G.I. Joe: A Real American Hero Password Hacking Guide by Passgener Version 1.0 (29 December 2009) Check GameFaqs.com for latest version! === Contents ================================================================== [1] Important! Read me first! [2] About this guide [3] Raw (unencoded) data format [4] Encoding a password [5] Example [6] Ready-Made Passwords! [7] Legal === [1] Important! Read me first! ============================================= Section 6 of this guide contains a ready-made set of 'ultimate' passwords. I'm saying this up front since I don't want anyone to decide they aren't interested in this guide before they find out this information which is still probably useful to some people who wouldn't otherwise care. === [2] About this guide ====================================================== The purpose of this guide is to explain the secrets behind the password system for the G.I. Joe NES game. I simply want this information to be known since there are certain individuals such as myself that might find it interesting. More generally, this simply allows you to create customized passwords for the game provided you have a basic understanding of binary numbers; if you don't then see section 6. This guide explains the format and encoding of the passwords in a straight forward but still firmly technical manner. When I originally decided to hack this system I thought that once I figured it out I could write a guide in a non-technical manner that would allow anyone to generate their own passwords. Once I figured out the system though I decided that certain aspects of it really required a basic understanding of binary numbers and so trying to explain it a non-technical manner would probably make it more convoluted than it really needed to be. As for the motivation for this guide, I've already mentioned that this information is of interest to individuals like me. By that I simply mean people who are interested in video games that have password systems. This game in particular is interesting to me because it was the first or one of the first games I ever played that had a password system and had always wanted to figure out how the passwords worked. Of course, back in grade school, when the game was new, I simply hadn't acquired the necessary skill to be able to decipher how they worked but now, in late 2009, I'm much smarter and cooler than I was back then. :) The mood just hit me one day and I thought it would be fun to give it a try again so I fired up the NES and the end result is this guide. === [3] Raw (unencoded) data format =========================================== In its raw form a G.I. Joe password consists of nine 4-bit values each one corresponding to one character of the password. Here's a bit map for the basic format (the left-most bit in each value is the most significant bit): aaaa bbcc ddee ffgg hhii jjkk llmm nnoo pppp Bits Meaning ---------------------------------------------- aaaa Mission number bb Quest number cc Unknown; probably unused dd Duke's stamina ee Duke's weapon level ff Blizzard's additional stamina gg Blizzard's weapon level hh Snake Eye's additional stamina ii Snake Eye's weapon level jj Captain Grid-Iron's additional stamina kk Captain Grid-Iron's weapon level ll Rock & Roll's additional stamina mm Rock & Roll's weapon level nn General Hawk's additional stamina oo General Hawk's weapon level pppp checksum value Each group of the same letter in the map represents a single 2-bit or 4-bit value. The mission number wastes some space since only six values are used in a full 4-bit value. If the password contains any value other than those listed below then the game will reject the password even if it is otherwise valid: Bits Meaning ---------------------------------------------- 0001 Mission 1 0010 Mission 2 0011 Mission 3 0100 Mission 4 0101 Mission 5 0110 Mission 6 The quest number is the upper two bits of the second 4 bit value. If the password contains any value other than those listed below then the game will reject the password even if it is otherwise valid: Bits Meaning ---------------------------------------------- 00 First quest 01 Second quest 10 Third quest The lower two bits of the second 4-bit value appear to be unused but I can't be absolutely sure. The game will accept any of the four possible values and they appear to have no effect. The third, fourth, fifth, sixth, seventh and eight 4-bit values contain the weapon and stamina data for Duke, Blizzard, Snake Eyes, Captain Grid-Iron, Rock & Roll and General Hawk, respectively. The upper four two bits are the additional stamina. This 2-bit value just gets added to the base stamina for the character to get the total stamina. Note that the character selection screen always shows the base stamina regardless of the modifier from the password. The lower two bits are the weapon level for the character: Bits Meaning ---------------------------------------------- 00 Level 1A 01 Level 2A 10 Level 3A 11 MAX Make note of the fact that there is a slot in the password for General Hawk. This is interesting since you can only use General Hawk in Mission 6 and his stats do not carry over between quests. To me this suggests that, originally, the developers were planning on making him available on other stages but decided later not to. I have no proof of this but can't imagine why else there would be data for him in the password. I don't believe the game will ever give you a password were Hawk has anything other than base stats but it will happily accept a password where his stats are higher. The last value is a check digit and how to calculate it is covered in the next section. === [4] Encoding a password =================================================== Encoding a password from the raw data requires several steps. First layout your raw data in nine 4-bit values as described in section 3. Next add the position number of each value to the value itself starting from the left going to the right where the first value is considered position 0. Skip the checksum value at the end (position 8) and leave it as value zero. If the resulting value is more than 4-bits (i.e. greater than 15) then simply throw out the upper bits and keep only the lower four (e.g. 2 + 15 = 1). For example, if you started out with all 9 nine values being zero and performed this step then you'd end up with these nine values: 0000 0001 0010 0011 0100 0101 0110 0111 0000 To compute the checksum, first set the checksum value (position 8) to zero. Then process each value in order as follows starting from the left and moving right. For each value, add the value to the checksum (position 8) and then rotate the bits of the checksum left once. Rotating the bits left means basically to shift all the bits in the value up in value but the most significant bit loops around and becomes the least significant bit. If that doesn't make sense then just use this map: abcd -> bcda The last step is just to convert the 4-bit numbers to the characters of the password. This is complicated by the fact that a different set of characters is used depending on the value of the two lower bits of the checksum. Don't change the value of the checksum at this point but just look at the two lower bits. Next, run through each of the first eight values (ignore the checksum for now) and use the appropriate table to convert each value to a character. +-----------+---------------------------+ | | Checksum value | | Raw Value | xx00 | xx01 | xx10 | xx11 | +-----------+------+------+------+------+ | 0000 | 3 | V | H | Z | | 0001 | S | Z | 3 | R | | 0010 | P | D | 6 | B | | 0011 | N | 3 | 9 | J | | 0100 | 5 | 9 | N | 0 | | 0101 | X | N | 5 | V | | 0110 | G | 5 | X | D | | 0111 | Z | X | G | 8 | | 1000 | R | S | Z | 5 | | 1001 | D | G | R | H | | 1010 | B | 8 | D | 3 | | 1011 | 2 | B | V | S | | 1100 | 0 | 2 | 8 | 9 | | 1101 | H | R | 0 | N | | 1110 | V | 0 | B | X | | 1111 | 8 | Q | 2 | G | +-----------+------+------+------+------+ Finally, use this table to convert the checksum value to a character and the password is completely encoded and ready to use. Checksum Character ---------------------------------------------- 0000 0 0001 1 0010 2 0011 3 0100 4 0101 5 0110 6 0111 7 1000 8 1001 9 1010 B 1011 C 1100 D 1101 F 1110 G 1111 H === [5] Example =============================================================== As an example, let's say we want to start playing from Mission 3 on the second quest with Snake Eyes maxed out. First we'll layout this raw data: 0011 0100 0000 0000 1111 0000 0000 0000 0000 Next, we'll run through and add the position number of each value to the value: 0011 0101 0010 0011 0011 0101 0110 0111 0000 Now that that's done we can compute the checksum (remember to add then rotate each time): 0011 0101 0010 0011 0011 0101 0110 0111 1000 Then convert each of the first eight values to characters using the first table from section 4: N X P N N X G Z 1000 Finally, use the second table from section 4 to convert the checksum value to a character and we have a complete password: NXPNNXGZ8 === [6] Ready-Made Passwords! ================================================= I know there are a few people who will find this guide interesting but I figure most people just want passwords with max stats and really don't care about or want to actually encode the passwords themselves. To that end, this section lists "ultimate" passwords for each mission and quest with all the character stats set to their maximums. Quest Mission Password ---------------------------------------------- 1 1 RRRBJ0VD7 1 2 PSSPN5XG0 1 3 3ZZD39N55 1 4 N3369N5XB 1 5 NZZD39N59 1 6 X3369N5XG 2 1 ZNZD39N55 2 2 65369N5XB 2 3 3NZD39N59 2 4 N5369N5XG 2 5 VVRBJ0VD3 2 6 X5369N5X6 3 1 ZGZD39N59 3 2 6R369N5XG 3 3 JHRBJ0VD3 3 4 NR369N5X6 3 5 VHRBJ0VD7 3 6 GDSPN5XG0 It also occurs to me that some people might want the opposite extreme where all the characters have basic stats so here are those passwords as well: Quest Mission Password ---------------------------------------------- 1 1 RRBJ0VD8C 1 2 6369N5XG6 1 3 3ZD39N5XF 1 4 5SPN5XGZ8 1 5 5369N5XGG 1 6 DRBJ0VD8H 2 1 ZND39N5XF 2 2 PXPN5XGZ8 2 3 9569N5XGG 2 4 0VBJ0VD8H 2 5 NND39N5X9 2 6 GXPN5XGZD 3 1 3R69N5XGG 3 2 BHBJ0VD8H 3 3 3GD39N5X9 3 4 5DPN5XGZD 3 5 VHBJ0VD8C 3 6 XR69N5XG6 If you want any others then you are on your own. === [7] Legal ================================================================= I, the author of this document, make no claim of copyright or responsibility to the content therein. You are free to use and distribute it as you see fit and do so entirely at your own risk. ===============================================================================