I think your idea about prejudging candidate passwords based on whether they meet the expected 42 'on' bit count is correct, but it should be easier to go about it the opposite way: generate a list of only the passwords that meet that requirement. The pool of candidates matching the bit count requirement is relatively small in comparison to the overall number of possible 8 character passwords, which should save you a lot of time.