Created
December 15, 2021 15:21
-
-
Save TomHarte/54df8bc663b2c97130403c97bb66222e to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
================================================================================ | |
Password Specs - Wonder Boy III: The Dragon's Trap by Splarka | |
================================================================================ | |
The password format uses a 70 bit password made from 14 alphanumeric characters. | |
The alphabet is: "0123456789ABCDEFGHJKLMNPRTUVWXYZ". Each character represents a | |
5 bit number, and the alphabet is linear, so 0 is 0b00000 and Z is 0b11111. The | |
last 7 bits form a checksum, and invalid checksums are not accepted. The first | |
63 bits form the options in the game. There are also 4 base templates which the | |
passwords are built on, to obfuscate them. | |
[bits 01-27] | |
The first 3 sets of 9 bits store the acquired equipment: swords, shields, and | |
armor. The equipped status is not stored, and the game apparently chooses the | |
best equipment for your current form on continue. The bits indicate the | |
position of the equipment in your inventory linearly, except the least powerful | |
(default) equipment, which comes second in the inventory and is not included. | |
The memory location in the game for these is CF20-CF3D (single bit, +80h for | |
"equipped"). | |
[bits 28-32] | |
The next 5 bits indicate spells. The manual states that spells are not included | |
on password continue, but there is a single bit for each of the five types, and | |
when set this bit gives you a pittance of spells. The bit is set upon password | |
generation in the game if you have at least this many spells to get any. For | |
Fireballs, Tornados and Arrows, this number is 5, for Boomerangs, it is 1, for | |
Thunder it is 3. Memory location CF3E-CF42 (single bit, +80h for "equipped"). | |
[bit 33] | |
If you have one key, this bit is set, and you get it back. Memory location CF49 | |
(single bit, +80h for "equipped"). | |
[bits 34-37] | |
These bits indicate the opened status of the green doors in the game. There are | |
four bits, but I have only been able to see the flag changed for three of them: | |
The Tower, the Meka Dragon's Castle (after you return), and the Sky Castle | |
entrance. There is a fourth green door (when you originally leave the Meka | |
Dragon's Castle this is a different door than when you return) but it cannot | |
be opened with a key. Memory location CF5C (stored as 4 bits, the same order as | |
the password). | |
[bits 38-39] | |
These bits indicate the password template. See below. | |
[bits 40-42] | |
These indicate how many extra heart containers you have found (0-7, binary num). | |
You cannot get heart containers out of sequence, nor can you get more than 8 | |
total, so the heart containers you have already acquired is derived from this | |
number. Memory location (CF54), stored as one byte, valid values are: 0D 1A 27 | |
34 41 4E 5B 68. | |
[bits 43-49] | |
This is a binary 7 bit integer for how many Stones you have found. It is | |
interesting to note that you can artifically inflate this number above the 99 | |
possible in the game, and it will carry over into passwords generated later. | |
Your charm score is also proportionally increased, allowing you to buy things | |
out of sequence. The max value in the password system is 127 (all 7 bits). | |
Memory location CF48 (00-7F). | |
[bits 50-57] | |
This stores an estimate of your acquired gold. As the gold value can range from | |
0 to 999999, this would normally take 20 bits, probably excessive. The formula | |
for generating the estimate (rounded down, so you almost always lose gold) seems | |
to be (with the sub-bits forming two 4-bit binary integers): | |
2^[bits 50-53] * 2 * [bits 54-57] | |
Note that if none of bits 54-57 are set, the value is zero. There is about 47% | |
overlap with this formula, and using some passwords will give you different | |
generated results in-game even if the number stays the same. The gold amount | |
is stored in memory at CF55-CF5A as 6 bytes, each byte holds a value (of | |
ascending significance) from 00-09, indicating the decimal value. | |
[bits 58-60] | |
This is a 3 bit binary number indicating your current form. The forms are: | |
00 Hu-Man | |
01 Lizard-Man | |
02 Mouse-Man | |
03 Piranha-Man | |
04 Lion-Man | |
05 Hawk-Man | |
06 *glitch | |
07 *glitch | |
The last two values will highly corrupt the game, pointing to graphics outside | |
the normal range. The game attempts to start, but is unplayable (though the | |
pause menu is accessable). It is interesting that passwords can be entered with | |
no error checking for this. Memory location is C24F (00-07). | |
[bits 61-63] | |
This is a 3 bit binary number indicating both the available forms you can change | |
into, as well as the dragons you have defeated. The values are: | |
00 up to Lizard-Man | |
01 up to Mouse-Man | |
02 up to Piranha-Man | |
03 up to Lion-Man | |
04 up to Hawk-Man | |
05 up to Hawk-Man * | |
06 up to Hawk-Man * | |
07 up to Hawk-Man * | |
The last three values will give odd behavior. Doors will be silent, and going | |
through a "Return" door will make you completely invisible, and door animations | |
will stop. Yet another interesting thing that the password system allows without | |
error checking. Memory location is CF5B (00-07). Note that if you get 99 Stones | |
and access the shortcut doors to the Dragons, this value is reset appropriately. | |
[bits 64-70] | |
These bits form the checksum. | |
Checksum Generation: | |
The game algorithm takes the available options and combines them into the first | |
63 bits of the password. The checksum is calculated before the templates are | |
applied, but includes the bits which determine the template. The 63 bits are | |
padded with a zero on the left and divided evenly into 8 bytes. Each byte is | |
then divided by two and rounded down (right shifted 1) and added to a sum. This | |
sum is then trimmed to the rightmost 7 bits (ANDed with 7Fh), and this value is | |
the checksum. | |
Password Templates: | |
Passwords are obfuscated with a set of 4 base templates, which do not factor | |
into the checksum (which is only applied to the changes), and randomly seem to | |
be chosen each time you generate a password at the church. These templates are | |
XORed against the password before the CRC is applied, but after it has been | |
calculated. The base password templates seem to be (as set by bits 37-38): | |
010100110000011011100001110100000000000000000001000110111000000 [00] | |
000011110011111001001001010101000000000000000010011010011100010 [01] | |
101100111110011110100000101110000000000000000000111000011100010 [10] | |
111000000101111001010100000001000000000000000000000110001110010 [11] | |
These were derived by unsetting all possible password-indicated options, and | |
then asking the game for a password, which gave: | |
AC3E 3L0 004D R00 [00] | |
1WZ4 JM0 209L W80 [01] | |
NFKU 1E0 403G W81 [10] | |
W1F5 810 600C E81 [11] | |
The checksum was stripped, and bits 37-38 were zeroed (as those bits do apply | |
to the checksum, oddly). | |
Encoding: | |
A simple chain to encode a password is: | |
* Combine the 63 bits. | |
* Calculate the checksum. | |
* XOR against the indicated template. | |
* Append the checksum. | |
* Divide into 5 bit integers (n) and select the (n)th alphanumeric character | |
from the available alphabet: "0123456789ABCDEFGHJKLMNPRTUVWXYZ". | |
Decoding: | |
* Replace each alphanumeric character with its 5 bit location in the alphabet. | |
* Combine these, strip the last 7 bits. | |
* XOR it against the indicated template, based on bits 37-38. | |
Password Weirdness: | |
* The password "WE5T 0NE 0000 000" is not a valid password, but a hard-coded | |
alias to "MKWH WBZ TY3J 0GP". | |
* Life, Revival Potions, and opened treasure chests are not stored in the | |
password system. You do, however, get some money for Revival Potions when you | |
generate a password. Equipped status is also not saved, the game seems to choose | |
the best equipment for your form each continue. | |
* Where is the fourth green door! | |
* As noted above, Stones, forms, available forms, and opened green doors can be | |
set via the password system to values not possible in the game, sometimes with | |
odd side effects. | |
* The gold estimation formula is very inefficient and has a lot of overlap. | |
* Some penultimate valid passwords: | |
0000 000 0000 017 | |
ZZZZ ZZW ZZZZ ZZW | |
ZZZZ ZZZ ZZZZ ZWL |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment