Dreams kept in a secret place

Updated 2023-04-22: most of the mysteries have been solved! See below for details.

Each time you start a mission in Burning Rangers, you get a different level map with a different set of survivors. After you finish, you're presented with a password that lets you play it again. This "generate" system is why the game is so replayable. As a kid, I always wanted to have a list of all the passwords.

How does this password system work? I asked Akio Setsumasa, the person that wrote it, and he said he didn't remember. Then I asked Andreas Scholl, the creator of the Burning Rangers Tribute, and he was able to point out a few key details. Eventually I was able to piece together most of the rest. Below is an explanation, and here is some code that can analyze passwords generated by the game.

The special passwords

When you rescue members of Sonic Team in the game, they sometimes give you special passwords. Most of them allow you to play as different characters - this is the only way to control Big, Lead, Iria, and Chris.

These passwords have been on the Internet since the game's release. But are there any hidden ones? Examining a save state reveals three fairly obscure ones:

BRANGERS11
BRANGERS22
BRANGERS33

If you've read the game's manual, you've seen the first of those before - it's in a shot of the mission completion screen. It lets you replay Mission 1 with its original layout. Unsurprisingly, the other two let you replay the original maps for Missions 2 and 3.

Deconstructing passwords

How about the passwords that aren't "special?" The ones you get after completing mission are 10 characters each, and can use the letters A-Z and numbers 0-6. That's 32 characters, a conspicuously computer-friendly power of 2.

If we take A to be a 5-bit binary 0 (00000), B to be a 5-bit binary 1 (00001), etc. we can try to analyze these passwords for structure. This table has five passwords from each mission:

We do see some interesting things:

Bit positions 0 and 1 seem to be constant.
Bit positions 18, 19, and 20 also seem to be constant.
Bit positions 36 and 37 appear to indicate which mission the password is for.

Disassembly and decompilation

By analyzing the game's machine code, Andreas pointed out two key facts about the passwords:

The lower 32 bits need to be XOR-ed with a magic constant (0x9fd43b75)
The result of that operation must match the checksum in the upper 16 bits

When given a password, the game first compares it to the table of special ones mentioned above. If there's no match, it applies the magic constant to the lower 32 bits. Then it computes a checksum from that value and compares it to the upper 16 bits.

The picture shows Ghidra using the Sega Saturn Loader on a Mednafen save state. The magic constant is highlighted.

Generating valid passwords

I was able to take Ghidra's decompilation of the checksum function and reproduce it in Python (it's an implementation of CRC-16-GENIBUS, if that helps). That takes care of the upper 16 bits.

Of the 32 remaining bits, 3 seem to always be constant (positions 18, 19, and 20 above) and 2 indicate which mission the password is for. That leaves us with 27 free bits. Are they all valid?

It seems like it! The game doesn't verify anything but the checksum, so you can pick a number below 2^27, generate the appropriate bit pattern and checksum, and you've got a playable level.

Some passwords are more valid than others, however. For example, the one shown in the screenshot shows 16 survivors in Mission 3, but there aren't that many places for survivors to even appear.

Rescuing Yuji Naka

As the creator of the FREE NAKA mod, I was particular interested in figuring out how generate passwords that let you rescue Yuji Naka.

Through trial and error, I found that Naka appears if bits 27 through 29 are 001. That means there are approximately 16 million different ways you can save him! Here are a few for your enjoyment:

EXDOP3YG2V
B5XKP3IG2V
CXUOAEHVEK
EADGHUBGVP
CHLWNEIXU1

The underlying structure

We've got: 2 unused bits, 16 checksum bits, 3 unused bits, 15 unknown bits, 2 mission bits, and 12 more unknown bits.

If we set all the unknown bits to 0 and vary the mission bits, we can recover the passwords you get when you first clear each mission:

Mission 1: D2H5P4IO2V
Mission 2: DYJSP4IK2V
Mission 3: D42GP4IG2V

That makes sense! If you use the special BRANGERSXX codes from above, these "all zero" passwords are displayed on the mission results screen.

Ghidra's decompilation reveals more of the structure:

There are five sets of 3 bit parameters, each of which can vary between 0x000 and 0x100.
There are four 1 bit flags.
There is one 8 bit parameter that can take on any value.

The selection procedure

The game has a list of survivors in a particular order for each mission. The last 8 bits of a password determine how this list gets shuffled. The five sets of 3 bit values determine how many values from the list get used.

There are five different types of survivors:

Mandatory: people who always appear in a particular mission. The doctor and his assistant in Mission 1; the chief in Mission 2; Neal in Mission 3.
Sonic Team "A": people like Satoshi Okano (Mission 1), Fumie Kumatani (Mission 2), and Yuji Naka (Mission 3) who always appear in the same place.
Sonic Team "B": people like Tomonori Dobashi and Kayo Shimizu who appear in random locations in Mission 3.
Elliot and Claris: the NiGHTS characters who can appear in Mission 2 if you have NiGHTS or Christmas NiGHTS save data.
Everyone else: people who appear in random locations.

The mandatory people aren't affected by the passwords. They don't get added to the list at all.

The Sonic Team "A" people don't get added to the list either. However, they are are guaranteed to appear if a particular 3 bit value is set (see below).

The Sonic Team "B" people don't get added to the list the first time you play Mission 3. But they can appear after that.

Elliot and Claris only get added to the list if you've completed Mission 2 at least 3 times and have the appropriate save data (NiGHTS for Elliot; Christmas NiGHTS for Claris).

Rescuing the rest of Sonic Team

The appearance of the Sonic Team "A" people is governed by the five sets of 3 bit values. You can activate a screen that shows the status of each set by changing memory address 0x060FFC30 to 22. The game calls bits 33-35 "SET 1," bits 30-32 "SET 2," and so on.

Mission 1
- Takao Miyoshi: he appears if bits 24-26 are 010
- Satoshi Okano: he appears if bits 33-35 are 001
- Hideaki Moriya: he appears if bits 33-35 are 011
Mission 2
- Fumie Kumatani: she appears if bits 24-26 are 011
- Toru Watanuki: he appears if bits 27-29 are 010
- Yasuhiko Nagamichi: he appears if bits 24-26 are 001
- Yasuhiro Watanabe: he appears if bits 27-29 are 001
- Shinichi Higashi: he appears if bits 30-32 are 100
- Yasuhiko Nagamichi: he appears if bits 24-26 are 001
Mission 3
- Yuji Naka: he appears if bits 27-29 are 001
- Naoto Ohshima: he appears if bits 30-32 are 100
- Ami Shibata: she appears if bits 27-29 are 010
- Takuya Matsumoto: he appears if bits 30-32 are 011

The Sonic Team "B" people appear if they're not shuffled out of the list of potential survivors. That is, their appearance is dictated by the last 8 bit value.

Kayao Shimizu
Naofumi Hataya
Masaru Setsumaru
Tomonori Dobashi

Call for papers

If this was interesting to you, check out the Hacking Guide for more Burning Rangers esoterica. Also, if you know something about the password system that I don't (or anything about BR), get in touch! I'm memory_fallen on Twitter.

Google Sites

Report abuse