†Move to block 0232, position 006F, and change to 01
Move to block 0005, position 008C, and change to 01
Move to block 0233, position 019F, and change to 60
Move to block 0233, position 01B3, and change to 01
Move to block 0233, position 01C7, and change to 01
Move to block 0005, position 0082, and change to 80
-
4th Dimension
v2.01
A-342165175449
B-302260105256
C-362106850509
D-205200607255
D-225490055617
D-302200129276
D-342002870616
E-245191050449
E-332300119683
H-203030825071
H-243178434494
H-244656412618
H-282650130833
H-302304109610
H-382704134633
I-302502133617
M-362304172827
N-302000207053
N-382908192038
O-205376978623
O-262105273925
O-302101218161
O-342301152649
P-205230003253
Q-243126514449
R-205270127273
S-243160352309
S-244397274027
S-342590516249
T-302092506051
U-302191537161
V-302290527273
V-342104143616
W-243387755207
W-322505173725
X-242064960694
X-382806163033
Y-332305915083
Y-342104173749
Z-342000985694
v2.2
A-342165175449
H-243178434494
O-262105273925
U-302191537161
B-302260105256
H-244656412618
O-302101218161
V-302290527273
C-362106850509
H-282650130833
O-342301152649
V-342104143616
D-205200607255
H-302304109610
P-205230003253
W-243387755207
D-225490055617
H-382704134633
Q-243126514449
W-322505173725
D-302200129276
I-302502133617
R-205270127273
X-242064960694
D-342002870616
M-362304172827
S-243160352309
X-382806163033
E-245191050449
N-302000207053
S-244397274027
Y-332305915083
E-332300119683
N-382908192038
S-342590516249
Y-342104173749
H-203030825071
O-205376978623
T-302092506051
Z-342000985694
v3.0.1
34868520554560
v3.1
34868520554560
†v3.0.4
For 4D to recognize any disk as the key disk:
Search for: 0A00 0001 2207 8200 6700 FE82
Change to: " " 0000 " " " " " " " "
Search for: 660C 3F2E FF96 4EAD 1422 7E01
Change to: 4E71 " " " " " " " " " "
Search for: 6600 028A 47EC FE9E 7000 2740
Change to: 4E71 4E71 " " " " " " " "
Search for: 0A00 0001 802C FF4F 802C FF51
Change to: 0A00 0000 " " " " " " " "
Search for: 0A00 0001 802C FF4F 6700 FB30
Change to: 0A00 0000 " " " " " " " "
==========
v3.0.1
Partial Crack
1. Install the program
2. Make a copy of the program
3. Make the following changes in the copy:
CODE 31+$22E From 66 to 60
CODE 31+$290 From 6700 FE82 to 4E71 4E71
CODE 31+$44C From 6600 10FE to 4E71 4E71
4. Run the copy and insert the serial number: 34868520554560
This will create a preferences file on the hard drive
5. Delete the copy and run the original because the changes
cause crashes in the program. You will however no longer be asked for
a key disk at startup.
4th Dimension 3.0.1 On Line Help
Change CODE 3+$422E
From: 6718
To: 4E71
==========
v2.0.x
By following the directions below, you should be able to use just about an serial # you want (of the form A-123456789012) so share share SHARE AWAY!
(The following has been tested on 4D 2.0.10 and the 4D Runtime which came with it, though any 4D 2.x version should be similar enough)
CODE 1+$2544, From $FFAE, To $FF56
(if you are using a different version of 4D, search for the pattern:
486E FFAE 486E FF56
and change either of the two negative numbers so that one equals the other (either change the FFAE to be FF56, or change the FF56 to be FFAE))
(see also 4D Runtime)
-
4D Insider
v1.0.1
†To never see/enter the personalization just use this:
Code #47 +A00 6600 02B6 -> 6000 02B6
in the event that the above is an imperfect krak, remove it and try:
Code #47 +B20 57C1->7201
this will accept anything as a serial number, but you will have to repersonalize each time.
-
4D Online Help (GTec Systems - not ACIUS makes this)
v2.0.6
†CODE #3 +422E 6718->4E71
-
4D Runtime
†CODE 1+$2498, From $FFAE to $FF56
(see note in 4th Dimension if you have a different version of this file)
Note: It is CONCEIVABLE that the offsets may have changed between versions, so if you are having particular difficulty locating the pair of PEA instructions, scan for 486EFF sequences, and keep an eye out for a routine that looks like this:
MOVEQ #$1A,D0 | 701A
MOVE.L D0,-(A7) | 2F00
JSR *-$22FE ; 00171D1E | 4EBA DD00
MOVE.L (A7)+,D0 | 201F
MOVEQ #$41,D1 ; 'A' | 7241
ADD.L D1,D0 | D081
MOVE.W D0,D6 | 3C00
MOVE.B D6,-$00A9(A6) | 1D46 FF57
MOVE.B #$2D,-$00A8(A6) ; '-' | 1D7C 002D FF58
PEA -$0052(A6) | 486E FFAE
PEA -$00AA(A6) | 486E FF56
JSR *-$1FE8 ; 00172052 | 4EBA E016
MOVE.B (A7)+,$0010(A6) | 1D5F 0010
MOVEM.L (A7)+,D4-D7 | 4CDF 00F0
UNLK A6 | 4E5E
MOVEA.L (A7)+,A0 | 205F
ADDQ.W #$8,A7 | 504F
JMP (A0) | 4ED0
-
4D Network
†Search for: 4FBF CE60 0E42
Change to: 4E71 4E71 " "
-
4D Compiler
v2.0.x≤4
20996169929821
20996169928831
20996169927841
20996169926851
20996169925861
20996169924871
20996169923881
20996169922891
†v1.0
This patch does two things:
A) Tells the program not to look for the keydisk and
Instead of using the above patch you can get as many tries as you want by:
CODE 3+$40B2 From: 6C To: 60
and try the names below. See if you can match faces with the names and save the faces as screen dumps or write a description of the boxer.
The boxer's names are:
Lars Lugnut, Hammer McGee, Blam Blam, Glump Fistwhistle, Lefty Enright, Weegie Wonka, Clinch Roberts, Mac the ouch, and Butch McKenna
-
4th Right
Butterball (case sensitive)
-
8 Ball Pinball Deluxe
6267EM11002
† Place the contents from all three disks into a folder and run the application. Let it uncompress all three files, when it gets to the
Registration Dialog, CANCEL it and exit to Finder. Change:
CODE 4+$1B8E From: 660E To: 600E
CODE 4+$1BAC From: 670E To: 600E
or try
After you first take it off the disks, run it once so that it will decompress itself, then cancel and change:
To use anything as a registration number:
This part changes the application tampering check:
CODE 4+$1BAC From: 670E To: 600E
This part changes the dialog handling procedure:
CODE 4+$2E47 From: 670E To: 600E
OK, now to spice up your game:
To get infinite lives:
{How do you end the game? I dunno… Try it for practice!!!}
CODE 5+$3EEA From: 661C To: 601C
To set your number of lives:
CODE 5+$371E From: 0004 To: Whatever! Ex.
1 = $0001
2 = $0002
4 = $0004
9 = $0009
10 = $000A
11 = $000B
16 = $0010
17 = $0011
Get the idea? Remember to make sure it's 4 characters long when you type it in! Also, when you play, you’ll only see a '-' for your ball, because it thinks that because you've got n balls left, and it ends at 4 (5?), you’ve got 4 (5?) - n (Probably a negative number) left!
or try
To really crack 8-Ball Deluxe, after you’ve done the crack in the readme, change:
CODE 2+$2EB2 From: 67 To: 60
Then you can copy the files all over the place.
-
ABCBase
†Search for: A9F4 42A7
Change to: 4E71 " "
Search for: A9F4 4246
Change to: 4E71 " "
or try
Search for: A9F4 4246
Change to: 4E71 " "
-
Accelerator
A300-31239-CP4U
A300-11114-CP4U
A300-12935-CP4U
-
Access PC
v2.02
500056261
v3.0
0120 0000 0253 0278
-
Accountant Inc. Pro
18225
-
Accutext
v2.0
10900016
-
Acrobat
v1.0
MVW100R3100000-050-208 (50 User)
DEW100R3100564-885
-
AddDepth
AD-100-2-1272-46699
-
Adobe Illustrator
v3.x
AAW3021019783
†Name in ARTY 256 resource, organization in ARTY 257 resource.
-
Adobe Photoshop
v1.1
PCA100000100-953
PCA100002582-359
PDA100001185-501
PDA100001517-722
v2.0
PCA100000915-575
v2.01
PCA100000915-575
PCA107011754-639
v2.5a
"shakti"
(all LOWER CASE!!!)
v2.5
(same as 2.0x)
-
Adobe Type Library 1-265
†The "Type on Call bundle version" serial number would be:
AAB QWY SAHI MSRV
those are 12 letters however to add more fonts, you need to enter the 14 character. that would be CDW200B1753407
-
AD Disney Screen Saver
DIS-00670-6681
-
AD Star Trek Screen Saver
KAM-21289-8489
STM-00670-6681
EAM-30306-9708
†ADga 1+$864 From: 6706 To: 6006
ADga 1+$882 From: 6604 To: 6004
ADga 1+$896 From: 6704 To: 6004
ADga 1+$8F4 From: 57C0 To: 4E71
Anything will work as a serial number when running the Installer program - you cannot just drag the control panel into your System Folder. The Name, Organization, and Serial Number are stored in the 'InaP' resources in the After Dark control panel. They are encrypted - didn't bother to figure that out.
or try
The crack is in the script file, resource ADga #1
Offset Original Cracked
2AC 67 60
362 6700FEE4 4E714E71
7A4 66 60
864 67 60
88E 6FE0 4E71
896 67 60
8B6 6DE8 4E71
8E6 6DD4 4E71
-
AgentDA
v1.x
102800455
v2.0
101208510
-
Airborne
†Search for: 6712 4267 3F3C 01F4 42A7
Change to: 6012 " " " " " " " "
-
Alarming Events
03478
-
Aldus After Effects
XH9-SVJ1-B5K
-
Aldus Fetch
v1.0
51-1003-102157313
51-1000-201176607
51-1007-201194631
-
Aldus FreeHand
v3.0x
02-1235-002302134
02-3008-000036469
02-4008-200010087
02-6023-000345263
12-1234-123456789
-
Aldus IntelliDraw
v1.0
Try any of the other
serial numbers for Aldus
-
Aldus Persuasion
08-2009-000379488
08-2001-200201529
02-3008-000036469
-
Aldus PrePrint
v1.x
02-0001-100000000
11-1009-200021734
11-1000-200027072
-
Alias Sketch
v1.x
SMKB8MMKZ6SM8EV
v1.5
SMDFQHB3THRH4LJ
-
Alsoft Power Pack
PS001604(001)
-
Alter Ego (male ver)
†Search for: 24D0 5DE0 3584
Change to : 23D0 5DE0 3584
Search for: B07A 09B0 05A5
Change to : D1BC 0DA4 3EC8
-
American Heritage Dictionary
v3.0
A9-L0010M3
A9-D0010M3
-
Ancient Art of War
†Search for: 4EAD 02DA B07C 0022 6700 0100 42A7
Change to : 246D E8BC 2B6A 0002 E9F2 6000 0102
-
Animal Kingdom
†Search for: 3CBA 000C 4EBA
Change to: 4E71 4E71 " "
-
Animation Toolkit
†Search for:6608 45FA 0020 3012 9041
Change to :600A " " " " " " " "
-
Animation Works
45482
-
App-Doc Linker
817GrGn5jkfh78h
-
Apple Easy Open
0120 0000 0253 0278
-
Arkanoid
† If you don't like relying on chance for the right power capsule to drop down, there is a way to make yourself a winner. First, boot the program and begin to play as you normally would. Then, type: dsimagic. Then, resume your play. You'll see a capsule called DS drifting down the screen. Catch it an press A to regain sound, then press the following keys to obtain the type of power capsule and feature you want:
A= Sound on/off
B or W= break to next round*
C= catch;
D= extra balls (3 total)
F= go to last round (33)
L= laser;
M= get three balls
P= player (extra life)
S= slow;
X= let the computer play
0= pause
9= resume.
*On some versions, when you press B, you see a screen called Boss Comming instead of the next level.
-
Armor Alley
3P6GXEH
8CW659X
H3PJ69D
HQQCDHA
JMNR9SC
DE5A8R3
v1.0.1
PWPWD92
PWPX939
PWX2QHX
PWX8TX3
PWX963Y
PWX99W6
PWXCAF9
PWXDEB2
PWXFL8Q
PWXL55F
PWXL98N
PWXN59J
PWXQHGF
PWXQNAH
PWXQNDN
PWX56SM
PWXT8BA
PWXWNQ9
PX29LNM
PX2B5N8
PX2BAHW
PX2D8E9
PX2DTES
PX2E9T8
PX2EQSG
PX2ES8L
PX2F9T6
PX2HF8Q
PX2J9YE
PX2JN98
PX2LFLM
PX2LLT5
PX2MD9A
PX2MW6X
PX2NPX5
PX2PY2R
PX2QAE8
PX2QP3X
PX2T3B6
PX2TJL9
PX2W6DW
PX2W6HY
PXC6FHX
PXC8A59
PXC8DWS
PXCBG5J
PXCEJJ9
PXCETED
PXCF5SS
PXCGRFQ
PXCHWSM
PXCJ3Q2
PXCJD35
PXCMN6B
PXCP3CA
PXCT52Y
v1.1
EXC2H3Y
EXC53RH
EXC5F33
EXCA992
EXCE8AT
EXCEDJM
EXCJMBF
EXCLBL6
EXCMTCN
EXCNCEP
EXCQRF5
EXCRR6X
EXCSDLL
EXCY2PP
EXD3XPA
EXD89FT
EXDB85R
EXDFPA5
EXDGPPG
EXDH8NL
EXDLAB2
EXDMWHM
EXDREBM
EXDS2QL
EXDTCHB
EXDTY9M
EXDYGQX
EXE3NMF
EXE669P
EXE9583
EXE9QQ3
EXEALLY
EXEDA9C
EXEEXRF
EXEFRMC
EXEHR25
EXEMPJL
EXEQR3E
EXESPMC
EXESXH2
EXEW6T5
EXEXSS3
EXF26LF
EXF3NWH
EXF58G6
EXF5HF6
EXFCBTG
EXFCJXJ
EXFFBFB
EXFFEHW
EXFLMYX
EXFNQ82
EXFR2NC
EXFSNBN
EXFWLQX
EXFWRHR
EXFX6NQ
EXG2A96
EXG563R
EXG8YW2
EXG9G9F
EXG9T2H
EXGBDS5
It appears that
any variation of the
C9X53TA serial
number works fine:
C9X53TA
C9X53TB
C9X53TC
etc.
also:
A3A56T3
A3A56T5
A3A56T8
A3A56D8
† To play a multiplayer game of Armor Alley, each copy needs to be registerred with a different serial number. These serial numbers are for Armor Alley™ 1.0.1. Some may have typos. Just make sure there is no Armor Alley prefs file in the system folder so you can register Armor Alley with a new serial number.
-
artWORKS
†1.0
This is a two step crack:
Step #1: To get bogus personalization info into the program, and have the program init itself, change:
CODE 148+$00DC From: 6728 To: 6028
+$0116 From: 6670 To: 4E71
+$011E From: 6D66 To: 4E71
+$018A From: 6714 To: 6014
+$07E2 From: 670A To: 4E71
Run the program and personalize it, then quit and:
STEP #2: To make it believe the personalization is valid and skip repersonalizing, change:
CODE 14+$09B2 From: 6400 0224 To: 6000 0224
+$0BDE From: 6E00 0094 To: 4E71 4E71
Now you should have a personalized artWORKS that works perfectly!
Note this may or may not remove the network copy protection, but I think it probably does.
-
Ascend
†Change code #80 offset 05f0 from 66 to 67.
and just enter a name in the licensed to
and leave the rest blank under registration.
-
Ashlar Vellum
01399
-
Astound
3006005109
-
Atlas
v1.2
†Search for: 4EBA F9AA
Change to: 4E71 4E71
Search for: 6704 4EAD 02E2 42AD
Change to: 6004 " " " " " "
-
AutoDoubler
vb12
tioga
-
AutoMenus
†Search for: 4A00 6600 00B0
Change to: " " 6000 " "
This will allow unlimited boots past the demo period.
-
Aztec C
†Aztec C (1.00c)
Change block 71 (decimal) byte $1A9 from 01 to 00
==========
v68K-C (commercial ver)
Apply this to sys:
Copy both disks with Diskutil or any program that will copy both disks. There are no bad blocks on the disk. Apply the following block patches:
Block 214 Byte 107 From: 01 To: 00
Block 212 Byte E0 From: xx xx xx xx xx xx To: 30 30 30 30 00 00
Where xx is the value of the serial # on your disk.
Apply to sys2:
Block 63 Byte 97 From: 01 To: 00
Block 61 Byte 6F From: xx xx xx xx To: 30 30 30 30
There’s a hidden serial number on the disk. It’s on Block 212 Byte E5-E6. Just zap it to 00 00. No need to do this on the second disk as the serial number (visible) is just junk, and the invisible one is gone.
==========
v1.06D,F
Search for: 5245 6000 FF2E 7001
Change to: " " " " " " 7000
==========
v1.7
In the file: SHELL.
Search for: 6700 00E4 3D7C 0001 FFAC
Change to: 6000 " " " " " " " "
-
BackBurner
03-1489-0280
03-1337-9988
† To fool BackBurner's personalization dialog into thinking any SN you enter is good, make the following changes to the BackBurner APP..
Search for: 4FEF 0022 6712 4EBA 005C
Change to: " " " " 6012 " " " "
-
Balance of Power
†Search for: 72A1 D3C1
Change to: 5AD0 60CA
Search for: 1B09 9629
Change to: 1C09 " "
Search for: 8BAF E645 DE98
Change to: EA69 7BA9 0AB5
-
Bane of the Cosmic Forge
†To eliminate the codes, use ResEdit, open Bane (on disk A) change:
CODE 1+$8406
From: 0C6D 0001 C268 6606
To: 3B7C " " " " 4E71
or try
Bypass the journal entry codes by changing:
CODE 14+$4020
From 4267 3F3C
To: 6000 01DA.
Bypass the rule book codes by changing:
CODE 2+$39E
From: 4EAD 037A
To: 6000 01F8.
-
Battle Chess
†Battle Chess 1.0, so you don't need the codes, change:
CODE 14+$3580 From: 486E FDB0 To: 6000 00C0
CODE 14+$364C From: 660E To: 602E
or try
The password dialog will never show up:
CODE 14+$32A0
To: 4E71 4E71
Battle Chess 1.01, so you don't need the codes, change:
CODE 14+$35A8 From: 486E FDB0 To: 6000 00C0
CODE 14+$3674 From: 660E To: 602E.
-
BetterWriter
v1.0.1
BW9112131832
-
Big Thesaurus
AxxxxBC
(A+B=C; x=any #)
-
Bola 32
†v1.1
Search: FFEC 0C40 000A 661A
Change: " " " " " " 4E71
Search: FFEE B0AE FFE0 6610
Change: " " " " " " 4E71
Search: FF16 B0AE FFF2 6606
Change: " " " " " " 4E71
-
Borrowed Time
†Search for: 2F10 4217 205F 4E90
Change to: 203C 99C4 5501 4E71
or try
Search for: A552 F6C8 44B0 3DC0 1564
Change to: CF40 9035 1857 73BB 1995
-
Brataccas
†Search for: 2F10 4217 205F 4E90
Change to: 203C 99C4 5501 4E71
-
Breach
†Search for: 6604 70FF 6088 0C6E
Change to: 4E71 " " " " " "
-
Brock Keystroke
†Search for: 6708 2F0E 4EBA FEAE
Change to: 4E71 " " " " " "
-
Bulk Mailer
†Search for: 675A 42A7 3F3C 01
Change to: 605A " " " " "
-
Business Filevision
†Search for: 6700 023C 4217 23B8
Change to: 6000 " " " " " "
Search for: 3E81 3B5F F2EE 4A6D
Change to: 4257 " " " " " "
Search for: 6C06 4EF9 0040
Change to: 6006 " " " "
-
Butler
1560216811
-
Cachet
CM0000045VPM
CM0000567VOM
-
Calculator Construction Set
†Search for: 0C40 0000 6700 0006 4EED
Change to: " " " " 4EFA " " " "
or try
Search for: 4EAD 00A2 0C40
Change to: 4E71 4E71 " "
-
Canvas
v2.0
2005355
1234567
(1st+6th digit=7th)
v3.0
3001700735
4753234241
2090414360
†To kill the ser# protection:
Search for: 6D00 FE94 0C6E
Change to: 600C " " " "
-
Capitalist Pig
†v1.02
CODE 4+$1F0E From: 6706 To: 6006
Also: to cheat break in at the inital setup dialog and set a breakpoint at SetUpDia +200 which is a MOVE.L #$F4240,-13A(A6) The $F4240 = 1,000,000 Decimal, which is the initial funds you start with simply change this value to say 100,000,000 or whatever you want.
-
Carbon Copy Mac
100003660
100003661
† No Checksum, etc. on the number; the serial number is REAL EASY to find with ResEdit, etc. Just change it and save changes, and presto — a “New Copy.”
†So that the password dialog will never show up, change:
CODE 1+$0088 To: 60
AMPC 42+$1D6EA To: 6060
$1D754 To: 4E71
-
Checkminder
†Search for: 3B5F F6C8 4A6D F6C8 6707
Change to: " " " " " " " " 6007
Search for: 101F 0A00 0001 670A
Change to: " " " " " " 600A
or try
Search for: 3B5F F6C8 4A6D F6C8 6706
Change to: " " " " " " " " 6006
Search for: 101F 0A00 0001 670A
Change to: " " " " " " 600A
-
Chequebook
†Search for: 6718 4267 3F3C 040B
Change to: 6018 " " " " " "
-
ChemDraw Plus
v3.0
Serial Number: 40770
Registration Code: CQXWPQ
-
Chem3D Plus
60086
KYAKRP
†If you’re using MS Word 5 and System 7, place the "EGO for Word" plug-in module in the Word Commands folder that is found in the folder containing the Word 5.0 application.
Keep the ChemDraw folder in the same folder as the CSC ChemDraw application
-
Chessmaster 2000
†Search for: A851 4EBA 30A8 42A7
Change to: " " " " " " 602E
Search for: 584F 4A40 6724 362E 0008
Change to: " " " " 4E71 " " " "
-
Chuck Yeager's Air Combat
†Code #2 +4742 B033->B034
-
Chuck Yeager's Air Combat Demo
†Here’s how to remove the two-minute limit in the demonstration version of Chuck Yeager's Air Combat:
CODE 04+$02A4 From: 6400 1110 To: 4E71 4E71.
+$145E From: 650C To: 600C
The first part removes the actual limit; the second part stops the game from telling you your time was up when you stop any time after two minutes.
-
Civilization
†The following list is all the questions you may be asked after playing for 1000 years after starting the program. They are very simple and you will be given an approximate page number. Every 5 or 6 items here I have given page numbers, so that should make the choice of what I am talking about fairly easy. If you answer wrong, you might as well quit. Wrong answers will tell you that you were wrong.
Picture of B2 Bomber Flight and Electricity
Scroll in Star Map Mysticism and Mathematics
Atom Theory of Gravity and Physics
Old Car Combustion and Steel
Piggy Bank Trade and the Republic
Bridge Construction and Iron Working
Black Pot on tripod(17) University and Medicine
Sword with Scarf Horseback riding & Feudalism
Statue of man with sword and scale Alphabet
Combustion engine Refining and Explosives
Soviet hammer cross Philosophy and Industrialization
IBM PC Computer Mathematics & Computers
Plain soldiers(35) Republic and Explosives
Hand holding hammer over inc. house Masonry and Currency
Coins and Dollars Bronze Working
Three hands over flag Philosophy and Literacy
Kite in lightning Metallurgy & Magnetism
Circuit board Enginerring and Electricity
Circuit design under ruler Wheel and Construction
Explosives Gunpowder and Chemistry
Castle on Hill Masonry and Monarchy
Man with Wings Combustion and Physics
Two Atoms splitting Nuclear Power and Superconductor
Molecular Splicing(47) Medicine and the Corporation
Old gun with Gunpowder Bag Invention and Iron Working
Factory emitting Smoke Railroad and Banking
Old Phonograph Engineering and Literacy
Shield and Spears Bronze Working
Shaking Hands with Shovel and Axe Mass Production and Communism
Open book with 3 closed in back Writing and Code of Laws
Magnet(64) Navigation and Physics
Map Alphabet
3 Cars Automobile and the Corporation
Abacus adding machine Alphabet and masonry
Red Cross with Snaking lines Philosophy and Trade
Smelting Ore cup pouring(78) Gunpowder and University
Crown Ceremonial Burial and Code of Laws
Suppliant Meditating Ceremonial Burial
Ship Wheel Map Making
Nuclear Explosion Atomic Theory & Mass Production
Nuclear Sign Electronics and Nuclear Fission
Pensive Sitting Statue(86) Mysticism and Literacy
Wheel Scale with two arrows Mathematics and Navigation
Plastic Engine Refining and Space Flight
Train(92) Steam Engine and Bridge Building
Recycle Sign Mass Production and Democracy
Robotic Implements(112) Plastics and Computers
Rocket Advanced Flight and Electronics
View of Earth Computers and Rocketry
Steam Engine Physics and Invention
Pouring Steel Metallurgy and Industrialization
Two Meters Plugged into Wall Plastics and Mass Production
4 Men in front of Graph(118) Banking and Industrialization
Eagle on Globe Code of Laws and Literacy
Balls falling with arrows on sides Astronomy and University
Hands Exchanging coins(122) Currency and Code of Laws
Scholar's Cap Mathematics and Philosophy
Writing Quill(124) Alphabet
I couldn’t find the location of the $ in the game before, so finally I
said to hell with it, I’ll just find somewhere where it accesses it and hack
there. (It seems to only decipher the $ when it needs to and the encrypt/hide it as I had searched the entire range of program memory for it at various interupt points.) ... Anyways to make buying a unit/improvementt give you $32,000 (!!!) just do this:
Civilization CODE #14
+4E48 6E00B6FA->363C7D00
+4E6E 9750->3083
To make it give you $32000 whenever you sell anything (unecessary if yopu do
the first one, but the first one may be to much of a cheat for some people)
+5340 700AC1D0->303C7D00
+5352 D150->3080
of course these ruin the game, but hey so what you now know that you can
dominate the game and thus do not have to waste the rest of '93 playing it.
- courtesy of DOOM
Nemo’s cheat for Civilization! Sure the challenge of Civilization is the entertaining part of the game, but there's something to be said about nuking the shit out of the other guys. So, here's a cheat so that you can buy anything that’s being produced in your city without losing any money. Also it stops you from losing any money each turn by low taxes or whatever:
Change CODE 14 This patches the buying
Offset:$4E00 From: $6E12 To: $4E71
Offset:$4E48 From: $6E00 B6FA To: $4E71 4E71
Offset:$4E6E From: $9750 To: $4E71
Offset:$62F6 From: $9150 To: $4E71
Change CODE 13 This patches losing money each turn
Offset:$18B8 From: $6E00 0088 To: $4E71 4E71
Offset:$18DA From: $9150 To: $4E71
Nemo’s cheats for Civilization!
AKA - ‘Civilization Championship Edition’
Fifth Revision
Sure the challenge of Civilization is the entertaining part of the game, but there’s something to be said about nuking the shit out of the other guys. So, here’s a bunch of cheats that I made for ‘stress relief.’
i) Allows you to buy anything for your city without losing any money
ii) Stops you from losing any money each turn, for low taxes, or whatever.
iii) Allows you to see what’s under the black (where you haven’t been) on the map.
Unfortunately, you can't see other cities unless you’ve been there.
iv) Prevents Global Warming
v) Prevents you from losing any offensive battles.
Doesn't work for other people attacking you.
vi) Prevents losing troops and settlers from food shortages
Side effect - your cities don't grow.
vii) All items can walk on water!
viii) All boats can swim on land!
You can attack cities, but you can't take them over (yet).
ix) SuperTechnology - all technology takes one turn.
Enemy technology also takes one turn.
x) Airplanes can't run out of fuel.
xi) Build cities on water
xii) Troops can attack from boats or the water without landing
Change CODE 14 This patches the buying
Offset: $4E00
From: $6E12
To: $4E71
Offset: $4E48
From: $6E00 B6FA
To: $4E71 4E71
Offset: $4E6E
From: $9750
To: $4E71
Offset: $62F6
From: $9150
To: $4E71
Offset: $6316
From: $5350
To: $4E71
Offset: $6330
From: $5350
To: $4E71
Offset: $6354
From: $5350
To: $4E71
Change CODE 13 This patches losing money each turn
Offset: $18B8
From: $6E00 0088
To: $4E71 4E71
Offset: $18DA
From: $9150
To: $4E71
Change CODE 3 This patches the map
Offset: $3B28
From: $6712
To: $4E71
Change CODE 7 This patches the global warming
Offset: $5544
From: $6624
To: $6024
Change CODE 7 This patches the battles
Offset: $3DA
From: $672A
To: $602A
Offset: $40C
From: $662C
To: $4E71
Offset: $456
From: $6C06
To: $4E71
Offset: $590
From: $6E18
To: $4E71
Change CODE 14 This patches the food shortages
Offset: $37E8
From: $6600 0080
To: $6000 04AE
Offset: $6FE
From: $6600
To: $6000
Change CODE 11 This patches walking on water
Offset: $2118
From: $6600
To: $6000
Change CODE 11 This patches boats on land
Offset: $271E
From: $664A
To: $604A
Change CODE 14 This patches the SuperTechnology
Offset: $602C
From: $6C28
To: $4E71
Offset: $6046
From: $670E
To: $4E71
Change CODE 11 This patches the airplane fuel.
Offset: $3F74
From: $6C14
To: $6014
Change CODE 11 This allows you to build cities on water.
Offset: $1978
From: $6700 00DE
To: $6000 0096
Change CODE 11 This allows troops to attack from water.
Offset: $21FE
From: $662A
To: $602A
-
Claris Works
1120000
-
Coach & Coach Pro
1000001
1234567
(1st+6th digit=7th)
-
ColorIt
v2.0
CI20A-xxxxx
(Notice that it is
CI and not C1)
^-L one-^
-
Color Studio
CS27968
CS11305
-
Command HQ
†GetPassW +314 6?->60
-
Comment
1234567
(1st+6th digit=7th)
†v2.0
Search for: B02E FFFE 6604
Change to: " " " " 4E71
Search for: 4A28 0068 6600
Change to: " " " " 6000
Search for: 670C 206E 0008
Change to: 600C " " " "
This will cause it not to ever ask for name and serial number. if you really want a name and company name, type them in along with any serial number then use MacsBug to exit to shell (type ES at the prompt).
-
Compactor Pro
16225913
†v1.33
To register Compact Pro 1.33 and enable encryption, change:
CODE 4+$2EA4 From: 67 To: 60
When it asks you for the registration code, type any 8 characters. If you want to reregister your copy (to change the name), change any number of bytes in the CLOC resource (don’t change the size).
If you have a copy of Compact Pro 1.33 that won't enable encryption (if there’s an ‘*’ after your name in the about dialogbox and no ‘Set password…’ item in the Misc menu), make sure CODE 4+$2F44 is $66 (not $60) and reregister.)
Eliminates updating of the free trials left number, Get unlimited tries.
-
Copy II Mac
†To get rid of that stupid startup message in versions 4.3 to 5.2 change:
Search for:486E FECE 3F3C 0032 3F3C 003C
Change to: 6000 0204 " " " " " " " "
-
Cosa After Effects
XH9-SVJ1-B5K
-
Crash Barrier
v1.0?
1982487924
v1.1
852328092
v1.03
†Open w/ resdit, change:
cdev+$14D4 From: 2F0E 4EBA FDFA To: 4E71 4E71 4E71
Worked for me (version 1.03).
v1.1
Change:
cdev -4064+$4724 From: 6606 To: 4E71
-
Creepy Castle
†V1.0 (ATTENTION: Patch also disables internal virus check!)
So that the password dialog will never show up change:
In file ‘Data A’
CODE 4+$3D4E From: 4E56 To: 4E75
CODE 3+$7176 From: 4EBA To: 7000
+$7178 From: E582 To: 7000
or try,
In file ‘Data A’
CODE 3+$57B6 From: 6704 7000 6050 To: 6054 7000 6700
This patch will disable the game's automatic virus checker for the mods and it’s shorter somewhat. This will also make it so the trivia dialog will never show up:
In file ‘Data A’
search for: 4EBA E582 3B40 A7C0
change to: 7000 4E71 " " " "
search for: 0C85 60EB 6953 670E
change to: " " " " " " 600E
or try,
To bypass the Trivia dialog in Creepy Castle, change:
In file ‘Data A’
CODE 3+$56FE From: 2F07 3F3C To: 6000 00B8
So that the built in virus checker doesn’t detect the change the code
checksum:
In file ‘Data A’
CODE 4+$3DA6 From: 60EB 6953 To: 2267 9A4C
-
Cribbage
†Search for: FA75 C74C 511
Change to: FB74 " " "
Search for: 6851 8EDF 775C
Change to: 6950 " " " "
-
Crimson Crown
†Search for: 2F10 4217 205F 4E90
Change to: 203C 99C4 5501 4E71
-
Crush Beta
tioga
(case sensitive)
†Search for:6704 7001 6002 7000
Change to: " " 7000 " " " "
Only search the resource fork. There are 5 or 6 places where this string can be found. You must replace all of them. When entering the “0” for the “1” in 7001, make sure to enter just one “0” and write each sector. That's it, happy crushing…
-
Cryptomatic
v1.01
346190
-
Curse of the Azure Bonds
†v1.0 (bw)
So that the password dialog will never show up, change:
CODE 7+$6772 To: 4E75
==========
v1.1 (color) (2/1/91)
So that the password dialog will never show up, change:
HOW TO: CHANGE THE WORD AT OFFSEA IN CODE RESOURCE 14 TO 4E75
[EH?!?!? Does some one have the offset?]
-
Cutthroats
†Search for: 6FDA 1006 6706 3B7C
Change to: 6004 " " " " " "
2nd Crack
Use Block Edit on block 44 and change byte 15D from 67 to 60 or try:
Move to block 002C, position 015D, change 67 to 60
-
Daymaker
v1.0
59AINA4AAOAC1G
v1.01
59AINA4AAOAC1G
13A39ADAAHA1QU
v2.0
59AINA4AA0AC1G
0148D-0F68F9-1F100
†v2.03
If the installer does not recognize your disks as originals, simply make these
changes to the installer with RESEDIT. Open the Installer file and change:
infn 1001+$456 From: 6704 To: 6004
+$562 From: 6704 To: 6004
+$462 From: 6EDE To: 4E71
or try,
(This is a partial CRACK)
Open the 'DayMakerInstall' file with ResEdit: To make it think the disks are
real install disks, change:
infn 1500+$0004 From: 4EBA 00BC To: 4E71 4E71
infn 1001+$0030 From: 4EBA 0ABA To: 4E71 4E71
To allow anything as a serial number, change:
infn 1001+$019A From: 6F0C To: 600C
+$01B2 From: 6704 To: 4E71
Daymaker 2.0 - Allows anything for a serial number.
in the file "DayMakerInstall"
“infn” #1001 +$1B2 $67->$66
-
Datebook Pro
TB6I14233S2KE1CS
buvc0z9s8h1n7dab
-
dBase Mac
0000000-00
-
DeBabelizer
v1.2.15
APB120-2836-14690
MC14-2836-1001340
v1.4.02
MC14-2836-1001340
v1.5
MC14-2836-1001340
†CODE 8+$1CB6 From: 6710 To: 6010
-
Deja Vu
†Before making these changes, you must do the following:
(1) Sector copy with format, tracks 1 to 58 from the original.
(2) Then sector copy tracks 60 to 79. Track 59 hangs up on all copiers.
then change:
Search for: 56C0 671E 7200
Change to: 51C0 601E " "
Search for: 56C0 6722 223C
Change to: 51C0 6022 " "
Search for: 6708 41F8 00EC
Change to: 6008 " " " "
Search for: 6748 486E FDEA
Change to: 6048 " " " "
Search for: 56C0 6720 322D
Change to: 51C0 6020 " "
Search for: 57C0 670C 41FA
Change to: 50C0 600C " "
Search for: 57C0 6716 41FA
Change to: 50C0 6016 " "
-
Deja Vu (Rubicon)
†Search for: 6708 4EAD 019A
Change to: 6008 " " " "
Search for: 6706 1B7C 0002 F58B
Change to: 6006 " " " " " "
-
Delta Graph Pro
2000002464
-
Desk Toppers
†Search for: OC40 FFAF
Change to: " " 0000
-
DiagnoSYS
v1.0
B102131444366
-
DietMac
†v1.0
Search for: 4267 42A7 3F3C 0
Change to: 60FA " " " " "
-
Dimensions
v1.0
DAW100R3104865-875
DAW100R3100720-191
PCA100000100953
-
Director
v3.0
D300-31239-CP4U
D300-11114-CP4U
D300-12935-CP4U
-
DiskCopy
†v4.2
To get rid of the dialog box, change:
CODE 1+$150C From: 67 To: 60
-
DiskDup
†v2.2.1
All you need is when at the “number of Copies” dialog field - just arrow key to the right of the number “1” and type 3 (three) blank spaces. This should register the application.
-
Disk Express II
JV103761
JE103744
JI103774
JV103735
JX103737
JX103763
JY103738
JZ103739
-
DiskTop
v4.0
06412
(any 5 #s)
v4.0x
(any 5 #s)
-
DMS
†DMS+
Search for: 0C6D 0034 8990 6700 0618
Change to: " " " " " " 6000 " "
==========
DMS 4.0a (messy crack, but effective)
Search for: 4A5F 671A 4267
Change to: " " 601A " "
Search for: B06D 82B0 671A 4267
Change to: " " " " 601A " "
Search for: 101F 6602 A9F4
Change to: " " 6002 " " (3 times)
Search for: C001 6766 102E 0008
Change to: " " 6066 " " " "
Search for: B240 662E 486E
Change to: " " 602E " "
Search for: 4A6D CF12 6766 102E
Change to: " " " " 6066 " "
-
Dollars & Sense
† Block (Hex) Byte From To
--------------------------------
425 146 6704 4E71
0FC 6700 6600
468 1E0 487A 6606
If you do not find these bytes on these blocks, you may have to search the disk.
Dollars and Sense A
Move to block 00B8, position 017C, change 56C0 to 4E71
Dollars and Sense B
Move to block 01A9, position 0146, change 6704 to 4E71
Move to block 01A9, position 00FC, change 6700 to 6600
Move to block 01D4, position 01E0, change 487A to 6606
Dollars and Sense C
Move to block 019E, position 01EF, change to 4E71
Move to block 019E, position 01F1, change to 4E71
==========
v1.3
Search for: 0A00 0001 6768 3F3C 0102
Change to: " " " " 6068 " " " "
-
Double Helix
DHMC180800011V30R1
-
Double Talk
† Change serial number in DATA resourse near the line 3D0. The serial
number is not exactly the same, it’s swapped to avoid detection.
-
Douglas CAD AutoRouter
v7.30
†guaranteed - Just hit cancel when asked for key disk
Code #5 +25F8 670C->4E71
OR
unguaranteed - but high degree of certainty - no key disk request at all
Code #5 +25E8 4267->6010
-
Douglas CAD Professional Layout
v7.30
†guaranteed - Just hit cancel when asked for key disk
Code #2 +2832 670C->4E71
OR
unguaranteed - but high degree of certainty - no key disk request at all
Code #2 +2822 4267->6010
-
Dragons Lair 2
†Search for: 426D 027A 0C6D
Change to: 4E71 4E71 " "
Be sure the folder format is EXACT! Put all files in a folder called DL2. The code is a 5 digit code, and this patch allows for any 5 digit combo. Even if you type a wrong serial code it will run the game anyway. Don’t forget to remove 32bit QuickDraw when running the game.
P.S. it hates MultiFinder. [and therefore probably bombs under S7?]
When your game is over. Just hit "0" to start over.
Another patch that will get rid of the jump to the serial code dialog box
Search for: 6100 04C2
Change to: 4E71 4E71
The patch seems to work just fine and without the code dialog you do not have to insert a code.
-
Dragon's Lair 3
† Unlike DL2, the DL3 app is buggy under certain circumstances. Even though the data files are installed on the hard disk, DL3 will try to look in the floppy drive, anyway!
Here's wathca do:
Copy file "disk1" to disk named “EscDisk1”
Copy file "disk2" to disk named “EscDisk2”
.
.
.
etc...
You might as well run it off floppies so copy “Escape” app to "EscDisk1" as well. DRAGON’S LAIR WILL NOW RUN FINE!
-
DragonWave
†v2.0
Open up the DragonWave 2.0 application and change:
CODE 18+$F5A From: 6720 To: 6020
-
Dragonworld
†Search for: 4EBA 0052 4A40 6748
Change to: 604E " " " " " "
-
Dreams of the Phoenix Fix
† Many DOTP programs DAs and FKEYS have trouble on the Mac II. In particular DA Installer + Q&D Terminal, Q&D Dialer, AVailable key, super note pad. The problems vary from minor inconvenience to crashing. This patch will fix them all. It won’t hurt them in any way :-)
Search for: 3082 2040 0000 4E75
Change to: " " " " A000 " "
has to do with self modifying code. Change all occurrences.
-
DX-7 Patch Editor
†v1.15
Search for: 8438 3F3C 0001 A
Change to: 76BE " " " " "
-
EG Word
51122400002818
-
Electric Checkbook
†v1.0?
Search for: 3E1F 206E FCF0
Change to: 4E71 " " " "
v1.1
Search for: 67DE 4A46 6728 487A
Change to: 4E71 " " 6028 " "
-
Elements of Style
ESM 113904 T
-
Empower
Name:Administrator
PW:Admin
vI & II
Name:Administrator
PW:Admin
-
Enforcer
v2.9 (Old)
876855327801
-
Ensemble
†v1.0
Read block 338 ($152) change bytes as follows
byte
1A from 67 to 4E
1B from 92 to 71
7E from 67 to 60
If the original bytes are not correct then perform the following searches:
Search for: 6756 4267 3F3C 0001
Change to: 6056 " " " " " "
Search for: 6792 2F0B A983
Change to: 4E71 " " " "
-
Evelyn Wood
†(versions .5 to 1.0)
Search for: 3444 3F3C 0001 A9
Change to: 256E " " " " "
-
ExperLisp
†v1.4
Search for: 670E 2FFE 0008 486E
Change to: 600E " " " " " "
Search for: 6738 486D F1DC A851
Change to: 6038 " " " " " "
v1.02
Search for: 6738 4860 F200 A851
Change to: 6038 " " " " " "
Search for: 670E 2F2E 0008 486E
Change to: 600E " " " " " "
-
Faces
†Search for: 4240 4840 80FC 0030 4840 3D40
Change to: 4280 " " " " " " " " " "
It will ask you who beat Napoleon at Waterloo. The answer is Welling.
or try,
Here is the complete crack:
CRACK PATCH
Open Faces 1.0 with ResEdit and change:
CODE 3+$652 From: 486D 01CA To: 603A 4E71
+$694 From: FEED To: FED4
Open Color Faces 1.0 with ResEdit and change:
CODE 3+$7C2 From: 486D 017A To: 603A 4E71
+$804 From: FEED To: FED4
-
Fact Finder
†v1.0
Factfinder A
Search for: 6604 A002 6002 A003 3D40 0012
Change to: " " " " " " " " 4E71 4E71
Factfinder B
Search for: 670A 206E FEF6 2D50
Change to: 600A " " " " " "
Factfinder ?
Move to block 015E, position 016C, change to 4280
-
Fahrenheit 451
†Search for: 0C42 005A 6F00 0014
Change to: " " " " 4E71 4E71
The mod is (using FEdit) Sector 59 of the Fahrenheit 451 file - offset 39F (or if you like, Seg #2 of CODE) - change JSR (4EBA 00A0) to NOP's (4E71 4E71).
-
Falcon MC
†Game Controls:
Pause ------------------------------ P,Q,ESC
Return to Cockpit ------------------ Command R
Quit ------------------------------- Command Q
All Sound -------------------------- Command S
Music ------------------------------ Command M
Switch MouseSticks ----------------- Command T
Exiting the Simulation :
Abort Mission ---------------------- Command A
End Mission ------------------------ Command E
Eject ------------------------------ Command Option E
Jettison Keys :
Jettison tanks --------------------- Option T
Jettison all A-G stores ------------ Option K
Jettison ECM pod ------------------- Option C
General Controls :
Autopilot on/off ------------------- A
Chat ( head-to-head only ) --------- '
Ranging TWI on/off ----------------- H
View stores ------------------------ V
Waypoint increment ----------------- U
Waypoint decrement ----------------- Y
Detail Controls :
None ------------------------------- Command 1
Far Terrain ------------------------ Command 2
Gradient Horizon ------------------- Command 3
Mountains -------------------------- Command 4
Medium Terrain --------------------- Command 5
Complex Rivers --------------------- Command 6
Ground Detail ---------------------- Command 7
All -------------------------------- Command 8
Flight Controls :
Forward stick ---------------------- (UP ARROW), I, numeric keypad 8
Back stick ------------------------- (DOWN ARROW), M, numeric keypad 2
Left stick ------------------------- (LEFT ARROW), J, numeric keypad 4
Right stick ------------------------ (RIGHT ARROW), L, numeric keypad 6
Set narrow fisheye ----------------- F10, Option 0
-
Feathers & Space
†Search for: 6706 38BC FFC2 600C
Change to: 6006 " " " " " " (6 times)
-
Ferrari Grand Prix
†v1.27
Search for: 0280 1234 FFFF 48E7 7FFE 41FA
Change to: 4240 21FC D9CD B903 0A80 4E75
-
Fetch
v1.0
51-1007-201194631
-
Field Assistant
8E06D026670F0550
-
File Buddy
v1.6.2
M526 E803 J1120
†To reregister a registered copy, remove the prefs file.
or try,
This krak works for version 1.51 and 1.62 of FileBuddy.
You only need to search for the first four hex bytes of each step:
Search for: 6718 3F3C 0082 3F3C 0012 4EAD 038A
Change to: 6018 " " " " " " " " " " " "
Search for: 662A 3F3C 003F 486E FDC2 486B 0004
Change to: 4E71 " " " " " " " " " " " "
-
File Force
†1.0
X-442540368699
-
FileGuard
v2.0.2
Mike
v2.7.1
77151-111159-201238
00111-683277-201548
v2.7.2
67188-222480-206181
77151-111159-201238
v2.7.3
04264-904468-226561
†Change:
HIGH 5+$52 From: 4EBA 05E2 To: 4E71 4E71
This will block the whole routine ‘CheckLicence’ which checks if it is registered, and if another computer on the network has the same serial number.
-
File Maker
vPro
1120000
†(probably not for pro version…)
Search for: 6702 2854 200C 57C0
Change to: 6002 " " " " " "
FileMaker Pro 2.0 P/W Solved! (kind of)
Cool...is it a resource? If so, I'll run a ResCompare and see where the password sits in various files. Perhaps change the password by a small amount here and there, and hopefully come up with the methodology used to encrypt it...
Well, thanks to the clues I've figured out
how to find and eliminate FMPro passwords - and I've had a 100% success rate thus far (8 databases). I'm using SUM Tools (I know, I know, ancient but it works) which shows a 16-byte line of hex data.
What you should look for is the string 01FF. I think the reason
there was a problem, was because he was looking for XXXXXX01FF as his five unique bytes before the password. The first three DO change; 01FF seems to be common. Anyways, if you look for 01FF, you'll find a ton of them. You'll know you have password info when you see something like:
XXXX XXXX XX01 FF07 AAAA AAAA AAAA AAXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XX07 AAAA AAAA AAAA AAXX
Note: 01FF is what you're searching for
07 is the number of characters in this particular password
AAAA etc. is encrypted password data.
Note that 07 is mirrored two lines down. Change both the 07's to 00's, and that password is eliminated (it gets changed to '(no password)' in the selection dialog).
That's all there is to it! Keep searching and you'll get them all.
enjoy! And thanks to *TUC403* for doing the dirty work for me!
Nope, it's all in the data fork. I guess you could copy the data fork into a single resource, and use res-compare that way (I wrote my own compare routine, so haven't needed to try that. And... don't ask for it, it's a very poor hack, and I'd hate to show it to anyone!!)
Hmmm, I see that I'm going to have a late night hacking. The difference between what you've done here, and in the hack I was working on (the one that works 100% in FM II and Pro 1.0), is that there is also a single byte somewhere within the file that says "yes I do, or no I don't" have any passwords. Changing that 1 byte will make FM come up w/o asking for any passwords (just as if the file were not passworded).
Ok, I just came up with my notes, and here's what I found concerning removing passwords from FileMaker files...
FileMaker II (100% accurate):
Search String: C117 4002 01aa 42xx
The aa is data that doesn't matter (we just read it to move the pointer)
The xx is the password flag. Anything other than 01 means passwords exist, 01 means NO passwords
FileMaker Pro 1.0 (100% accurate):
Search String: C0C1 17C1 xx
The xx is the password flag. Anything other than 00 means passwords exist, 00 means NO passwords
FileMaker Pro 2.0 (75+% accurate):
Search String: C0C1 17C1 0540
Starting at the 40, replace with 42 0500 55AA 55AA C105 C0C0
so the line becomes:
C0C1 17C1 0542 0500 55AA 55AA C105 C0C0
That's it. I hope this helps anyone trying to crack it...
Ok, here's the crack for FileMaker Pro 2.0 files.
(it seems I was in the right area, but screwing
with the wrong bytes!)
He was partially right, in that you look for 01FF, and there are A LOT of them, but, if you look for 0301FF, there only seems to be ONE of them in the entire file, and this is the mark for the primary password! Look below...
______ xx
C0C10841 280301FF 0D385930 5E2B4A38
412F0200 00000008 01441642 0B4A1841
005F3DD8 00000000 0D185910 5EC0C0C0
xx
First, you search the database for 0301FF (I won’t get into which editor to use, but I use Norton). The following byte (in this case, 0D is a password length byte). Here, he was completely correct. Change this byte to 00. Next, 32 bytes away, you’ll see the same byte again, change it to a 00 also, an tada, it's fixed. Now, when you open the file, it opens straight up, without asking for a password.
The beauty of this method (over the one that I described earlier), is this still leaves all other passwords intact. The only difference, is that in the define passwords section, the main/primary password will show as (no password), and of course, you can change that. The previous method destroyed all passwords.
FileMaker Pro 2.0 Password revisited...
It appears that my previous post was a bit of “premature ejaculation,” uh, I mean “elation.” Every file I checked last night had the primary password preceeded by 0301FF, but files I’ve checked today don’t! One things for sure (so far) though, an 01FF followed by a byte, with that byte duplicated 32 bytes away, IS a password.
Here’s another wrench, I removed the passwords (using this method) from the Products DB file on here, it opened just fine, with FULL access to all fields, except that the Access Privs.. menu option is ghosted (non-selectable). I’ll have to play with that some more.
FileMaker Pro 2.0 P/W Solved!!!
Congrats! I'll check out the 03 trick right away... looks cool though; I’m thinking of writing a drag&drop that does just this. Worth my time, or will your Masterkey do this?
Bummer. Just read your message. I never had the access privs problem happen to me...strange indeed. I’ll look into it some more as well. I think the drag & drop is still very possible: Write a data fork search engine that looks for 01FF, then looks at the next byte, jumps 32 bytes and checks out the following byte. If it's the same as the byte following 01FF, then change both to 00. Ugh. Sorry, my brain hurts, and if that didn't make any sense then I’m not surprised.
Funny, though, did you check out the encoded passwords? I had a 7 character password of ‘aaaaaaa’, and it was encoded as:
C101 412B EA01 FF07 3455 3455 3455 34FF
FA48 6DC4 084E BAFA 943E 1F3D 4700 124C
DF00 C04E 5E20 5F07 1455 1455 1455 14C0
Interesting, no? It’s encoded as 3455 3455 3455 34 on the top line, and 1455 1455 1455 14 on the bottom. Also, I believe that the FF and C0 following the password is some kind of checksum (changing it brought up an error dialog when the database was being loaded).
That’s the same method I intend to use to find the p/w. I noticed that about the passwords last night... but haven’t been able to figure out the encoding (haven’t really tried though). I imagine if you gave a pw of “abba”, it should clue you in to something.
-
Filevision
†On block CE of the file Filevision, at byte 1B0 change 6604 to 4E71
or try,
Filevision Alternate Crack:
Search for: 6700 FEC6 (should be on Block 227, Byte 118)
Change to:..4E71 4E71
-
Finder 7 Menus
v1.3/2.x
cc5187efH28b911af
-
First Class Server
35058
v1.6
admin/password
-
First Things First
v1.x
101006058
101006048
v2.0
2001762695
v3.0
3001515541
3001677975
†Change CSEG 128+$6D3E From: 6716 To: 4E71
Restart after altering the Extension so that it will re-load the altered commands. Now it will accept anything as a valid serial number.
†If this expires you can get around it by changing:
CODE 24+$09D6 To: 4E71
+$09D7 To: 4E71
-
Foxbase
Serial #:FMD027877
Activate:emzxpyei
-
FrameMaker
v2.1
2-01320-27
2-01880-14
2-02071-17
v3.0
2-01320-27
2-01880-14
2-02071-17
2-150753-47
2-151967-07
-
FreeHand
v1.x/2.x
08-1004-0268684
v3.0
02-1235-002302134
02-3008-000036469
02-4008-200010087
02-6023-000345263
04-1000-000006699
11-1009-200021734
06-0001-100000000
02-0000-000000000
-
Frogger
† They named the Frogger program “Finder” and made it invisible, locked, and Bozo bit set, so just use setfile and undo all three and copy it to your disk, and then set the original back to the way it was. Now you have Frogger as a single file!!! One note of interest: After each game it executes the file named “Finder” Since that was what it was called. So if you don’t want to have to reclick on it everytime you want to play, then make sure the Frogger program is named Finder.
[One thing of note, under System 7, the Bozo bit is now the stationary bit (like any one used the Bozo bit anymore…). Since you can’t execute stationary :-), I don’t know how this will affect the program. Of course, it probably doesn’t work on System 7 anyways…]
-
FrontDesk
†Search for: 4EAD 046A 101F 675C
Change to: 4E71 4E71 " " 4E71
-
Frontier
v1.0
ULF.10108.100
-
Full Impact
v1.1
0000000-00
(XXXXXXX-AA X=any #,
AA = sum of x's)
-
FullWrite Pro
v1.x
0000000-00
(XXXXXXX-AA X=any #,
AA = sum of x's)
PN=1013409103 SN= 8052167-29
-
Fun Pak
†Search for: 4A5F 6708 48
Change to: " " 6008 "
-
Futuria
†Finder copy all the Files on the Futuria disk and then take Fedit to the file
Futuria.
Search for: 4EBA FC18 205F 4EFA FE16
Change to: 4E71 4E71 " " " " " "
or try,
Search for: 3CBA 000C 4EBA
Change to: 4E71 4E71 " "
-
FWB HD Toolkit
10033B7E
10829C71
10000B9S
(^-FWB’s :-) )
†HDT PRIMER
Search for: 6714 2F3C 0000 121F
Change to: 6014 " " " " " "
0r
HDT PRIMER Version 1.2.1
CODE 2+$1B82 From: 6714 To: 6014
HDT WORLD CONTROL
Search for: 6712 486D E46C 2F3C
Change to: 6012 " " " " " "
Or
HDT WORLD CONTROL Version 1.2.1
CODE 2+$107C From: 6720 To: 6020
+$134C From: ???? To: 6012
^^^^--(might be 6712?)
-
FWB CD ROM Toolkit
v1.0/1.01
C34012798
v1.0.3
C12348678
N90307999
†FWB CD ROM Toolkit 1.0.3
The serial number for 1.0/1.0.1 doesn’t work in 1.0.3. Here’s how to crack it (or you can just use the 1.0.3 Serial Number):
The personalization information is stored in the resource 'Font' ID - 4048, which must always have a size of 148.
The first byte is the length of the name, and the name is encrypted by XORing the bytes by $93.
The byte at offset $40 is the length of the organization and, the subsequent bytes are the organization itself, encrypted by XORing the bytes by $7C.
The byte at offset $80 is the length of the Serial Number, and the subsequent bytes are the serial number itself, encrypted by XORing the bytes by $E9.
The crack so that the serial number always looks good is:
cdev -4064+$56DA From: 59FF To: 5A00
Now any serial number in the correct format except C34012798 will work!
The personalization information is stored in the resource 'Font' ID -4048,
which must always have a size of 148. The first byte is the length of the
name, and the name is encrypted by XORing the bytes by $93. The byte at offset $40 is the length of the organization and the subsequent bytes are the organization itself, encrypted by XORing the bytes at $7C. The byte at offset $80 is the length of the serial number and the subsequent bytes are the serial number itself, encrypted by XORing the bytes by $E9.
The crack so the serial number will always look good is:
Then using MacZap 3.0, read block E6 using Address marks of D5ADAD (I think).Change the Address marks to the normal marks and write the block back to the disk. Use Fedit to write the changes to the code and unprotect,unlock & make visible the file CTEX.
2nd Gato 1.2
Search for: 4A01 6700 0006 4EAD
Change to: " " 6000 " " " "
==========
v1.3:
Search for: 6B00 00F6 203C 0000 0258
Change to: 6000 " " " " " " " "
==========
Gato
Search for: 4A01 6700 0006 4EAD
Change to: " " 6000 " " " "
-
Geometry
†Search for: 4E71 4E71 4E71 4E71 0280 ABCD
Change to: 4240 21FC 9FFB B503 0A80 4E75
-
GIF Converter
v2.2 (& up)
62-37-77-f4-de-a8-8b-b2
-
Go
†1.02
Go Questions:
The first golden age in the history of Japanese Go occured in which century?
17
Traditionally, the stones used in the game of Go are kept in what kind of containers?
bowls
The high quality white stones in the game of Go are made from what substance?
clam shells
Traditionally, the black stones in the game of Go are made from what substance?
slate
What is the term for mutual life in the game of Go?
seki
The Go game board 19 x19 has 361 positions called what?
points
What does one player say to the other when making a play that threatens capture of opponent stones?
atari
In what month and year was the first international computer Go competition held in Taiwan?
November 1986
Where are the first four handicap stones placed at the beginning of a game of Go?
Make these changes to a sector copy and then bit copy track#4 with any bit copier.
-
Hayden SAT
†Search for: 6608 45FA 003A
Change to: 4E71 " " " "
Search for: 6610 3F3C 0000
Change to: 4E71 " " " "
-
Hayden Speller
†Search for: 225F 508F 4ED1 4E56 FFC0
Change to: " " " " " " 4E71 4EF9 0000 E888
or try,
Search for: 4E56 FFC0 41EE
Change to: 4E71 6000 0AA8
or try
Search for: 4EBA 02BA 2E1F 4E5E
Change to: 4E71 4E71 " " " "
or try
Search for: 2007 0A00 0001 6700
Change to: 4E71 7000 " " " "
-
Hearts
†v2.2
Using TeachText, create a file named 'RP' that contains the word ‘Hearts’. Put this together with the files from the Hearts disk on a HD.
Hearts will not work on a floppy. It must be on a hard drive to work because on a floppy, it thinks there is a disk input output error (-36) when it trys to read the RP file. The original copy protection wouldn’t let you copy the RP file from the floppy using the finder or other file copying programs. Hearts checks this file and its contents to see if you have a valid copy. You had to bit copy the whole disk to make a copy. Although a normal copier couldn’t read the file, the Hearts program could but only if it was on the protected disk. It can’t if it was on an unprotected disk because it uses a different driver meant for the protected disk. This limitation doesn’t apply to the hard drive though.
There is one major bug: you can’t insert a disk after you start Hearts until you restart the Mac because the Mac will crash.
If Hearts doesn’t work on your Macintosh because it crashes at MCOD 45+$42, try changing MCOD 45+$3E from 6A to 60. This will skip over the part:
+$42 MOVE.B #$D5,$00FCC0E1
+$4A MOVE.B #$AA,$00FCC0E3
The address $FCC0xx is probably hardware I/O addresses for the old Macs. I couldn’t figure out what the $FCC0xx was for the new ones. These addresses are not the same on all Macs and programs that use them are bound to crash on some Macs.
This program works only under System 6.07 or earlier, not under System 7.0.
-
Heaven & Earth
†Search for: 671E 0C79 FFFF
Change to: 601E " " " "
Search for: 4EAD 0AEA 508F
Change to: 4E71 4E71 " "
The preceding patch was installed in the 13” color version after the install.
-
Helium
v2.0.2
40859
v2.1.1
2020-3000
† To register Helium 2.0.2, copy the cdev from the patched Helium cdev resource file (found elsewhere) into your Helium control panel replacing the old cdev. After quiting ResEdit, open Helium. If it wasn't registerred already, it will give an alert telling you what the registration code is. It will display the same alert if you type in the wrong code. To reregister under a new name or reset the 15 day limit on unregisterred copies, erase the preferences file in the preferences folder.
-
Hellcats
† I hacked into Hellcats to get rid of that annoying cp box. Load up Symantic Tools or the like and open a COPY of Hellcats and change:
(if this doesn’t work, try leaving that last word at 5257)
-
Home Accountant
†Search for: 4A6E FFFE 6D08 1D7C 0001 000C
Change to: 4E71 4E71 4E71 " " " " " "
Search for: 0240 0001 6700 FF74 3F3C 0FD2
Change to: 303C " " " " " " " " " "
==========
v1.02
Search for: 6D08 1D7C 0001 000C
Change to: 4E71 " " " " " "
Search for: 302D FE34 B06D
Change to: 302D FE32 " "
Search for: 662C 4267 2F0E 4EBA
Change to: 4E71 4267 2F0E 4EBA
-
HyperCard
†HyperCard 2.1
Remove password protection from HC stacks!
Just the IDEA that some bozo put in a password... ARGH! I have a problem with that. In your HyperCard 2.1 file:
Search for: 6704 6000 02A2 42A7 3F3C 008C 42A7
Change to: 60 " " " " " " " " " " " " "
for HC to accept any password you give it, and let you into the protection dialog (remember, to get pswd. dialog in a protected stack, hold CMD while choosing Protection from File menu).
You can still assign pswds to stacks you make, and the pswd protection will still work on other people’s HCs, unless they have also applied this Kpatch.
==========
2.0 Light (the copy that [used to] come with your mac)
To gain user level five do the following:
In the first card of the HomeStack: Hit [Command] + M
Type:go cd "User Preferences" [enter]
magic [enter]
Select Level Five (Scripting)
(They hid half the user levels with an opaque button over UserLevel 3,4,5)
NOTE: This does not work with Hypercard Player, which doesn’t allow Userlevels 3, 4, or 5 at ALL. Boo...
Talk about reusable code, these guys reused half the friggin program or more, including, hilariously enough the same copy protection routines down to the byte (ie they were compiled from the same source with the same version of the compiler) the only difference was at link time apparently. Thus these code changes are for CODE #72 for Informed Manager, and CODE #79 for Informed Designer 1.3.3
To simply run the program without personalization (from unpersonalized copy obviously) change
+D72 6600->6000 (believe it's personalized)
OR:
if you want it personalized then follow these steps:
1: change +F18 6642->6042 (allow anything for serial # when personalizing)
2: run the program and personalize (use anything you want for a serial #), Quit (duh).
4: that's it it should work fine, in fact the first change isn't needed anymore.
this is the best that can be done with an actual serial number as the check
for a valid serial # is also the check for wether or not to personalize.
-
In Control
v2.0
2000-0031184-1
2000-0031185-8
-
Infini-D
v1.x.x
01-1400-6350
31-9326-1679
v2.0.1
01-1400-6350
v2.5
01-1400-6350
01-1820-0916
31-9326-1679
†v1.02
Hex Changes:
Search for: 4EBA 0796
(You should find this 2 times, at Sectors 392 & 3FE)
Change to : 4E71 4E71
-
INIT Info Pro
B102131444366
-
Inline Sync
122343
-
Inspiration
v3.0.1a
4130T1247J6521
†Change CODE 1+$66CA From: 67 To: 60
Change CODE 24+$724 From: 67 To: 60
Change CODE 24+$74A From: 67 To: 60
-
Intellidraw
37-1006-000647252
-
Interlace
†v1.1/1.2
Search for: 0010 6600 003A
Change to: " " 4E71 4E71
Search for: 51C9 FFF8 4A42 66
Change to: " " " " " " 60
-
Ishido
†V1.1 bw
CODE 2+$0742 To: 4E71 4E71
==========
v1.1c
CODE 2+$07E0 To: 4E71 4E71
-
Jack Nicklaus Golf
†To completely skip protection dialog, change:
CODE 7+$D56 From: 670A To: 600A
or try,
In case that isn’t a full crack this one weeds its way through the protection code.
This is in the "Protect" routine - (the offsets are LOCAL OFFSETS-ie add $C8 to each to get the offset into CODE 2, as is shown in the first one)
CODE 2+$C8+$1DE From: 6D08 To: 6008
+$250 From: 661E To: 601E
+$282 From: 6700 FF0E To: 4E71 4E71
+$2CC From: 673E To: 603E
+$334 From: 6620 To: 4E71
-
KAI's Power Tools
Password: KPT273
-
Kid’s Desk
†To get to administrator mode type Command-Option-A
-
Kid Pix personalization
†Well, I know it's not a crack per se, but if anyone has a copy of Kid Pix with some other kid's name on it (other than your own kid's name, not your name, that is… Kid Pix IS for kids =) ), you can remove/change it in the following trivial Resedit hack:
Open the kID resource, open the one resource inside it, and you should see a short chunk of hex. The first digit is the number of letters in the name, and the rest of the string is the name. To change it, hilite the ASCII on the right hand side and type in the name you want ENCRYPTED in this ultra-secure, defense-department standard code: shift each letter one to the right (i.e., JOE becomes KPF)
-
Kid Talk
†Search for:6730 3F3C 0002
Change to: 6030 " " " "
Search for: 67B4 426D F750
Change to: 4E71 " " " "
or try
Search for: 6602 5200 5901 6AF4
Change to: 6018 " " " " " "
-
King’s Bounty
†v1.0
CODE 2+$47E4 To: 4E71 4E71
or try,
v1.01
Search for: 4EBA FB96
Change to: 4E71 4E71
or try,
v1.01
Search for: 4EBA FBA6
Change to: 4E71 4E71
Here's a little trick to get more gold, leadership, and commission…
Open one of your saved games.
with Norton, go to Sector 8 of your file.
On line 160: XXXX AAAA BBBB CCCC
the A’s and B’s are your leadership, put the same value in each, the C’s are
your commission/week. Yes, there is a 64K limit to your leadership and comm.
On line 448: AAAA AAAA
all the A's are your gold, just put 0F in the first AA and you'll have about
250 million.
-
Kiwi Envelopes
v3.x
KE301120RA
KE304244RC
KE311870RK
KE311120RA
-
KiwiFinder
v1.0
VB1011672KF
KE304244RC
KE301120RA
KE311120RA
KE311870RK
-
Kiwi Power Windows
10KPW002996b
†with ResEdit, in the second "LDEF" (ID 27420(?)), change the first four bytes
from "FFFF FFFF" to "0000 0000". You will now be able to postpone registering
at startup. Each time you start-up you have to postpone again.
-
KPT Gradient Filler
KPT273
(unlocks expert mode)
-
Kung-Fu Chivralry
†The continue password for Kung-Fu Chivralry is 90179240. This number is stored in hex format at CODE 5+$4EE2 and occupies 4 bytes. To make it so that you can continue no matter what you type, change:
CODE 5+$4EE8 From: 6600 0070 To: 4E71 4E71
If you do this and you don't want to continue, just type Command-Q and the current game will end and the program will go back to the main screen.
-
LabView
v2.2.1
SN 27645; PN 4224446-24
-
Legacy
†Search for: 6702 604C 4EAD 0112
Change to: 6002 " " " " " "
Search for: 670C 487A 00CC 4EAD
Change to: 600C " " " " " "
-
Lemmings
†v1.4.2
CODE 2+$1DE0 From: 6DC4 To: 4E71
+$1DE6 From: 6610 To: 6010
Lemmings Codes
Rating: FUN Rating: TRICKY Rating: TAXING Rating: MAYHEM
In case you might need it, the serial number is hidden in the Lightspeed C file sector offset 281, byte 320 in decimal ASCII, you can’t miss it.
-
Lock Finder 5.0 & above.
†
Search for: 3C38 0210 BE6D FF16 6730
Change to: " " " " " " " " 6030
Search for: 3C38 0210 BE6D FF16 674E
Change to: " " " " " " " " 604E
-
Lode Runner
†Search for: 6058 4EBA 00EA
Change to: 4E71 " " " "
Search for: 7E01 602E 4FBC
Change to: 7E1C " " " "
Lode Runner (new)
Search for: 6100 EBE6 42A7
Change to: 4E71 4E71 " "
-
Luscher Profile
†Search for: 3DF1 9C0F 2E
Change to: 5C37 0227 8B2C
-
Mac+ ][
†Search for:6700 0250 2C7C 0001 8000
Change to :4E71 4E71 " " " " " "
Mac+ ][ 3.0
Search for: 6700 0250 2C7C 00
Change to: 4E71 4E71 " " "
-
Mac a Mug
†Search for:4569 2487 18D6
Change to: 24AF BAA3 0A42
Search for: 31E3 70F7 C897
Change to: 36E3 " " " "
-
MacAttack
†1.0
Move to block 002F, position 0174. Change 67FA to 4E71
MacAttack 1.4
USE MACTOOLS, AND UNLOCK, UNPROTECT, AND MAKE VISIBLE ALL FILES. THEN, USE FEDIT, OPEN UP 'PLAYFIELD1'. Find 67FA 4EAD and change to 4E71 4E71 COPY THE FILES OVER USING MACTOOLS (LOCKED DISK) AND COPY PLAYFIELD1, SYSTEM & THE TWO FILES SCORES & STEMP,YOU NEED THEIR SYSTEM BECAUSE IT HAS TEN FONTS FOR THE GAME. YOU CAN, IF YOU WISH, TAKE THIS FILE AND USING RESEDIT, COPY THE FONT FILES FROM THE SYSTEM AND THEN PASTE THEM INTO PLAYFIELD ONE. THEN YOU MAY USE ANY SYSTEM FILE.
MacAttack 1.6
Search for: F49E 67FA 4EAD 023A 41ED
Change to: " " 4E71 " " " " " "
-
MacBackup
†v2.3
Search for: 6700 0026 317C 0001
Change to: 6000 " " " " " "
==========
v3.0
Search for:4EBA 0170 4A40 6700 0016 4EBA
Change to :4E71 4E71 " " " " " " " "
==========
v3.5
Search for: 4EBA 0170 4A40 6700
Change to: 4E71 4E71 " " " "
-
MacCommand
†Search for: 4EEA 0010 31FC 0001
Change to: 6000 E8F4 " " " "
Copy files MC, HIscore, and startup screen and MCScreen.
1. Using MacZap Tools, Change data marker to D5 FC AD, then read block 3A hex from original.
2. Change marker back to default (D5 AA AD), then write block to sector copied disk.
-
Mac Edge
†Search for: 4EAD 00E2 4A6D FA48 6624
Change to: 4E71 4E71 " " " " 4E71
Search for: 4EAD 00C2 4A6D FD14 662C
Change to: 4E71 4E71 " " FA48 4E71
Search for: 4EAD 00C2 4A6D FD9C 662C
Change to: 4E71 4E71 " " FA48 4E71
Search for: 4EAD 00D2 4A6D F534 6624
Change to: 4E71 4E71 " " FA48 4E71
Search for: 4EAD 00C2 4A6D F828 6624
Change to: 4E71 4E71 " " FA48 4E71
Search for: 4EAD 00E2 4A6D F81E 6624
Change to: 4E71 4E71 " " FA48 4E71
Search for: 4EAD 00DA 4A6D E652 6624
Change to: 4E71 4E71 " " FA48 4E71
Search for: 4EAD 00D2 4A6D EC06 661C
Change to: 4E71 4E71 " " FA48 4E71
==========
MacEdge II
Search for: 672E 4267 487A
Change to: 4E71 " " " "
Search for: 6752 4267 487A
(The rest is missing, pure speculation, but the next line might be:
Change to: 4E71 " " " "
But that’s a guess…)
-
MacEKG
v2.0.6
12345Z9L2416
-
MacFATS
†v1.0
Search for: 6600 00E4 3F3C
Change to: 6000 " " " "
-
MacFerret
Marty
-
Mac Fortran
†Search for: 6700 000A 43FA
Change to: 6000 " " " "
Search for: 6602 604C
Change to: 4E71 " "
==========
v2.0a
Search for: 361F 6616 487A 0C54
Change to: " " 4E71 " " " "
Search for: 6602 604C 3F3C
Change to: 4E71 " " " "
Search for: 0016 A017 4A39
Change to: " " 4E71 " "
==========
v2.0b
Search for: 6100 FF22 6600 0016 47A0 6B4
Change to: 4E71 4E71 4E71 4E71 " " 6B4
-
MacGammon/Cribbage
†Search for: FA75 C74C 511
Change to: FB74 " " 511
Search for: 6851 8EDF 775C
Change to: 6950 " " " "
-
Mac Golf
†Search for:21C2 022E 4A40 6700 002E
Change to: " " " " " " 6000 " "
MacGolf (font Change for nonstandard System)
Search for: 487A 04EF 487A FFE4 A900
Change to: 4E71 4E71 4E71 4E71 4E71
Search for: 3F3A FFDE A887 3F3C 000E A88A
Change to: 3F3C 0189 " " " " 000C " "
-
MacIndexer
†v1.0
Search for: 6700 00EA 486D F9
Change to: 6000 00EA 486D F9
-
Macintercomm
vLite 1.1.1
v1.1b21
ToasT (case sensitive)
†Open MacIntercomm Lite 1.1.1 with your favorite resource editor and
Find: CODE resource 2.
Find: hex offset 0B7E
change 4EAD to 4E71 and 1382 to C080
-
Mac Jack II & Poker
†Works on both games.
Open ‘Finder’
Search for: 2007 4FBC 00FF
Change to: 6016 " " " "
Rename ‘Finder’ to whatever. You will have to use Fedit or Mactools to rename as the Finder does not allow itself to be renamed from the desktop.
(To Change the routine that ejects and make it exit to the Finder, useful on Hard Disks)
Search for: A017 3D40 000E 4E5E
Change to: A9F4 " " " " " "
-
MacLabeler
v1.0
Search for: 0002 2E4E 4D00
Change to: 4002 " " " "
-
MacLink
v6.0
00678935
-
MacMatch
†Search for: 6616 4267 6016
Change to: 6716 " " " "
or try,
Search for: 4EBA 0690 101F 6702 A9F4
Change to: 4E71 4E71 " " 6002 " "
-
Mac Pascal
†Move to block 0209, position 0039, Change 41EE to 6000
Move to block 0209, position 003B, Change FFB0 to 008A
Move to block 0229, position 0105, Change 41EE to 6000
Move to block 0229, position 0107, Change FFB0 to 008A
Move to block 024B, position 01FB, Change 41EE to 6000
Move to block 024B, position 01FD, Change FFB0 to 008A
(Disk vs. file level)
SECTOR COPY THE DISK, THEN PERFORM THE FOLLOWING PATCHES..
SEARCH DISK FOR 41EE FFB0 Change EACH TO 6000 008A
(I FOUND IT IN ABOUT 8 PLACES)
SEARCH FOR B26E 0008 6702 60
TO 60
(FOUND ON 2 BLOCKS)
MacPascal V2.0 'Beta Plus'
Search for: 61 00 00 62 66 00 00 0A 61 00 00 C2
Change to 40
-
MacPassword
v3.8.7
Nov301954May261951
v3.8.8/3.9.0
Nov301954May261951
-
MacPlot
v1.6
Search for: 6738 4267 3F3C
Change to: 6038 " " " "
==========
MacPlots // 1.01
Search for: EBAF D364 2A7
Change to: 4E71 4E71 2A7
-
MacPublisher
†(mounted as 1st volume)
Search for: 316E 0014 0016 4268 001C A007
Change to: 317C FFFF " " " " " " " "
(mounted as 2nd volume)
Search for: 316E 0014 0016 4268 001C A007
Change to: 317C FFFE " " " " " " " "
==========
v1.25
Search for: 4EAD 0552 41ED 0552
Change to: 4E71 4E71 " " " "
==========
v1.3
Search for:6760 102D FF22
Change to: 6660 " " " "
Search for: 6626 102D FF22
Change to: 6726 " " " "
Search for: 6606 197C 0001
Change to: 6706 " " " "
==========
MacPublisher II 2.0
Search for: 8310 2DFF 0E67 24
Change to: " " " " 0E60 24
Search for: 1F0A 0100 01C0 0167 00
Change to: " " " " " " 0160 00
-
Mac Racquetball
†For harddrives. Enable you to use MacRacquetball on it without the reset.
Search for: D8FF 6C00 007A 4267
Change to: " " 6000 " " " "
Search for: 4EBA 5E92 91C8 317C
Change to: 4E71 4E71 " " " "
-
MacRenderman
v1.3
978862966
-
MacRISK
†Patch for Mac II, 1-bit mode ONLY:
Search for: C1E8 000C 48C0
Change to: " " " " 4E71
I don’t know what the programmer was trying to do, but the above patch will allow MacRISK to work on the Mac II without ExitToShell happening all the time. All it does is replace an EXT.L D0 with a NOP. D0 was already in long form from the result of a MULS and on the Mac II the EXT.L was making D0 go negative. Not too good for a handle size… (Try running it in 1 bit mode if you have problems)
The above patch will _ONLY_ work in 1 bit mode. To make MacRISK work in all modes on all Macs do the following long patch:
Search for:
4E56 FFFC
486D FBCC A910 XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX 4E5E 4E75 5341
Change to:
4E56 FFFC
486D FBCC A910 203C 0000 5080 A122 4A40
6702 A9F4 2B48 FBC8 A029 206D FBC8 2050
2B48 FBBA 3B7C 0040 FBBE 2B7C 0014 0000
FBC0 2B7C 0156 0200 FBC4 206D FBCC 4868
0002 486D FBBA 486D FBC0 486D FBC0 4267
42A7 A8EC 4E71 4E71 4E71 4E71 4E71 4E71
4E71 4E71 4E71 4E71 4E71 4E71 4E71 4E71
4E71 4E71 4E71 4E5E 4E75 5341
This patch completely rewrites the “save the bits” routine. If you really want all the details disassemble from "SAVESCRE"+0 to see the new code.
-
MacRobots
†Search for: 3CBA 000C 4EBA
Change to: 4E71 4E71 4EBA
-
MacroMedia
†All you need for a MacroMedia serial number is D310-12345-CP4U. The first set of numbers stands for the “D” in Director. The “310” is the version 3.1. “CP4U” is for all Mac programs. Therefore, using this formula you can get the serial number for any Macromedia program.
For example;
Macromedia Three-D would be T110-12345-CP4U for the 1.1 version,
and MM Accelerator would be A300-12345-CP4U for the 3.0 version.
The “12345” is any five numbers you want.
-
MacroMind 3D
T100-12407-CPU4
D300-31239-CP4U
-
MacroMind Accelerator
A300-12935-CP4U
A300-31239-CP4U
-
MacroMindDirector
D300-12935-CP4U
D300-31239-CP4U
D300-11114-CP4U
D300-13580-CP4U
v3.0
D300-31239-CP4U
D300-11114-CP4U
D300-12935-CP4U
†For a general serial # scheme for Director 3.0 try:
d300-AxBxC-CP4U where the x is anything you want and (A+B)/2=C.
For example d300-69696-CP4U works.
Or:
I think all you need for a MacroMedia serial number is D310-12345-CP4U. The first set of numbers stands for the “D” in Director. The “310” is the version 3.1. “CP4U” is for all mac programs. Therefore, using this formula you can get the serial number for any Macromedia program. For example Macromedia Three-D would be T110-12345-CP4U for the 1.1 version, and A300-12345-CP4U would be for the Accelerator version 3.0.
For all three of the Mac Zap series programs the serial number may be searched for and replaced. It is not converted to hex. For instance if your number is
'30' =$00003045 in ASCII, you may change those to $00000000 or anything else you wish. But first apply the patches below.
MAC ZAP COPY 4.1
Search for:B380 0C80 1122 3344 6600 025A
Change To :4E71 4E71 4E71 4E71 4E71 4E71
MAC ZAP PATCHER 4.1
Search for: B380 0C80 1122 3344 66ED
Change To : 4E71
and
Search for: 0010 A9C4 6600 E943
Change To : 4E71 4E71
MAC ZAP TOOLS 4.1
Search for: 11 2233 66ED
Change To : 4E71
Search for: 0010 A9C4 6600 E8E9
Change To : 4E71 4E71
-
Maelstrom
†1.02
I was plugging along through the Maelstrom code when I came upon a way to have the bonus timer count forward instead of backwards.
Search for: 700A 91AD FCB2 4AAD
Change to: 700A D1AD " " " "
This changes the SUB.L D0,-$034E(A5) to ADD.L D0,-$034E(A5)
or try,
1. Invincibility. When you should die because of a collision or a hit,
it says "Sweet!" instead and you live. Shields are no longer needed.
CODE Resource #2:
Location 06DE:
Old Data: 66 New Data: 60
Location 0752:
Old Data: 66 New Data: 60
Location 0B14:
Old Data: 67 1E New Data: 4E 71
Location 0B22:
Old Data: 66 10 New Data: 4E 71
2. Initial goodies (3x fire power, long shots, rapid fire, retro brakes).
Luck and shields are no longer important when you’re invincible, so
they’re not fooled with.
CODE Resource #3:
Location 0ECA:
Old Data: 42 6D FC EA 42 6D FC EC
New Data: 2B 7C 00 01 00 01 FC EA
Location 0ED6:
Old Data: 42 6D FC F0 42 6D FC F2
New Data: 2B 7C 00 01 00 01 FC F0
3. Initial bonus points in a new wave. Set it to whatever you want.
CODE Resource #3:
Location 1284: Old Data: 00 00 07 D0
or try,
Run Maelstrom, start a game, and then drop into MacsBug. type the
following commands:
sm (a5)-30e 1
sm (a5)-30c 1
sm (a5)-30a 1
sm (a5)-308 1
sm (a5)-306 1
then type:
g
When you return to the game, you’ll find you have quite a few goodies. You can selectively cheat by only executing a subset of those "sm" commands.
==========
v1.03
To eliminate the small rocks COMPLETELY, change CODE #2
+CB0 From 4EBA 21DE to 4E71 4E71
+C98 From 3F3C 0003 to 3F3C 0000
or
The Official Maelstrom 1.03 Cheat Guide
Here is a list of points.
Small asteroid -> 300 points
Medium asteroid -> 100 points
Big asteroid -> 50 points
Vortex -> 500 points
Autonominous mine -> 700 points
Super nova -> 1000 points
Hitting a steel asteroid -> 100 points
Blowing up a steel asteroid -> 5000 points
Big Enemy -> 1000 points
Little enemy -> 2000 points
Picking up a stranded pilot gives you and extra life.
Here is a list of cheats for Maelstrom 1.03:
The Official Maelstrom 1.03 Cheat Guide
To start playing on any level you like, hit the 'L' key while you are at the main screen. A dialog box will come up that lets you choose what level to start on. The 'Turbofunk' option makes the game run as fast as it can, instead of the constant 30fps it normally uses.
Here are some neat little cheats that make Maelstrom interesting. You’ll need Maelstrom 1.03 for all of these cheats, DO NOT try them with an earlier version (you might crash your machine).
You'll also need MacsBug; it is widely available on AOL and other information services. To install it, just drag 'MacsBug' and 'Debugger Prefs' into your System Folder and reboot.
Once you've installed MacsBug, load up Maelstrom 1.03 and hit 'P' to start playing the game. When you want to use a cheat, hit the interrupt switch on your Macintosh to drop it into MacsBug; take care to hit the right switch: one reboots the machine, the other will drop you into MacsBug. On Machines like the ][si (which doesn't have an interrupt switch), hold down the Command key and hit the Power On key to drop you into MacsBug.
Now for the cheats:
Type: SW (A5)-$338 1 <return> for ACME XQJ-37 Retro Thrusters
Type: SW (A5)-$336 1 <return> for Machine Guns
Type: SW (A5)-$334 1 <return> for Luck
Type: SW (A5)-$332 1 <return> for Long Shots
Type: SW (A5)-$330 1 <return> for Triple Shots
Type: SW (A5)-$384 #X <return> where X is the number of lives you want
Type: SW (A5)-$32C #300 <return> for Maximum sheilds
After you’ve finished cheating, Type: G <return> to continue playing.
I was plugging along through the Maelstrom code when I came upon a way to have the bonus timer count forward instead of backwards.
Search for: 700A 91AD FCB2 4AAD
Change to: 700A D1AD " " " "
This changes the SUB.L D0,-$034E(A5) to ADD.L D0,-$034E(A5)
NOW, SEARCH FOR:A0023F00 (SHOULD BE ON SAME BLOCK ABOUT, 10-20 BYTES DOWN)
REPLACE WITH:A0026098
3rd Crack:
Move to block 0153, position 0149, Change 3F00 to 6098
Move to block 0153, position 01B0, Change 3F00 to 6098
-
Math Blaster
†Search for: 56C0 4400 1B40 FF40
Change to: 51C0 " " " " " "
-
Mathematica
v2.03
Disk 1 PW:
1862-40876-83824-2660
†Mathematica 2.102 Enhanced
CODE #2 "Main2"
Global Offset Routine Name Local Offset From Bytes -> To Bytes
+603E ParsePas +4C 6600 00BC 4E71 4E71
+6052 ParsePas +60 6700 00A8 4E71 4E71
+6156 CheckPas +3E 6F24 4E71
+615E CheckPas +46 6C1C 4E71
+6E0A DoSealDi +130 6700 00CA 4E71 4E71
+6E24 DoSealDi +14A 6700 00B0 4E71 4E71
This allowed me to register with a bogus serial. Now network checking is still enabled, I believe, though I'm sure I could circumvent this easily too, but I haven't got a network with 2 machines with fpu's so I cannot test it. Instead, for now, I suggest changing the two longwords listed below as I beleive they are the keys that are unique to each copy of Mathematica - these may or may not have to be certain values, if so simply find these routines (by their name) in another copy of Mathematica and try the numbers there - chances are you have a second (nth) valid Mathematica. (PS: I have a high degree of certainty that these two numbers are the serialization keys, thus we should develop a list of them if any two #'s do not work [I haven't had time to check yet])
+6B46 GetProdu +6 xxxx xxxx
+6B60 GetMagic +6 xxxx xxxx
if this doesn't work try
+6CBC CheckSea +86 6704 6604
this probably won’t work for very long as I believe it calls “AnnoyNet” and “CheckNet” periodically - that is where to look if you need a net crack.
-
McCad PCB Design
†(v3.1 to 3.8)
Search for: 4E34 3FC0 0001 A9F0
Change to: 3CE2 " " " " " "
-
McCad Schematic
†v1.0
Search for: 55C2 3F3C 0001
Change to: 40A2 " " " "
-
McCad PCB/SMT
†v1.0
Search for: 53A8 3F3C 0001
Change to: 4268 " " " "
-
Meeting Maker
MV 000563
†Administration Pwrd:
admin
-
Megadesk
†Search for: 670C 3F3C 0002 1F3C
Change to: 600C " " " " " "
Search for: 6700 0114 4EBA EDFC
Change to: 4E71 4E71 " " " "
-
Megafiler
†Move to block 02A2, position 01C4, Change to 3EBC
Move to block 02A2, position 01C6, Change to 0100
Move to block 02A2, position 01C8, Change to 4E71
Move to block 02A2, position 01CA, Change to 4E71
-
MegaForm
†v2.0
Search for: 6700 00EE 4267
Change to: 6000 " " " "
==========
v2.1
Search for: 6700 00EE 4267
Change to: 6000 " " " "
-
MegaMerge
†v3.0
Search for: 6700 00EE 4267 3F3C
Change to: 6000 " " " " " "
-
MGM Cad
v2.5 II
220301
-
MGM Station
†v1.0
Search for: 671C 302E FFFE
Change to: 601C " " " "
Search for: 101F 0A00 0001 6704
Change to: " " " " " " 6004
==========
v1.01
Search for: 6728 302E FFFC
Change to: 6028 " " " "
Search for: 6704 4EAD 0262
Change to: 6004 " " " "
-
MicroLeague Baseball ][
†For the MLB Application:
Search for: 4EAD 0652 2000 6708
Change to: 4E71 4E71 " " 6008
For the General Manager Application:
Search for: 4EBA 11EA 4A80
Change to: 4E71 4E71 " "
-
Microphone II
v3.0
B 008617
†MicroPhone II 4.0
Contains a bug that prevents the program from downloading files to mounted volumes with more than 32768 blocks free. Here's a ResEdit patch you can apply to fix the problem. Use this only if you feel comfortable using ResEdit and ONLY with a copy of MicroPhone II 4.0. Do not modify your master disks.
Patch 1 fixes XMODEM and YMODEM. Patch 2 fixes Kermit.
Patch 1:
CODE 21+$192 From: 302E FFC4 48C0 To: 4280 302E FFC4
Patch 2:
CODE 31+$11A8 From: 302E FFEA 48C0 To: 4280 302E FFEA
-
Microplanner
†v4.4
Search for: 6722 487A 0052
Change to: 6022 " " " "
==========
Microplanner+ 5.2 - 5.7
Search for: 6700 00D4 2F0E
Change to: 6000 " " " "
-
MidiMac
†I had to dissassemble all of CODE 7. By following the code, I was able to
figure out how to decrypt code 7 (It's encrypted in three parts). To
dissassemble it I used Nosy by the way. I copied pieces of code 7 to decrypt
code 7 each time I came to a part that decrypts something. After I got all of
CODE 7, I had figured out all of the decrypting procs, trap and vector changes etc. When code 7 is done it's disk checks and copy protection, it uses code 6 to change the first jump table item to code 1+5744 and it decrypts the jump table (which is pointed to by A5+CurJtOffset and is the same info as in CODE 0). I copied the procedure that decrypted code 0 and used that to give my a copy of the CODE 0 resource, except decrypted now. CODE 7 jumps to either CODE 1+5744 or CODE 8+0. It changes the first jump table item to code 8+0 if you put in a copy (I guess) and then jumps to the first jump table item after
disposing itself. CODE 8 gives that big dialog that lets you install copies,
run the original, run the copy or return to the finder. If you put in the
original copy in the first place, it goes directly to CODE 1+$5744. The
_Loadseg instructions in the jump table call GetResource. GetResource was
patched by CODE 7 to decrypt CODE resources. I had the proc to decrypt the
other code resources, but I was missing a number, a creation date or longint
in the boot block I guess. By looking at the decrypted CODE 0 jump table, I
was able to figure out what the first bytes of each code resource were
supposed to be because they tell where in the jump table this code resource is used and how many items it has in the jump table. The decrypting proc uses
some calculation to get a byte each iteration to EOR with the CODE resource
byte. The procedure was complicated but it turned out (by tracing it) that it
was only adding $2D to the byte used to EOR with the CODE bytes each time.
Knowing this and what the eor byte should be for the first 4 bytes, I got the
number I was missing. (I only needed 8 bits of the 32 bit number). I replaced
all the resources with the decrypted resources and code 0 pointing to 1+5744
as the new start of the program and it worked! It seems none of the other
resources do any copy protection (except for probably code 8 which isn't used
any more because code 7 isn't used anymore). I made no patches, just decrypted the codes.
-
Might & Magic II
†COLOR V1.0.2 (with possible FREEZE, try out)
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 4
CHANGE THE TWO WORDS AT OFFSET 02F4 TO 4E71 2D49
-
Mind Prober
†Search for: 6718 486D F314 A851
Change to: 6018 " " " " " "
-
MindShadow
†Search for: 2F10 4217 205F 4E90
Change to: 203C 99C4 5501 4E71
or try,
Search for: A552 F6C8 44B0 3DC0 1564
Change to: CF40 9035 1857 73BB 1995
-
Mindsight
†v1.1
Search for 2924 3F3C 0001
Change to: 21CE " " " "
-
MiniCAD
v4.0+
1400-07710400
†v2.01
Search for: 5E2E 9F4E 7550 4154 204E 56FE EC
Change to: " " " " " " " " 2000 0000 00
Search for: FA3F 2EFF FE48 6EFE F14E AD02 02
Change to: " " " " " " " " F100 0000 00
==========
v2.43
Search for: BC6E 000C 6F00 00F4 42A7
Change to: " " " " 6000 " " " "
Search for: 200C 6700 00C6 4247
Change to: " " 6000 " " " "
-
Minotaur
†Network Crack:
CODE 6+$1D90 From: 67 To: 60
-
Mission Thunderbolt
†In the application:
$129 Change 1EF0-1FB0 to 0000-0000
Then just type RETURN when asked to enter the code
==========
v1.06
STRS #129, Change $1BF0-1CAF to 0000-0000
or
CODE 11+$280C From: 67F6 To: 60F6
-
The Mist
†Search for: F92C 443C 994E
Change to: D15D F737 " "
Search for: 6094 21A4 7948
Change to: 6794 " " " "
Search for: 101A 69D0 A505
Change to: 71DC F456 E3E0
-
MitemView
11089
-
Monopoly
v2.01
CODE 8+$3BBC From: 66 To: 60.
-
MORE
†Name in STR 63. Organization in STR 64. Personalized information is encoded.
-
More Disk Space
1982487924
†v1.1
Key words for successful use of MDS
To install, make a diskcopy image, boot from that floppy (very important). Go into options under file. Select which disk to install on (or sets of disks). Install (File menu). 2nd most important thing: Don’t let it go automatic on you. The automatic is eating people although we've had NO NO NO NO NO NO NO problems with it here or our collective 750 meg of hard drives on 7 machines. You can still reap the benefits of MDS by just smashing programs and games etc MANUALLY. You’ll still get 30-40 meg of hard drive space, your programs will not launch any slower, sometimes even faster and you won't have to publish any more messages about how it ate your precious files that you didn’t have backed up properly.
To remove MDS:
Run program from HD,
Hold down Command key
File menu’s formerly dimmed “Install” item will appear undimmed as “Remove”
Just make sure you have your hard disk selected in the options dialog or it won’t know which machine to remove from.
-
More Lemmings
† W I C K E D
02 - NICMITUODP
03 - OCCLWUGPDL
04 - CKLVUFOQDS
05 - GAHPVMHBEF
06 - IHSTDNGCEM
07 - MQTDJGEDEI
08 - QVMHGMMEEK
09 - VMHGAHVFEP
10 - ELGIHTTGEQ
11 - NGCLTTDHEQ
12 - GKLWVLJIES
13 - GEHQUDLJEM
14 - OISWLHGKEQ
15 - MPUDLGCLEQ
16 - PUMHGIMMEM
17 - UMHGEITNEJ
18 - DNGIHTUOEK
19 - HGCMUWLPEP
20 - GKMUUELQED
21 - GGHPTFNBFJ
22 - MHQTFNGCFR
23 - LPTGNGCDFM
24 - STFNGILEFF
25 - TGLGAHWFFN
26 - GLGIHVTGFF
27 - LGCLWTFHFE
28 - GMLWTNJIFF
29 - GAHSUGLJFO
30 - KHSUGLGKFJ
31 - MQUOJFGLFO
32 - SUGNGKLMFR
33 - UGLGCHWNFI
34 - FLGOHTUOFR
-
Morph
v1.1
1300670063
v2.0
1406016346
-
Mouse Stampede
†Search for: 3F3C 0006 4EBA 03EC 6000 0096
Change to: 4E71 4E71 4E71 4E71 4E71 4E71
or try,
Search for: 3F3C 0006 4EBA 0CEC 6000 0096
Change to: 4E71 4E71 4E71 4E71 4E71 4E71
-
Mouse Write
†v1.1
Search for: 6760 2F0E 4EBA
Change to: 6060 " " " "
Search for: 6700 0088 206E
Change to: 6000 " " " "
Search for: 6606 2F0E 4E
Change to: 6006 " " "
v2.3
Search for: 6606 2F0E 4EBA FF18
Change to: 6006 " " " " " "
Search for: 6700 0088 206E 0008
Change to: 6000 " " " " " "
Search for: 6606 2F0E 4EBA FD00
Change to: 6006 " " " " " "
Search for: 6706 2F0E 4EBA FC62
Change to: 6006 " " " " " "
-
Movie Magic
†To break the copy protection of Movie Magic, here’s what ya do. Use ResEdit to find the place where the copy protected name is stored. Simply backspace over it, deleting it. The name is also stored in the footnotes. If you disable it, the machine will bomb if anyone tries to use a footnote. So place an invisible box over the footnote box so no one will even think of using it in the first place.
-
MS Chart
†Search for: 6081 BEDD 608B BEDD
Change to: 4E71 " " " " " "
-
MS Excel
v3.0
00-065-0300-92000809
v4.0
00-065-0400-46250964
†v1.0
Search for: 608E BEDD
Change to: B103 6ADD
or try,
Search for: 37CF 0267 DD79
Change to: 00CF " " " "
or try,
MS Excel crack 1.0
Search for: 0000 A5A5
Change to: 045B BAAB
2nd crack
Search for: 37CF 0267 DD79
Change to: 00CF " " " "
MS Excel Serial # Removal
To remove the hidden ser# on excel, search for 7A43 5856 425A.
Change the *next* 3 words to 0000 0000 0000. Some may be zeros already.
-
MS File
†Search for: 1260 82BE DD
Change to: 124E 71BE "
==========
v1.02
Search for: 608F BEDD 608E
Change to: 678F " " " "
==========
v1.04
Search for: 608E BEDD 608F
Change to: 678E " " " "
-
MS Word
†v1.05
Search for: DD 6084 BEDD
Change to: " 4E71 " "
==========
v1.15
Search for: 608E BEDD
Change to: 4E71 " "
MS Word A
Search for: DD 608B BEDD
Change to: " 4E71 " "
MS Word B
Search for: DD 6084 BEDD
Change to: " 4E71 " "
-
MS Multiplan
†v1.02
Search for: 1260 8007 BE
Change to: 4E71 " " "
-
Multi-Ad Creator
100911030
100733861
100733861
100063800
100066120
v2.0
000002784
100911030
v2.2
100911030
000002784
v3.0
000716055
†For the General Manager Application:
Search for: 4EBA 11EA 4A80
Change to: 4E71 4E71 " "
==========
v3.0
In the application:
CODE 14+$1C56 From: 6776 To: 4E71
+$1D28 From: 6700 007E To: 4E71 4E71
+$1D2E From: 6700 00F2 To: 4E71 4E71
+$1D4A From: 6708 To: 4E71
+$1E26 From: 662A To: 4E71
This both cracks the program and removes the network check.
==========
v3.5
Forget the install process... Copy the disk files to your hard drive and extract the files yourself & put into a folder (files from disk 1&2 have to be done this way, the other can be run on their own), now in the application change:
CODE 10+$000E From: 67 To: 60
this works and gives me and registered to blank, serial #.
-
Multi Ad Search
100063800
100066120
-
Multi-Disk
PS001604(001)
-
Mutant Beach
000234
003557
-
myDiskLabeller
†v1.0
Search for: 6600 05B0 41ED 0352
Change to: 4E71 4E71 " " " "
-
My Office
†Search for: 6600 00A2 2813 6700
Change to: 6000 " " " " " "
-
Nascar Challenge
†Bill Elliots NASCAR Challenge:
CODE 3+$07E0 From: 6700 FF46 To: 4E71 4E71
+$07E8 From: 6604 To: 4E71
this totally removes the protection as you do not even have to press a key
or try,
Bill Elliot's Nascar Challenge!
As always, open it up with ResEdit (The Application 'benc').
CODE 3+$0B5E From: 6704 To: 4E71
This is quite a cool 'Turbo' feature.
CODE 12+$05D8 From: 006D To: whaver
The lower the number you change it to, the faster you go. For instance, if you want to double your speed (Doesn’t change the other cars’ speeds), change it to $0036 (Half of $006D). If you want to have fun, and just fly out of the stadium, set it to below $0010. If you for any reason, want to go really slow, set it to something like $0100.
-
Negotiation Edge
†Search for:FDD0 6718 486D
Change to: " " 6018 " "
-
Net-Cal
†v1.3
Search: FFDE B0AE FFDA 6F0C
Change: " " " " " " 600C
-
Nightingale
v1.01
195121
-
Nightwatch
†Nightwatch is a slick new protection scheme for hard disks. It is supposed to prevent anyone from accessing your hard disk, but really doesn't do much good. Basically it alters the hard disk so it seems to be permantely write protected. If the disk is write protected, you can write out the Desktop file, and the mac won't mount it.
How to crack it!
1) Bring a disk with the System on it and Mactools from copy ii mac. MAKE SURE that Mactools is the “startup” application, so you won’t even get into the Finder and see this desktop shit.
2) Boot the disk on the nightwatched system and you'll be up into Mactools with the ‘nightwatched’ hard disk mounted, ready to be leached!
(For more fun, bring another HD and leach the whole fucking thing!)
Alternately, you can set startup to any application and use Disktools or Disktop to open up nightwatch.
-
Nisus
3.0x
90040236
-
Nok Nok
9300 49591
9300 49799
9300 59593
-
Notify
0005940166
-
Now Up-To-Date
v1.0
UDA-100-0001-011445453986
v2.0
UDU-200-0001-002377188121
-
NUBase
v1.3
0000000-00
-
NuPaint
10111220
-
O.G.R.E.
†Search for: 6700 000E A017 21FC 0000
Change to: 6000 " " " " " " " "
Must use the system that comes with the game (lots of resources).
HFS disks: remove all files from folders.
-
Object Master
v2.0.2
L\002428392663
-
Oids
†CODE 12+$1F58 From: 670C To: 4E71
+$1F5E From: EC70 To: EC72
+$1F62 From: EC72 To: EC70
v1.3
CODE 12+$1F7C From: 670C To: 4E71
+$1F82 From: EC2E To: EC30
+$1F86 From: EC30 To: EC2E
-
OmniPage
v3.0
0102E-%001705
0132A-%002643
v2.0
2801G-%001327
v2.1
0102E-%001705
0132A-%002643
-
Omnis 3+
†Search for: 6612 2F2E 0008
Change to: 6012 " " " "
Search for: 6624 2006 0A00
Change to: 4E71 " " " "
-
Omnis 7
v1.0.3 Mac
7MDI 102344 37554
7MDI 103039 37065
Name each disk D1, D2, D3
v1.0.3 Win 3.x
7WDI 108844 18592
Name each disk D1, D2, D3, D4, D5
Unzip to FLOPPIES then install through Windows
v1.1 Mac
7MDI 102344 37554
7MDI 103039 37065
7MDI 103247 37782
v1.1 Windows
7WDI 108844 18592
v2.0
7MDSI25119011700
-
One on One
†Search for: 2CE0 075B 4274 01C5
Change to: 42BF D8BD 9A4B 3915
Search for: D8EF F320 B611
Change to: D8BD 96C6 C05D
-
Operation Combat
†It took me a few hours, but I finally figured out a crack for this program. The only problem is that you cannot quit except through the monitor… You know, press the interupt switch and type SM 0 A9F4, G 0 or in MacsBug type ‘es’...
Search for: 102D 9E0A 6700 FEE2 4EBA 1A2E
Change to: " " " " 6000 " " " " " "
This trades a BEQ for a BRA. Works great.
-
Operation Desert Storm
†(B&W & Color)
Search for: 6700 FF44 2F2C FFEC
Change to: 4E71 4E71 " " " "
-
Operation Tsunami
†Level Passwords (case sensitive):
Normal: Hard:
Level 1
Area 2 FrGdSL ThrfrG
Area 3 vdThWr ndMkDs
Area 4 ldThtH cplsfl
Level 2
Area 1 GvHsnl lNtnsB
Area 2 Bgttns tzngTh
Area 3 nThtTh mnThNm
Area 4 sWhBlv fThFth
Level 3
Area 1 thnHmM rndfTh
Area 2 ghtNtP SnndfT
Area 3 BtHvtr hHlySp
Area 4 nlLfJh rtMtth
Level 4
Area 1 ThrSxt wTwnty
Area 2 nKngJm ghtTwn
Area 3 sVrsnf tyNwnt
Area 4 ThHlBb nlVrsn
Level 5
Area 1 lPrsGd PrsJss
-
Out of This World
†CODE 5+$325C From: 67C0 To: 4E71
File 0146 is a GIF that has a secret message....
Codes:
1) LDKD 2) HTDC 3) CLLD 4) FXLC 5) KRFK
6) XDDJ 7) LBKG 8) KLFB 9) TTCT 10) DDRX
11) TBHK 12) BRTD 13) CKJL 14) LFCK 15) BFLX
16) XJRT 17) HRTB 18) HBHK 19) JCGB 20) HHFL
21) TFBB 22) TXHF
-
OverVUE
†Search for: 1842 8112 3C00 314E
Change to: 0242 " " " " " "
==========
v2.0?
Move to block 030B, position 019C, Change to 0000
Move to block 030B, position 01A0, Change to 0000
or
Search for: 1842 8112 3C00 314E
Change to: 0242 " " " " " "
-
Oxyd
†Here are the first 2nd to 11 level codes:
2) 218780766 3) 10232399 4) 32882199
5) 13794470 6) 28197802 7) 17887807
8) 51761122 9) 83882268 10) 6071220
11) 58037867
-
PacerForum
License Key: 5
User Key: B-6MX00096002114
-
PacerTerm
v1.0
B-43C78920099091
-
Pagemaker
v4.x
02-4008-200010087
02-6023-000345263
02-3013-000-196593
08-1003-000357503
02-0004-000094245
02-3008-000036469
02-0000-000000000
v5.0b1
11-1009-200021734
v5.0
11-1009-200021734
11-1516-200723741
†v1.0
Search for: 4E56 FFFE 422E 0008 486E
Change to: 205F 301F 1F3C 0001 4ED0
==========
v5.0
Open up the PageMaker App itself with ResEdit (or your favorite Brand X resource editor) and find the 'KXRX' resource. The net ID number is located between offsets 0A and 1F inclusive. You will find all of the bytes at these offsets have already been zeroed. Change them to whatever makes you happy (as long as it's unique for each machine on the net).
==========
v1.1
Search for: 6B00 00F4 203C 0000
Change to: 6000 " " " " " "
Search for: 670E 4267 4EBA FCF0
Change to: 600E " " " " " "
Search for: 670C 4267 4EBA FCD4
Change to: 600C " " " " " "
==========
v1.2
Search for: 676E 4267 2F07 4EAD
Change to: 606E " " " " " "
==========
Pagemaker Ser. # Removal:
To erase the serial number of Page Maker:
- Start Fedit
- Open File Page Maker
- Read sector 0 of the file
- At location $158 you will find a string like “xxxx 69xx xxxx 69xx xxxx
xxxx” which is the serial number. They, of course, encoded it but with a
simple key. They used the creator string "ALDU" and pass each letter in
turn to encode each number of the serial number.
Ex.:
$71 XOR $41 (A) = $30 (0)
$7E XOR $4C (L) = $32 (2)
$69 XOR $44 (D) = $2D (-)
and so on...
- If you just change the numbers to put out a 00-000-00000, the program bombs
out of its skull.
- A little more digging uncovers the preceding two bytes. $156 is the address
where the serial number check begins. It is normally a $0D so the checking
doesn’t begin until the 6th number ($15D) in the serial number string
(which starts at $158).
- $157 is the number of digits to print in the serial number box when the
program starts. If the number is less then $0C (original number), the
string “Serial number” before the actual number doesn’t get printed.
- So, to turn the number to 00-000-00000:
* Read sector 0 of the Page Maker file
* Go to byte $156
* Hex modify: 0D0C XXXX 69XX XXXX 69XX XXXX XXXX
To: 140C 717C 6965 717C 6965 717C 7465
* Write the sector back
-
Painter (Fractal Painter)
v1.x
OOOOOOOAAA
0013951HZY
0014731DJN
v2.0
0011187QBO
(The last 3 are letters)
†Painter 1.2
To make it so you can use any serial number (7 digits, 3 letters), change:
GWIL 1+$322 From: 6600 FEF8 To: 4E71 4E71
Registerred copies will not have a GWIL 1 resource and can’t be registerred without one. After registerring, a CPHR 0 resource is added that holds your name and serial number.
CHANGE THE BYTES AT OFFSET 25 FROM AD 01 4A TO 71 4E 71
IN CODE RESOURCE 3, CHANGE THE BYTE AT OFFSET 16060 FROM 6F TO 60
or
Change CODE 3+$17EA (A few characters over from 17E8)
from:
025A
to: 0172
This simple crack just jumps over waiting for you to enter the password, and lands right at the part where it sets the memory that says you got the password right.
-
PlayMaker Football
†v2.0
Find CODE 90+$608 is $6700 FF18
change CODE 90+$59E to $4E71 and CODE 90+$5F2 to $6018
change the message in DLOG 800 to
"Press Command-G and hit OK until the game begins.
Then you will never see this dialog box again."
or
Code #90
+54A 66D6->4E71
+552 670A->600A
+464 6714->4E71
-
Pool of Darkness
†In the application:
Check
'CODE'
$B
$6d92
2
$4ead
$01d2
Modify
'CODE'
$B
4
$6d92
$4e71
$6d94
$4e71
$6dc8
$600c
$6dec
$4e71
-
Pool of Radiance
†V1.1
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 2
CHANGE THE TWO WORDS AT OFFSET 3E94 TO 4E71 4E71
-
Power Launcher
†V1.6
Search for : 6716 1B7C 0001 F643 4206 554F
Change to : 6016
That will eliminate the check-sum routine that detects that the code has been modified.
Search for : 6718 3F3C 0080 4EAD 019A 554F
Change to : 6018
That will allow anything for your registration dialog. If it doesn’t ask for the registration then trash the pref. file before you launch it and it will ask you to register. If you want it un-registered just click ok. This crack also removes the annoying dialog everytime you change sets.
-
PowerMerge
v1.0
PM1-002897
-
Practica Musica
v1.x
00215052
PM220569
692878
v2.295
226835
-
Premiere
v1.0
PRB100101253-785
v2.0
PRW200100586-763
v3.0
PRW200100586-763
PRW200101810-587
PRW200101890-129
-
Preprint
v1.0/1.5
11-1009-200021734
02-0001-100000000
11-1000-200027072
-
Presenter
†1.5 Demo!
This will make Presenter 1.5 Demo act as though it is not a demo. There are three global variables which say in what way it is limited - such as Demo (INIT), Demo (ADB), and all that. From looking at the resources - there's one called 'EvE ', it seems that this uses the EvE protection scheme... So, the crack just changes the variables that says whether or not it has found the EvE.
Open CODE 12 in ResEdit
Change it at offset $5EC0
From: $6F3E
To: $603E
Change it at offset $6B7C
From: $6708
To: $4E71
Change it at offset $6BC4
From: $6708
To: $4E71
Change it at offset $7268
From: $6728
To: $6028
-
PressWise
02-000-00000
-
Prince of Persia
†EFFECT: The Potion Level never appears
HOW TO: LOCATE CODE RESOURCE 2
CHANGE THE WORD AT OFFSET 1F70 FROM 660A TO 600A
or
To Patch Prince of Persia 1.0 so there are unlimited chances to get the right potion in the potion level, change CODE 3+$55A6 from $5240 to $7000. Note: The potion level has to be done again only if you quit Prince of Persia and run it again later.
To get rid of the potion level altogether, change CODE 2+$1DF2 from $0002 to $FFFF. This is for new games and opening from the file menu. Change CODE 2+$1DD6 from $3B6D BA64 BA62 to $3B7C FFFF BA62 for opening from the desktop.
Prince of Persia saved games:
The format of the save files for version 1.0 is 2 bytes each for:
minutes left; fraction of a minute out of $2D0 (max is $2CF); level ($F is potion level, $E is last level or princess level, $C and $D are level 12 part 1 and part 2: Jaffer level, $1-$B is level 1 to 11 and $0 is the demo level); potions; unknown; prizes (people killed, items obtained, big potions etc); how many times prince died; checksum (which=$1B39 - min*$B - frac - level*$11 - potions*$25 - unknown*$C1 - prize*$17 - died*$D. To eliminate the need to calculate the checksum, change CODE 2+ $15AC from $663A to $4E71.
(POP 0.15B saved files do not have prizes or died and are therfore, only 12 bytes instead of 16. The checksum does not include prizes or died. To eliminate the need to calculate the checksum for 0.15B, change CODE 2+$181C from $662E to $4E71.)
Prince of Persia speed up:
The 'Turbo POP' updater program changes CODE 2+$102 from $90 to $D0 to speed up the animation.
Prince of Persia Editor 2.01
Change CODE 3+$05FA (A few characters over from $05F8)
The personalization data is stored in 'Qky2' ID 1. When you register it, with
this crack, it will use the serial number 19628, which is presumably the
default one. To see the personalization, go to 'About QuicKeys™...' in the
option menu when editing keysets.
-
QuickMail 2.2
40866
†Crack for 2.0 serial numbers patch:
Open up the QUICKINIT file with ResEdit:
Look in INIT 25 "QuickInit", offset $24, for an ASCII sequence of digits (they directly follow a string that looks like QuickMai, e.g., QuickMai00000). ASCII modify them to any serial # you want, preferably something far away from what other people are using. You see, that serial # is a BASE serial number, from which the Quickmail software will increment x # of times, where x is the # of users allowed by that particular pack. There is one more spot where it's stored, and that's in the DATA -14144 resource, offset $5C, again, it's five ASCII digits. Change them to the same # you installed into the INIT 25
resource. Once you've made your changes, be sure to save them, and then reboot with the new files installed in your System Folder to see them take effect. I know it's not a patch to remove the serial number check process altogether, but since I do not know how the scheme is intrinsically tied to the actual workings of the client/server mechanism, I'd rather not play around with that and possibly create reliability problems. If you want to invest loads of time looking into it, feel free and please post the results; but I think if all you want to do is get your office up and running with Quickmail for everyone, then this should meet your needs.
Change to :4E75FFC041EEFFC0316E00080016216E000A0012A017
Ragtime 3.0
Serial Number:6601120 Production Number:8739401
Ragtime 3.1
Serial Number:6601120 Production Number:8739401
-
Railroad Tychoon
†Krak Patch
Hex search for:
28 00 02 B0 69 06 84 66 08 08 AD
Hex change the bold values to 4E 71
This should appear on sector 301, byte 25848 of the file.
or
Find Hex string
0684 6646 486E
Replace it with
0684 4E71 486E
When you hit the choose the locomotive screen, any choice you make will be
valid The krak listed above allows the game to continue to limit your play to
two trains at a time.
-
Rambo
†Search for:DB49D669B2FD Change to:DC49D669B2FD
Search for:4B6F26851ED8 Change to:2AA9BB036063
-
RAMdisk
†v3.16
Leave three blank spaces after your name to register
-
RapidTrak
600001201
-
RayDream Designer
v2.0.3
RDD5-1230-48398
RDD5-1550-52358
-
Real Poker
†Search for:43FA FE80 32BC FFDC
Change to:4E71 4E71 4E71 4E71
Make the files "Saloon File" & "Poker Data" visible. Also, there is a poker
font in the fonts file you have to have on your system.
-
Red Ryder
†v11.0
Find:6630 42A7 4879 434F 4445 3F3C Replace 42A7 with 6030
-
Rendermania Beta
3273071853
4027723341
3574598582
2518174477
4011405915
-
Resolve (Claris)
†v1.0
Hex Changes:
Search : 486E FFFC 4EBA FCF6 4A00 588F 670E
Change : 4E71 4E71 600E
-
Retrospect Remote
Authorization Numbers:
650-729-7746
543-999-2682
647-741-1178
595-161-0202
577-533-0106
545-366-9586
602-708-6450
592-374-9842
577-330-3898
652-350-7410
Registration Number:
05030000180
-
Reversi
†Search for:6708487A01904EBAF69
Change to :66008487A01904EBAF696
Search for:6708487A01524EBAF988
Change to :6008487A01524EBAF988
Search for:4EBA08C23E1F4EF9
Change to :A9F408C23E1F4EF9
Search for:4EBA0BF03E1F4EF9
Change to :A9F408C23E1F4EF9
Search for:4EBA04D03E1F4EF9
Change to :A9F408C23E1F4EF9
-
RightWriter
TGMC 113695
-
Robosport
†How to remove the copy protection from Maxis' game "RoboSport":
Search for 4EAD 066A 4FEF 000A 3E00 4A47, using a Utility such as ResEdit or
SUM Tools.(This sequence is in code resource 2 at offset 2A8C if you look with
ResEdit. Replace the first two words with 7001 7001, and everything should be
OK.
Or try:
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 2
CHANGE THE WORDS AT OFFSET 2A82-98 (2A82, 2A84, ..., 2A98) TO 4E71
CHANGE THE WORDS AT OFFSET 2AB2-C8 (2AB2, 2AB4, ..., 2AC8) TO 4E71
Or try:
COMPATIBILITY NOTES
If you play RoboSport on a MAC PLUS or MAC CLASSIC, turn OFF the Preview Movie Sound option in the Preferences Window otherwise the program may lock during Turn Generation due to a sound chip incompatability. You need MORE THAN 1MB RAM to play RoboSport under MultiFinder. If you only have 1 MB RAM, you must play RoboSport under the Finder. RoboSport is not compatible with the Apple CD-ROM init. RoboSport is not compatible with the Now Menus in the Now Utilities.
APPLETALK NOTES
To remove a SECONDARY machine from an AppleTalk network game, the person on the PRIMARY machine must:
(1) Select REMOVE SECONDARY from the EDIT MENU
(2) Click the radio button next to the player you want to remove, and
(3) Click on the REMOVE SECONDARY button.
AppleTalk Zones are not supported in this version of RoboSport—only direct machine to machine AppleTalk.
KRAK NOTES
Run the program. <IN PROGRAM> Marvel at the cool sounds. Go to the dialog box in which you're asked to input the three symbols appearing on some page in the manual. Pick any three symbols. Break into TMON. <IN TMON> Choose MAGIC RETURN from User window. <IN PROGRAM> Hit OK button. <IN TMON> GOSUB a few times; do not GOSUB over pascal case statement beginning (TRACE through it to avoid hanging TMON). Notice quite a few BRAs to Code0005+BCC. Decide too many IFs to handle, so hack logic at source, decision stage (Code0003+15A, Code0003+16E). A #$00 returned from decision routine in D0 means a faulty code, a #$01 returned in D0 means good code. Change all MOVE #$00,D0 to MOVE #$01,D0 so every code is good.
This bypasses the hardkey and accepts anything put in for name and serial #.
However, it seems to hang when plotting to a file… (help needed).
For name and serial check.
Search for: 6C00 000C 7003 3F00 A9C8 6000
Change to : 6000
Search for: 6700 000C 7003 3F00 A9C8 6000 FF56
Change to : 6000
For hardkey bypass
Search for:6600 0008 3D6E 8002 801E 302E
Change to :6016 4E71
This might work for the "program has been modified"
Search for: 6700 0006 4EFA 0018 558F 3F2E
Change to : 4E71 4E71
-
Silverlining
please
(use on 2nd attempt)
-
SimCity
†Typing when the cursor is in the toolbox:
FUND: gets you an infusion of cash
SimCity
Change CODE 2+6E44
from:
2F2D C298 A915 2F2D C298 A91F
to:
4E71 4E71 4E71 4E71 4E71 4E71
AND
Change CODE 2+6F1E
from:
4EBA 00AC 3D40 FFFE 4A6E FFFE
to:
7001 426D D544 3D40 FFB6 6056
(Note: Maxis took out ALL CP in v1.4)
-
SimEarth Crack
†This patch to SimEarth 1.0 eliminates the annoying quiz at the beginning. This patch appears to work on both the color and black & white versions. The first patch disables the quiz for new planets, the second for loading existing planets. They simulate a successful call to the quiz procedure.
CODE 11 offset $61C (newgame)
change 4EAD 008A (color version) or 4EAD 00EA (B&W) to 4E71 7001
CODE 14 offset $D8 (loadgame)
change 4EAD 008A (color version) or 4EAD 00EA (B&W) to 4E71 7001
or
EFFECT: The password dialog will never show up
HOW TO: CHANGE THE WORD AT OFFSET 127E IN CODE RESOURCE 2 TO 4E71
Sure the challenge of Spaceway is really fun, but there's something to be said about kicking the shit out of the other computer. So, here's a bunch of cheats that I made for 'stress relief'.
i) *TURBO* patch
Hint: go in low-gear, unless you are really psycho
ii) Rapid Fire Fore and Aft Weapons
Hint: if Fore is on, Aft will not work, because the bullet
These are serial numbers for Spectre 1.0. To play multi player games, you need to have each copy registerred under a different serial number. Just copy your
Spectre, delete the 'STR ' resource ID 997 in the copy using ResEdit (this
erases the old serial number so you can reregister using a new one), and run
the copy. When it asks you to register your copy, use one of these serial
numbers. Use a different serial number for each copy.
Extra Note: try typing GOD (or dog) when playing the game, at the option
selection screen or in the demo.
or
To make anything a serial number:
CODE 2+$19DE
From: 660C
To: 600C
AND
CODE 2+$19EE
From: 67A4
To: 4E71
To really spice up the customizable tank:
CODE 25+$2F8
From: 6744
To: 6044
This will allow you to have up to 127 for your 3 attributes. For a really fun
game, try putting things in negative!
==========
Spectre Supreme (MacWorld Special Edtn)
NOTE: There is a bug in the way the program searches for the matrix file, so
to launch the application, double click the matrix file. Perhaps this bug
might be because it passes $910 to FS<something> instead of the correct low-
memory global (maybe #920 (CurDirStore))? Your guess is as good as mine...
To allow anything as a serial number...
CODE 2+$2A26
From: 6614
To: 6014
AND
CODE 2+$2A3E
From: 6796
To: 4E71
The name and serial number are stored in the 'STR ' resource ID 997.
To spice up the customizable tank
Change CODE 23+$310
From: 6624
To: 4E71
AND
CODE 23+$334
From: 6708
To: 6008
or
Search the Spectre App for : 4eba fcf6 1e1f 1007 6614 1007
Change the Specter App to : 6014
Search the Spectre App for : 6797 42a7 4240 102e fefc 5840
Change the Spectre App to : 4e71
or try
Patch to Fix Spectre Supreme 2.0b3
Search for: 6614 3F3C 2AFA 4EAD 07EA
Change to: 6014 3F3C ....
Search for: 6796 42A7 4240 102E FEFC
Change to: 4E71 42A7 ....
After these patches, you can enter ANY number or string as a serial number.
To remove the serial number so that you can repersonalize it, just delete
'STR' 997, and run the program again.
or try
Copy the STR resource from the 1.1 developer version. Replace the STR in
2.0b3 with the one from 1.1. This will give you one serial number. For
another serial number, delete the STR resouce in 1.1d, load it up and enter
any serial number. Repeat the process to get a copy of 2.0b3 with a different
serial number.
or try
These are serial numbers for Spectre 2.0. To play multi player games, you need
to have each copy registerred under a different serial number. Just copy your
Spectre, delete the 'STR ' resource ID 997 in the copy useing ResEdit, and run
the copy. When it asks you to register your copy, use one of these serial
numbers. Use a different serial number for each copy.
Extra Note: try typing GOD (or dog) when playing the game, at the option
selection screen or in the demo.
==========
Spectre Supreme (release)
Sometimes, but not always, you can re-personalize a copy of Spectre or Spectre
Supreme without knowing a valid serial number.
If you open the personalization resource with ResEdit (#995 or #997), all the
personalization info will be there. Delete everything from inside the
resource, but not the resource itself. Then type in a random hexidecimal
number and save. Then for each copy you wish to make, type in another,
different random hex number.
What I think happens is this: Spectre first checks to see if there is the
personalization resource (#997). If there is no STR# 997 then it will bring up
the serial # dialog box. But since there is (you didn't delete it, 'member?)
it continues. Then it checks the net for copies with the same SN, and
supposedly all your copies will have different ones. For some reason, at
random times, a dialog has come up saying that the same SN is on the net when,
for the life of me, I can't find it. I'm still trying to figure out why this
be.
-
Speedbeep
v2.0.6
PRETZEL
†To register Speed Beep, Cmd-Opt-Shf-Click on Title and "RoNertL"
Make these changes to a sector copy, then bit copy tracks #78 & 79 with copy
II Mac.
-
Wishbringer
†Search for 6FDA100667063B7C change to 6004100667063B7C
-
Wizardry
†Search for 0A00000167000090302EFFF2 change to 0A00000160000098302EFFF2
THAT REMOVES THE PROTECTION, BUT YOU STILL HAVE TO PUT SOME KIND OF DISK IN
THE INTERNAL DRIVE WHEN IT ASKS FOR THE MASTER(ANY DISK). TO REMOVE THE EJECTS
AND THE DISK REQUEST, DO THE FOLLOWING (AFTER YOU MAKE THESE MODS, IT WON'T
WORK ON A HARD DRIVE THO..) (SO IF YOU HAVE A H.D., JUST DO THE FIRST PATCH)
Search for 205FA0173E804ED14E56FFCE change to 205FA0173EBC00004E56FFCE
Search for 216E000A0012A0173D40000E4E change to 216E000A00124E713D40000E4E
Search for 2F2E00084EBAFF66A853 change to 2F2E00084E714E71A853
Search for FFF46620487A067E487A0632 change to FFF44E71487A067E487A0632
THAT'S, EITHER THE FIRST PATCH, OR ALL OF THEM, THE FILES ARE FINDER COPYABLE
AND NO MORE CHECKS.
or try
Wizardry 1.1
Search for 4EAD 059A 41ED 059A change to 4E714E7141ED059A
-
Wordtris
†(color version)
Search for: A915 3B7C 000C 962E 422D
Change to : 4E71
Search for: 6600 FF4C 2F0C A983 1006 4CEE 10E0
Change to : 4E71 4E71 2F0C 4E71
Search for: A991 486D 95F2 7003
Change to : 4E71
(B/W version)
Search for: A915 3B7C 000C 963C 422D
Change to : 4E71
Search for: 6600 FF4C 2F0C A983 1006 4CEE 10E0
Change to : 4E71 4E71 2F0C 4E71
Search for: A991 486D 9600 7003
Change to : 4E71
or
Open it with ResEdit and open CODE resource ID=1 with a hex editor. At
position 07A0 you will find: 4EAD 056A 4A00 6606 4EBA 0BC8 A9F4 598F
Change this to: 4E71 4E71 4E71 4E71 4E71 4E71 4E71 4E71
-
Word Perfect
v2.0x
V0000005961
v3.0
V0000005961
-
X-FerIT
†name is "anonymous"
number is 550035173-2
-
Xerion
†the following commands to wired things:
Clear 5 - Next Level (Just like Dos Master said for Crazy Cars)
Clear 6 - Directly to the bounus stage
Clear 3 - Clears what ever is pulling you or making you wiggle
Clear 1 - Make the paddel larger
Clear 2 - Makes you catch the ball
-
Xyphus
†Search for each string seperately and change the 67's to 60's.
4EBA 5F6C 101F 6708
4EBA 5E6A 101F 6708
4EAD 007A 101F 6708
or try
Search for 670002502C7C00 change to 4E714E712C7C00
-
ZephyrPalettes
v1.3
2-130-3186163
-
Zone of Avoidance
†Another collection of modifications to make games more fun!
****************************************
This patch allows you to have unlimited missiles:
Open CODE 4 in ResEdit
Change it at offset $4392
From: $5379
To: $6004
****************************************
This patch gives you full abilites after you finish Level 1:
Open CODE 4 in ResEdit
Change it at offset $736E
From: $6252
To: $4E71
AND
Change it at offset $737A
From: $4ED1 0C39 0004
To: $23FC 0404 0404
-
~~~~~ Acknowledgements ~~~~~
†Thanks to the many people from whose postings I have stolen KRAKs and Serial Numbers. Special thanks to those who have taken the trouble to EMail me to send me the KRAKs and Serial Numbers, and to the creator of this database to view the files!
-
~~~~~ Cracking Tips ~~~~~
†“Single Test Crack”
- refers to a crack that works in two halves (that have to applied seperately and in order) as the result of the program that is being cracked having a particularly simple and annoying personalization/registration scheme. Namely these programs test the same data (the serial number) (in one or more -usually 2 places) for two different reasons:
#1 do I have a valid serial#?
Yes -> Personalized.
No -> Personalize
#2 Is the serial # valid when Personalizing?
Yes -> Save personalization and enter program
No -> Quit or give alert saying try again.
Now assuming we can circumvent these two checks (ie. always make the answer yes) we are left with a small dilemma: If we just circumvent check#1 (or check#1 and check#2) we will never get to personalize, and if we just circumvent check#2 we get it personalized and can use it once, but it will ask us to personalize every time we run it - clearly an unacceptable state of affairs.
The two possible (CODE) solutions:
---------------------------------
Method A:
Just Patch Test#1 (simple but may cause crashes and/or not work - see below)
Method B:
Patch Test #2
Run Program and Personalize/Register
Quit the program (this is obvious but included for completeness)
Patch Test #1 (at this point the patch to test #2 is irrelevant)
Method B is by far the preferred course of action - although it is a somewhat tedious 3 step process it is guaranteed (by me {iff the crack is correct}) to ALWAYS work as it mimicks exactly the way the original code was meant to work (aside from reversing the checks results).
Method A is fraught with DANGER as it will definitely skip any special one time initialization/setup that is done by the personalization code, which at a minimum records your personalization info. Usually your personalization info is used for display in about boxes and such and if you go to one of these locations the program may or may not crash/screw up DEPENDING ENTIRELY on how it is programmed. Also you can never be absolutely sure that it won’t crash unless your capable of disassembling the whole program and analyzing it completely - go ahead make my day...(and you don’t need my help if you can - and the NSA has a job for you)
-
***** Cracks & Numbers *****
† ***** Cracks & Numbers Nov. 1 Edition *****
-
----- Using the Cracks -----
†Using the cracks:
Most of these cracks can be installed either by using the Sector Editor option of Norton Utilities, or by using ResEdit...
Norton Utilities:
Run Norton Utilities and go to the Sector Editor option in the pull down menus. Select this. Open the drive the file is on. Open the file to be modified. Search for the string requiring modification using the find option. Select the bytes to be modified. Type in the changes.
ResEdit
Run ResEdit and select the file to be modified. Click on the resource indicated (ie - Code 1) If there is more than one entry under that heading select the entry indicated in the crack. Go to the address indicated (Offset - this is usually shown as $0000 and is in the leftmost column) At this location you should see the code you have to change. Select the code to be changed. Type in the changes.
