Burning Rangers’ Password System – Reverse Engineered

Bo Bayles, software engineer and writer of Bo Bayles Annex has in the past expressed his deep appreciation for Sonic Team’s Burning Rangers, having explored the game extensively and written about it on his blog. That appreciation has ultimately led to the investigation of the game’s password system.

Each time you start a mission in Burning Rangers, you get a different level map with a different set of survivors. After you finish, you’re presented with a password that lets you play it again. This “generate” system adds to the game’s replay value, and as a kid, Bayles always wanted to have a list of every password for the game.

However, when reaching out to Akio Setsumasa, the individual who wrote the password system, it seems Setsumasa had no memory of how it all worked, instead offering this list of level passwords:

MISSION 1
D2H5P4IO2V – Default
GHKCPNBOUI – Rescue Mitsuyoshi
CYRSNWZ5RJ – Rescue Morii
C6Y1NHA5WD – Rescue Okano

MISSION 2
DYJSP4IK2V – Default
HRNOHZYLAJ – Azuma-san, Claris rescue
AJVKK5M2GN – Elliot -san rescue

MISSION 3
D42GP4IG2V – Default
GWHWI6ZGQC – Oshima-san, Shibata-san rescue
EADGHUBGVP – Naka-san rescue
EPK5L5BGH5 – Dobashi-san , Mr. Shimizu rescued
GA5SJWKGVY – Mr. Setsumasa rescued
ACGWM5EGQS – Mr. Matsumoto rescued

While this may have been somewhat helpful, Bayles’ true goal was to reverse engineer the password system to understand how it actually worked, so he turned to another Burning Rangers aficionado, Andreas Scholl, the ‘patron saint of Burning Rangers’ and the individual responsible for the Burning Rangers Tribute Demo, which was featured in SAGE 2021.

Working together, here is what they found (from Bo Bayles Annex):

The special passwords

When you rescue members of Sonic Team in the game, they sometimes give you special passwords. Most of them allow you to play as different characters – this is the only way to control Big, Lead, Iria, and Chris.

These passwords have been on the Internet since the game’s release. But are there any hidden ones? Loading a save state into a disassembler reveals three fairly obscure ones:

• BRANGERS11
• BRANGERS22
• BRANGERS33

If you’ve read the game’s manual, you’ve seen the first of those before – it’s in a shot of the mission completion screen. It lets you replay Mission 1 with its original layout. Unsurprisingly, the other two let you replay the original maps for Missions 2 and 3.

Normal password structure

How about the passwords that aren’t “special?” The ones you get after completing mission are 10 characters each, and can use the letters A-Z and numbers 0-6. That’s 32 characters, a conspicuously computer-friendly power of 2.

If we take A to be a 5-bit binary 0 (00000), B to be a 5-bit binary 1 (00001), etc. we can try to analyze these passwords for structure. This table has five passwords from each mission:

We do see some interesting things:

• Bit positions 0 and 1 seem to be constant.
• Bit positions 18, 19, and 20 also seem to be constant.
• Bit positions 36 and 37 appear to indicate which mission the password is for.

Disassembly and decompilation

By analyzing the game’s machine code, Andreas pointed out two key facts about the passwords:

• The lower 32 bits need to be XOR-ed with a magic constant
• The result of that operation must match the checksum in the upper 16 bits

When given a password, the game first compares it to the table of special ones mentioned above. If there’s no match, it applies the magic constant to the lower 32 bits. Then it computes a checksum from that value and compares it to the upper 16 bits.

The picture shows Ghidra using the Sega Saturn Loader on a Mednafen save state. The magic constant is highlighted.

Generating valid passwords

I was able to take Ghidra’s decompilation of the checksum function and reproduce it in Python. That takes care of 16 of the upper 16 bits.

Of the 32 remaining bits, 3 seem to always be constant (positions 18, 19, and 20 above) and 2 indicate which mission the password is for. That leaves us with 27 free bits. Are they all valid?

It seems like it! The game evidently doesn’t verify anything but the checksum, so you can pick a number below 2^27, generate the appropriate bit pattern and checksum, and you’ve got a playable level.

Some passwords are more valid than others, however! The one shown in the screenshot claims there were 16 people to rescue. But mission 3 has a maximum of 6! It’s not yet clear which password bits control the survivor placement.

Call for papers

If you’re a Saturn machine code expert, get in touch! I’d love to understand more about what the password bits “mean.”