Research: Pokemon Super Mystery Dungeon - SOS/Rescue/Thank You Research

[Shubshub]

Currently attempting to take a look at SOS/Thank You/Rescue Codes from the latest Pokemon Mystery Dungeon game and see if we can figure anything out about them, Also perhaps I'll take a look at some RAM dumps of the game I can do with my 3DS

What I'd like from the community is for you to provide Codes they can be either SOS, Rescued or Thank You mail codes but only passwords no QR Codes please

Click Here to Submit a Code

Click here to view the list of Codes

Down below I'll post findings that I discover about these codes, If and when I find something out

For all we know they may just be encrypted with a One Time Pad which would require scouring the games code for which will take a while if it comes to that

Lets get Researching!

Theories (These are not 100% Confirmed)

• SOS Codes store only ID numbers for Pokemon to be rescued
• SOS Codes Encrypt the entire Team name
• Rescue Codes use the SOS Code in some form to generate the Code to activate the rescue
• It's entirely possible that the game interpets the @ symbol as the Bullseye symbol in game

100% Confirmed

• List of Available Letters for Rescue Passwords
• The game has the same amount of letters for use as the other games in the series
• Dungeon Seeds are not stored in the passwords (Layouts are different every time)
• We have discovered something intriguing about the passwords
  It seems that a bunch of items (Completely randomly selected by the developers it seems or at least sets of items separated from the same Item Type?) are bundled into a set of groups which each have a seed attached to them that will tell the game how to generate the SOS Password so far we have discovered 2 sets of items that relate to each other I'll post them below this

Item Identifier Location in Password

Spoiler:

This password here contains a Plain Seed and it is a Thank You Mail
XQ5KP-% MM1-T1 YR$+F&Q
9NPXJJ8 C%&KY1 %58W&W$
0K%KW+4 0J8155 65PK3&N
PJ9F383 #W3419 FKN$65F

This password here contains a Decoy Seed and it is a Thank You Mail
XQ5KP-% MM1-T1 YR$+F&Q
9NPXJJ8 C%&KY1 %58W&W$
0K%KW+4 0J8155 65PK3&N
PJ9F383 #W3=16 FKN$65F

These two items are related to each other somehow in the games code and thus produce the same encryption key or so we think

This password here contains a Warp Seed and it is a Thank You Mail
21+W7C- M9KM=W $&T##9C
WM05=T& W8=Q+C =$TH23P
927YFN$ +478=M 8009H80
+6=&3$P HQFSM6 -MS%H-C

This password here contains a Ban Seed and it is a Thank You Mail
21+W7C- M9KM=W $&T##9C
WM05=T& W8=Q+C =$TH23P
927YFN$ +478=M 8009H80
+6=&3$P HQF+K9 -MS%H-C


So what we can deduce from just this small amount of information is exactly where the Items identifier value is stored in the password
XXXXXXX XXXXXX XXXXXXX
XXXXXXX XXXXXX XXXXXXX
XXXXXXX XXXXXX XXXXXXX
XXXXXXX XXXYYY XXXXXXX

The bolded portion of the above bunch of letters is where the Item values in the Thank You Mail is stored, So far from what we have gathered is that these passwords are not shuffled about randomly before or after encryption

 

[Shubshub]

If someone could do me a favour and do the following
Before you do it you need to have a Thank You Mail you haven't sent yet

1. Create a Save Backup of your Super Mystery Dungeon game

2. Send the Thank You Mail via Password/QR Code without an Item Attached

3. Submit the Password using this Link

4. Restore your Save Data

5. Send the same Thank You Mail via Password/QR Code with an Item Attached

6. Submit the Password using the same Link as above and list what item you attached as well

7. Restore Save Data if you want

Also if you could do it with multiple items that would be awesome! Thanks

 

[Shubshub]

Bumpdate

We have made a rather important discovery in figuring out how these passwords work
We have cracked a small mystery on the road to a Generator, we have found out where the game stores the Item Idenfitier in the Thank You Mail Passwords and a little bit of theory which could be quite possibly true as well read the main post for more details I have updated it

 

[Shiny Quagsire]

The codes kinda remind me of base64, wonder if they do something similar to that in terms of getting raw data to inputtable ASCII. I might try to see if I can track down where in the code they actually read those out, since I got my cart dumped and decrypted.

 

[Shubshub]

The codes kinda remind me of base64, wonder if they do something similar to that in terms of getting raw data to inputtable ASCII. I might try to see if I can track down where in the code they actually read those out, since I got my cart dumped and decrypted.

Yea that'd be great, They are a little base64ish I suppose I was actually surprised when we discovered where the Item Locations were stored after only a day of working on it, Although so far that's all we've discovered as everything else seems to change the passwords entirely Although we are working at it slowly, Been out all day today so haven't done anything on it today

 

[Shiny Quagsire]

I think I found the function used to judge the validity of SOS codes, although I'll have to investigate as to how it even checks the things. It has the strings "bad SOS len", "bad DC huff", "bad AC huff", "bad SOS" and "bad SOS component count", just taking a guess, perhaps the SOS codes are based on a huffman variant? It wouldn't be the first time I've seen custom huffman implementations in code.

 

[Shubshub]

I think I found the function used to judge the validity of SOS codes, although I'll have to investigate as to how it even checks the things. It has the strings "bad SOS len", "bad DC huff", "bad AC huff", "bad SOS" and "bad SOS component count", just taking a guess, perhaps the SOS codes are based on a huffman variant? It wouldn't be the first time I've seen custom huffman implementations in code.

Interesting thats some rather good discovery there ^_^ Let me know if you find out anything else

So is a Huffman Code sort of like a Binary Tree in programming?