Post subject: Password Generators - Adding to?
Joined: 1/16/2011
Posts: 4
I have created a JavaScript password generator for Wonder Boy III (TAS), and was wondering if anyone wanted to convert and add it to http://tasvideos.org/PasswordGenerators.html, which is one of the only places with such a large collection of browser-capable generators around. As far as I can tell, it is the first (public) password encoder/decoder/generator for this game, which seems odd. I spent a good deal of time fruitlessly looking for specs on the password, before figuring it out myself. It seems to work fine for the Master System, Game Gear, and Japanese/Brazilian versions. Here is a working example (using the Metroid generator style on this site). The relevant code is mostly UI, so it isn't really worth pasting snippits that reference a bunch of checkboxes. See the working link above or a pastebin snapshot here. Here are the specs I derived (no license restriction):
================================================================================
Password Specs - Wonder Boy III: The Dragon's Trap                    by Splarka
================================================================================
The password format uses a 70 bit password made from 14 alphanumeric characters.
The alphabet is: "0123456789ABCDEFGHJKLMNPRTUVWXYZ". Each character represents a
5 bit number, and the alphabet is linear, so 0 is 0b00000 and Z is 0b11111. The
last 7 bits form a checksum, and invalid checksums are not accepted. The first
63 bits form the options in the game. There are also 4 base templates which the
passwords are built on, to obfuscate them.

[bits 01-27]
The first 3 sets of 9 bits store the acquired equipment: swords, shields, and
armor. The equipped status is not stored, and the game apparently chooses the
best equipment for your current form on continue. The bits indicate the
position of the equipment in your inventory linearly, except the least powerful
(default) equipment, which comes second in the inventory and is not included.
The memory location in the game for these is CF20-CF3D (single bit, +80h for
"equipped").

[bits 28-32]
The next 5 bits indicate spells. The manual states that spells are not included
on password continue, but there is a single bit for each of the five types, and
when set this bit gives you a pittance of spells. The bit is set upon password
generation in the game if you have at least this many spells to get any. For
Fireballs, Tornados and Arrows, this number is 5, for Boomerangs, it is 1, for
Thunder it is 3. Memory location CF3E-CF42 (single bit, +80h for "equipped").

[bit 33]
If you have one key, this bit is set, and you get it back. Memory location CF49
(single bit, +80h for "equipped").

[bits 34-37]
These bits indicate the opened status of the green doors in the game. There are
four bits, but I have only been able to see the flag changed for three of them:
The Tower, the Meka Dragon's Castle (after you return), and the Sky Castle
entrance. There is a fourth green door (when you originally leave the Meka
Dragon's Castle this is a different door than when you return) but it cannot
be opened with a key. Memory location CF5C (stored as 4 bits, the same order as
the password).

[bits 38-39]
These bits indicate the password template. See below.

[bits 40-42]
These indicate how many extra heart containers you have found (0-7, binary num).
You cannot get heart containers out of sequence, nor can you get more than 8
total, so the heart containers you have already acquired is derived from this
number. Memory location (CF54), stored as one byte, valid values are: 0D 1A 27
34 41 4E 5B 68.

[bits 43-49]
This is a binary 7 bit integer for how many Stones you have found. It is
interesting to note that you can artifically inflate this number above the 99
possible in the game, and it will carry over into passwords generated later.
Your charm score is also proportionally increased, allowing you to buy things
out of sequence. The max value in the password system is 127 (all 7 bits).
Memory location CF48 (00-7F).

[bits 50-57]
This stores an estimate of your acquired gold. As the gold value can range from
0 to 999999, this would normally take 20 bits, probably excessive. The formula
for generating the estimate (rounded down, so you almost always lose gold) seems
to be (with the sub-bits forming two 4-bit binary integers):
  2^[bits 50-53] * 2 * [bits 54-57]
Note that if none of bits 54-57 are set, the value is zero. There is about 47%
overlap with this formula, and using some passwords will give you different
generated results in-game even if the number stays the same. The gold amount
is stored in memory at CF55-CF5A as 6 bytes, each byte holds a value (of
ascending significance) from 00-09, indicating the decimal value.

[bits 58-60]
This is a 3 bit binary number indicating your current form. The forms are:
  00 Hu-Man
  01 Lizard-Man
  02 Mouse-Man
  03 Piranha-Man
  04 Lion-Man
  05 Hawk-Man
  06 *glitch
  07 *glitch
The last two values will highly corrupt the game, pointing to graphics outside
the normal range. The game attempts to start, but is unplayable (though the
pause menu is accessable). It is interesting that passwords can be entered with
no error checking for this. Memory location is C24F (00-07).

[bits 61-63]
This is a 3 bit binary number indicating both the available forms you can change
into, as well as the dragons you have defeated. The values are:
  00 up to Lizard-Man
  01 up to Mouse-Man
  02 up to Piranha-Man
  03 up to Lion-Man
  04 up to Hawk-Man
  05 up to Hawk-Man *
  06 up to Hawk-Man *
  07 up to Hawk-Man *
The last three values will give odd behavior. Doors will be silent, and going
through a "Return" door will make you completely invisible, and door animations
will stop. Yet another interesting thing that the password system allows without
error checking. Memory location is CF5B (00-07). Note that if you get 99 Stones
and access the shortcut doors to the Dragons, this value is reset appropriately.

[bits 64-70]
These bits form the checksum.

Checksum Generation:
The game algorithm takes the available options and combines them into the first
63 bits of the password. The checksum is calculated before the templates are
applied, but includes the bits which determine the template. The 63 bits are
padded with a zero on the left and divided evenly into 8 bytes. Each byte is
then divided by two and rounded down (right shifted 1) and added to a sum. This
sum is then trimmed to the rightmost 7 bits (ANDed with 7Fh), and this value is
the checksum.

Password Templates:
Passwords are obfuscated with a set of 4 base templates, which do not factor
into the checksum (which is only applied to the changes), and randomly seem to
be chosen each time you generate a password at the church. These templates are
XORed against the password before the CRC is applied, but after it has been
calculated. The base password templates seem to be (as set by bits 37-38):
  010100110000011011100001110100000000000000000001000110111000000  [00]
  000011110011111001001001010101000000000000000010011010011100010  [01]
  101100111110011110100000101110000000000000000000111000011100010  [10]
  111000000101111001010100000001000000000000000000000110001110010  [11]
These were derived by unsetting all possible password-indicated options, and
then asking the game for a password, which gave:
  AC3E 3L0 004D R00  [00]
  1WZ4 JM0 209L W80  [01]
  NFKU 1E0 403G W81  [10]
  W1F5 810 600C E81  [11]
The checksum was stripped, and bits 37-38 were zeroed (as those bits do apply
to the checksum, oddly).

Encoding:
A simple chain to encode a password is:
* Combine the 63 bits.
* Calculate the checksum.
* XOR against the indicated template.
* Append the checksum.
* Divide into 5 bit integers (n) and select the (n)th alphanumeric character
from the available alphabet: "0123456789ABCDEFGHJKLMNPRTUVWXYZ".

Decoding:
* Replace each alphanumeric character with its 5 bit location in the alphabet.
* Combine these, strip the last 7 bits.
* XOR it against the indicated template, based on bits 37-38.

Password Weirdness:
* The password "WE5T 0NE 0000 000" is not a valid password, but a hard-coded
alias to "MKWH WBZ TY3J 0GP".
* Life, Revival Potions, and opened treasure chests are not stored in the
password system. You do, however, get some money for Revival Potions when you
generate a password. Equipped status is also not saved, the game seems to choose
the best equipment for your form each continue.
* Where is the fourth green door!
* As noted above, Stones, forms, available forms, and opened green doors can be
set via the password system to values not possible in the game, sometimes with
odd side effects.
* The gold estimation formula is very inefficient and has a lot of overlap.
* Some penultimate valid passwords:
  0000 000 0000 017
  ZZZZ ZZW ZZZZ ZZW
  ZZZZ ZZZ ZZZZ ZWL
Post subject: +Metal Gear
Editor, Active player (296)
Joined: 3/8/2004
Posts: 7469
Location: Arzareth
Here's another password generator datasheet submitted to me that I never had the time to implement in JS. It was submitted by TNSe. Slightly edited for brefity.
Metal Gear uses 25 * 5 bit chars for the code

Char<->Value table
US-EU-HX
1  B  00
2  D  01
3  G  02
4  H  03
5  J  04
6  K  05
A  L  06
B  M  07
C  N  08
D  P  09
E  Q  0A
F  R  0B
G  T  0C
H  V  0D
I  W  0E
J  X  0F
K  Y  10
L  Z  11
M  1  12
N  2  13
O  3  14
P  4  15
Q  5  16
R  6  17
S  7  18
T  8  19
U  9  1A
V  -  1B
W  *  1C
X  .  1D
Y  #  1E
Z  "  1F

Code Layout:
  01234 56789
A xxxxx xxxxx
B xxxxx xxxxx
C xxxxx

18 bytes result:
ABCDEFGHIJKLMNOPQR
012345678901234567

Conversion matrix:
A 0:2 = A0 0:2, A 3:7 = 0
B 0:4 = A1 0:4, B 5:7 = B8 0:2
C 0:4 = A2 0:4, C 5:7 = B9 0:2
D 0:1 = A0 3:4, D 2:7 = 0
E 0:4 = A3 0:4, E 5:7 = C0 0:2
F 0:4 = A4 0:4, F 5:7 = C1 0:2
G 0:4 = A5 0:4, G 5:7 = C2 0:2
H 0:4 = A6 0:4, H 5:7 = C3 0:2
I 0:4 = A7 0:4, I 5:6 = B8 3:4, I 7:7 = C2 4:4
J 0:4 = A8 0:4, J 5:6 = B9 3:4, J 7:7 = C2 3:3
K 0:4 = A9 0:4, K 5:6 = C0 3:4, K 7:7 = C3 4:4
L 0:4 = B0 0:4, L 5:6 = C1 3:4, L 7:7 = C3 3:3
M 0:4 = B1 0:4, M 5:7 = 0
N 0:4 = B2 0:4, N 5:7 = 0
O 0:4 = B3 0:4, O 5:7 = 0
P 0:4 = B4 0:4, P 5:7 = B7 0:2
Q 0:4 = B5 0:4, Q 5:6 = B7 3:4, Q 7:7 = 0
R 0:4 = B6 0:4, R 5:7 = 0


Accounted for:
var    bit
   01234
A0 AAADD
A1 BBBBB
A2 CCCCC
A3 EEEEE
A4 FFFFF
A5 GGGGG
A6 HHHHH
A7 IIIII
A8 JJJJJ
A9 KKKKK

B0 LLLLL
B1 MMMMM
B2 NNNNN
B3 OOOOO
B4 PPPPP
B5 QQQQQ
B6 RRRRR
B7 PPPQQ
B8 BBBII
B9 CCCJJ

C0 EEEKK
C1 FFFLL
C2 GGGJI
C3 HHHLK
C4 Checksum


A = Starting Place (3 bits), starting location depends on your rank (in paranthesis)
 00 - Illegal
 01 - Jungle (*)
 02 - Building 1 (**)
 03 - Elevator (***)
 04 - South of Tanks (****)
 05 - Illegal
 06 - Illegal
 07 - Illegal

B = Bosses, first 8, bitmapped
 0 - Machine Gun Kid
 1 - Twin Shot
 2 - Shotgunner
 3 - Tanks
 4 - Bulldozer
 5 - Arnold
 6 - Fire Trooper
 7 - Coward Duck

C = Weapons, Bitmapped
 0 - Pistol
 1 - Mines
 2 - Explosives
 3 - Missiles
 4 - Machine Gun
 5 - Grenade Launcher
 6 - Rocket Launcher
 7 - Option: Silencer

D = Bosses, last 2, bitmapped
 0 - Super Computer (Having this bit set puts you directly outside super computer room)
 1 - "Big Boss"

E, F & G are 24 prisoners, bitmapped.
F:3 = "Grey Fox"
G:2 = Jennifers Brother

H = Cards, Card 1 through 8, bitmapped

I = Inventory 1, Bitmapped
 0 - Cigarettes (Always given even if not set)
 1 - Gasmask
 2 - Binoculars
 3 - Cardboard Box
 4 - Bomb Blast Suit
 5 - Enemy Uniform
 6 - Infrared Goggles
 7 - Glove
J = Inventory 2, Bitmapped
 0 - Mine Detector
 1 - Armor
 2 - Antenna
 3 - Antidote
 4 - Flashlight
 5 - Compass
 6 - Oxygen
 7 - Transmitter

K = Rations (Lower 4 bits, 0..15)
 Game State in upper 4, Bitmapped
  4 - ?
  5 - Poisoned (This bit is removed before game begins)
  6 - Captured (A code with this bit sets ignores location above)
  7 - Escaped (Will only work if you have taken card 3?)

Ammo: (Any values out of range from the numbers in paranthesis will cause ERR CODE)
L = Hand Gun (0..255)
M = Mines (0..20)
N = Explosives (0..20)
O = Missile (0..20)
P = Machine Gun (0..255)
Q = Grenade Launcher (0..90)
R = Rockets (0..30)

Byte locations in Memory:
A..R = 6E..7F
Post subject: Re: +Metal Gear
Joined: 1/16/2011
Posts: 4
Bisqwit wrote:
Here's another password generator datasheet submitted to me that I never had the time to implement in JS. It was submitted by TNSe. Slightly edited for brefity.
Metal Gear uses 25 * 5 bit chars for the code
Here's someone else's generator for that one: http://unoriginal.org/people/cybern/metal_gear.html