--- title: "Quake Shareware, a CD-ROM just a little too full" url: https://daily.dev/posts/quake-shareware-a-cd-rom-just-a-little-too-full-tjlhxddvp source_url: https://fabiensanglard.net/quake_shareware_cd/index.html type: article source: "Fabien Sanglard" published: 2026-08-17T23:37:53.188Z updated: 2026-08-18T04:41:44.983Z tags: ["security", "reverse-engineering"] reading_time: 7 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Quake Shareware, a CD-ROM just a little too full **[Fabien Sanglard](https://daily.dev/sources/fabiensanglard)** · 7 min read · 1 upvotes · 0 comments ## Summary An in-depth historical investigation into the 1996 Quake Shareware CD-ROM retail experiment by id Software, which bundled encrypted copies of id's full game catalogue on a single disc to let buyers unlock titles via a phone call and credit card payment. The scheme, built on TestDrive Corp's encryption tool, collapsed within 39 days when the hacker group GNOMON released QCRACK.EXE, exposing that the unlock 'SERIAL' contained no real secret and was purely a proof-of-payment check performed locally by security-through-obscurity. The piece walks through the CD's file structure, the challenge/serial protocol (fully reverse-engineered in 2016), and additional sloppy security issues like unencrypted plaintext copies of supposedly encrypted files. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the 1996 Quake Shareware CD-ROM unlock system actually work? Buyers purchased a $9.95 shareware CD containing encrypted (denatured) versions of id Software's full game catalogue, then called an 800 number and paid to receive an UNLOCK CODE (SERIAL) tied to a CODE NUMBER (CHALLENGE) generated by the disc's software, which decrypted the executables using a secret seed supposedly derived from that serial. _Anyone curious about legacy DRM design can trace how these unlock schemes were built and broken via daily.dev._ ### How was the Quake Shareware CD copy protection cracked? The hacker group GNOMON discovered the SERIAL contained no real secret; it was only a proof of payment, since the local FLOW.EXE unlock program could generate the same SERIAL from the CHALLENGE itself and simply compared it to what the user entered. This security-through-obscurity flaw let them release QCRACK.EXE just 39 days after the CD launched, unlocking every game for free. _Developers studying flawed protection schemes can dig into cases like this through daily.dev._ ### What is the formula used to generate the Quake Shareware unlock SERIAL from the CHALLENGE? The unlock value is computed as unlock = ((reverse7(GAME_ID) + MEM + 0x18) & 0x7F) + 0x83 * ((MEM ^ 0x1EA3) + 0x1700A1), a formula fully reverse-engineered in 2016 by rmolina after analyzing the CD-ROM's encrypted and plaintext files. _Those fascinated by reverse-engineered algorithms and old-school crypto can find more deep dives on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 132 comments across lobsters, hackernews (as of 2026-08-18). **TL;DR:** The discussion is mostly nostalgic and technically curious, digging into whether id's per-CD encryption scheme could ever have worked at scale, while reminiscing about the shareware disc's soundtrack, packaging, and era-specific hardware quirks; the author actively engaged to fix factual/image errors in the piece. **Sentiment:** 25% positive · 55% mixed · 20% skeptical **The case for** - Several found the shareware disc a great value even beyond the game, citing the NIN soundtrack and box art as highlights. - Some argued the easily-crackable scheme may have been good marketing, exposing more people to the game who later bought sequels. - The author was praised implicitly through active back-and-forth fixing errors readers pointed out. **The pushback** - Multiple commenters concluded that making per-CD unique encryption was economically and technically infeasible at 1996 manufacturing scale, so the scheme was doomed from the start. - Some noted the DRM was outright misattributed as a security failure when it was really id's flawed implementation on top of the vendor's system rather than a fundamentally broken concept. - A photo used in the article was called out as likely AI-generated (wrong store branding, garbled signage text), undermining credibility until corrected. **By community** - lobsters (mixed): Minimal engagement, with one commenter simply noting their own retail CD lacked the extras discussed. - hackernews (mixed): A large, technically detailed thread mixing DRM feasibility debates, nostalgic CD-era anecdotes, and constructive fact-checking of the article's images and details. **Hottest debate:** Whether any per-disc or cryptographic scheme could have realistically prevented cracking given 1996 CD pressing economics and the lack of per-machine hardware identifiers. **Open questions** - Could a public-key or per-device challenge scheme have been made practical over a phone call in 1996? - Was the trivially crackable protection an intentional marketing strategy or simply a naive implementation by id/TestDrive? **Highlights** > Yes, my point, if the answer is that there is no way this works without every disc being different. It was not possible to manufacture at the time at scale. > — [ekelsen on hackernews · 1 comments](https://news.ycombinator.com/item?id=49339658) > But it sounds like it wasn't Testdrive's fault; iD implemented it incorrectly. Their phone support weren't issuing the decrypt code, just a simple checksum: > Described as is, there is no flaw in this process. The secret seed comes from the unlock server, tied to a CHALLENGE/SERIAL that could not be reused. But the hacker team GNOMON found a way. > The QUAKE unlock program FLOW.EXE that ships on the CD is capable of generating the SERIAL from the CHALLENGE on its own. All it does is check that its own locally-generated SERIAL and the SERIAL entered by the user match! The entire protection mechanism relies on security by obscurity. > — [jhy on hackernews · 1 comments](https://news.ycombinator.com/item?id=49339575) > I fed the image into Gemini and it could not detect that it’s legit or AI, but in addition to the wrong store name, the other banner that’s supposed to day SOFTWARE says TWARE or something like that. It sure seems like AI to me. > — [dennisnedry on hackernews](https://news.ycombinator.com/item?id=49339217) > This screw up ended up costing id Software millions in sales. With the Doom franchise they only included the first episode in the shareware version. But to save a buck I guess they decided this was better than mailing a second CD with the full game on it. Then doubling down on that greed by putting their entire game library on the disc. This is right about the time John Romero and John Carmack parted ways, can't help but wonder if this debacle played a role. And by all accounts Quake's development was painful, so imagine this happens after going through hell getting a game out the door. > — [kolanos on hackernews](https://news.ycombinator.com/item?id=49339079) > I did exactly this thing when I was a broke teenager. The files in my ID1 directory that I shuffle around from computer to computer to this day came from that disc 30 years ago. (I still have the disc, but not the case.) I did, however, purchase Quake II and III when they were released. And many years later bought Quake on Steam. I think they got their money's worth from me after all. (There were some who believed that making the shareware disc easily-crackable was an intentional stroke of genius. It got people who couldn't afford the full retail version to buy the game and expand its popularity. The argument being that $10 was a fairly ludicrous amount of money to pay for a single shareware game. Shareware CDs tended to be $5 on the high end, or free with most computer/gaming magazines.) > — [bityard on hackernews · 2 comments](https://news.ycombinator.com/item?id=49339052) **Source threads** - [lobsters](https://lobste.rs/s/j5xjf2/quake_shareware_cd_rom_just_little_too) · 9 points · 1 comments - [hackernews](https://news.ycombinator.com/item?id=49338328) · 80 points · 131 comments ## Similar posts on daily.dev - [A trip down shareware lane](https://daily.dev/posts/a-trip-down-shareware-lane-yw6uwnlpz) · InfoWorld · 0 upvotes · 0 comments - [How quake.exe got its TCP](https://daily.dev/posts/how-quake-exe-got-its-tcp-cbg95kuvv) · Fabien Sanglard · 0 upvotes · 0 comments - [Building a Quake PC: VQuake](https://daily.dev/posts/building-a-quake-pc-vquake-tplkqovxw) · Fabien Sanglard · 0 upvotes · 0 comments - [Why WinQuake exists and how it works](https://daily.dev/posts/why-winquake-exists-and-how-it-works-05rkd25tg) · Fabien Sanglard · 0 upvotes · 0 comments - [How quake.exe got its TCP](https://daily.dev/posts/how-quake-exe-got-its-tcp-ovq8qf2nm) · Lobsters · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#reverse-engineering](https://daily.dev/tags/reverse-engineering) [View this post on daily.dev](https://daily.dev/posts/quake-shareware-a-cd-rom-just-a-little-too-full-tjlhxddvp)