Dreams kept in a secret place

Updated 2022-04-22: most of the mysteries have been solved! See below for details.

Each time you start a mission in Burning Rangers, you get a different level map with a different set of survivors. After you finish, you're presented with a password that lets you play it again. This "generate" system is why the game is so replayable. As a kid, I always wanted to have a list of all the passwords.

How does this password system work? I asked Akio Setsumasa, the person that wrote it, and he said he didn't remember. Then I asked Andreas Scholl, the creator of the Burning Rangers Tribute, and he was able to point out a few key details. Eventually I was able to piece together most of the rest. Below is an explanation, and here is some code that can analyze passwords generated by the game.

The special passwords

When you rescue members of Sonic Team in the game, they sometimes give you special passwords. Most of them allow you to play as different characters - this is the only way to control Big, Lead, Iria, and Chris.

These passwords have been on the Internet since the game's release. But are there any hidden ones? Examining a save state reveals three fairly obscure ones:

If you've read the game's manual, you've seen the first of those before - it's in a shot of the mission completion screen. It lets you replay Mission 1 with its original layout. Unsurprisingly, the other two let you replay the original maps for Missions 2 and 3.

Deconstructing passwords

How about the passwords that aren't "special?" The ones you get after completing mission are 10 characters each, and can use the letters A-Z and numbers 0-6. That's 32 characters, a conspicuously computer-friendly power of 2.

If we take A to be a 5-bit binary 0 (00000), B to be a 5-bit binary 1 (00001), etc. we can try to analyze these passwords for structure. This table has five passwords from each mission:

We do see some interesting things:

Disassembly and decompilation

By analyzing the game's machine code, Andreas pointed out two key facts about the passwords:

When given a password, the game first compares it to the table of special ones mentioned above. If there's no match, it applies the magic constant to the lower 32 bits. Then it computes a checksum from that value and compares it to the upper 16 bits.

The picture shows Ghidra using the Sega Saturn Loader on a Mednafen save state. The magic constant is highlighted.

Generating valid passwords

I was able to take Ghidra's decompilation of the checksum function and reproduce it in Python (it's an implementation of CRC-16-GENIBUS, if that helps). That takes care of 16 of the upper 16 bits.

Of the 32 remaining bits, 3 seem to always be constant (positions 18, 19, and 20 above) and 2 indicate which mission the password is for. That leaves us with 27 free bits. Are they all valid?

It seems like it! The game doesn't verify anything but the checksum, so you can pick a number below 2^27, generate the appropriate bit pattern and checksum, and you've got a playable level.

Some passwords are more valid than others, however. For example, the one shown in the screenshot shows 16 survivors in Mission 3, but there aren't that many places for survivors to even appear.

Rescuing Yuji Naka

As the creator of the FREE NAKA mod, I was particular interested in figuring out how generate passwords that let you rescue Yuji Naka.

Through trial and error, I found that Naka appears if bits 27 through 29 are 001. That means there are approximately 16 million different ways you can save him! Here are a few for your enjoyment:

The underlying structure

We've got: 2 unused bits, 16 checksum bits, 3 unused bits, 15 unknown bits, 2 mission bits, and 12 more unknown bits.

If we set all the unknown bits to 0 and vary the mission bits, we can recover the passwords you get when you first clear each mission:

That makes sense! If you use the special BRANGERSXX codes from above, these "all zero" passwords are displayed on the mission results screen.

Ghidra's decompilation reveals more of the structure:

The selection procedure

The game has a list of survivors in a particular order for each mission. The last 8 bits of a password determine how this list gets shuffled. The five sets of 3 bit values determine how many values from the list get used.

There are five different types of survivors:

The mandatory people aren't affected by the passwords. They don't get added to the list at all.

The Sonic Team "A" people don't get added to the list either. However, they are are guaranteed to appear if a particular 3 bit value is set (see below).

The Sonic Team "B" people don't get added to the list the first time you play Mission 3. But they can appear after that.

Elliot and Claris only get added to the list if you've completed Mission 2 at least 3 times and have the appropriate save data (NiGHTS for Elliot; Christmas NiGHTS for Claris).

Rescuing the rest of Sonic Team

The appearance of the Sonic Team "A" people is governed by the five sets of 3 bit values. You can activate a screen that shows the status of each set by changing memory address 0x060FFC30 to 22. The game calls bits 33-35 "SET 1," bits 30-32 "SET 2," and so on.

The Sonic Team "B" people appear if they're not shuffled out of the list of potential survivors. That is, their appearance is dictated by the last 8 bit value.

Call for papers

If this was interesting to you, check out the Hacking Guide for more Burning Rangers esoterica. Also, if you know something about the password system that I don't (or anything about BR), get in touch! I'm memory_fallen on Twitter.