G.I. Joe: A Real American Hero
                      Password Hacking Guide by Passgener
                         Version 1.0 (29 December 2009)

                     Check GameFaqs.com for latest version!

=== Contents ==================================================================
 
 [1] Important! Read me first!
 [2] About this guide
 [3] Raw (unencoded) data format
 [4] Encoding a password
 [5] Example
 [6] Ready-Made Passwords!
 [7] Legal
 
=== [1] Important! Read me first! =============================================

Section 6 of this guide contains a ready-made set of 'ultimate' passwords. I'm
saying this up front since I don't want anyone to decide they aren't interested
in this guide before they find out this information which is still probably
useful to some people who wouldn't otherwise care.

=== [2] About this guide ======================================================

The purpose of this guide is to explain the secrets behind the password system
for the G.I. Joe NES game. I simply want this information to be known since
there are certain individuals such as myself that might find it interesting.
More generally, this simply allows you to create customized passwords for the
game provided you have a basic understanding of binary numbers; if you don't
then see section 6.

This guide explains the format and encoding of the passwords in a straight
forward but still firmly technical manner. When I originally decided to hack
this system I thought that once I figured it out I could write a guide in a
non-technical manner that would allow anyone to generate their own passwords.
Once I figured out the system though I decided that certain aspects of it
really required a basic understanding of binary numbers and so trying to
explain it a non-technical manner would probably make it more convoluted than
it really needed to be.

As for the motivation for this guide, I've already mentioned that this
information is of interest to individuals like me. By that I simply mean people
who are interested in video games that have password systems. This game in
particular is interesting to me because it was the first or one of the first
games I ever played that had a password system and had always wanted to figure
out how the passwords worked.

Of course, back in grade school, when the game was new, I simply hadn't
acquired the necessary skill to be able to decipher how they worked but now, in
late 2009, I'm much smarter and cooler than I was back then. :) The mood just
hit me one day and I thought it would be fun to give it a try again so I fired
up the NES and the end result is this guide.

=== [3] Raw (unencoded) data format ===========================================

In its raw form a G.I. Joe password consists of nine 4-bit values each one
corresponding to one character of the password. Here's a bit map for the basic
format (the left-most bit in each value is the most significant bit):

  aaaa bbcc ddee ffgg hhii jjkk llmm nnoo pppp

Bits   Meaning
----------------------------------------------
aaaa   Mission number
  bb   Quest number
  cc   Unknown; probably unused
  dd   Duke's stamina
  ee   Duke's weapon level
  ff   Blizzard's additional stamina
  gg   Blizzard's weapon level
  hh   Snake Eye's additional stamina
  ii   Snake Eye's weapon level
  jj   Captain Grid-Iron's additional stamina
  kk   Captain Grid-Iron's weapon level
  ll   Rock & Roll's additional stamina
  mm   Rock & Roll's weapon level
  nn   General Hawk's additional stamina
  oo   General Hawk's weapon level
pppp   checksum value

Each group of the same letter in the map represents a single 2-bit or 4-bit
value.

The mission number wastes some space since only six values are used in a full
4-bit value. If the password contains any value other than those listed below
then the game will reject the password even if it is otherwise valid:

Bits   Meaning
----------------------------------------------
0001   Mission 1
0010   Mission 2
0011   Mission 3
0100   Mission 4
0101   Mission 5
0110   Mission 6

The quest number is the upper two bits of the second 4 bit value. If the
password contains any value other than those listed below then the game will
reject the password even if it is otherwise valid:

Bits   Meaning
----------------------------------------------
  00   First quest
  01   Second quest
  10   Third quest

The lower two bits of the second 4-bit value appear to be unused but I can't be
absolutely sure. The game will accept any of the four possible values and they
appear to have no effect.

The third, fourth, fifth, sixth, seventh and eight 4-bit values contain the
weapon and stamina data for Duke, Blizzard, Snake Eyes, Captain Grid-Iron, Rock
& Roll and General Hawk, respectively.

The upper four two bits are the additional stamina. This 2-bit value just gets
added to the base stamina for the character to get the total stamina. Note that
the character selection screen always shows the base stamina regardless of the
modifier from the password.

The lower two bits are the weapon level for the character:

Bits   Meaning
----------------------------------------------
  00   Level 1A
  01   Level 2A
  10   Level 3A
  11   MAX

Make note of the fact that there is a slot in the password for General Hawk.
This is interesting since you can only use General Hawk in Mission 6 and his
stats do not carry over between quests. To me this suggests that, originally,
the developers were planning on making him available on other stages but
decided later not to. I have no proof of this but can't imagine why else there
would be data for him in the password. I don't believe the game will ever give
you a password were Hawk has anything other than base stats but it will happily
accept a password where his stats are higher.

The last value is a check digit and how to calculate it is covered in the next
section.

=== [4] Encoding a password ===================================================

Encoding a password from the raw data requires several steps. First layout your
raw data in nine 4-bit values as described in section 3.

Next add the position number of each value to the value itself starting from
the left going to the right where the first value is considered position 0.
Skip the checksum value at the end (position 8) and leave it as value zero. If
the resulting value is more than 4-bits (i.e. greater than 15) then simply
throw out the upper bits and keep only the lower four (e.g. 2 + 15 = 1). For
example, if you started out with all 9 nine values being zero and performed
this step then you'd end up with these nine values:

  0000 0001 0010 0011 0100 0101 0110 0111 0000

To compute the checksum, first set the checksum value (position 8) to zero.
Then process each value in order as follows starting from the left and moving
right. For each value, add the value to the checksum (position 8) and then
rotate the bits of the checksum left once. Rotating the bits left means
basically to shift all the bits in the value up in value but the most
significant bit loops around and becomes the least significant bit. If that
doesn't make sense then just use this map:

  abcd -> bcda

The last step is just to convert the 4-bit numbers to the characters of the
password. This is complicated by the fact that a different set of characters is
used depending on the value of the two lower bits of the checksum. Don't change
the value of the checksum at this point but just look at the two lower bits.
Next, run through each of the first eight values (ignore the checksum for now)
and use the appropriate table to convert each value to a character.

+-----------+---------------------------+
|           |       Checksum value      |
| Raw Value | xx00 | xx01 | xx10 | xx11 |
+-----------+------+------+------+------+
| 0000      |   3  |   V  |   H  |   Z  |
| 0001      |   S  |   Z  |   3  |   R  |
| 0010      |   P  |   D  |   6  |   B  |
| 0011      |   N  |   3  |   9  |   J  |
| 0100      |   5  |   9  |   N  |   0  |
| 0101      |   X  |   N  |   5  |   V  |
| 0110      |   G  |   5  |   X  |   D  |
| 0111      |   Z  |   X  |   G  |   8  |
| 1000      |   R  |   S  |   Z  |   5  |
| 1001      |   D  |   G  |   R  |   H  |
| 1010      |   B  |   8  |   D  |   3  |
| 1011      |   2  |   B  |   V  |   S  |
| 1100      |   0  |   2  |   8  |   9  |
| 1101      |   H  |   R  |   0  |   N  |
| 1110      |   V  |   0  |   B  |   X  |
| 1111      |   8  |   Q  |   2  |   G  |
+-----------+------+------+------+------+

Finally, use this table to convert the checksum value to a character and the
password is completely encoded and ready to use.

Checksum   Character
----------------------------------------------
0000       0
0001       1
0010       2
0011       3
0100       4
0101       5
0110       6
0111       7
1000       8
1001       9
1010       B
1011       C
1100       D
1101       F
1110       G
1111       H

=== [5] Example ===============================================================

As an example, let's say we want to start playing from Mission 3 on the second
quest with Snake Eyes maxed out. First we'll layout this raw data:

  0011 0100 0000 0000 1111 0000 0000 0000 0000
  
Next, we'll run through and add the position number of each value to the value:

  0011 0101 0010 0011 0011 0101 0110 0111 0000
  
Now that that's done we can compute the checksum (remember to add then rotate
each time):

  0011 0101 0010 0011 0011 0101 0110 0111 1000
  
Then convert each of the first eight values to characters using the first table
from section 4:

  N    X    P    N    N    X    G    Z    1000
  
Finally, use the second table from section 4 to convert the checksum value to a
character and we have a complete password:

  NXPNNXGZ8
  
=== [6] Ready-Made Passwords! =================================================

I know there are a few people who will find this guide interesting but I figure
most people just want passwords with max stats and really don't care about or
want to actually encode the passwords themselves. To that end, this section
lists "ultimate" passwords for each mission and quest with all the character
stats set to their maximums.

Quest   Mission   Password
----------------------------------------------
 1       1        RRRBJ0VD7
 1       2        PSSPN5XG0
 1       3        3ZZD39N55
 1       4        N3369N5XB
 1       5        NZZD39N59
 1       6        X3369N5XG
 2       1        ZNZD39N55
 2       2        65369N5XB
 2       3        3NZD39N59
 2       4        N5369N5XG
 2       5        VVRBJ0VD3
 2       6        X5369N5X6
 3       1        ZGZD39N59
 3       2        6R369N5XG
 3       3        JHRBJ0VD3
 3       4        NR369N5X6
 3       5        VHRBJ0VD7
 3       6        GDSPN5XG0

It also occurs to me that some people might want the opposite extreme where all
the characters have basic stats so here are those passwords as well:

Quest   Mission   Password
----------------------------------------------
 1       1        RRBJ0VD8C
 1       2        6369N5XG6
 1       3        3ZD39N5XF
 1       4        5SPN5XGZ8
 1       5        5369N5XGG
 1       6        DRBJ0VD8H
 2       1        ZND39N5XF
 2       2        PXPN5XGZ8
 2       3        9569N5XGG
 2       4        0VBJ0VD8H
 2       5        NND39N5X9
 2       6        GXPN5XGZD
 3       1        3R69N5XGG
 3       2        BHBJ0VD8H
 3       3        3GD39N5X9
 3       4        5DPN5XGZD
 3       5        VHBJ0VD8C
 3       6        XR69N5XG6

If you want any others then you are on your own.

=== [7] Legal =================================================================

I, the author of this document, make no claim of copyright or responsibility to
the content therein. You are free to use and distribute it as you see fit and
do so entirely at your own risk.

===============================================================================