Dreams kept in a secret place

Updated 2022-12-31: We know a lot more now! See below.

Each time you start a mission in Burning Rangers, you get a different level map with a different set of survivors. After you finish, you're presented with a password that lets you play it again. This "generate" system is why the game is so replayable. As a kid, I always wanted to have a list of every password.

How does this password system work? I asked Akio Setsumasa, the person that wrote it, and he said he didn't remember the details. But thanks to Andreas Scholl, the patron saint of Burning Rangers, we now know some of them.

The special passwords

When you rescue members of Sonic Team in the game, they sometimes give you special passwords. Most of them allow you to play as different characters - this is the only way to control Big, Lead, Iria, and Chris.

These passwords have been on the Internet since the game's release. But are there any hidden ones? Loading a save state into a disassembler reveals three fairly obscure ones:

  • BRANGERS11

  • BRANGERS22

  • BRANGERS33

If you've read the game's manual, you've seen the first of those before - it's in a shot of the mission completion screen. It lets you replay Mission 1 with its original layout. Unsurprisingly, the other two let you replay the original maps for Missions 2 and 3.

Normal password structure

How about the passwords that aren't "special?" The ones you get after completing mission are 10 characters each, and can use the letters A-Z and numbers 0-6. That's 32 characters, a conspicuously computer-friendly power of 2.

If we take A to be a 5-bit binary 0 (00000), B to be a 5-bit binary 1 (00001), etc. we can try to analyze these passwords for structure. This table has five passwords from each mission:

We do see some interesting things:

  • Bit positions 0 and 1 seem to be constant.

  • Bit positions 18, 19, and 20 also seem to be constant.

  • Bit positions 36 and 37 appear to indicate which mission the password is for.

Disassembly and decompilation

By analyzing the game's machine code, Andreas pointed out two key facts about the passwords:

  • The lower 32 bits need to be XOR-ed with a magic constant

  • The result of that operation must match the checksum in the upper 16 bits

When given a password, the game first compares it to the table of special ones mentioned above. If there's no match, it applies the magic constant to the lower 32 bits. Then it computes a checksum from that value and compares it to the upper 16 bits.

The picture shows Ghidra using the Sega Saturn Loader on a Mednafen save state. The magic constant is highlighted.

Generating valid passwords

I was able to take Ghidra's decompilation of the checksum function and reproduce it in Python (it's an implementation of CRC-16-GENIBUS, if that helps). That takes care of 16 of the upper 16 bits.

Of the 32 remaining bits, 3 seem to always be constant (positions 18, 19, and 20 above) and 2 indicate which mission the password is for. That leaves us with 27 free bits. Are they all valid?

It seems like it! The game evidently doesn't verify anything but the checksum, so you can pick a number below 2^27, generate the appropriate bit pattern and checksum, and you've got a playable level.

Some passwords are more valid than others, however. The one shown in the screenshot claims there were 16 people to rescue. But mission 3 has a maximum of 7! It's not yet clear which password bits control the survivor placement.

What does it all mean

We've got: 2 unused bits, 16 checksum bits, 3 unused bits, 15 unknown bits, 2 mission bits, and 12 more unknown bits.

If we set all the unknown bits to 0 and vary the mission bits, we can recover the passwords you get when you first clear each mission:

  • Mission 1: D2H5P4IO2V

  • Mission 2: DYJSP4IK2V

  • Mission 3: D42GP4IG2V

That makes sense! The decompilation helps reveal some more structure to the password. The 15 unknown bits are processed as 5 sets of 3 bit values. The 12 unknown bits are processed as 4 sets of 1 bit values and an 8 bit value.

Changing bits affects the level layout and survivors in non-obvious ways. It seems like the different values are used as table indexes. So it's possible that most of the meaning is actually in the tables rather than being encoded into the password.

The Yuji Naka bits

One thing we do know is how to generate passwords for Mission 3 that contain Yuji Naka.

For unclear reasons, Naka will appear if the third set of 3 bit values is 001. So I think that means there are 16 million different ways you can save him. Here are a few for your enjoyment:

  • EXDOP3YG2V

  • B5XKP3IG2V

  • CXUOAEHVEK

  • EADGHUBGVP

  • CHLWNEIXU1

Ami Shibata can similarly be placed by setting the third set of 3 bit values to 010. Alas, you can't place Naka and Shibata together with 011.

Other things we know

Trial and error has shown a few other things about the passwords (after applying the magic constant 0x9fd43b75):

  • The five 3 bit values are each restricted to values between 000 and 100

  • The four 1 bit values after the mission are restricted to the values 0000, 0001, 0011, 0111, and 1111

  • Mission 1:

    • Takao Miyoshi: he appears if the second set of 3 bit values is 010

    • Satoshi Okano: he appears if the fifth set of 3 bit values is 001

    • Hideaki Moriya: he appears if the fifth set of 3 bit values is 011

  • Mission 2:

    • Elliot Edwards: he appears if the four 1 bit values are 0011

    • Claris Sinclair: she appears if the four 1 bit values are 0111

    • Fumie Kumatani: she appears if the second set of 3 bit values is 011

    • Toru Watanuki: he appears if the third set of 3 bit values is 010

    • Yasuhiko Nagamichi: he appears if the second set of 3 bit values is 001

    • Yasuhiro Watanabe: he appears if the third set of 3 bit values is 001

    • Shinichi Higashi: he appears if the fourth set of 3 bit values is 100

    • Yasuhiko Nagamichi: he appears if the second set of 3 bit values is 001

  • Mission 3

    • Yuji Naka: he appears if the third set of 3 bit values is 001

    • Naoto Ohshima: he appears if the fourth set of 3 bit values is 100

    • Ami Shibata: she appears if the third set of 3 bits values is 010

    • Takuya Matsumoto: he appears if the fourth set of 3 bit values is 011

Call for papers

If you're a Saturn machine code expert, get in touch! There is much more to understand about these passwords. If you can help figure out the tables the game uses to determine layouts and survivors, do let me know.