hide results

    Password Crack FAQ by TurboCMinusMinus

    Version: 1.2 | Updated: 07/06/05 | Search Guide | Bookmark Guide

    NES Gauntlet Password Crack FAQ  v1.2
    Cracked on 7/9/04 by Bill Thomas (particle-man@comcast.net)
    Updated: 7/12/04 (3200 Treasure info)
    Updated: 7/7/05 (Complete Vault Codes!! & more 'A' password info)
    
      (1)     (2)      (3)      (4)      (5)      (6)      (7)      (8)      (9)
    |-----|--------|--------|--------|--------|--------|--------|--------|--------|
    | . . |4:Unk.=0|4:Shot  |4:Speed |4:Magic |4:Fight |4:Armor |        |        |
    |V . .|        |        |        |        |        |        |4:Treas0|4:Treas1|
    | a . |3:Treas2|3:Treas3|3:Treas4|3:Treas5|3:Treas6|3:Treas7|3:Treas8|3:Treas9|
    |. u .|2:Tr10=0|2:Tr11=0|        |        |        |        |        |        |
    | . l |        |        |2:Tools0|2:Tools1|2:Tools2|2:Tools3|2:Tools4|2:Tools5|
    |C . t|1:Tools6|        |        |        |        |        |        |        |
    | o . |        |1:Room0 |1:Room1 |1:Room2 |1:Room3 |1:Room4=0        |        |
    |. m .|        |        |        |        |        |        |        |        |
    | . b |        |        |        |        |        |        |1:Plyr0 |1:Plyr1 |
    |. . o|        |        |        |        |        |        |        |        |
    | . . |0:CHKSUM|0:CHKSUM|0:CHKSUM|0:CHKSUM|0:CHKSUM|0:CHKSUM|0:CHKSUM|0:CHKSUM|
    |-----|--------|--------|--------|--------|--------|--------|--------|--------|
    
    Above is a bit-chart of the NES Gauntlet password.  Each digit in the password
    contains 5 bits (0 through 4).  In binary, 'bit 0' refers to the least-
    significant or rightmost bit; bit 4 is leftmost of the 5.  5 bits per digit
    means 2^5 = 32 characters available for each digit.  Here's the character set
    and corresponding bits:
    
    Password Digit    Binary Equivalent   Password Digit    Binary Equivalent
          A                 00000               S                 10000
          B                 00001               T                 10001
          C                 00010               U                 10010
          D                 00011               W                 10011
          E                 00100               X                 10100
          F                 00101               Y                 10101
          G                 00110               Z                 10110
          H                 00111               1                 10111
          I                 01000               2                 11000
          K                 01001               3                 11001
          L                 01010               4                 11010
          M                 01011               5                 11011
          N                 01100               6                 11100
          O                 01101               7                 11101
          P                 01110               8                 11110
          R                 01111               9                 11111
                            ^   ^
                            |   |
                        bit 4   bit 0
    
    Once you understand what each bit does, to create or change a password, all you
    need to do is set/modify the proper bits.  For example, to give yourself extra
    shot power, simply turn on bit 4 (leftmost bit) of the third digit in the pass-
    word!  Well, it's not QUITE that simple.  :)  Let's go through each part of the
    password step by step.
    
    
    *****************************
    *** Digit 1 - The Bitmask ***
    *****************************
    
    The first digit is basically a exclusive-or bitmask, which modifies all of the
    other digits in the password.  (This is explained in the next section.)  This 
    digit is simply protection against password cracking.  :D  But in a way, it also
    references the vault combination you will need to beat the game.  The actual
    8-digit vault combination isn't contained in your password, but is stored in the
    game code.  There is only really one vault combo, but it is masked by the first
    password digit.  For example, the 'A' (00000) vault combo is PYMKFERH.  All
    passwords that begin with 'A' will have that same vault combo.  If your password
    begins with 'B' (00001), your vault combo is RXLIEFPG.  This is actually the 'A'
    vault combo which has had its bit-0 masked (exclusive OR'ed).  All the 32 vault
    combos are listed later on.
    
    However, there is another fine issue with the first digit.  Passwords that begin
    with 'A' - DON'T WORK!  Undoubtedly this was done to make sure there is always a
    bitmask of some kind, to help disguise the password's contents.  However, guess
    what?  The game WILL give out 'A' passwords!  (Thanks to "FODA" for pointing
    this out.)  Isn't that friendly?  The bitmask value seems to be randomly chosen
    at the game start.  So, you have a 1/32 chance of getting an 'A' password, and 
    this password will never, ever work.  High-quality coding, I say.  Moving on...
    
    
    *********************************************************
    *** Digits 2-9 Intro, Power-ups & Checksum Annoyances ***
    *********************************************************
    
    Digits 2-9 contain all of the other game information, such as items, room #, and
    type of player.  As shown in the chart, bit 4 in digits 3-7 control the 5 power-
    ups (shot, speed, magic, fight, armor.)  There's an unused bit 4 in digit 2;
    perhaps this was an unused power-up?  Who knows.  (This unused bit must always
    be 0.)  In any case, to activate a power-up, simply set the bit to a 1.
    However, there are 2 issues to address.  The first is the CHECKSUM (bit 0,
    digits 2-9).  In digits 2-9, all 5 bits must add up to be even.  The checksum
    bit changes to ensure that (and to prevent password tampering! :)  So, if you
    change bit 4 from 0 to 1, you must also reverse the checksum to compensate.  For
    example, if you started with a 'D' (00011), and you wanted to turn on bit 4, you
    must change it to a 'U' (10010), NOT a 'W' (10011).  Otherwise you would be
    changing the even/odd result.  Easy enough, right?
    
    Unfortunately, there's a second layer of protection (annoyance) applied on top
    of this.  It involves digit 1 - the bitmask, remember?  So what's an "exclusive-
    or bitmask", anyway?  Essentially, for every bit in digit 1 which is a 1, every
    other matching bit in digits 2-9 are FLIPPED.  I'll give an example.
    
    Let's say you've used the chart to set the item bits you want, and your
    resultant digit 3 is a '5' (11011).  However, your bitmask digit 1 is a 'P'
    (01110).  See the 1's there?  You will have to FLIP bits 1, 2, and 3 in ALL of
    the other password digits.  So instead of a '5' (11011) for digit 3, you must 
    flip the center 3 bits, and will end up with a 'Y' (10101).  Remember, this
    applies AFTER the checksum.  There are probably other ways to visualize the
    binary math.  If you're dealing with an existing password, the relevant bits
    will be flipped to begin with.  So to change an existing password, such as
    turning on shot power, simply FLIP the relevant bit 4 and also the checksum.
    No other thinking required!
    
    
    ****************
    *** Treasure ***
    ****************
    
    Now THIS is an interesting one.  Much pain, anguish and controller damage has
    been caused by the Gauntlet treasure system.  But now its secrets will be
    REVEALED!!!  (muhahaha...)  May as well tackle the big issue right off the bat:
    
     ANY PASSWORD CONTAINING A TREASURE VALUE OF 2000 OR GREATER WILL NOT WORK!!!!
    
    So that time you swore blind that you wrote the password down correctly, which
    subsequently refused to ever work, well, maybe you did.  The game feels happy
    and content to generate passwords for you with treasure values 2000 or greater.
    It just won't ACCEPT them.  :P  There's even a whole bit (perhaps 2) reserved
    in the password for treasure values of 2048 and (perhaps) 4096.  But, they are
    completely useless and must always be set to 0.  (I KNOW the 2048 treasure bit
    IS indeed what it is.  The 4096 bit I am just guessing on, but you can see the
    bit layout for yourself.)  And yes, the cutoff is 2000 and not 2048.  I've
    tested it.  You can probably accumulate at least 8191 treasure in the game or
    more, but you can never password it.  Well, you CAN, but the passwords will
    never work.  :P  
    
    **UPDATE** Just managed to get 3200 treasure.  Getting 3200 treasure DOES raise
    your max HP.  However, there seems to be a max HP cutoff of 1600.  So, the elf
    will only gain an extra 60 HP by getting 3200 treasure.  It would be more worth
    it for the other characters, I guess.  
    
    Another issue with the treasure is, the password rounds your treasure down to
    the nearest 2 (it ignores the LSB.)  This saved them a precious bit I suppose,
    although they then proceeded to waste 2 bits by limiting it to 2000... Anyway,
    for example, say you have a treasure value of 275.  Divide it by 2, then round
    down, giving you 137.  In binary, this is 0000 1001 0001.  So, you will turn on
    Treasure0 (Digit 8, bit 4), Treasure4 (Digit 4, bit 3), and Treasure7 (Digit 7,
    bit 3).  Keeping in mind checksums and annoyances, of course.
    
    Maximum passwordable treasure is 1998, which corresponds to 999 =
    0011 1110 0111.  If you don't care about potentially reaching 3200, you may as
    well stick with 1600 treasure to keep your password usable as long as possible,
    which would be 800 = 0011 0010 0000.  (However, if you start with 1998 treasure
    in room 5, 3200 is pretty well within reach!)
    
    
    *************
    *** Tools ***
    *************
    
    "Tools".  A word applied when I realized the game combines keys and bombs just
    to save 1 bit.  Here's the equation:
    
          Tools Value = Keys * 11 + Bombs
    
    So if you have 5 keys and 4 bombs, your tools value will be 5*11 + 4 = 59.  In
    binary, that will be 0111011.  Set Tools bits 0, 1, 3, 4, and 5.
    
    Max tools, 10 keys and 10 bombs, would be 10*11 + 10 = 120, or 1111000 in
    binary.  Set Tools bits 3-7.
    
    
    ************
    *** Room ***
    ************
    
    Only rooms after treasure rooms can be accessed via password.  Here's the
    rundown:
    
    Room #    Room Rank   Binary
      5           1        00001
      9           2        00010
     14           3        00011
     20           4        00100
     25           5        00101
     30           6        00110
     37           7        00111
     42           8        01000
     50           9        01001
     56          10        01010
     63          11        01011
     68          12        01100
     72          13        01101
     79          14        01110
    *93          15        01111
    
    Room 93, which is after the only treasure room in world 5, cannot be accessed
    via password.  No KNOWN way, at least!
    
    
    **************
    *** Player ***
    **************
    
    The 2 player bits.  Pretty straightforward.
    
    Warrior  = 00
    Valkyrie = 01
    Wizard   = 10
    Elf      = 11
    
    Just remember to pay attention to the bit ordering on the chart.  Valkyrie and
    Wizard may seem backward, but they aren't.
    
    
    *************************
    *** Vault Combination ***
    *************************
    
    As explained previously, there are 32 vault combinations, adjusted solely by
    the value of password digit 1 (the bitmask.)  Here is a complete list of the
    vault combinations, painstakingly gathered by "FODA" and verified by me, using
    a C program I wrote (which uses the bit-flipping method, applied to the vault
    combo by "DarkCecil")
    
    Digit 1	Bitmask	Vault Combo
    
    A code:	00000		PYMKFERH* ('A' passwords do not work!)
    B code:	00001		RXLIEFPG
    C code:	00010		N1KMHGOF
    D code:	00011		OZILGHNE
    E code:	00100		LTROBAMD
    F code:	00101		MSPNABLC
    G code:	00110		IWORDCKB
    H code:	00111		KUNPCDIA
    I code:	01000		G7DBONHR
    K code:	01001		H6CANOGP
    L code:	01010		E9BDRPFO
    M code:	01011		F8ACPREN
    N code:	01100		C3HFKIDM
    O code:	01101		D2GEIKCL
    P code:	01110		A5FHMLBK
    R code:	01111		B4EGLMAI
    S code:	10000		8F53YX91
    T code:	10001		9E42XY8Z
    U code:	10010		6H351Z7Y
    W code:	10011		7G24Z16X
    X code:	10100		4B97TS5W
    Y code:	10101		5A86ST4U
    Z code:	10110		2D79WU3T
    1 code:	10111		3C68UW2S
    2 code:	11000		ZOWT7619
    3 code:	11001		1NUS67Z8
    4 code:	11010		XRTW98Y7
    5 code:	11011		YPSU89X6
    6 code:	11100		UK1Y32W5
    7 code:	11101		WIZX23U4
    8 code:	11110		SMY154T3
    9 code:	11111		TLXZ45S2
    
    I'd suggest using the 'B' combination or similar, since with a B bitmask you'll
    only have to flip the checksum bits in your password.  Remember, 'A' passwords
    DO NOT WORK!
    
    So that's it!  You're ready to make your password!  Go!  Go do it!  ...Oh, fine.
    I'll just list the best passwords myself.  (Why did I type all this out then?)
    
    
    ****************************
    *** Ultimate Passwords!! ***
    ****************************
    
    All use the 'S' vault combination, which again is 8F53YX91.
    All have max (1998) treasure, 10 keys, 10 bombs, and all power-ups.
    
    Warrior   L5: S4C-BII-OOO
    Valkyrie  L5: S4C-BII-OPO
    Wizard    L5: S4C-BII-OOP
    Elf       L5: S4C-BII-OPP
    
    Warrior  L20: S4B-CII-OOO
    Valkyrie L20: S4B-CII-OPO
    Wizard   L20: S4B-CII-OOP
    Elf      L20: S4B-CII-OPP
    
    Warrior  L42: S4B-BIM-OOO
    Valkyrie L42: S4B-BIM-OPO
    Wizard   L42: S4B-BIM-OOP
    Elf      L42: S4B-BIM-OPP
    
    Warrior  L63: S4C-CIM-OOO
    Valkyrie L63: S4C-CIM-OPO
    Wizard   L63: S4C-CIM-OOP
    Elf      L63: S4C-CIM-OPP
    
    Warrior  L79: S4B-CMM-OOO
    Valkyrie L79: S4B-CMM-OPO
    Wizard   L79: S4B-CMM-OOP
    Elf      L79: S4B-CMM-OPP
    
    Woo.  Now I guess I should try to beat the game, eh... :)
    
    
    ************************
    *** Acknowledgements ***
    ************************
    
    - Thanks to 'DarkCecil' (PrismSoft2@aol.com) for pointing out the method for 
      deriving the Vault Codes!
    - Thanks to 'FODA' (nesrocks@gmail.com) for providing a complete list of
      Vault Codes and other stuff!

    FAQ Display Options: Printable Version