NES Gauntlet Password Crack FAQ v1.2 Cracked on 7/9/04 by Bill Thomas (particle-man@comcast.net) Updated: 7/12/04 (3200 Treasure info) Updated: 7/7/05 (Complete Vault Codes!! & more 'A' password info) (1) (2) (3) (4) (5) (6) (7) (8) (9) |-----|--------|--------|--------|--------|--------|--------|--------|--------| | . . |4:Unk.=0|4:Shot |4:Speed |4:Magic |4:Fight |4:Armor | | | |V . .| | | | | | |4:Treas0|4:Treas1| | a . |3:Treas2|3:Treas3|3:Treas4|3:Treas5|3:Treas6|3:Treas7|3:Treas8|3:Treas9| |. u .|2:Tr10=0|2:Tr11=0| | | | | | | | . l | | |2:Tools0|2:Tools1|2:Tools2|2:Tools3|2:Tools4|2:Tools5| |C . t|1:Tools6| | | | | | | | | o . | |1:Room0 |1:Room1 |1:Room2 |1:Room3 |1:Room4=0 | | |. m .| | | | | | | | | | . b | | | | | | |1:Plyr0 |1:Plyr1 | |. . o| | | | | | | | | | . . |0:CHKSUM|0:CHKSUM|0:CHKSUM|0:CHKSUM|0:CHKSUM|0:CHKSUM|0:CHKSUM|0:CHKSUM| |-----|--------|--------|--------|--------|--------|--------|--------|--------| Above is a bit-chart of the NES Gauntlet password. Each digit in the password contains 5 bits (0 through 4). In binary, 'bit 0' refers to the least- significant or rightmost bit; bit 4 is leftmost of the 5. 5 bits per digit means 2^5 = 32 characters available for each digit. Here's the character set and corresponding bits: Password Digit Binary Equivalent Password Digit Binary Equivalent A 00000 S 10000 B 00001 T 10001 C 00010 U 10010 D 00011 W 10011 E 00100 X 10100 F 00101 Y 10101 G 00110 Z 10110 H 00111 1 10111 I 01000 2 11000 K 01001 3 11001 L 01010 4 11010 M 01011 5 11011 N 01100 6 11100 O 01101 7 11101 P 01110 8 11110 R 01111 9 11111 ^ ^ | | bit 4 bit 0 Once you understand what each bit does, to create or change a password, all you need to do is set/modify the proper bits. For example, to give yourself extra shot power, simply turn on bit 4 (leftmost bit) of the third digit in the pass- word! Well, it's not QUITE that simple. :) Let's go through each part of the password step by step. ***************************** *** Digit 1 - The Bitmask *** ***************************** The first digit is basically a exclusive-or bitmask, which modifies all of the other digits in the password. (This is explained in the next section.) This digit is simply protection against password cracking. :D But in a way, it also references the vault combination you will need to beat the game. The actual 8-digit vault combination isn't contained in your password, but is stored in the game code. There is only really one vault combo, but it is masked by the first password digit. For example, the 'A' (00000) vault combo is PYMKFERH. All passwords that begin with 'A' will have that same vault combo. If your password begins with 'B' (00001), your vault combo is RXLIEFPG. This is actually the 'A' vault combo which has had its bit-0 masked (exclusive OR'ed). All the 32 vault combos are listed later on. However, there is another fine issue with the first digit. Passwords that begin with 'A' - DON'T WORK! Undoubtedly this was done to make sure there is always a bitmask of some kind, to help disguise the password's contents. However, guess what? The game WILL give out 'A' passwords! (Thanks to "FODA" for pointing this out.) Isn't that friendly? The bitmask value seems to be randomly chosen at the game start. So, you have a 1/32 chance of getting an 'A' password, and this password will never, ever work. High-quality coding, I say. Moving on... ********************************************************* *** Digits 2-9 Intro, Power-ups & Checksum Annoyances *** ********************************************************* Digits 2-9 contain all of the other game information, such as items, room #, and type of player. As shown in the chart, bit 4 in digits 3-7 control the 5 power- ups (shot, speed, magic, fight, armor.) There's an unused bit 4 in digit 2; perhaps this was an unused power-up? Who knows. (This unused bit must always be 0.) In any case, to activate a power-up, simply set the bit to a 1. However, there are 2 issues to address. The first is the CHECKSUM (bit 0, digits 2-9). In digits 2-9, all 5 bits must add up to be even. The checksum bit changes to ensure that (and to prevent password tampering! :) So, if you change bit 4 from 0 to 1, you must also reverse the checksum to compensate. For example, if you started with a 'D' (00011), and you wanted to turn on bit 4, you must change it to a 'U' (10010), NOT a 'W' (10011). Otherwise you would be changing the even/odd result. Easy enough, right? Unfortunately, there's a second layer of protection (annoyance) applied on top of this. It involves digit 1 - the bitmask, remember? So what's an "exclusive- or bitmask", anyway? Essentially, for every bit in digit 1 which is a 1, every other matching bit in digits 2-9 are FLIPPED. I'll give an example. Let's say you've used the chart to set the item bits you want, and your resultant digit 3 is a '5' (11011). However, your bitmask digit 1 is a 'P' (01110). See the 1's there? You will have to FLIP bits 1, 2, and 3 in ALL of the other password digits. So instead of a '5' (11011) for digit 3, you must flip the center 3 bits, and will end up with a 'Y' (10101). Remember, this applies AFTER the checksum. There are probably other ways to visualize the binary math. If you're dealing with an existing password, the relevant bits will be flipped to begin with. So to change an existing password, such as turning on shot power, simply FLIP the relevant bit 4 and also the checksum. No other thinking required! **************** *** Treasure *** **************** Now THIS is an interesting one. Much pain, anguish and controller damage has been caused by the Gauntlet treasure system. But now its secrets will be REVEALED!!! (muhahaha...) May as well tackle the big issue right off the bat: ANY PASSWORD CONTAINING A TREASURE VALUE OF 2000 OR GREATER WILL NOT WORK!!!! So that time you swore blind that you wrote the password down correctly, which subsequently refused to ever work, well, maybe you did. The game feels happy and content to generate passwords for you with treasure values 2000 or greater. It just won't ACCEPT them. :P There's even a whole bit (perhaps 2) reserved in the password for treasure values of 2048 and (perhaps) 4096. But, they are completely useless and must always be set to 0. (I KNOW the 2048 treasure bit IS indeed what it is. The 4096 bit I am just guessing on, but you can see the bit layout for yourself.) And yes, the cutoff is 2000 and not 2048. I've tested it. You can probably accumulate at least 8191 treasure in the game or more, but you can never password it. Well, you CAN, but the passwords will never work. :P **UPDATE** Just managed to get 3200 treasure. Getting 3200 treasure DOES raise your max HP. However, there seems to be a max HP cutoff of 1600. So, the elf will only gain an extra 60 HP by getting 3200 treasure. It would be more worth it for the other characters, I guess. Another issue with the treasure is, the password rounds your treasure down to the nearest 2 (it ignores the LSB.) This saved them a precious bit I suppose, although they then proceeded to waste 2 bits by limiting it to 2000... Anyway, for example, say you have a treasure value of 275. Divide it by 2, then round down, giving you 137. In binary, this is 0000 1001 0001. So, you will turn on Treasure0 (Digit 8, bit 4), Treasure4 (Digit 4, bit 3), and Treasure7 (Digit 7, bit 3). Keeping in mind checksums and annoyances, of course. Maximum passwordable treasure is 1998, which corresponds to 999 = 0011 1110 0111. If you don't care about potentially reaching 3200, you may as well stick with 1600 treasure to keep your password usable as long as possible, which would be 800 = 0011 0010 0000. (However, if you start with 1998 treasure in room 5, 3200 is pretty well within reach!) ************* *** Tools *** ************* "Tools". A word applied when I realized the game combines keys and bombs just to save 1 bit. Here's the equation: Tools Value = Keys * 11 + Bombs So if you have 5 keys and 4 bombs, your tools value will be 5*11 + 4 = 59. In binary, that will be 0111011. Set Tools bits 0, 1, 3, 4, and 5. Max tools, 10 keys and 10 bombs, would be 10*11 + 10 = 120, or 1111000 in binary. Set Tools bits 3-7. ************ *** Room *** ************ Only rooms after treasure rooms can be accessed via password. Here's the rundown: Room # Room Rank Binary 5 1 00001 9 2 00010 14 3 00011 20 4 00100 25 5 00101 30 6 00110 37 7 00111 42 8 01000 50 9 01001 56 10 01010 63 11 01011 68 12 01100 72 13 01101 79 14 01110 *93 15 01111 Room 93, which is after the only treasure room in world 5, cannot be accessed via password. No KNOWN way, at least! ************** *** Player *** ************** The 2 player bits. Pretty straightforward. Warrior = 00 Valkyrie = 01 Wizard = 10 Elf = 11 Just remember to pay attention to the bit ordering on the chart. Valkyrie and Wizard may seem backward, but they aren't. ************************* *** Vault Combination *** ************************* As explained previously, there are 32 vault combinations, adjusted solely by the value of password digit 1 (the bitmask.) Here is a complete list of the vault combinations, painstakingly gathered by "FODA" and verified by me, using a C program I wrote (which uses the bit-flipping method, applied to the vault combo by "DarkCecil") Digit 1 Bitmask Vault Combo A code: 00000 PYMKFERH* ('A' passwords do not work!) B code: 00001 RXLIEFPG C code: 00010 N1KMHGOF D code: 00011 OZILGHNE E code: 00100 LTROBAMD F code: 00101 MSPNABLC G code: 00110 IWORDCKB H code: 00111 KUNPCDIA I code: 01000 G7DBONHR K code: 01001 H6CANOGP L code: 01010 E9BDRPFO M code: 01011 F8ACPREN N code: 01100 C3HFKIDM O code: 01101 D2GEIKCL P code: 01110 A5FHMLBK R code: 01111 B4EGLMAI S code: 10000 8F53YX91 T code: 10001 9E42XY8Z U code: 10010 6H351Z7Y W code: 10011 7G24Z16X X code: 10100 4B97TS5W Y code: 10101 5A86ST4U Z code: 10110 2D79WU3T 1 code: 10111 3C68UW2S 2 code: 11000 ZOWT7619 3 code: 11001 1NUS67Z8 4 code: 11010 XRTW98Y7 5 code: 11011 YPSU89X6 6 code: 11100 UK1Y32W5 7 code: 11101 WIZX23U4 8 code: 11110 SMY154T3 9 code: 11111 TLXZ45S2 I'd suggest using the 'B' combination or similar, since with a B bitmask you'll only have to flip the checksum bits in your password. Remember, 'A' passwords DO NOT WORK! So that's it! You're ready to make your password! Go! Go do it! ...Oh, fine. I'll just list the best passwords myself. (Why did I type all this out then?) **************************** *** Ultimate Passwords!! *** **************************** All use the 'S' vault combination, which again is 8F53YX91. All have max (1998) treasure, 10 keys, 10 bombs, and all power-ups. Warrior L5: S4C-BII-OOO Valkyrie L5: S4C-BII-OPO Wizard L5: S4C-BII-OOP Elf L5: S4C-BII-OPP Warrior L20: S4B-CII-OOO Valkyrie L20: S4B-CII-OPO Wizard L20: S4B-CII-OOP Elf L20: S4B-CII-OPP Warrior L42: S4B-BIM-OOO Valkyrie L42: S4B-BIM-OPO Wizard L42: S4B-BIM-OOP Elf L42: S4B-BIM-OPP Warrior L63: S4C-CIM-OOO Valkyrie L63: S4C-CIM-OPO Wizard L63: S4C-CIM-OOP Elf L63: S4C-CIM-OPP Warrior L79: S4B-CMM-OOO Valkyrie L79: S4B-CMM-OPO Wizard L79: S4B-CMM-OOP Elf L79: S4B-CMM-OPP Woo. Now I guess I should try to beat the game, eh... :) ************************ *** Acknowledgements *** ************************ - Thanks to 'DarkCecil' (PrismSoft2@aol.com) for pointing out the method for deriving the Vault Codes! - Thanks to 'FODA' (nesrocks@gmail.com) for providing a complete list of Vault Codes and other stuff!