Lance McDonald is an Australian video game developer with a particular passion for coding in BASIC. He made an entire video game, Black Annnex, in almost pure QBASIC.
So it’s safe to say he knows his stuff. But the real question here is – does Bob from Stranger Things? In that episode, in that scene – just how legit was it? Lance knows.
Enter the best twitter thread I’ve seen in quite some time.
This article has been retimed to coincide with the third season of Stranger Things this week.
Let’s critique Bob’s BASIC pic.twitter.com/gjWtpCWcEz
— Lance McDonghard (@manfightdragon) November 16, 2017
To start with, this is a man who DIMs his variables. That’s a solid guy to have on your team right there. Immediately a good dude.
— Lance McDonghard (@manfightdragon) November 16, 2017
DIM is totally optional, he could just throw that variable at the system and let it go nuts with whatever default variable type it’s set to, but on. He knows what he wants, and he wants an INTEGER.
— Lance McDonghard (@manfightdragon) November 16, 2017
Next up he just goes straight into a BEAUTIFULLY indented 4-deep FOR loop, i j k and l. All lowercase. A modern man. Stylish. Good. He’s got this.
— Lance McDonghard (@manfightdragon) November 16, 2017
FourDigitPassword is back. We know this is an integer, and he’s gonna use some function we’ve never heard of called getFourDigits. That lowercase “g” in “get” tells us he didn’t make that function off-screen. Some API here? No one knows.
— Lance McDonghard (@manfightdragon) November 16, 2017
What could getFourDigits be? I imagine it’s some proprietary stuff they’re using at Hopkins’ Lab here, probably generates some 4 digit integer, I guess. Love the use of () around the parameters, that’s a genuine BASIC FUNCTION there.
— Lance McDonghard (@manfightdragon) November 16, 2017
Okay so he’s got an IF … THEN next, but what is this other function? checkPasswordMatch. That lowercase “c”, Hopkins uses Camel Case for their internal stuff I guess, whereas Bob is more of a Pascal Case guy. No sweat.
— Lance McDonghard (@manfightdragon) November 16, 2017
He’s got an = TRUE in there, but he hasn’t defined TRUE as a CONST anywhere. No problem, it’s probably already defined in whatever environment they’re using here. Impossible to know what it is, though!
— Lance McDonghard (@manfightdragon) November 16, 2017
GOTO 140. Yeah no problem, if the password he’s dug out of the RAM or whatever matches the Hopkins password checking function, output the password to the screen. Makes sense, solid, no sweat. Easy.
— Lance McDonghard (@manfightdragon) November 16, 2017
But Bob… BOB… WHAT IS THIS? You can’t just throw an “END” there. You can’t end an IF BLOCK like that! Surely no environment would accept that! You gotta use “END IF”! You expect me to believe you can end and IF BLOCK with “END”?
— Lance McDonghard (@manfightdragon) November 16, 2017
We’ll just have to take his word for it. He knows this system. We don’t. Keep going man.
— Lance McDonghard (@manfightdragon) November 16, 2017
Oh baby. This is the good stuff. His indentation is so beautiful that his NEXT statements are already self explanatory, but he goes so far as to append the variable names to the end of the NEXTs? Art. Sure, they COULD be required by this system, but…
— Lance McDonghard (@manfightdragon) November 16, 2017
I believe that either way, Bob is a man who throws out a full “NEXT j” when a “NEXT” would have been perfectly valid syntax.
— Lance McDonghard (@manfightdragon) November 16, 2017
Alright so we’re back outside our deep next of FOR NEXTs and we’re outputting whatever password it ended up finding. Impossible to know if it is the correct password, or the FOR statements just finished their loops, but he’s gonna have to trust it.
— Lance McDonghard (@manfightdragon) November 16, 2017
AND HE THROWS OUT AN “END” JUST TO BE SURE. Not confident letting the interpreter decide how this is going down. He knows what he wants, and he wants an END. Done. He”s got this shit on lock. Bob. Jesus. So perfect. So good.
— Lance McDonghard (@manfightdragon) November 16, 2017
At the end of the day, it’s a solid bit of password brute force software. He knew there’d be a BASIC interpreter on whatever terminal they had there, hell, he founded the town’s AV company, he probably sold it to them.
— Lance McDonghard (@manfightdragon) November 16, 2017
It sounded crazy when he blurted out “DO YOU KNOW BASIC?!” but he already knew exactly how he was gonna handle this. He nailed it. Heroics.
— Lance McDonghard (@manfightdragon) November 16, 2017
And what spurred on this critique/worship?
“I was just annoyed at how many people are like ‘THIS IS THE DUMBEST SCENE IN STRANGER THINGS YOU CANT RESET A BREAKER WITH BASIC CODE’ like as if this was some CSI; Cyber level shit,” Lance told me.
“He’s just writing a brute force password retriever on an interpreter that would be on EVERY computer in that era that he probably sold the company and already knew how to use like jeez it’s a good scene.”
If you’re keen to hear more of Lance’s retro tech insights, you might want to check out his YouTube channel here.
I gotta say, I kinda cringed when he was all like, “I know basic, I got this”. I dunno why. I think it felt kind of contrived. I think I’ve been cringing at hacking scenes since swordfish.
…since Swordfish? Not Hackers? Lets all re-watch Hackers. Why does that guy arrive on a skateboard? Because….Hackers.
Maybe because it sounded like the infamous “It’s a UNIX system, I know this!” line from Jurassic Park.
Not all super heroes wear capes
Forget the spoiler warnings, this article needed a trigger warning! I’m not ready to re-live it yet…
Bob the Brave. A true superhero.
So explain to me how an integer is the right variable type when you want to check a passcode for 0312 which is clearly a string. certainly the return value is a string.
Its all numbers. if there was a letter thrown in it would be a string.
“0312” is a string 0312 integer would be 312
An integer with leading zeroes?
is a string.
Not that I watch Stranger Things nor know BASIC too well, but looking at the screenshot he sets a FOR loop for each letter i, j, k & l from 0 to 9. Wouldn’t this mean you’ve got an integer in each variable which, when he puts them together is still an integer no?
Gotta assume this scenario gets caught by internal policy and the mysterious getFourDigits.
Since Bob’s code ran, we can assume that getFourDigits returns an integer, and that checkPasswordMatch takes an integer parameter. Considering this API, for all intents and purposes the system would consider 0312 and 312 the same. That said, using four for-loops to brute force a single numeric password is wasteful when he could have just used a single loop iterating 0..9999 instead. In fact, he wouldn’t have needed to use getFourDigits at all unless it had odd semantics like shifting (which is unlikely).
Of course, it’s a TV show. Even though they got the code correct (and kudos for that!) they still had to make it look good on screen. Longer, more indented code is more visually interesting. The program could have been written like below instead, but 6 lines, most of which are only 4-5 characters long, is much less interesting. Underscores for indentation:
10 FOR i = 0 TO 9999
20 __IF checkPasswordMatch(i) = TRUE THEN
30 ____PRINT i
40 ____END
50 __END IF
60 NEXT i
Best of all… if you look closley you see the code goes off the edfge of the screen and overlaps the monitor bezel. Ooops ;P