Under the Microscope: Stimpy’s Invention

Some game cartridges from the 16-bit era shipped with backup chips. These allowed players save their progress. But they were expensive relative to a software-only alternative, session passwords.

In addition to being cheaper, session passwords could be shared. Players eagerly subscribed to game magazines that printed them. And in the 90s, having a notebook full of Sega Genesis codes was a good way to increase your status on the playground.

*Getting a password at the end of a level*

The best password systems used strings that were (a) long enough to encode everything important about a game’s state, and (b) short enough to be easily swapped by middle schoolers.

That brings us to The Ren & Stimpy Show Presents: Stimpy’s Invention, the 1993 adaptation of the Nickelodeon cartoon for the Genesis. It uses 14 character passwords that are drawn from a restricted alphabet:

0123 4567 89BC DFGH JKLM NPQR STUV WXYZ

This alphabet leaves out easily-confused characters like I and O, so it’s optimized for jotting down. And it has 32 symbols, a power of 2 that’s convenient for programming purposes.

When you choose a character from the password entry screen, its index is used to update the value at ffff050c. Each new entry shifts the previous value by 5 bits. 5 bits can represent exactly 32 different characters, since 2^5=32.

Those operations are performed by the function at 00042272. Its logic looks like this pseudo-Python:

new_accumulator_value = (old_accumulator_value << 5) | new_character_index

Here’s what the password 0123456789BCDF looks like in memory:

The function at 000420dc checks whether passcodes are valid. Before it gets to extracting game state parameters from the string, it does some special comparisons:

Do the first 32 bits of the passcode match the value 0x54b43c47?
Do the second 32 bits match 0xca968788?
Do the last 8 bits match 0xf8?

This is how the Motorola 68k checks for the nine-byte value 0x54b43c47ca968788f8.

To figure out what that value corresponds to, we can reverse the logic above:

char_index = old_accumulator_value & 0x1f  # Extract 5 bits
new_accumulator_value = old_accumulator_value >> 5 # Shift by 5 bits

But we have to do an extra step first. Our nine bytes target is 72 bits, but our passwords are 70 bits (14 characters * 5 bits per character). So we need to discard 2 bits first. The full decode is:

ALPHABET = "0123456789BCDFGHJKLMNPQRSTUVWXYZ"
accumulator_value = 0x54b43c47ca968788f8 >> 2
for _ in range(14):
    char_index = accumulator_value & 0x1F
    accumulator_value >>= 5
    print(ALPHABET[char_index], end='')

The output is YKS3ULBYKS3ULB. That’s reversed, since the code above works from right to left. So the target passcode is BLU3SKYBLU3SKY.

Enter that, and the staff credits start playing!

The password refers, of course, to BlueSky Software, the studio that developed the game. Here’s a video of the whole sequence:

I don’t think this password has been reported before, which makes it the oldest cheat code I’ve discovered! The other passwords that the game recognized have already been documented – this GameFAQs guide by user Zachary1021 has the full set.

Outro

Greetings, SegaBits! I’ll be posting articles like this about cheat codes and Easter eggs I find in Genesis games. Thanks for reading! For more on retro game reverse engineering, including lots about Saturn and Dreamcast games, see my blog.

Outro

Related posts:

Leave a Reply Cancel reply