NES Gauntlet Password Crack FAQ  v1.2
Cracked on 7/9/04 by Bill Thomas (particle-man@comcast.net)
Updated: 7/12/04 (3200 Treasure info)
Updated: 7/7/05 (Complete Vault Codes!! & more 'A' password info)

  (1)     (2)      (3)      (4)      (5)      (6)      (7)      (8)      (9)
|-----|--------|--------|--------|--------|--------|--------|--------|--------|
| . . |4:Unk.=0|4:Shot  |4:Speed |4:Magic |4:Fight |4:Armor |        |        |
|V . .|        |        |        |        |        |        |4:Treas0|4:Treas1|
| a . |3:Treas2|3:Treas3|3:Treas4|3:Treas5|3:Treas6|3:Treas7|3:Treas8|3:Treas9|
|. u .|2:Tr10=0|2:Tr11=0|        |        |        |        |        |        |
| . l |        |        |2:Tools0|2:Tools1|2:Tools2|2:Tools3|2:Tools4|2:Tools5|
|C . t|1:Tools6|        |        |        |        |        |        |        |
| o . |        |1:Room0 |1:Room1 |1:Room2 |1:Room3 |1:Room4=0        |        |
|. m .|        |        |        |        |        |        |        |        |
| . b |        |        |        |        |        |        |1:Plyr0 |1:Plyr1 |
|. . o|        |        |        |        |        |        |        |        |
| . . |0:CHKSUM|0:CHKSUM|0:CHKSUM|0:CHKSUM|0:CHKSUM|0:CHKSUM|0:CHKSUM|0:CHKSUM|
|-----|--------|--------|--------|--------|--------|--------|--------|--------|

Above is a bit-chart of the NES Gauntlet password.  Each digit in the password
contains 5 bits (0 through 4).  In binary, 'bit 0' refers to the least-
significant or rightmost bit; bit 4 is leftmost of the 5.  5 bits per digit
means 2^5 = 32 characters available for each digit.  Here's the character set
and corresponding bits:

Password Digit    Binary Equivalent   Password Digit    Binary Equivalent
      A                 00000               S                 10000
      B                 00001               T                 10001
      C                 00010               U                 10010
      D                 00011               W                 10011
      E                 00100               X                 10100
      F                 00101               Y                 10101
      G                 00110               Z                 10110
      H                 00111               1                 10111
      I                 01000               2                 11000
      K                 01001               3                 11001
      L                 01010               4                 11010
      M                 01011               5                 11011
      N                 01100               6                 11100
      O                 01101               7                 11101
      P                 01110               8                 11110
      R                 01111               9                 11111
                        ^   ^
                        |   |
                    bit 4   bit 0

Once you understand what each bit does, to create or change a password, all you
need to do is set/modify the proper bits.  For example, to give yourself extra
shot power, simply turn on bit 4 (leftmost bit) of the third digit in the pass-
word!  Well, it's not QUITE that simple.  :)  Let's go through each part of the
password step by step.


*****************************
*** Digit 1 - The Bitmask ***
*****************************

The first digit is basically a exclusive-or bitmask, which modifies all of the
other digits in the password.  (This is explained in the next section.)  This 
digit is simply protection against password cracking.  :D  But in a way, it also
references the vault combination you will need to beat the game.  The actual
8-digit vault combination isn't contained in your password, but is stored in the
game code.  There is only really one vault combo, but it is masked by the first
password digit.  For example, the 'A' (00000) vault combo is PYMKFERH.  All
passwords that begin with 'A' will have that same vault combo.  If your password
begins with 'B' (00001), your vault combo is RXLIEFPG.  This is actually the 'A'
vault combo which has had its bit-0 masked (exclusive OR'ed).  All the 32 vault
combos are listed later on.

However, there is another fine issue with the first digit.  Passwords that begin
with 'A' - DON'T WORK!  Undoubtedly this was done to make sure there is always a
bitmask of some kind, to help disguise the password's contents.  However, guess
what?  The game WILL give out 'A' passwords!  (Thanks to "FODA" for pointing
this out.)  Isn't that friendly?  The bitmask value seems to be randomly chosen
at the game start.  So, you have a 1/32 chance of getting an 'A' password, and 
this password will never, ever work.  High-quality coding, I say.  Moving on...


*********************************************************
*** Digits 2-9 Intro, Power-ups & Checksum Annoyances ***
*********************************************************

Digits 2-9 contain all of the other game information, such as items, room #, and
type of player.  As shown in the chart, bit 4 in digits 3-7 control the 5 power-
ups (shot, speed, magic, fight, armor.)  There's an unused bit 4 in digit 2;
perhaps this was an unused power-up?  Who knows.  (This unused bit must always
be 0.)  In any case, to activate a power-up, simply set the bit to a 1.
However, there are 2 issues to address.  The first is the CHECKSUM (bit 0,
digits 2-9).  In digits 2-9, all 5 bits must add up to be even.  The checksum
bit changes to ensure that (and to prevent password tampering! :)  So, if you
change bit 4 from 0 to 1, you must also reverse the checksum to compensate.  For
example, if you started with a 'D' (00011), and you wanted to turn on bit 4, you
must change it to a 'U' (10010), NOT a 'W' (10011).  Otherwise you would be
changing the even/odd result.  Easy enough, right?

Unfortunately, there's a second layer of protection (annoyance) applied on top
of this.  It involves digit 1 - the bitmask, remember?  So what's an "exclusive-
or bitmask", anyway?  Essentially, for every bit in digit 1 which is a 1, every
other matching bit in digits 2-9 are FLIPPED.  I'll give an example.

Let's say you've used the chart to set the item bits you want, and your
resultant digit 3 is a '5' (11011).  However, your bitmask digit 1 is a 'P'
(01110).  See the 1's there?  You will have to FLIP bits 1, 2, and 3 in ALL of
the other password digits.  So instead of a '5' (11011) for digit 3, you must 
flip the center 3 bits, and will end up with a 'Y' (10101).  Remember, this
applies AFTER the checksum.  There are probably other ways to visualize the
binary math.  If you're dealing with an existing password, the relevant bits
will be flipped to begin with.  So to change an existing password, such as
turning on shot power, simply FLIP the relevant bit 4 and also the checksum.
No other thinking required!


****************
*** Treasure ***
****************

Now THIS is an interesting one.  Much pain, anguish and controller damage has
been caused by the Gauntlet treasure system.  But now its secrets will be
REVEALED!!!  (muhahaha...)  May as well tackle the big issue right off the bat:

 ANY PASSWORD CONTAINING A TREASURE VALUE OF 2000 OR GREATER WILL NOT WORK!!!!

So that time you swore blind that you wrote the password down correctly, which
subsequently refused to ever work, well, maybe you did.  The game feels happy
and content to generate passwords for you with treasure values 2000 or greater.
It just won't ACCEPT them.  :P  There's even a whole bit (perhaps 2) reserved
in the password for treasure values of 2048 and (perhaps) 4096.  But, they are
completely useless and must always be set to 0.  (I KNOW the 2048 treasure bit
IS indeed what it is.  The 4096 bit I am just guessing on, but you can see the
bit layout for yourself.)  And yes, the cutoff is 2000 and not 2048.  I've
tested it.  You can probably accumulate at least 8191 treasure in the game or
more, but you can never password it.  Well, you CAN, but the passwords will
never work.  :P  

**UPDATE** Just managed to get 3200 treasure.  Getting 3200 treasure DOES raise
your max HP.  However, there seems to be a max HP cutoff of 1600.  So, the elf
will only gain an extra 60 HP by getting 3200 treasure.  It would be more worth
it for the other characters, I guess.  

Another issue with the treasure is, the password rounds your treasure down to
the nearest 2 (it ignores the LSB.)  This saved them a precious bit I suppose,
although they then proceeded to waste 2 bits by limiting it to 2000... Anyway,
for example, say you have a treasure value of 275.  Divide it by 2, then round
down, giving you 137.  In binary, this is 0000 1001 0001.  So, you will turn on
Treasure0 (Digit 8, bit 4), Treasure4 (Digit 4, bit 3), and Treasure7 (Digit 7,
bit 3).  Keeping in mind checksums and annoyances, of course.

Maximum passwordable treasure is 1998, which corresponds to 999 =
0011 1110 0111.  If you don't care about potentially reaching 3200, you may as
well stick with 1600 treasure to keep your password usable as long as possible,
which would be 800 = 0011 0010 0000.  (However, if you start with 1998 treasure
in room 5, 3200 is pretty well within reach!)


*************
*** Tools ***
*************

"Tools".  A word applied when I realized the game combines keys and bombs just
to save 1 bit.  Here's the equation:

      Tools Value = Keys * 11 + Bombs

So if you have 5 keys and 4 bombs, your tools value will be 5*11 + 4 = 59.  In
binary, that will be 0111011.  Set Tools bits 0, 1, 3, 4, and 5.

Max tools, 10 keys and 10 bombs, would be 10*11 + 10 = 120, or 1111000 in
binary.  Set Tools bits 3-7.


************
*** Room ***
************

Only rooms after treasure rooms can be accessed via password.  Here's the
rundown:

Room #    Room Rank   Binary
  5           1        00001
  9           2        00010
 14           3        00011
 20           4        00100
 25           5        00101
 30           6        00110
 37           7        00111
 42           8        01000
 50           9        01001
 56          10        01010
 63          11        01011
 68          12        01100
 72          13        01101
 79          14        01110
*93          15        01111

Room 93, which is after the only treasure room in world 5, cannot be accessed
via password.  No KNOWN way, at least!


**************
*** Player ***
**************

The 2 player bits.  Pretty straightforward.

Warrior  = 00
Valkyrie = 01
Wizard   = 10
Elf      = 11

Just remember to pay attention to the bit ordering on the chart.  Valkyrie and
Wizard may seem backward, but they aren't.


*************************
*** Vault Combination ***
*************************

As explained previously, there are 32 vault combinations, adjusted solely by
the value of password digit 1 (the bitmask.)  Here is a complete list of the
vault combinations, painstakingly gathered by "FODA" and verified by me, using
a C program I wrote (which uses the bit-flipping method, applied to the vault
combo by "DarkCecil")

Digit 1	Bitmask	Vault Combo

A code:	00000		PYMKFERH* ('A' passwords do not work!)
B code:	00001		RXLIEFPG
C code:	00010		N1KMHGOF
D code:	00011		OZILGHNE
E code:	00100		LTROBAMD
F code:	00101		MSPNABLC
G code:	00110		IWORDCKB
H code:	00111		KUNPCDIA
I code:	01000		G7DBONHR
K code:	01001		H6CANOGP
L code:	01010		E9BDRPFO
M code:	01011		F8ACPREN
N code:	01100		C3HFKIDM
O code:	01101		D2GEIKCL
P code:	01110		A5FHMLBK
R code:	01111		B4EGLMAI
S code:	10000		8F53YX91
T code:	10001		9E42XY8Z
U code:	10010		6H351Z7Y
W code:	10011		7G24Z16X
X code:	10100		4B97TS5W
Y code:	10101		5A86ST4U
Z code:	10110		2D79WU3T
1 code:	10111		3C68UW2S
2 code:	11000		ZOWT7619
3 code:	11001		1NUS67Z8
4 code:	11010		XRTW98Y7
5 code:	11011		YPSU89X6
6 code:	11100		UK1Y32W5
7 code:	11101		WIZX23U4
8 code:	11110		SMY154T3
9 code:	11111		TLXZ45S2

I'd suggest using the 'B' combination or similar, since with a B bitmask you'll
only have to flip the checksum bits in your password.  Remember, 'A' passwords
DO NOT WORK!

So that's it!  You're ready to make your password!  Go!  Go do it!  ...Oh, fine.
I'll just list the best passwords myself.  (Why did I type all this out then?)


****************************
*** Ultimate Passwords!! ***
****************************

All use the 'S' vault combination, which again is 8F53YX91.
All have max (1998) treasure, 10 keys, 10 bombs, and all power-ups.

Warrior   L5: S4C-BII-OOO
Valkyrie  L5: S4C-BII-OPO
Wizard    L5: S4C-BII-OOP
Elf       L5: S4C-BII-OPP

Warrior  L20: S4B-CII-OOO
Valkyrie L20: S4B-CII-OPO
Wizard   L20: S4B-CII-OOP
Elf      L20: S4B-CII-OPP

Warrior  L42: S4B-BIM-OOO
Valkyrie L42: S4B-BIM-OPO
Wizard   L42: S4B-BIM-OOP
Elf      L42: S4B-BIM-OPP

Warrior  L63: S4C-CIM-OOO
Valkyrie L63: S4C-CIM-OPO
Wizard   L63: S4C-CIM-OOP
Elf      L63: S4C-CIM-OPP

Warrior  L79: S4B-CMM-OOO
Valkyrie L79: S4B-CMM-OPO
Wizard   L79: S4B-CMM-OOP
Elf      L79: S4B-CMM-OPP

Woo.  Now I guess I should try to beat the game, eh... :)


************************
*** Acknowledgements ***
************************

- Thanks to 'DarkCecil' (PrismSoft2@aol.com) for pointing out the method for 
  deriving the Vault Codes!
- Thanks to 'FODA' (nesrocks@gmail.com) for providing a complete list of
  Vault Codes and other stuff!