154 pointsby shdon4 hours ago21 comments
  • edg50002 minutes ago
    Am I reading this right, and was only the file header encrypted? Also, wasn't ID the company that did not use serials or other DRM? Maybe that explains their naivite, maybe they underestimated how easily games get cracked.
  • bityard3 hours ago
    I did exactly this thing when I was a broke teenager. The files in my ID1 directory that I shuffle around from computer to computer to this day came from that disc 30 years ago. (I still have the disc, but not the case.) I did, however, purchase Quake II and III when they were released. And many years later bought Quake on Steam. I think they got their money's worth from me after all.

    (There were some who believed that making the shareware disc easily-crackable was an intentional stroke of genius. It got people who couldn't afford the full retail version to buy the game and expand its popularity. The argument being that $10 was a fairly ludicrous amount of money to pay for a single shareware game. Shareware CDs tended to be $5 on the high end, or free with most computer/gaming magazines.)

    • mewse-hn2 hours ago
      > There were some who believed that making the shareware disc easily-crackable was an intentional stroke of genius.

      I doubt it. I would believe that the id guys weren't too choked about the lost revenue after the fact, but the business guys probably believed the scheme would work (especially since they contracted a company that said "yes, this will work").

      Aside from that, the shareware cd was incredible marketing - the digipak cd case was the kind of art and paper construction that nin was using on their discs (like the Broken EP), and the disc itself has nice art with the four logos in cardinal directions. I bought a copy of the registered disc from ebay years later and it's in a jewel case with really crappy artwork vs the shareware version, it was a surprising disappointment.

    • somatan hour ago
      Glad I am not the only one who carts an id1 directory around. Mine originally came from a retail disk with a funny story, I had bought it for a friend. a birthday present. and a couple years later I bought their old pc from them and that quake disk was in the box of parts. It had came back me.
  • dylan6042 hours ago
    "The CD was announced[4] on July 3, 1996 and released on August 30th[5]. The hacker group GNOMON released Quakecrk.zip only 39 days later[6]."

    While not being familiar with the Windows side of things, I did frequent the a.b.m.a newsgroup being a broke student. It was always impressive to me to see how quickly someone would post a binary before the crack was posted. I remember one app I was very interested in posting on Friday, and the crack available when I checked back on Monday. Even apps that needed a physical dongle for the ADB port were cracked and not just the apps that needed a key typed in to unlock. Later, the apps that would clone a USB dongle came along, and one software company that used USB dongles actually advised using this tool when we started running their software on Blade servers that did not support adding 24 USB devices.

  • beloch2 hours ago
    "For video game developers, the CD-ROM was an odd beast. The capacity far exceeded the quantity of assets they were able to produce. A few titles, like 7th Guest (1993) or Phantasmagoria (1995) introduced Full Motion Video (in a world where only part of the screen could be animated). "

    ------

    The title that made me go out and buy a CD-ROM drive was "Wing Commander III", released during the holidays of 1994, a year and a half before Quake 1. This was peak "Silliwood", when games started to use FMV cut-scenes starring bankable actors like Mark Hamill. Games were still being released for the SNES at this point, so imagine the contrast!

    In the age before wikipedia or ubiquitous internet access, it was also pretty amazing to have access to a multimedia enhanced encyclopedia. Storing large amounts of data was still a tricky thing. It would take a few years for CD-R's to arrive, and there would be a plethora of competing technologies like Zip drives. Looking back, it seems like computer technology was moving especially fast in the 90's.

    • NopIdoN22 minutes ago
      Ripper (1996) with Christopher Walken and Paul Giamatti came on 6 CDs
  • jonhohle3 hours ago
    It’s worth getting the Quake shareware disc for the NIN soundtrack. Official track names are now available following the vinyl release a few years ago. This is the only CD release of the soundtrack. Just don’t forget to skip track 1.
    • Lammy6 minutes ago
      > Just don’t forget to skip track 1.

      There is very slightly more to it than just the mixed-mode sessions: the audio tracks on the Quake CD were mastered with pre-emphasis, so your ripper or player needs to apply corresponding de-emphasis EQ in order for them to sound correct. 1996 was actually a strangely late year to find any CD mastered with pre-emph; it was mostly an '80s thing: https://www.studio-nibble.com/cd/index.php?title=Pre-emphasi...

      On top of being a technique that had long fallen out of common use by that time, Quake has the pre-emphasis metadata flagged in the subcodes but not flagged in the TOC, so some software players/rippers like (annoyingly) Exact Audio Copy won't heed it: https://wiki.hydrogenaudio.org/index.php?title=Comparison_of...

      Here's a side-by-side comparison — my EAC rip of my MacSoft version of Quake (left) alongside the output of `sox_ng deemph` for the same file (right): https://i.ibb.co/9m18CSsk/Emi-2026-08-17-18-52-48.png

      Although if someone has been unknowingly listening to the pre-emphasized tracks for thirty years, maybe the ‘incorrect’ one is what sounds right to them? :)

    • doubled1123 hours ago
      The data track never sounds very good. A little too industrial for my tastes.
      • 986aignan2 hours ago
        Now I'm curious if it's possible to make a data track that has at least some resemblance to actual music. That could be an interesting challenge if it can't obviously be ruled out.
        • jonhohle2 hours ago
          In each sector 2048 of the data bits are just bits, but each data sector also includes 12 bytes of sync, 4 bytes of metadata and 288 bytes of ECC that are not really controllable (if you want the disc to be readable). Then there’s the ISO 9660 on top that will impact the first few sectors. If you have a single file (say a zip/tarball/rar, image) you could limit that. Assuming you could mask the noise from the ECC at 75hz it might be possible.
        • BLKNSLVRan hour ago
          Sounds like the sort of thing Aphex Twin would do.
    • chungy3 hours ago
      Mind that every Quake release includes the same soundtrack, it's not just the shareware version ;)

      There's millions of such CDs in the wild, both shareware and fully purchased copies.

      • jonhohle2 hours ago
        Oops, I can see how that reads like only the shareware version is this way. It’s often cheaper if you’re just going for the music.
    • hadlock2 hours ago
      NIN and iD (re-?)released a vinyl record set for the 30th anniversary a couple weeks ago.
  • jasongill2 hours ago
    As soon as I saw "Quake Shareware" in the title of this post, I thought "Pray to the one you will pay!" which was what appeared on the screen when you ran QCRACK.

    I always wondered why Final Doom didn't unlock with QCRACK - I always assumed it was a bug with the keygen, never realized it wasn't possible to purchase it from the disk at all!

  • zf000022 hours ago
    I remember Microsoft had a time limited version of Office on cd-rom that was sold for a couple bucks at Kinko's. You could replace a .dll in it and that removed the time limit.
  • fullstop3 hours ago
    Ha, I remember buying the shareware disk and unlocking every game on there. Plus you got the soundtrack which was pretty cool.
    • andai3 hours ago
      Did it work as an audio CD, the way PS1 games do?
      • fullstop3 hours ago
        Yes, the game just played it as a regular CD. In fact, if you put a different disc in the drive it would play the tracks from there instead. There were also console commands to change the track, stop the music, loop, or even reload the disc information if you needed to refresh it after swapping CDs.
        • olyjohn2 hours ago
          Yeah, and I remember if you didn't have the audio cable that went from the CDROM into your sound card, you would never hear the tracks. It wasn't your computer decoding the music, the CDROM drive was simply doing the decoding, and passing the audio out into a CDROM input (just a line-level audio signal) on your sound card.
          • jaredhallenan hour ago
            I'd forgotten about those little cables. If I recall correctly, they were small round cables, with maybe four conductors and a little flat connector with a clip?
            • indrora38 minutes ago
              4-conductor audio, generally.

              Later on there was a generation of two-conductor cables that used SPDIF/PCM Audio instead of analog audio for better fidelity.

  • ekelsen3 hours ago
    Was there anyway to make this work unless every CD was burned with a different key used to do the encryption?
    • jasonfarnon2 hours ago
      No. That cracking group would have known a priori the phone call was a pretense, because id was very unlikely to press distinct CDs. So they could focus on conventional cracking techniques.
    • fluoridation3 hours ago
      A reminder that CD-ROMs are pressed from glass masters, not burned like CD-Rs. I wonder if anyone has tried something like this with burned discs, though.
      • kevin_thibedeauan hour ago
        The multisession standard actually afforded the possibility of CD-PROM; a hybrid disc with a pressed read-only session followed by a writable section. It was only used for Kodak Picture CD (not the same as Photo CD) to hold software in the pressed session. It also apparently standardized a magneto-optical hybrid that never made it to market.
      • ekelsen2 hours ago
        Yes, my point, if the answer is that there is no way this works without every disc being different.

        It was not possible to manufacture at the time at scale.

        • fluoridationan hour ago
          It's still not possible. You would need to make a unique master for every individual unit.
    • netsharc3 hours ago
      Maybe have n versions of the CD (maybe 16, or 32), so there are n decryption keys. When the buyer recites the code over the phone, the program run by the salesperson can identify which key is used based on the number.

      The hacker groups would be a little frustrated trying to find all of the different CDs.

      • duskwuff2 hours ago
        The setup costs for a pressed CD are substantial - manufacturing many different designs would have been much more expensive, and would have only slowed down crackers marginally. It's unlikely that this would have recovered enough sales to be worth it.
    • loeg3 hours ago
      Some sort of public key crypto scheme + including hard-to-change local device characteristics in the challenge.
    • kg3 hours ago
      You would need some sort of hardware serial number system for PCs and a whole security infrastructure to verify that the serial number being used for the unlock wasn't faked. Then you could do per-PC unlocks. I'm not aware of anything like that being widespread back in the Quake days, though these days every computing device you own probably has a unique ID burned into ROM somewhere.
      • chocochunks3 hours ago
        Supposedly Xbox One+ discs are individually serialized which was originally going to be used for their DRM system at launch that was walked back.
  • netsharc3 hours ago
    Man, if I were id, I'd sue the hell out of Testdrive for selling me that broken security system...
    • jhy2 hours ago
      But it sounds like it wasn't Testdrive's fault; iD implemented it incorrectly. Their phone support weren't issuing the decrypt code, just a simple checksum:

      > Described as is, there is no flaw in this process. The secret seed comes from the unlock server, tied to a CHALLENGE/SERIAL that could not be reused. But the hacker team GNOMON found a way.

      > The QUAKE unlock program FLOW.EXE that ships on the CD is capable of generating the SERIAL from the CHALLENGE on its own. All it does is check that its own locally-generated SERIAL and the SERIAL entered by the user match! The entire protection mechanism relies on security by obscurity.

      • codebje44 minutes ago
        If the phone support issued the decrypt code, you could just replay that same code for every CD stamped from the same master.

        If phone support issued an encrypted decrypt code that could only be used with your challenge code to decrypt the decrypt code, replay wouldn't be as trivial.

        Every CD is identical, so no matter how iD went about this there's only ever one decryption key (per title, I assume) and those keys must either have been encoded in iD support's response, or already stored on the CD. TestDrive sold iD on the notion that the process was too hard for hacker groups to reverse engineer, and it wasn't.

  • classichasclass3 hours ago
    Man, those CompUSA and Computer City pictures take me back. Spent too much time there (when the 7300 was my regular Mac, the CompUSA "Apple store" was my primary source of software). Probably still have some of those free Computer City floppies in a drawer somewhere.
  • toast02 hours ago
    > A gamer could go to any of the hundreds of CompUSA/Computer City stores and buy the CD for $9.95.

    I'm pretty sure I bought it for $6.66

  • thaumasiotesan hour ago
    > Upon contacting the operator, users were to also communicate a "SOURCE CODE". It played no part in generating the Unlock code. It may have been a way for the distributors to claim a transaction fee. Browsing eBay, I found many with names indicative of past/present retailers. 12-BSTBY BestBuy, 24-CCITY Computer City, 22-CUSA CompUSA, 88, 11-1111, 38-EB Electronic Boutique, 44-FTRSP Future Shop (Canada), 34-EGGH Egghead Software, and 56-MCTR Media Play/ Musicland.

    Why do we think that CCITY is a code for Computer City and not Circuit City?

  • andai3 hours ago
    I was wondering how it was economical to burn every CD with a different key. Turns out it was not!
  • kristianp3 hours ago
    The "incredibly expensive Intel Pentium" image link 404s.
  • andai3 hours ago
    That box art is so cool. They don't make em like they used to!
  • ranger_danger3 hours ago
    Is it really fair to call these such algorithms "security through obscurity"?

    By that logic, wouldn't real symmetric crypto also be considered the same, since it's still just math that similarly swaps the data with other bytes, based on an "obscured" password or key?

    • _def3 hours ago
      The obscured part was pretending the unlocker needs external information
      • chungy3 hours ago
        I guess they could have done a public/private key pair in 1996, but doing that over a phone call was going to be painful. A simple password read over the phone and verified by the software was the best solution at the time.

        Mind, this was also intended for a world where internet connectivity was not to be expected. The majority of PC owners were not online.

        • ekelsen3 hours ago
          How would your scheme work? You use RSA to encrypt the entire thing? Or you use it to get a key for a block cipher and then use that?

          I feel like either way, you'd need the key to be different for every CD, otherwise you could just share the shared key. But if the encryption of every CD is different, why not just share the block cipher key directly? They can have a list of CDs and the associated key(s).

          What additional security or functionality does an RSA like step add here?

        • smackeyacky3 hours ago
          Which is true, so the distribution of the software cracker would have been fairly limited I would have thought.
          • chungy3 hours ago
            Sneakernet was common also. Say you have a class of 30 kids, and one of them has access to Usenet to grab qcrack.zip. He'll put it on a floppy disk and share ;)
            • soneil35 minutes ago
              yeah, software travelled exactly the same way as rumours that such and such had a rib removed - remarkably effectively.

              Also the same way we got viruses, long before anyone I knew had the Internet.

            • mikestorrent2 hours ago
              Hells yeah qcrack.zip
          • edoceoan hour ago
            BBS, zmodem
          • mikestorrent2 hours ago
            I was 12 years old and had qcrack on a floppy from a buddy. Everyone had it. Didn't even have to have internet.
    • 1970-01-013 hours ago
      I think you right, however they left all the right clues to decrypt it in days. You really don't want to do that.
  • logicallee3 hours ago
    [comment withdrawn]
    • ydj3 hours ago
      The computers in the photo and the layout of the store and signage are also quite strange.
    • fabiensanglard2 hours ago
      That was an image I found in Google Image search. I should have done a better job to research the provenance and I appreciate being called on it. I have updated the photo.
      • vunderba2 hours ago
        Kind of sounds like the low‑background steel [1] problem all over again.

        I have a rather badly written tool [2] I made about 5–6 years ago. If you connect it to your Google Custom Search Engine (along with the appropriate CSE keys), you can quickly search, copy, and download images from before 2022. It also has a ban list so you can filter out Shutterstock, Alamy, and other heavily watermarked sources.

        The app is a hot circle of garbage code, but it might still be useful as a starting point.

        [1] https://en.wikipedia.org/wiki/Low-background_steel

        [2] https://github.com/scpedicini/truman-show

    • dennisnedry3 hours ago
      I fed the image into Gemini and it could not detect that it’s legit or AI, but in addition to the wrong store name, the other banner that’s supposed to day SOFTWARE says TWARE or something like that. It sure seems like AI to me.
  • brcmthrowaway2 hours ago
    If you were to do this today, how could you make it foolproof?
    • shoo2 hours ago
      there isn't a market for gamers buying games on CDs these days, so it's not really a problem that needs to be solved
  • kolanos3 hours ago
    This screw up ended up costing id Software millions in sales. With the Doom franchise they only included the first episode in the shareware version. But to save a buck I guess they decided this was better than mailing a second CD with the full game on it. Then doubling down on that greed by putting their entire game library on the disc. This is right about the time John Romero and John Carmack parted ways, can't help but wonder if this debacle played a role. And by all accounts Quake's development was painful, so imagine this happens after going through hell getting a game out the door.
  • ButlerianJihad3 hours ago
    Okay, I haunted CompUSA in my teen years and I purchased my first 386 system there. So the photograph included in this blog seems bona fide.

    Except their logo or name was never "Compu USA". Where in the world did they get a store hung with signs that all say "Compu USA"? Is this some Mandela Effect that has me in its clutches? The business was definitely never named or branded that way. I did my Wikipedia and Bing Images research. There are no serious search hits. Gemini is giving some truly b.s. explanations that I do not believe.

    Is this a concrete example of a USA store tolerating mis-branded signage... inside their own store? Or is it some third-world knockoff? The merch on the shelves, the bros shopping for themselves, the tie-wearing salesmen, they all seem totally legit. What kind of big-box computer store lets that happen to their signage?

    • fabiensanglard2 hours ago
      I made a mistake when I researched photos for it and found "one" without sources. You are right this photo looks shady. I have replaced it (with source).
    • dennisnedry3 hours ago
      It’s not Mandela effect, it’s AI.