<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/">
  <channel>
    <title>Retro Gaming on Max Woolf&#39;s Blog</title>
    <link>https://minimaxir.com/tag/retro-gaming/</link>
    <description>Recent content in Retro Gaming on Max Woolf&#39;s Blog</description>
    <image>
      <title>Max Woolf&#39;s Blog</title>
      <url>https://minimaxir.com/android-chrome-512x512.png</url>
      <link>https://minimaxir.com/android-chrome-512x512.png</link>
    </image>
    <generator>Hugo</generator>
    <language>en</language>
    <copyright>Copyright Max Woolf © 2026</copyright>
    <lastBuildDate>Thu, 23 May 2013 20:26:00 -0700</lastBuildDate>
    <atom:link href="https://minimaxir.com/tag/retro-gaming/index.xml" rel="self" type="application/rss+xml" />
    <item>
      <title>A Role-Playing Game With an Easily Exploitable Random Number Generator</title>
      <link>https://minimaxir.com/2013/05/guaranteed-to-be-random/</link>
      <pubDate>Thu, 23 May 2013 20:26:00 -0700</pubDate>
      <guid>https://minimaxir.com/2013/05/guaranteed-to-be-random/</guid>
      <description>The Golden Sun RNG is so poorly implemented that players have found out how to make events with 1/256 probability occur one hundred percent of the time.</description>
      <content:encoded><![CDATA[<p>When the Game Boy Advance was released in June 2001, Nintendo promised that the handheld device would be capable of delivering a home gaming console experience on-the-go. <a href="http://en.wikipedia.org/wiki/Golden_Sun">Golden Sun</a>, developed by Camelot and published by Nintendo a few months after the console&rsquo;s release, exemplified the GBA&rsquo;s full capabilities with its hand-drawn environments, flashy battle effects, and <em>very</em> difficult dungeon puzzles which undoubtedly resulted in the sale of many strategy guides.</p>
<p>In Golden Sun, you play as a group of teenage mages called Adepts, who wield the power of the four elements (Earth, Fire, Wind, and Water) by casting spells with Psynergy. The antagonists of the game are a pair of jerks who are attempting to reawaken a dangerous and sealed power, and only four kids can stop them from destroying the world. Released two years later, <a href="http://en.wikipedia.org/wiki/Golden_Sun:_The_Lost_Age">Golden Sun: The Lost Age</a> takes place immediately after the conclusion of the first game with a different quartet of Adepts and a new pair of jerks. In this sequel, it is revealed that the jerks who keep trying to kill you are not the bad guys and the whole conflict is just one big misunderstanding! Yes, the plot is very reminiscent of other Japanese-developed RPGs such as <a href="http://en.wikipedia.org/wiki/Final_Fantasy_%28video_game%29">Final Fantasy</a> and <a href="http://en.wikipedia.org/wiki/Chrono_Trigger">Chrono Trigger</a>, but it&rsquo;s still impressive for a game I typically played in the backseat of a car.</p>
<p>Like Final Fantasy and Chrono Trigger, Golden Sun has an inventory system where players earn new weapons and items by purchasing them at a store or by finding them as loot from defeating enemies in the world. The most powerful weapons, naturally, only drop from enemies at the end of the game with odds of less than 0.01% per kill. If you killed <a href="http://www.wolframalpha.com/input/?i=binomial&#43;distribution%28100%2C1%2F256%29">such enemies 100 times</a>, for example, you would only have a 32% expected chance of seeing a rare drop among all the kills. And killing that many enemies could take hours. It depends on the almighty will of Golden Sun&rsquo;s Random Number Generator.</p>
<p>As it turns out, the <a href="http://goldensun.wikia.com/wiki/Random_Number_Generator">Golden Sun RNG</a> is so poorly implemented that players have found out how to make events with 1/256 probability occur <em>one hundred percent</em> of the time.</p>
<h2 id="you-make-your-own-luck">You Make Your Own Luck</h2>
<figure>

    <img loading="lazy" srcset="/2013/05/guaranteed-to-be-random/random_number_hu_afe93aba3db7836.webp 320w,/2013/05/guaranteed-to-be-random/random_number.png 400w" src="random_number.png"
         alt="http://xkcd.com/221/"/> <figcaption>
            <p><a href="http://xkcd.com/221/">http://xkcd.com/221/</a></p>
        </figcaption>
</figure>

<p>Soon after the first Golden Sun was released, players discovered that the first random enemy encounter the player enters after turning the GBA on was always a First Strike, where the player&rsquo;s party gets a free turn. Was this a cute gameplay mechanic intended to give the player a quick advantage, or was it indicative of a flaw in the game&rsquo;s RNG?</p>
<p>Most modern RNGs are partially seeded and randomized using a timer, i.e. the current time of the computer in microseconds. This makes it infeasable to reproduce the output of the RNG reliably.</p>
<p>However, the GBA does not have an internal clock, so time-based methods of seeding aren&rsquo;t possible. By the time the sequel was released in 2003, the
<a href="http://www.goldensunrealm.com/gs/nickpresta_rng-guide.txt">entire Golden Sun RNG</a> was reverse-engineered:</p>
<blockquote>
<p>Golden Sun uses the ANSI-C standard rand function as its Pseudo-Random Number
Generator.</p>
<p>There is one difference: Golden Sun&rsquo;s RNG uses an unsigned 4-byte number and
returns it with no shifting, so you&rsquo;d replace &ldquo;return ((next &raquo;16) &amp; 32757);&rdquo;
with &ldquo;return (next &amp; 4294967295);&rdquo;</p>
<p>This, ordinarily, is a perfectly capable RNG, but there is one flaw with what
Golden Sun does with it.</p>
<p>It only makes a new random number when something random happens. What&rsquo;s more,
it uses <em>two</em> copies of the RNG to create two random numbers, and the
first RNG only handles battle situations.</p>
<p>As such, it is easy to control when a new random number is generated.</p>
<p>On top of this, the RNGs are seeded with 0 when the GBA is reset, and because
of the way the game has been programmed, the RNG controlling battle events will
<em>continue</em> to be 0 even when you load the game&hellip;</p>
</blockquote>
<p>Golden Sun&rsquo;s Random Number Generator isn&rsquo;t &ldquo;random&rdquo; at all. It&rsquo;s manipulated <em>entirely</em> from player-controlled actions, from the moment the Game Boy Advance is turned on.</p>
<h2 id="get-lucky">Get Lucky</h2>
<figure>

    <img loading="lazy" srcset="/2013/05/guaranteed-to-be-random/kiku_hu_6fa5cd9073b0014c.webp 320w,/2013/05/guaranteed-to-be-random/kiku.png 320w" src="kiku.png"/> 
</figure>

<p>One of Golden Sun&rsquo;s contributions to the typical RPG character class customization is the <a href="http://goldensun.wikia.com/wiki/Djinn">Djinn system</a>. In the game lore, Djinn are impish creatures that grant enhanced powers to Adepts. There are four types of Djinn, one for each element, that can be found in the overworld, and each Djinni can be used to either increase a character&rsquo;s statistics, or Unleashed to provide a powerful spell effect. Also, as with many other RPGs, Golden Sun implements an elemental rock-paper-scissors combat system: enemies are weak to an element and resistant to another.</p>
<p>A <a href="http://www.gamefaqs.com/">GameFAQs</a> forum user by the name of &ldquo;darkpanther&rdquo; discovered that using a Djinn Unleash with an element that is the enemy&rsquo;s weakness will not only increase the amount of Experience and Coins earned, but also <em>quadruple</em> the chance of the enemy dropping a rare item. (this fact is neither hinted anywhere in the game nor stated in any strategy guides)</p>
<p>This is essential toward manipulating the RNG. Normally, the rarest items such as <a href="http://goldensun.wikia.com/wiki/Tisiphone_Edge">Tisiphone Edge</a> and <a href="http://goldensun.wikia.com/wiki/Lachesis%27_Rule">Lachesis&rsquo; Rule</a> have an &ldquo;Item-Class Chance&rdquo; of 9, meaning the item has a 1/(2<sup>9-1</sup>) = 1/256 chance of dropping per enemy kill. The &ldquo;DP Method&rdquo; decreases the ICC by 2, meaning the new drop rate becomes 1/(2<sup>7-1</sup>) = 1/64. But:</p>
<blockquote>
<p>As &lsquo;unpredictable&rsquo; as RNGs seem to be, if they are always seeded to the same
value and do not use a timer-based response, they will become predictable by
anyone who is good at noticing patterns. One pattern being, for example, that
the 31st random number that is calculated - 33727075 - will drop <em>any</em> item if
the enemy dying when this random number was called was just killed by an
elemental Djinn attack that it is weak to.</p>
</blockquote>
<p>Calculating the 31st random number would fail against an ICC9 item, but now works against an ICC7 item. (and all items of lower ICC too)</p>
<p>Therefore, <strong>in order to guarantee that an item drops, kill the appropriate enemy with an element-advantage Djinni such that the 30th random number is generated</strong>. (the 31st random number is generated on the enemy&rsquo;s death)</p>
<p>How do you ensure that you only create 31 random numbers? From the Golden Sun Wikia:</p>
<blockquote>
<p>Save the game and do a hard reset in the area where the monster that drops the item you need appears. Run around to get in a battle. If the encounter consists of a formation of 2 monsters, with at least one of them being the monster you want, proceed. If not, do another hard reset and try again.</p>
<p>During battle, have the entire party use multi-targetting Psynergy on the targets in the first turn, and since a battle right after a hard reset always involve your party attacking first where possible, the monsters will not be able to act. During the second turn, use two multi-targetting Psynergy on the enemies, and have the third party member (or fourth, if one of the three party members that act before uses Defend) unleash an attack Djinni of the element the monster is weak to on the monster. If by this point, the monster flashes in colour and dies, you will obtain the drop of that monster at the end of the battle, however rare it is. If the monster does not die then (either dies too soon or doesn&rsquo;t die by this step), adjust the power of your attacks until you get it just right.</p>
</blockquote>
<div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;">
      <iframe allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share; fullscreen" loading="eager" referrerpolicy="strict-origin-when-cross-origin" src="https://www.youtube-nocookie.com/embed/UCJzuSBQ1hU?autoplay=0&amp;controls=1&amp;end=0&amp;loop=0&amp;mute=0&amp;start=0" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" title="YouTube video"></iframe>
    </div>

<p>Moral of story: if you&rsquo;re making a video game, seed your RNGs with an algorithm that players can&rsquo;t manipulate 100%. Otherwise, hilarity will inevitably ensue. I forgive Camelot for implementing a simplistic RNG though; the two games&rsquo; <a href="http://www.youtube.com/watch?v=DaxYYwMqiso&amp;list=PL8C84ECF55B28DC74">awesome</a> <a href="http://www.youtube.com/watch?v=M31afGXIGpQ&amp;list=PL586792F46D5A35D4&amp;index=13">soundtrack </a> more than makes up for it.</p>
]]></content:encoded>
    </item>
    <item>
      <title>A Profanity-Laced Video Game Password That Breaks Everything</title>
      <link>https://minimaxir.com/2013/05/its-a-livin/</link>
      <pubDate>Thu, 16 May 2013 20:50:00 -0700</pubDate>
      <guid>https://minimaxir.com/2013/05/its-a-livin/</guid>
      <description>Most of these passwords were gibberish that required a pen-and-paper to write down and remember. One password, however, is more memorable, and much more sinister.</description>
      <content:encoded><![CDATA[<p>If you&rsquo;re a fan of video games, you&rsquo;ve likely heard of the Metroid franchise. Released for the NES in 1986 by Nintendo, Metroid set a new standard for 2-D exploration in video games with its expansive power-up system, well-hidden secrets, and polished platforming controls. Due to its popularity, Metroid has been rereleased multiple times: as an unlockable in <a href="http://en.wikipedia.org/wiki/Metroid_Prime">Metroid Prime</a>, an unlockable in the remake <a href="http://en.wikipedia.org/wiki/Metroid_Zero_Mission">Metroid: Zero Mission</a>, a <a href="http://en.wikipedia.org/wiki/Classic_NES_Series">standalone game</a> on the Game Boy Advance, the Wii Virtual Console, and the 3DS Virtual Console.</p>
<p>You play as Samus Aran, an armored bounty hunter who has infiltrated the base of the dreaded Space Pirates on Planet Zebes. Samus must defeat the leaders of the Space Pirates: the dinosaur Kraid, the dragon and memetic badass of the series <a href="http://en.wikipedia.org/wiki/Ridley_%28Metroid%29">Ridley</a>, and the AI construct <a href="http://en.wikipedia.org/wiki/Mother_Brain_%28Metroid%29">Mother Brain</a>. Additionally, Samus must find a way to defeat the Metroids, which are nearly-indestructible parasites that threaten all life. Yes, this was a plot written in the 80&rsquo;s.</p>
<p>Since the NES Metroid cartridge did not have the ability to save games, and the game itself took awhile to complete, Nintendo developed a password system to allow players to continue at a later time. Upon death, the player received a 24-character alphanumeric password that could be entered to restore all items the player has unlocked and remember which bosses the player has defeated. Most of these passwords were gibberish that required a pen-and-paper to write down and remember.</p>
<p>One password, however, is more memorable, and much more sinister.</p>
<h2 id="the-password-is-always-swordfish">The Password is Always Swordfish</h2>
<p>Even before the days of the internet and personal computing, players <a href="http://metroid.wikia.com/wiki/List_of_Metroid_passwords">found passwords</a> with unique properties.</p>
<p>The <a href="http://metroid.wikia.com/wiki/Narpas_Sword">Narpas Sword password</a>:</p>
<figure>

    <img loading="lazy" srcset="/2013/05/its-a-livin/narpassword.png 256w" src="narpassword.png"/> 
</figure>

<p>is essentially the debug mode for the game, with all items unlocked, infinite health, and infinite health for Samus.</p>
<p>Another, more revealing password is the <a href="http://metroid.wikia.com/wiki/Justin_Bailey">Justin Bailey password</a>:</p>
<figure>

    <img loading="lazy" srcset="/2013/05/its-a-livin/justinbailey.png 256w" src="justinbailey.png"/> 
</figure>

<p>This password starts the game with most unlockables obtained, but more notably, it changes Samus&rsquo;s sprite from an armored powersuit to a bikini swimsuit.</p>
<p>One password, discovered over 20 years later, long after the Metroid password system had been completely reverse-engineered, does not grant you all items. <em>This</em> password just crashes and resets the game:</p>
<figure>

    <img loading="lazy" srcset="/2013/05/its-a-livin/engageridley.png 256w" src="engageridley.png"/> 
</figure>

<h2 id="wtf">WTF?</h2>
<p>On a NES and various other rereleases, inputting that code will cause the game to either simply reset or transform the game into a glitched wonderland:</p>
<div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;">
      <iframe allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share; fullscreen" loading="eager" referrerpolicy="strict-origin-when-cross-origin" src="https://www.youtube-nocookie.com/embed/x3UyVylP7AI?autoplay=0&amp;controls=1&amp;end=0&amp;loop=0&amp;mute=0&amp;start=0" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" title="YouTube video"></iframe>
    </div>

<p>But what happens when you enter the password on an emulated Virtual Console, where the game environment is sandboxed? In the case of the 3DS Virtual Console, the <em>3DS completely crashes</em>:</p>
<div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;">
      <iframe allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share; fullscreen" loading="eager" referrerpolicy="strict-origin-when-cross-origin" src="https://www.youtube-nocookie.com/embed/pjQ7SjB_6a8?autoplay=0&amp;controls=1&amp;end=0&amp;loop=0&amp;mute=0&amp;start=0" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" title="YouTube video"></iframe>
    </div>

<h2 id="rated-e-for-everyone">Rated E for Everyone?</h2>
<p>You may be asking &ldquo;did someone at Nintendo actually program a consequence for profanity in the game? Is the glitching and crashing a punishment for the perverse player?&rdquo; In truth, the password is merely a coincidence.</p>
<p>As mentioned earlier, the password algorithm for Metroid has been reverse-engineered, and you can actually download a program to both generate and interpret such passwords <a href="http://games.technoplaza.net/mpg/">here</a>.</p>
<figure>

    <img loading="lazy" srcset="/2013/05/its-a-livin/metroidpassgen_hu_f02ebb82933d20d3.webp 320w,/2013/05/its-a-livin/metroidpassgen.png 597w" src="metroidpassgen.png"/> 
</figure>

<p>The profane password is indeed a legitimate password (in which Ridley is already defeated, ironically enough). But why does it crash the game? The <a href="http://games.technoplaza.net/mpg/password.txt">Metroid Password Format Guide</a> explains the secret:</p>
<blockquote>
<p>There are five valid start locations. They are specified using bits 64-66.
To start in Brinstar, all the bits should be off. Norfair, Kraid&rsquo;s Lair, and
Ridley&rsquo;s Lair can be specified by turning their bit on and leaving the others
off. Tourian is specified by turning on Norfair and Kraid&rsquo;s Lair
simultaneously. Any other combination of these three bits is invalid and will
cause Metroid to reset.</p>
<p>The reset bit is part of the start location. There are 16 possible values,
but only 5 valid ones. Turning on the reset bit will produce and invalid
start location and cause Metroid to reset. This is why it is called it is
called the reset bit, because it guarantees an invalid password.</p>
</blockquote>
<p>For the profane password, the reset bit is turned on, so it will always cause a reset. And that&rsquo;s why the weird behavior happens.</p>
<p>If you manually disable the reset bit using this tool in order to make the password valid, the new password becomes:</p>
<figure>

    <img loading="lazy" srcset="/2013/05/its-a-livin/metroidpassgen2_hu_4cfe65ee7b9a72e2.webp 320w,/2013/05/its-a-livin/metroidpassgen2.png 597w" src="metroidpassgen2.png"/> 
</figure>

<p>Not as catchy, unfortunately.</p>
<p>In fact, the Justin Bailey password is also a completely coincidental password. Sometimes, passwords can just do very unexpected things.</p>
]]></content:encoded>
    </item>
  </channel>
</rss>
