How a 39-Day Crack Killed id Software's Direct-Sales Experiment

Fabien Sanglard has published a teardown of the 1996 Quake shareware CD-ROM, the disc id Software sold for $9.95 at CompUSA and Computer City with the rest of its catalogue — several DOOM versions, Hexen, Heretic — sitting encrypted in the leftover space. Buyers were meant to call 1-800-ID-GAMES, read out a challenge number, pay, and get an unlock code back.

The flaw is the kind that still ships today. The unlock tool, licensed from TestDrive Corp, generated a serial from the challenge and then compared it against what the user typed. The serial carried no secret; it was only proof of payment. The hacker group GNOMON worked this out and released QCRACK.EXE 39 days after the CD hit stores, able to derive a valid serial from any challenge. Sanglard walks through the derivation, which was reverse-engineered in 2016 by rmolina: a game ID indexes an encrypted SKU database, a codename pulls a 512-byte record, and offset/depth values walk a table to produce the final number.

Supporting details make it worse. The encrypted SKU.17 file has a plaintext twin, SKU.TXT, elsewhere on the disc. Temporary files, editor backups, and an unused ENCRYPT.EXE shipped too. A typo in the SKU table capitalised "Final", meaning Final Doom could not be unlocked by paying — crackers got a better experience than customers.

Sanglard quotes David Kushner's Masters of Doom on the aftermath: fulfilment spun out of control and id was left with roughly 150,000 CDs in a warehouse. The article does not claim the crack alone caused that.