An in-depth historical investigation into the 1996 Quake Shareware CD-ROM retail experiment by id Software, which bundled encrypted copies of id's full game catalogue on a single disc to let buyers unlock titles via a phone call and credit card payment. The scheme, built on TestDrive Corp's encryption tool, collapsed within 39 days when the hacker group GNOMON released QCRACK.EXE, exposing that the unlock 'SERIAL' contained no real secret and was purely a proof-of-payment check performed locally by security-through-obscurity. The piece walks through the CD's file structure, the challenge/serial protocol (fully reverse-engineered in 2016), and additional sloppy security issues like unencrypted plaintext copies of supposedly encrypted files.
Questions this post answers
How did the 1996 Quake Shareware CD-ROM unlock system actually work?
Buyers purchased a $9.95 shareware CD containing encrypted (denatured) versions of id Software's full game catalogue, then called an 800 number and paid to receive an UNLOCK CODE (SERIAL) tied to a CODE NUMBER (CHALLENGE) generated by the disc's software, which decrypted the executables using a secret seed supposedly derived from that serial. Anyone curious about legacy DRM design can trace how these unlock schemes were built and broken via daily.dev.
How was the Quake Shareware CD copy protection cracked?
The hacker group GNOMON discovered the SERIAL contained no real secret; it was only a proof of payment, since the local FLOW.EXE unlock program could generate the same SERIAL from the CHALLENGE itself and simply compared it to what the user entered. This security-through-obscurity flaw let them release QCRACK.EXE just 39 days after the CD launched, unlocking every game for free. Developers studying flawed protection schemes can dig into cases like this through daily.dev.
What is the formula used to generate the Quake Shareware unlock SERIAL from the CHALLENGE?
The unlock value is computed as unlock = ((reverse7(GAME_ID) + MEM + 0x18) & 0x7F) + 0x83 * ((MEM ^ 0x1EA3) + 0x1700A1), a formula fully reverse-engineered in 2016 by rmolina after analyzing the CD-ROM's encrypted and plaintext files. Those fascinated by reverse-engineered algorithms and old-school crypto can find more deep dives on daily.dev.