------------------------------------------------------------------------------- | Metroid Password Format Guide | by John David Ratliff | | The most recent version of this guide can always be found at | http://games.technoplaza.net/mpg/password.txt | | Copyright (C) 2005,2012 emuWorks (http://games.technoplaza.net/) | Permission is granted to copy, distribute and/or modify this document | under the terms of the GNU Free Documentation License, Version 1.2 | or any later version published by the Free Software Foundation; | with no Invariant Sections, no Front-Cover Texts, and no Back-Cover | Texts. A copy of the license can be found at | http://www.gnu.org/licenses/fdl.html ------------------------------------------------------------------------------- ------------------------------------------------------------------------------- | Table of Contents ------------------------------------------------------------------------------- 1.0 Introduction 2.0 Copyright Notice 3.0 Revision History 4.0 Password Data 4.1 Basics 4.2 The Metroid Alphabet 4.3 The Checksum 4.4 The Shift Byte 4.5 Known Password Bits 4.6 Encoding 4.7 Decoding 4.8 The Debug Password 5.0 mpg - The Metroid Password Generator 6.0 Credits & Acknowledgments 7.0 Contact Information ------------------------------------------------------------------------------- | 1.0 Introduction ------------------------------------------------------------------------------- This document is a guide to the password system used by Metroid for the NES. It applies to the original Metroid 1 released in the US and Europe. I believe the information is also accurate for the hidden Metroid 1 game that can be unlocked in Metroid Prime, and for Metroid Zero Mission for Game Boy Advance. I have only tested the information with the original Metroid for the US version of Metroid. Please contact me if you find anything to be inaccurate, either as it applies to the Metroid 1 for the NES or any of the others mentioned. This guide is not a walkthrough for Metroid, and will probably not really help you create passwords. This guide is a document describing the password format for anyone who may be interested in it. I'm writing it because there doesn't seem to be any document to describe the password format in and of itself. The only thing close is the documentation contained with SnoBro's metroid password generator (MetCode) and its source code. If you just want to create passwords, I suggest using a password generator. There are several choices, but because I have written one, it's the one I'm going to recommend. You can find my program, mpg (Metroid Password Generator), on emuWorks at http://games.technoplaza.net/mpg/. I wrote the program to help me learn about the password format so that I could write this document. ------------------------------------------------------------------------------- | 2.0 Copyright Notice ------------------------------------------------------------------------------- This document is Copyright (C) 2005,2012 emuWorks (http://games.technoplaza.net/) Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license can be found at http://www.gnu.org/licenses/fdl.html Basically, it is free documentation in much the same way software under the GNU General Public License is free software. You can modify it, redistribute it, sell it, publish it, etc. ------------------------------------------------------------------------------- | 3.0 Revision History ------------------------------------------------------------------------------- Version 1.1 - Tuesday, June 19, 2012 - Minor typo and grammar corrections - Rewrote explanation of the checksum in [4.3, 4.6] to remove ambiguity - Rewrote explanation of bit rotation in [4.6, 4.7] for clarity Version 1.0 - Friday, September 30, 2005 - First Public Release ------------------------------------------------------------------------------- | 4.0 Password Data ------------------------------------------------------------------------------- This is the important section. It covers the details of the Metroid password format. ------------------------------------------------------------------------------- | 4.1 Basics ------------------------------------------------------------------------------- The Metroid Password is a string of 24 characters in the Metroid Alphabet. The password string is an encoded 144-bit data field, with 128 bits reserved for game data, 8 bits for the checksum, and 8 bits for the shift byte. Each character in the password represents 6 bits of the password (24 * 6 bits = 144 bits). To obtain the contiguous 144-bits, you will need to string the character bits together. After this has been done, you can perform operations on the comprising 18 individual bytes. There are 12 bits of the password data whose function is currently unknown. It is probable that some of the bits are unused. I have seen one in use, but have yet to discover it's function. If you learn the function of any of the bits marked Unknown in the document, I would very much appreciate an email. The remaining 116 bits are used to store data about the game. This data includes how many missiles Samus is carrying, what equipment Samus has in her inventory (Long Beam, Maru Mari, etc), which missile containers Samus has picked up, which energy tanks Samus has collected, how long the game has been played, which red and yellow doors have been opened, Samus' starting location, which statues have been raised, if Samus is wearing her space suit or her swimsuit, which zebetites have been destroyed, and finally which bosses have been killed. The password can be encrypted using a shift value, which is not part of the 128-bit password data. It comprises the 8-bits just following the password data. More about the shift byte will be said in 4.4 The Shift Byte. The final 8 bits are the checksum, which is the first 136-bits added together. This provides Metroid a way to ensure that a valid password is being entered. Because the checksum is the same for every unique combination of the first 136 bits, there are 2^136 valid Metroid passwords, which is approximately 8.7112285931760246646623899502533e+40 passwords. Many of them are functionally equivalent. ------------------------------------------------------------------------------- | 4.2 The Metroid Alphabet ------------------------------------------------------------------------------- Passwords, as well as all text in the game are comprised from an alphabet of 65 characters, which include the entire alphabet A-Z (both upper and lower case), the numbers 0-9, and the characters dash (-), question mark (?), and space ( ). Each character has a distinct value in a Metroid password, and they are ordered as follows: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz?- The space character, which is at the end carries a special value of 255. The remaining characters are all numbered from 0-63. In other words, the Metroid character 'C' has a value of 13. These values are used to decode the password into raw bit values. Because (with the exception of space), they can all be expressed in 6-bits. You may think that this means a space has the same value as the dash, but this is not entirely true. Because of the way the data is converted from 6-bit values to 8-bit values (it is not simply strung together), the space can introduce it's high 2 bits over the lower order bits of the character which preceeded it. This means the space has the potential to alter the character which came before it. This will be discussed more in 4.7 Decoding. ------------------------------------------------------------------------------- | 4.3 The Checksum ------------------------------------------------------------------------------- Metroid passwords use a simple checksum to confirm their authenticity as a valid Metroid password. The last 8-bits (1 byte) comprises the checksum. To calculate the checksum for a password, add together the first 17 individual bytes (136 bits) together. Take the lowest 8-bits of this value and you have the 1 byte (8 bit) checksum. The checksum is not a perfect means of validation. It can only do a glib test stating that the data is likely to be what you meant to enter. ------------------------------------------------------------------------------- | 4.4 The Shift Byte ------------------------------------------------------------------------------- The 17th byte (bits 128-135) comprises the shift byte. It is used to encrypt the password. Basically, when the password is encoded, bits are rotated from one byte to the next and the bit rotated off the last byte goes onto the first byte. The shift byte determines how many times this bit rotation occurs. So, a value of 0 means the password is not encrypted at all. The method for bit rotation will be covered in 4.6 Encoding and 4.7 Decoding. ------------------------------------------------------------------------------- | 4.5 Known Password Bits ------------------------------------------------------------------------------- This section lists all the bits in the 128-bit password data that are known. I with I could be more specific about the locations of missile containers, energy tanks, and certain red doors, but without a good point of refernece (like a public map), this is difficult to do. There is another password generator written in Flash that contains a map and does a great job of telling you exactly where things are and which bit corresponds with what item. It is available at http://www.geocities.com/passgens/pages/metroid/metflash.htm. If you have Flash, and want to know specifics, I suggest you check it out. I'm going to list them in the order they exist in the password. Bit 0: Maru Mari Taken Bit 1: Missile Container (Brinstar) Bit 2: Red Door (Long Beam) Bit 3: Red Door (Tourian Bridge) Bit 4: Energy Tank (Brinstar) Bit 5: Red Door (Bombs) Bit 6: Bombs Taken Bit 7: Red Door (Ice Beam Brinstar) Bit 8: Missile Container (Brinstar) Bit 9: Energy Tank (Brinstar) Bit 10: Red Door (Varia) Bit 11: Varia Taken Bit 12: Energy Tank (Brinstar) Bit 13: Missile Container (Norfair) Bit 14: Missile Container (Norfair) Bit 15: Red Door (Ice Beam Norfair) Bit 16: Missile Container (Norfair) Bit 17: Missile Container (Norfair) Bit 18: Missile Container (Norfair) Bit 19: Missile Container (Norfair) Bit 20: Missile Container (Norfair) Bit 21: Missile Container (Norfair) Bit 22: Missile Container (Norfair) Bit 23: Red Door (High Jump Boots) Bit 24: High Jump Boots Taken Bit 25: Red Door (Screw Attack) Bit 26: Screw Attack Taken Bit 27: Missile Container (Norfair) Bit 28: Missile Container (Norfair) Bit 29: Red Door (Wave Beam) Bit 30: Energy Tank (Norfair) Bit 31: Missile Container (Norfair) Bit 32: Red Door (Kraid's Lair) Bit 33: Missile Container (Kraid's Lair) Bit 34: Missile Container (Kraid's Lair) Bit 35: Red Door (Kraid's Lair) Bit 36: Energy Tank (Kraid's Lair) Bit 37: Red Door (Kraid's Lair) Bit 38: Red Door (Kraid's Lair) Bit 39: Missile Container (Kraid's Lair) Bit 40: Missile Container (Kraid's Lair) Bit 41: Red Door (Kraid's Room) Bit 42: Energy Tank (Kraid's Room) Bit 43: Missile Container (Ridley's Lair) Bit 44: Red Door (Ridley's Lair) Bit 45: Energy Tank (Ridley's Lair) Bit 46: Missile Container (Ridley's Lair) Bit 47: Yellow Door (in Ridley's Room) Bit 48: Energy Tank (Room Behind Ridley) Bit 49: Missile Container (Ridley's Lair) Bit 50: Yellow Door (Tourian) Bit 51: Red Door (Tourian) Bit 52: Red Door (Tourian) Bit 53: Zebetite 1 Killed Bit 54: Zebetite 2 Killed Bit 55: Zebetite 3 Killed Bit 56: Zebetite 4 Killed Bit 57: Zebetite 5 Killed Bit 58: Mother Brain Killed Bit 59: Unknown Bit 60: Unknown Bit 61: Unknown Bit 62: Unknown Bit 63: Unknown Bit 64: Start in Norfair Bit 65: Start in Kraid's Lair Bit 66: Start in Ridley's Lair Bit 67: Reset Bit 68: Unknown Bit 69: Unknown Bit 70: Unknown Bit 71: Samus in Swimsuit Bit 72: Samus Has Bombs Bit 73: Samus Has High Jump Boots Bit 74: Samus Has Long Beam Bit 75: Samus Has Screw Attack Bit 76: Samus Has Maru Mari Bit 77: Samus Has Varia Bit 78: Samus Has Wave Beam Bit 79: Samus Has Ice Beam Bit 80: Missile Count (+1 Missile) Bit 81: Missile Count (+2 Missiles) Bit 82: Missile Count (+4 Missiles) Bit 83: Missile Count (+8 Missiles) Bit 84: Missile Count (+16 Missiles) Bit 85: Missile Count (+32 Missiles) Bit 86: Missile Count (+64 Missiles) Bit 87: Missile Count (+128 Missiles) Bit 88: Game Age (32-bit Value -- Low Bit) Bit 89: ... Bit 90: ... Bit 91: ... Bit 92: ... Bit 93: ... Bit 94: ... Bit 95: ... Bit 96: ... Bit 97: ... Bit 98: ... Bit 99: ... Bit 100: ... Bit 101: ... Bit 102: ... Bit 103: ... Bit 104: ... Bit 105: ... Bit 106: ... Bit 107: ... Bit 108: ... Bit 109: ... Bit 110: ... Bit 111: ... Bit 112: ... Bit 113: ... Bit 114: ... Bit 115: ... Bit 116: ... Bit 117: ... Bit 118: ... Bit 119: Game Age (32-bit Value -- High Bit) Bit 120: Unknown Bit 121: Unknown Bit 122: Unknown Bit 123: Unknown Bit 124: Ridley Killed Bit 125: Ridley Statue Raised Bit 126: Kraid Killed Bit 127: Kraid Statue Raised Most of these are obvious, but some require some additional explanation. The bits that say "XXX Taken", such as Maru Mari Taken, are used to determine whether the item will appear in the place it is supposed to be. If Samus doesn't have the Maru Mari (Bit 76), but Maru Mari is Taken (Bit 0), then Samus can never get the Maru Mari. All the beams (Long, Ice, and Wave) are always there. The game will not let you pick up the Ice Beam and Wave Beam simultaneously. If you pick up one, the other will deactivate. If you activate both bits yourself, you get a weird cross between the two beams. It doesn't seem to hurt the game. There are five valid start locations. They are specified using bits 64-66. To start in Brinstar, all the bits should be off. Norfair, Kraid's Lair, and Ridley's Lair can be specified by turning their bit on and leaving the others off. Tourian is specified by turning on Norfair and Kraid's Lair simultaneously. Any other combination of these three bits is invalid and will cause Metroid to reset. The reset bit is part of the start location. There are 16 possible values, but only 5 valid ones. Turning on the reset bit will produce and invalid start location and cause Metroid to reset. This is why it is called it is called the reset bit, because it guarantees an invalid password. If Mother Brain is dead, the door will already be there when you get to the end of Tourian. The bomb timer will not activate, and you will be able to spend as much time as you like escaping Tourian. The missile count is an 8-bit (1 byte) value ranging from 0-255. Just convert the number you want to binary and turn on the appropriate bits. The game age is a complicated number. It is a 32-bit value, though in reality, it only has a range of 2^24 * 208 because the least significant byte overflows at 208. This means there are 3,489,661,135 distinct values in the range 0 - 4,294,967,295. The game age is in what I will call 'game ticks'. The exact value of a tick depends upon whether you have an NTSC NES (the US Nintendo) or a PAL NES (the European Nintendo). If you have an NTSC NES, then 1 game tick = (256 / 60) seconds or approximately 4.2666666666666666666666666666667 seconds. For a PAL NES, 1 game tick = (256 / 50) seconds or 5.12 seconds. Where did these values come from? 1 game tick is actually the amount of time it takes to draw 256 frames. Because the NTSC NES draws 60 frames per second, you get (256 / 60). The PAL NES draws 50 frames per second, so you get (256 / 50). The difference is related to television signal differences between North American (NTSC) and Europe (PAL). ------------------------------------------------------------------------------- | 4.6 Encoding ------------------------------------------------------------------------------- Here comes the good part; taking the password data from its raw format and creating a Metroid password from it. The encode is a fairly simple process, although it involves a lot of tedious math. If you actually want to encode raw data, I highly recommend using a password generator, such as mpg (http://games.technoplaza.net/mpg/). The encoding process involves four steps. 1. Calculate the checksum 2. Encode the password data using the shift byte 3. Convert the 18 8-bit blocks to 24 6-bit blocks 4. Translate the 6-bit blocks into a readable password Step 1 - Calculate the Checksum Calculating the checksum is a fairly simple process. Take the first 17 bytes (136 bits) and add them together. The lowest byte (8 bits) of this value is the checksum. The checksum should be stored in the last byte (bits 136-143). Step 2 - Encode the Password Data Using the Shift Byte This is the part where the password gets encrypted using bit rotation. Here is how it works. Take the 16 bytes of the password as a 128 bit string. Shift all the bits one position to the right. The least significant bit that was shifted off wraps around to become the most significant bit. Do this x times, where x is the value of the shift byte. Step 3 - Convert the 18 8-bit Blocks to 24 6-bit Blocks Now that we have our password encoded using the shift byte, we can translate to the Metroid alphabet. Because each letter of the Metroid alphabet can be represented in 6-bits, the encoding process will never produce a password with spaces. You can read more about spaces in 4.7 Decoding. To convert from 8-bit blocks to 6-bit blocks, all we need to do is take every 6 bits in order. So just take your 144-bit string and separate it into 24 6-bit segments. Step 4 - Translate the 6-bit Blocks into a Readable Password Since each letter can be represented in 6-bits, converting between the 6-bit blocks and the english alphabet is trivial. Convert each 6-bit value to a decimal number, and take that as the offset from 0 in the Metroid alphabet. In other words, 000000 binary = 0 decimal = '0' 111111 binary = 63 decimal = '-' You can fill in the rest from 4.2 The Metroid Alphabet. That's all there is to it. The math is rote, but hard to do by hand. I highly recommend using a password generator if you want to actually encode Metroid passwords. ------------------------------------------------------------------------------- | 4.7 Decoding ------------------------------------------------------------------------------- Decoding is nearly a mirror image of encoding, but there are a couple of minor differences that are important to note. Decoding, like encoding, is a four step process. Just like encoding, I recommend using a password generator if you really want to decode Metroid passwords. 1. Convert the password to the Metroid alphabet 2. Convert the 24 characters to 18 8-bit blocks 3. Decode the password data using the shift byte 4. Verify the checksum Step 1 - Convert the Password to the Metroid Alphabet This is basically the same as step 4 in the original, but we have to be careful, because we are not dealing with 6-bit blocks here. Although 64 of the 65 characters in the Metroid alphabet can be represented in 6-bits, the final character (space) cannot. Therefore, we must use 24 8-bit blocks, rather than 6-bit blocks. All the characters use their same values except for space which uses 255. In a minute, we will see how this causes spaces in passwords to sometimes affect the character that came before it. Step 2 - Convert the 24 characters to 18 8-bit blocks. Although we have 8-bit blocks now, we need to have 18 contiguous 8-bit blocks, and since most of the characters (if any) won't be spaces, we will have the upper two bits of every character off. If you have no spaces in the password, then you can just remove the leading two bits from each character and create a 144-bit string. If you have spaces, it gets more complicated. The character that preceeds the space must be altered to have its lowest two bits turned on. After that, you can treat the space like a dash. If you take a look at the source code for mpg, you can glean a more mathematical reason for why you have to do this with spaces, but for this document, I'm just going to tell you that it has to be done. Step 3 - Decode the Password Data Using the Shift Byte This is the same process we did for encoding, but in reverse. Instead of rotating right, we rotate left, and we swap least significant bit and most significant bit. Here is the whole process. Take the 16 bytes of the password as a 128 bit string. Shift all the bits one position to the left. The most significant bit that was shifted off wraps around to become the least significant bit. Do this x times, where x is the value of the shift byte. Step 4 - Verify the Checksum Finally, we have our password data. Now we need to verify the checksum. All we have to do is calculate the checksum on the data we have, and make sure it's equal to byte 18 (bits 137-144). If not, then the password is not valid and will be rejected by Metroid. That's all there is to decoding. ------------------------------------------------------------------------------- | 4.8 The Debug Password ------------------------------------------------------------------------------- One password, which I will call the debug password, and is also known as the NAR PASSWORD, is a special password which does not use the shift byte or the checksum. This is because it is hard coded into Metroid and the password data has no meaning. It simply triggers a debugging mode in Metroid that was used to help test the US version of the game. The NAR PASSWORD, which if written completely is NARPAS SWORD0 0000 The last 8 characters can be anything and are not checked at all. This is because 16 * 6 = 96 bits = 12 bytes = 3 quads. I don't know if this is specifically why you need the last 5 zeros, but it is my theory. Why 3 quads? I don't know, but it's a nice number from a computer science point of view. If not 3 quads, then 12 characters which would be 12 * 6 = 72 bits = 9 bytes would have been pretty easy to check in 6502 assembly. It is also possible they simply wanted to restrict the number of passwords that would trigger debug mode, and requiring 5 zeros at the end is one way it could have been done. However, if that is the reason, why not require they all be zeros? Why have any wildcard characters at all? Blanks are interpreted as 0's in the Metroid password screen, so you never need to enter more than NARPAS SWORD anyways. (That's blank, meaning no character present, not space, which looks identical to, but is interpreted very differently from a blank). What does NAR mean? There are a few theories, but no one knows for sure. The three most popular are as follows: 1. NAR = North American Release The Japanese version did not have passwords and used the FDS (Famicom Disk System) to store Metroid save games. 2. NAR = Not a Real (as in Not a Real Password) 3. NAR = Tohru Narihito Tohru Narihito designed and implemented the password system in Metroid. Maybe he named the debug password after himself. ------------------------------------------------------------------------------- | 5.0 mpg - The Metroid Password Generator ------------------------------------------------------------------------------- As I have mentioned many times, it is inconvenient to use the methods described here by hand. This document wasn't written so people would try to do this by hand. Rather it was written to further the understanding of the Metroid password format. I wrote a program called mpg (The Metroid Password Generator) as a replacement for a program I had seen called MetCode (the first Metroid password creation tool written by SnoBro). SnoBro only updated it within his MetEdit (Metroid Editor) program, and the program itself leaves quite a lot to be desired. SnoBro did not have complete information on the password format, so many bits in the password that I learned about were blank in his program. It was also Windows only and has what I consider to be a less than optimal interface. mpg is a replacement for SnoBro's MetCode. It takes the basic idea and turns it into a nicer program. It runs on Windows, Linux, and Mac OS X for sure, but should also run on any unix supporting the GTK+ toolkit. mpg also takes inspiration from a program called metpass by tapper, which was written to aid in the creation of Metroid passwords as strings of words. If you want to spell words in Metroid Passwords, you could use metpass to fix the checksum so the password would work in Metroid. I thought the two ideas should be combined, so I added the features of metpass into mpg. I have spent a lot of time refining the interface, and although there are at least 5 other programs that create metroid passwords, I truly feel that mine is better than all of them. The one thing that it doesn't have that one of the others does is a reference map for where each item, red door, energy tank, and missile container is. It is written in Flash and will run in a web browser if you have the Flash plugin. You can find it at http://www.geocities.com/passgens/pages/metroid/metflash.htm. Despite his nice map, I still feel I have a better overall program. If you would like to use mpg, it is available for download at http://games.technoplaza.net/mpg/. It is free software under the GNU General Public License, comes with full source, and runs on nearly every platform. ------------------------------------------------------------------------------- | 6.0 Credits & Acknowledgments ------------------------------------------------------------------------------- While I have learned a great deal on my own about the password format used in Metroid, much of my information comes originally from others. I will try to acknowledge everyone who has lead to the creation of this document here. SnoBro (aka Kent Hansen) Creator of SnoBro's Metroid Password Generator (MetCode) and MetEdit, an editor for Metroid ROMs. He did the original work on Metroid and learned the checksum and shift byte meanings, along with decoding the Metroid alphabet. I'm 99% positive that every Metroid password generator owes its existence to SnoBro and the original data he shared in his readme and source code. This include mpg. Thanks SnoBro! tapper (aka Sebastian Pettersson) Creator of metpass, a checksum generation utility that helps turn strings of words into valid Metroid passwords. His program inspired me to improve mpg beyond what I had originally envisioned and his readme contained information that helped me learn more about the password format. Xodnizel Creator of FCEU, an NES emulator with a debugger. I was able to confirm many of my theories about the password data using the debugger in FCEU. ------------------------------------------------------------------------------- | 7.0 Contact Information ------------------------------------------------------------------------------- The author (John Ratliff) can be contacted at webmaster [AT] technoplaza [DOT] net. Replace as necessary. I can also be reached via an online feedback form at http://www.technoplaza.net/feedback.php