Dreams kept in a secret place

The special passwords

When you rescue members of Sonic Team in the game, they sometimes give you special passwords. Most of them allow you to play as different characters - this is the only way to control Big, Lead, Iria, and Chris.

These passwords have been on the Internet since the game's release. But are there any hidden ones? Loading a save state into a disassembler reveals three fairly obscure ones:

• BRANGERS11

• BRANGERS22

• BRANGERS33

If you've read the game's manual, you've seen the first of those before - it's in a shot of the mission completion screen. It lets you replay Mission 1 with its original layout. Unsurprisingly, the other two let you replay the original maps for Missions 2 and 3.

Disassembly and decompilation

By analyzing the game's machine code, Andreas pointed out two key facts about the passwords:

• The lower 32 bits need to be XOR-ed with a magic constant

• The result of that operation must match the checksum in the upper 16 bits

When given a password, the game first compares it to the table of special ones mentioned above. If there's no match, it applies the magic constant to the lower 32 bits. Then it computes a checksum from that value and compares it to the upper 16 bits.

The picture shows Ghidra using the Sega Saturn Loader on a Mednafen save state. The magic constant is highlighted.

Generating valid passwords

I was able to take Ghidra's decompilation of the checksum function and reproduce it in Python (it's an implementation of CRC-16-GENIBUS, if that helps). That takes care of 16 of the upper 16 bits.

Of the 32 remaining bits, 3 seem to always be constant (positions 18, 19, and 20 above) and 2 indicate which mission the password is for. That leaves us with 27 free bits. Are they all valid?

It seems like it! The game evidently doesn't verify anything but the checksum, so you can pick a number below 2^27, generate the appropriate bit pattern and checksum, and you've got a playable level.

Some passwords are more valid than others, however. The one shown in the screenshot claims there were 16 people to rescue. But mission 3 has a maximum of 7! It's not yet clear which password bits control the survivor placement.

What does it all mean

We've got: 2 unused bits, 16 checksum bits, 3 unused bits, 15 unknown bits, 2 mission bits, and 12 more unknown bits.

If we set all the unknown bits to 0 and vary the mission bits, we can recover the passwords you get when you first clear each mission:

• Mission 1: D2H5P4IO2V

• Mission 2: DYJSP4IK2V

• Mission 3: D42GP4IG2V

That makes sense! The decompilation helps reveal some more structure to the password. The 15 unknown bits are processed as 5 sets of 3 bit values. The 12 unknown bits are processed as 4 sets of 1 bit values and an 8 bit value.

Changing bits affects the level layout and survivors in non-obvious ways. It seems like the different values are used as table indexes. So it's possible that most of the meaning is actually in the tables rather than being encoded into the password.

The Yuji Naka bits

One thing we do know is how to generate passwords for Mission 3 that contain Yuji Naka.

For unclear reasons, Naka will appear if the third set of 3 bit values is 001. So I think that means there are 16 million different ways you can save him. Here are a few for your enjoyment:

• EXDOP3YG2V

• B5XKP3IG2V

• CXUOAEHVEK

• EADGHUBGVP

• CHLWNEIXU1

Ami Shibata can similarly be placed by setting the third set of 3 bit values to 010. Alas, you can't place Naka and Shibata together with 011.