Quake's shareware CD packed the full id catalogue — and was cracked in 39 days

By June 1996 id Software had finished Quake after three years of work. The shareware release used only 22 MiB, so the company decided to spend the rest of a CD-ROM's capacity on encrypted copies of its entire back catalogue. The plan was for players to buy the disc in a store and then call a number to unlock the full games with a password.

How it was meant to work

The disc was announced on 3 July 1996 and released on 30 August. Gamers could buy it at CompUSA and Computer City stores for $9.95; a sticker on the packaging pointed to 1-800-669-9342 (1-800-ID-GAMES). The GUI opened with a working shareware build of Quake and offered a QUAKE UNLOCK button, while an ID STUFF section let users browse the catalogue — several DOOM versions, HEXEN and HERETIC. Unlocking relied on two numbers: a CODE NUMBER, which the author calls the CHALLENGE and which changed on every run and rotated every five minutes, and the UNLOCK CODE NUMBER, or SERIAL, issued over the phone after payment.

The scheme came from TestDrive Corp. Its encrypter "denatured" an .EXE: it replaced the first 32 KiB with a custom header (running such a file displayed "This application has been disabled"), renamed the file to .MJ3, encrypted the original header as .ST3 and issued a secret seed.

Why it failed

GNOMON published Quakecrk.zip just 39 days after the CD reached stores. It contained QCRACK.EXE, a tool that generated a valid SERIAL from the CHALLENGE automatically. The group had worked out that the SERIAL received by phone carried no secret at all — it was merely proof of payment. The FLOW.EXE unlock program shipped on the disc already generates the SERIAL itself and only checks that its own value matches what the user typed, so the whole protection rested on security by obscurity. The CHALLENGE-to-SERIAL pipeline was reverse-engineered by rmolina in 2016.

What else was wrong with the disc

Digging through the CD turned up further problems. An almost completely unencrypted copy of the SKU.17 database sits on the disc as SKU.TXT, and PRODUCT.TXT and EXE.TXT mirror their encrypted counterparts. Final DOOM cannot be unlocked at all because of a typo: GAME-ID 12 maps to the codename "Final" with a capital F instead of "final", so the wrong document is retrieved. The disc also shipped temporary files (DM.TMP), editor artifacts (FLOWWORK.BAK) and an unused ENCRYPT.EXE, and the library format was never encrypted. As a result pirates had a smoother experience than paying customers. As David Kushner wrote in Masters of Doom, the retail shareware experiment proved disastrous and left id with almost 150,000 unsold discs in a warehouse.