd43b75*):

The five 3 bit values are each restricted to values between

*000*and*100*The four 1 bit values after the mission are restricted to the values

*0000*,*0001*,*0011*,*0111*, and*1111*Mission 1:

Takao Miyoshi: he appears if the second set of 3 bit values is

*010*Satoshi Okano: he appears if the fifth set of 3 bit values is

*001*Hideaki Moriya: he appears if the fifth set of 3 bit values is

*011*

Mission 2:

Elliot Edwards: he appears if the four 1 bit values are

*0011*Claris Sinclair: she appears if the four 1 bit values are

*0111*Fumie Kumatani: she appears if the second set of 3 bit values is

*011*Toru Watanuki: he appears if the third set of 3 bit values is

*010*Yasuhiko Nagamichi: he appears if the second set of 3 bit values is

*001*Yasuhiro Watanabe: he appears if the third set of 3 bit values is

*001*Shinichi Higashi: he appears if the fourth set of 3 bit values is

*100*Yasuhiko Nagamichi: he appears if the second set of 3 bit values is

*001*

Mission 3

Yuji Naka: he appears if the third set of 3 bit values is

*001*Naoto Ohshima: he appears if the fourth set of 3 bit values is

*100*Ami Shibata: she appears if the third set of 3 bits values is

*010*Takuya Matsumoto: he appears if the fourth set of 3 bit values is

*011*

**Call for papers**

If you're a Saturn machine code expert, get in touch! There is much more to understand about these passwords. If you can help figure out the tables the game uses to determine layouts and survivors, do let me know.