Mac OS 9 Serial Number Archive

home *** CD-ROM | disk | FTP | other *** search

/ Mac OS 9 Serial Number Archive / SN Archive 2023.11.04.toast / Cracks & Numbers / C&N 1994.04 < prev next >

Wrap

Text File | 1994-03-27 | 231.5 KB | 8,542 lines | [SNKR/KRAK]

Cracks & Numbers 2 601 Sunday, March 27, 1994 - ***** Cracks & Numbers ***** † ***** Cracks & Numbers Apr. 1 Edition ***** - ~~~~~ Acknowledgements ~~~~~ †Thanks to the many people from whose postings I have stolen KRAKs and Serial Numbers. Special thanks to those who have taken the trouble to EMail me to send me the KRAKs and Serial Numbers, and to the creator of this database to view the files! - ----- Using the Cracks ----- †Using the cracks: Most of these cracks can be installed either by using the Sector Editor option of Norton Utilities, or by using ResEdit... Norton Utilities: Run Norton Utilities and go to the Sector Editor option in the pull down menus. Select this. Open the drive the file is on. Open the file to be modified. Search for the string requiring modification using the find option. Select the bytes to be modified. Type in the changes. ResEdit Run ResEdit and select the file to be modified. Click on the resource indicated (ie - Code 1) If there is more than one entry under that heading select the entry indicated in the crack. Go to the address indicated (Offset - this is usually shown as $0000 and is in the leftmost column) At this location you should see the code you have to change. Select the code to be changed. Type in the changes. - ][ in a Mac †Search for: 6100 B754 42AF 3F Change to: 4E71 B754 42AF 3F v2.0 Search for: 4EBA 02C2 42A7 3F3C Change to: 4E71 4E71 42A7 3F3C - 1st Base †Move to block 0232, position 006F, and change to 01 Move to block 0005, position 008C, and change to 01 Move to block 0233, position 019F, and change to 60 Move to block 0233, position 01B3, and change to 01 Move to block 0233, position 01C7, and change to 01 Move to block 0005, position 0082, and change to 80 - 4th Dimension v2.01 A-342165175449 B-302260105256 C-362106850509 D-205200607255 D-225490055617 D-302200129276 D-342002870616 E-245191050449 E-332300119683 H-203030825071 H-243178434494 H-244656412618 H-282650130833 H-302304109610 H-382704134633 I-302502133617 M-362304172827 N-302000207053 N-382908192038 O-205376978623 O-262105273925 O-302101218161 O-342301152649 P-205230003253 Q-243126514449 R-205270127273 S-243160352309 S-244397274027 S-342590516249 T-302092506051 U-302191537161 V-302290527273 V-342104143616 W-243387755207 W-322505173725 X-242064960694 X-382806163033 Y-332305915083 Y-342104173749 Z-342000985694 v2.2 A-342165175449 H-243178434494 O-262105273925 U-302191537161 B-302260105256 H-244656412618 O-302101218161 V-302290527273 C-362106850509 H-282650130833 O-342301152649 V-342104143616 D-205200607255 H-302304109610 P-205230003253 W-243387755207 D-225490055617 H-382704134633 Q-243126514449 W-322505173725 D-302200129276 I-302502133617 R-205270127273 X-242064960694 D-342002870616 M-362304172827 S-243160352309 X-382806163033 E-245191050449 N-302000207053 S-244397274027 Y-332305915083 E-332300119683 N-382908192038 S-342590516249 Y-342104173749 H-203030825071 O-205376978623 T-302092506051 Z-342000985694 v3.0.1 34868520554560 v3.1 34868520554560 v3.0+ 08020600 48020000 28020800 18020700 38020900 58020100 68020200 †v3.0.4 For 4D to recognize any disk as the key disk: Search for: 0A00 0001 2207 8200 6700 FE82 Change to: " " 0000 " " " " " " " " Search for: 660C 3F2E FF96 4EAD 1422 7E01 Change to: 4E71 " " " " " " " " " " Search for: 6600 028A 47EC FE9E 7000 2740 Change to: 4E71 4E71 " " " " " " " " Search for: 0A00 0001 802C FF4F 802C FF51 Change to: 0A00 0000 " " " " " " " " Search for: 0A00 0001 802C FF4F 6700 FB30 Change to: 0A00 0000 " " " " " " " " ========== v3.0.1 Partial Crack 1. Install the program 2. Make a copy of the program 3. Make the following changes in the copy: CODE 31+$22E From 66 to 60 CODE 31+$290 From 6700 FE82 to 4E71 4E71 CODE 31+$44C From 6600 10FE to 4E71 4E71 4. Run the copy and insert the serial number: 34868520554560 This will create a preferences file on the hard drive 5. Delete the copy and run the original because the changes cause crashes in the program. You will however no longer be asked for a key disk at startup. 4th Dimension 3.0.1 On Line Help Change CODE 3+$422E From: 6718 To: 4E71 ========== v2.0.x By following the directions below, you should be able to use just about an serial # you want (of the form A-123456789012) so share share SHARE AWAY! (The following has been tested on 4D 2.0.10 and the 4D Runtime which came with it, though any 4D 2.x version should be similar enough) CODE 1+$2544, From $FFAE, To $FF56 (if you are using a different version of 4D, search for the pattern: 486E FFAE 486E FF56 and change either of the two negative numbers so that one equals the other (either change the FFAE to be FF56, or change the FF56 to be FFAE)) (see also 4D Runtime) - 4D Insider v1.0.1 †To never see/enter the personalization just use this: Code #47 +A00 6600 02B6 -> 6000 02B6 in the event that the above is an imperfect krak, remove it and try: Code #47 +B20 57C1->7201 this will accept anything as a serial number, but you will have to repersonalize each time. - 4D Online Help (GTec Systems - not ACIUS makes this) v2.0.6 †CODE #3 +422E 6718->4E71 - 4D Runtime †CODE 1+$2498, From $FFAE to $FF56 (see note in 4th Dimension if you have a different version of this file) Note: It is CONCEIVABLE that the offsets may have changed between versions, so if you are having particular difficulty locating the pair of PEA instructions, scan for 486EFF sequences, and keep an eye out for a routine that looks like this: MOVEQ #$1A,D0 | 701A MOVE.L D0,-(A7) | 2F00 JSR *-$22FE ; 00171D1E | 4EBA DD00 MOVE.L (A7)+,D0 | 201F MOVEQ #$41,D1 ; 'A' | 7241 ADD.L D1,D0 | D081 MOVE.W D0,D6 | 3C00 MOVE.B D6,-$00A9(A6) | 1D46 FF57 MOVE.B #$2D,-$00A8(A6) ; '-' | 1D7C 002D FF58 PEA -$0052(A6) | 486E FFAE PEA -$00AA(A6) | 486E FF56 JSR *-$1FE8 ; 00172052 | 4EBA E016 MOVE.B (A7)+,$0010(A6) | 1D5F 0010 MOVEM.L (A7)+,D4-D7 | 4CDF 00F0 UNLK A6 | 4E5E MOVEA.L (A7)+,A0 | 205F ADDQ.W #$8,A7 | 504F JMP (A0) | 4ED0 - 4D Network †Search for: 4FBF CE60 0E42 Change to: 4E71 4E71 " " - 4D Compiler v2.0.x≤4 20996169929821 20996169928831 20996169927841 20996169926851 20996169925861 20996169924871 20996169923881 20996169922891 †v1.0 This patch does two things: A) Tells the program not to look for the keydisk and B) Yes, it found the keydisk. Search for: 4267 487A FCCE 42A7 487A FD94 42A7 4EAD 003A 101F 6716 Change to: 4E71 4E71 4E71 4E71 4E71 4E71 4E71 4E71 4E71 4200 " " 4D Compiler 1.0.4 Code #1 +31F6 6724->4E71 +3214 6006->4E71 - 4D Boxing †To patch 4D Boxing so you don’t have to type in the boxer's name: CODE 3+$4080 From: 0C40 FFFE 66E6 4EAD 0D6A 302D BC0A E540 2F33 0000 2F0C 4EAD 07AA To: 2F0B 2F0C 302D BC0A E540 2673 0000 18DB 66FC 285F 265F 7000 4E71 Instead of using the above patch you can get as many tries as you want by: CODE 3+$40B2 From: 6C To: 60 and try the names below. See if you can match faces with the names and save the faces as screen dumps or write a description of the boxer. The boxer's names are: Lars Lugnut, Hammer McGee, Blam Blam, Glump Fistwhistle, Lefty Enright, Weegie Wonka, Clinch Roberts, Mac the ouch, and Butch McKenna or - 4D BOXING 1.0 EFFECT:The program will never ask you the question. HOW TO: Locate CODE 12, Find offset $0CFA, Change the word $6604 to $6004. - 4th Right Butterball (case sensitive) - 8 Ball Pinball Deluxe 6267EM11002 † Place the contents from all three disks into a folder and run the application. Let it uncompress all three files, when it gets to the Registration Dialog, CANCEL it and exit to Finder. Change: CODE 4+$1B8E From: 660E To: 600E CODE 4+$1BAC From: 670E To: 600E or try After you first take it off the disks, run it once so that it will decompress itself, then cancel and change: To use anything as a registration number: This part changes the application tampering check: CODE 4+$1BAC From: 670E To: 600E This part changes the dialog handling procedure: CODE 4+$2E47 From: 670E To: 600E OK, now to spice up your game: To get infinite lives: {How do you end the game? I dunno… Try it for practice!!!} CODE 5+$3EEA From: 661C To: 601C To set your number of lives: CODE 5+$371E From: 0004 To: Whatever! Ex. 1 = $0001 2 = $0002 4 = $0004 9 = $0009 10 = $000A 11 = $000B 16 = $0010 17 = $0011 Get the idea? Remember to make sure it's 4 characters long when you type it in! Also, when you play, you’ll only see a '-' for your ball, because it thinks that because you've got n balls left, and it ends at 4 (5?), you’ve got 4 (5?) - n (Probably a negative number) left! or try To really crack 8-Ball Deluxe, after you’ve done the crack in the readme, change: CODE 2+$2EB2 From: 67 To: 60 Then you can copy the files all over the place. or -•EIGHT BALL DELUXE 1.0.1 EFFECT: Bypasses the check to reinstall the game from master disks, if copied to another harddrive HOW TO: CHANGE THE BYTE AT OFFSET 2EB2 IN CODE RESOURCE 2 TO 60 - ABCBase †Search for: A9F4 42A7 Change to: 4E71 " " Search for: A9F4 4246 Change to: 4E71 " " or try Search for: A9F4 4246 Change to: 4E71 " " - Accelerator A300-31239-CP4U A300-11114-CP4U A300-12935-CP4U - Access PC v2.02 500056261 v3.0 0120 0000 0253 0278 0120 0000 4589 1115 - Accountant Inc. Pro 18225 - Accutext v2.0 10900016 - Acrobat v1.0 MVW100R3100000-050-208 (50 User) DEW100R3100564-885 - AddDepth AD-100-2-1272-46699 - Adobe Illustrator v3.x AAW3021019783 †Name in ARTY 256 resource, organization in ARTY 257 resource. - Adobe Photoshop v1.1 PCA100000100-953 PCA100002582-359 PDA100001185-501 PDA100001517-722 v2.0 PCA100000915-575 v2.01 PCA100000915-575 PCA107011754-639 v2.5a "shakti" (all LOWER CASE!!!) v2.5 (same as 2.0x) - Adobe Type Library 1-265 †The "Type on Call bundle version" serial number would be: AAB QWY SAHI MSRV those are 12 letters however to add more fonts, you need to enter the 14 character. that would be CDW200B1753407 - AD Disney Screen Saver DIS-00670-6681 DSM-75689-8965 - AD Marvel Comics Saver MAR-00670-6681 EAM-30306-9708 †Crack for After Dark - Marvel Comic Edition This is an FKEY which will patch the installer while it is running, and allow you to enter a serial number. You cannot just switch a few bytes in a resource because the resource is compressed. Also, it is on an installer disk, and if you just want to mount the image, it is a pain to edit it. Here is what to do: - Open up your system file with ResEdit - Open up the resource type 'FKEY' - Hit Cmd-K (Create New Resource). It might say 'There is no Code in this...'. If so, then open the new resource (ID 128) with the Hex Editor. - Paste the FKEY Code in (down below) - Close the Resource - Select it and hit Cmd-I (Get Resource Info) - Give it a unique ID (Between 4-9) - Quit ResEdit (and save changes) - Run the installer program When it asks you for you Name, Rank & Serial Number, run the FKEY by hitting Command + Shift + the ID number you gave it (E.G. Cmd Shift 3 is the screen capture FKEY). Now just type whatever you want into the dialog box and hit OK. If the FKEY Beeps, then it didn't work. Try again. You should remove the FKEY now. It would probably be a heck of a lot easier just to get a SN#! Here is the code for the FKEY: -------- (Cut & Paste Below here) --------- 4E56FFFC42A72F3C494D69644267A9A02D5FFFFC4AAEFFFC66064267 A9C86022206EFFFC205020282DD00C80486EFEF267064267A9C86008 217C700160042DD04E714E5E4E75 Install the latest version of AfterDark (currently Marvel Comics) It will run all the preceding modules (Disney, Star Trek, MOD etc) - AD Star Trek Screen Saver KAM-21289-8489 STM-00670-6681 EAM-30306-9708 †ADga 1+$864 From: 6706 To: 6006 ADga 1+$882 From: 6604 To: 6004 ADga 1+$896 From: 6704 To: 6004 ADga 1+$8F4 From: 57C0 To: 4E71 Anything will work as a serial number when running the Installer program - you cannot just drag the control panel into your System Folder. The Name, Organization, and Serial Number are stored in the 'InaP' resources in the After Dark control panel. They are encrypted - didn't bother to figure that out. or try The crack is in the script file, resource ADga #1 Offset Original Cracked 2AC 67 60 362 6700FEE4 4E714E71 7A4 66 60 864 67 60 88E 6FE0 4E71 896 67 60 8B6 6DE8 4E71 8E6 6DD4 4E71 - AgentDA v1.x 102800455 v2.0 101208510 - Airborne †Search for: 6712 4267 3F3C 01F4 42A7 Change to: 6012 " " " " " " " " - Alarming Events 03478 - Aldus After Effects XH9-SVJ1-B5K - Aldus Fetch v1.0 51-1003-102157313 51-1000-201176607 51-1007-201194631 - Aldus FreeHand v3.0x 02-1235-002302134 02-3008-000036469 02-4008-200010087 02-6023-000345263 12-1234-123456789 - Aldus IntelliDraw v1.0 Try any of the other serial numbers for Aldus - Aldus Persuasion 08-2009-000379488 08-2001-200201529 02-3008-000036469 - Aldus PrePrint v1.x 02-0001-100000000 11-1009-200021734 11-1000-200027072 - Alias Sketch v1.x SMKB8MMKZ6SM8EV v1.5 SMDFQHB3THRH4LJ - ALLright Utilities v1.0 1026439 - Alsoft Power Pack PS001604(001) - Alter Ego (male ver) †Search for: 24D0 5DE0 3584 Change to : 23D0 5DE0 3584 Search for: B07A 09B0 05A5 Change to : D1BC 0DA4 3EC8 - American Heritage Dictionary v3.0 A9-L0010M3 A9-D0010M3 - Ancient Art of War †Search for: 4EAD 02DA B07C 0022 6700 0100 42A7 Change to : 246D E8BC 2B6A 0002 E9F2 6000 0102 - Animal Kingdom †Search for: 3CBA 000C 4EBA Change to: 4E71 4E71 " " - Animation Toolkit †Search for:6608 45FA 0020 3012 9041 Change to :600A " " " " " " " " - Animation Works 45482 - App-Doc Linker 817GrGn5jkfh78h - Apple Easy Open 0120 0000 0253 0278 - Appleshare v4.0 B-341UFD-170-QEC-357-HZM-484-XDG-340 v3.0 B-341UFD-170-QEC-357-HZM-484-XDG-340 - Arkanoid † If you don't like relying on chance for the right power capsule to drop down, there is a way to make yourself a winner. First, boot the program and begin to play as you normally would. Then, type: dsimagic. Then, resume your play. You'll see a capsule called DS drifting down the screen. Catch it an press A to regain sound, then press the following keys to obtain the type of power capsule and feature you want: A= Sound on/off B or W= break to next round* C= catch; D= extra balls (3 total) F= go to last round (33) L= laser; M= get three balls P= player (extra life) S= slow; X= let the computer play 0= pause 9= resume. *On some versions, when you press B, you see a screen called Boss Comming instead of the next level. - ARKANOID (to run on most Mac's) EFFECT: ??? (I guess it patches the game) HOW TO: LOCATE CODE resource ID #4 Change byte 42 (hex) from hex 66 to hex 6D Good luck, the only problems I have heard are from powerbooks, (a 140 crashed) Oh, and it really likes it if you switch to B/W FIRST. - Armor Alley 3P6GXEH 8CW659X H3PJ69D HQQCDHA JMNR9SC DE5A8R3 v1.0.1 PWPWD92 PWPX939 PWX2QHX PWX8TX3 PWX963Y PWX99W6 PWXCAF9 PWXDEB2 PWXFL8Q PWXL55F PWXL98N PWXN59J PWXQHGF PWXQNAH PWXQNDN PWX56SM PWXT8BA PWXWNQ9 PX29LNM PX2B5N8 PX2BAHW PX2D8E9 PX2DTES PX2E9T8 PX2EQSG PX2ES8L PX2F9T6 PX2HF8Q PX2J9YE PX2JN98 PX2LFLM PX2LLT5 PX2MD9A PX2MW6X PX2NPX5 PX2PY2R PX2QAE8 PX2QP3X PX2T3B6 PX2TJL9 PX2W6DW PX2W6HY PXC6FHX PXC8A59 PXC8DWS PXCBG5J PXCEJJ9 PXCETED PXCF5SS PXCGRFQ PXCHWSM PXCJ3Q2 PXCJD35 PXCMN6B PXCP3CA PXCT52Y v1.1 EXC2H3Y EXC53RH EXC5F33 EXCA992 EXCE8AT EXCEDJM EXCJMBF EXCLBL6 EXCMTCN EXCNCEP EXCQRF5 EXCRR6X EXCSDLL EXCY2PP EXD3XPA EXD89FT EXDB85R EXDFPA5 EXDGPPG EXDH8NL EXDLAB2 EXDMWHM EXDREBM EXDS2QL EXDTCHB EXDTY9M EXDYGQX EXE3NMF EXE669P EXE9583 EXE9QQ3 EXEALLY EXEDA9C EXEEXRF EXEFRMC EXEHR25 EXEMPJL EXEQR3E EXESPMC EXESXH2 EXEW6T5 EXEXSS3 EXF26LF EXF3NWH EXF58G6 EXF5HF6 EXFCBTG EXFCJXJ EXFFBFB EXFFEHW EXFLMYX EXFNQ82 EXFR2NC EXFSNBN EXFWLQX EXFWRHR EXFX6NQ EXG2A96 EXG563R EXG8YW2 EXG9G9F EXG9T2H EXGBDS5 It appears that any variation of the C9X53TA serial number works fine: C9X53TA C9X53TB C9X53TC etc. also: A3A56T3 A3A56T5 A3A56T8 A3A56D8 † To play a multiplayer game of Armor Alley, each copy needs to be registerred with a different serial number. These serial numbers are for Armor Alley™ 1.0.1. Some may have typos. Just make sure there is no Armor Alley prefs file in the system folder so you can register Armor Alley with a new serial number. EFFECT: Disables network serial number checking. HOW TO: Open CODE resource 6 at offset 03CE, change words to $4E71 4E71 - artWORKS †1.0 This is a two step crack: Step #1: To get bogus personalization info into the program, and have the program init itself, change: CODE 148+$00DC From: 6728 To: 6028 +$0116 From: 6670 To: 4E71 +$011E From: 6D66 To: 4E71 +$018A From: 6714 To: 6014 +$07E2 From: 670A To: 4E71 Run the program and personalize it, then quit and: STEP #2: To make it believe the personalization is valid and skip repersonalizing, change: CODE 14+$09B2 From: 6400 0224 To: 6000 0224 +$0BDE From: 6E00 0094 To: 4E71 4E71 Now you should have a personalized artWORKS that works perfectly! Note this may or may not remove the network copy protection, but I think it probably does. - Ascend †Change code #80 offset 05f0 from 66 to 67. and just enter a name in the licensed to and leave the rest blank under registration. - Ashlar Vellum 01399 - Astound 3006005109 - Atlas v1.2 †Search for: 4EBA F9AA Change to: 4E71 4E71 Search for: 6704 4EAD 02E2 42AD Change to: 6004 " " " " " " - Atticus Vista v1.0 126100023 - Autoboot v1.1.1 †Crack for Autoboot 1.1.1: ---------------------- 1) Open up the CDEV Resource 2) Open up ID -4064 3) Find Offset 075C 4) Change 672E to 4E71 5) Quit and save changes! 6) Open up the Control Panel and click Register. 7) Enter in whatever the phuck you want. - AutoDoubler vb12 tioga - AutoMenus †Search for: 4A00 6600 00B0 Change to: " " 6000 " " This will allow unlimited boots past the demo period. - Aztec C †Aztec C (1.00c) Change block 71 (decimal) byte $1A9 from 01 to 00 ========== v68K-C (commercial ver) Apply this to sys: Copy both disks with Diskutil or any program that will copy both disks. There are no bad blocks on the disk. Apply the following block patches: Block 214 Byte 107 From: 01 To: 00 Block 212 Byte E0 From: xx xx xx xx xx xx To: 30 30 30 30 00 00 Where xx is the value of the serial # on your disk. Apply to sys2: Block 63 Byte 97 From: 01 To: 00 Block 61 Byte 6F From: xx xx xx xx To: 30 30 30 30 There’s a hidden serial number on the disk. It’s on Block 212 Byte E5-E6. Just zap it to 00 00. No need to do this on the second disk as the serial number (visible) is just junk, and the invisible one is gone. ========== v1.06D,F Search for: 5245 6000 FF2E 7001 Change to: " " " " " " 7000 ========== v1.7 In the file: SHELL. Search for: 6700 00E4 3D7C 0001 FFAC Change to: 6000 " " " " " " " " - BackBurner 03-1489-0280 03-1337-9988 † To fool BackBurner's personalization dialog into thinking any SN you enter is good, make the following changes to the BackBurner APP.. Search for: 4FEF 0022 6712 4EBA 005C Change to: " " " " 6012 " " " " - Balance of Power †Search for: 72A1 D3C1 Change to: 5AD0 60CA Search for: 1B09 9629 Change to: 1C09 " " Search for: 8BAF E645 DE98 Change to: EA69 7BA9 0AB5 - Bane of the Cosmic Forge †To eliminate the codes, use ResEdit, open Bane (on disk A) change: CODE 1+$8406 From: 0C6D 0001 C268 6606 To: 3B7C " " " " 4E71 or try Bypass the journal entry codes by changing: CODE 14+$4020 From 4267 3F3C To: 6000 01DA. Bypass the rule book codes by changing: CODE 2+$39E From: 4EAD 037A To: 6000 01F8. or - BANE OF THE COSMIC FORGE EFFECT: This will remove the "match the codes" box. HOW TO: LOCATE 'CODE' ID 1 FIND Offset $83FE From: 0C6D 0001 C268 6606 To: 3B7C 0001 C268 4E71 The following is a BANE patch that appears to work correctly (the previously posted one works fine until you get into combat --- then you always miss!) - BANE OF THE COSMIC FORGE (Apr 24, 1991 version) EFFECT: While you will still be prompted for a password the first time you restore a game, any old word works. HOW TO: CODE ID = 1 Offset was change to 86D0 6C 60 8702 67 60 (just killing off the JSR to the password grabbing routine didn't work, so this will have to do unless someone makes a little more effort) - Battle Chess †@Å@Åõˇˇ ö ú@Ä*h©ûÄ@Ä*l@Ä*n@Å9`@ãòÊ@Ä*t@Ä*t@Ä*t@Ä*tÄ*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Å–@Å‡@Å@Å@Å@Å @Ä*z@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@ãë:@Ä*t@Ä*t@ãó>@ãët@ãî,@ãïv@ãôò@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*tˇˇHH5åÄ∫πŒd,Ld&4YhŸˇˇˇˇˇˇˇˇd&Ni∞ˇˇˇˇˇˇˇ»ˇÔ/`ﬂ9ˇˇˇˇNL÷_Ø^·Äˇ - BetterWriter v1.0.1 BW9112131832 - Big Thesaurus AxxxxBC (A+B=C; x=any #) - Bola 32 †v1.1 Search: FFEC 0C40 000A 661A Change: " " " " " " 4E71 Search: FFEE B0AE FFE0 6610 Change: " " " " " " 4E71 Search: FF16 B0AE FFF2 6606 Change: " " " " " " 4E71 - Borrowed Time †Search for: 2F10 4217 205F 4E90 Change to: 203C 99C4 5501 4E71 or try Search for: A552 F6C8 44B0 3DC0 1564 Change to: CF40 9035 1857 73BB 1995 - Brataccas †Search for: 2F10 4217 205F 4E90 Change to: 203C 99C4 5501 4E71 - Breach †Search for: 6604 70FF 6088 0C6E Change to: 4E71 " " " " " " - Brock Keystroke †Search for: 6708 2F0E 4EBA FEAE Change to: 4E71 " " " " " " - Bulk Mailer †Search for: 675A 42A7 3F3C 01 Change to: 605A " " " " " - Business Filevision †Search for: 6700 023C 4217 23B8 Change to: 6000 " " " " " " Search for: 3E81 3B5F F2EE 4A6D Change to: 4257 " " " " " " Search for: 6C06 4EF9 0040 Change to: 6006 " " " " - Butler 1560216811 - Cachet CM0000045VPM CM0000567VOM - Calculator Construction Set †Search for: 0C40 0000 6700 0006 4EED Change to: " " " " 4EFA " " " " or try Search for: 4EAD 00A2 0C40 Change to: 4E71 4E71 " " - Canvas v2.0 2005355 1234567 (1st+6th digit=7th) v3.0 3001700735 4753234241 2090414360 †To kill the ser# protection: Search for: 6D00 FE94 0C6E Change to: 600C " " " " - Capitalist Pig †v1.02 CODE 4+$1F0E From: 6706 To: 6006 Also: to cheat break in at the inital setup dialog and set a breakpoint at SetUpDia +200 which is a MOVE.L #$F4240,-13A(A6) The $F4240 = 1,000,000 Decimal, which is the initial funds you start with simply change this value to say 100,000,000 or whatever you want. or - CAPITALIST PIG EFFECT: When password dialog appears, press enter to bypass protection. HOW TO: LOCATE CODE 4...FIND THE OFFSET 1F08 AND CHANGE THE NUMBER 6706 TO 6006 - CAPITALIST PIG V1.0.2 EFFECT: Enter any number you wish into the password dialog box HOW TO: LOCATE CODE RESOURCE 4 CHANGE THE WORD AT OFFSET 1F10 FROM 4EAD TO 4E71 CHANGE THE WORD AT OFFSET 1F12 FROM 013A TO 4E71 CHANGE THE WORD AT OFFSET 1F14 FROM A9F4 TO 4E71 if you don't want to see the dialog at all you can change all the words between (and including) offsets 1D0C and 1F1C to 4E71. - Carbon Copy Mac 100003660 100003661 † No Checksum, etc. on the number; the serial number is REAL EASY to find with ResEdit, etc. Just change it and save changes, and presto — a “New Copy.” - C.A.T. IV v1.0 (Evaluation Copy) SeRvIcEs - CC Mail v1.x? UP8DW0XCN45ZGX v2.01 (Mac) 19344 030400 v4.0 (DOS) 19340 030380 v1.11 (Windows) 19342 030390 - CE Tiles v1.0 100369 - Championship Boxing †Search for: 660A 3D7C 2708 FF Change to: 6000 000A " " " Search for: 6612 3F3C 2708 Change to: 6012 " " " " Search for: 660A 303C 2708 Change to: 600A " " " " Search for: 6606 303C 2708 Change to: 6006 " " " " Search for: 660E 3F3C 2708 Change to: 600E " " " " Search for: 6608 303C 2708 Change to: 6008 " " " " - Checkers & Reversi †Search for: 6708 487A 0190 4EBA F69 Change to: 6600 8487 A019 04EB AF696 [<--This looks REALLY screwed up...] Search for: 6708 487A 0152 4EBA F988 Change to: 6008 " " " " " " " " Search for: 4EBA 08C2 3E1F 4EF9 Change to: A9F4 " " " " " " Search for: 4EBA 0BF0 3E1F 4EF9 Change to: A9F4 08C2 " " " " Search for: 4EBA 04D0 3E1F 4EF9 Change to: A9F4 08C2 " " " " - Checkmate †So that the password dialog will never show up, change: CODE 1+$0088 To: 60 AMPC 42+$1D6EA To: 6060 $1D754 To: 4E71 - Checkminder †Search for: 3B5F F6C8 4A6D F6C8 6707 Change to: " " " " " " " " 6007 Search for: 101F 0A00 0001 670A Change to: " " " " " " 600A or try Search for: 3B5F F6C8 4A6D F6C8 6706 Change to: " " " " " " " " 6006 Search for: 101F 0A00 0001 670A Change to: " " " " " " 600A - Chequebook †Search for: 6718 4267 3F3C 040B Change to: 6018 " " " " " " - ChemDraw Plus v3.0 Serial Number: 40770 Registration Code: CQXWPQ - Chem3D Plus 60086 KYAKRP †If you’re using MS Word 5 and System 7, place the "EGO for Word" plug-in module in the Word Commands folder that is found in the folder containing the Word 5.0 application. Keep the ChemDraw folder in the same folder as the CSC ChemDraw application - Chessmaster 2000 †Search for: A851 4EBA 30A8 42A7 Change to: " " " " " " 602E Search for: 584F 4A40 6724 362E 0008 Change to: " " " " 4E71 " " " " - Chuck Yeager's Air Combat †@Å@Åõˇˇ ö ú@Ä*h©ûÄ@Ä*l@Ä*n@Å9`@ãòÊ@Ä*t@Ä*t@Ä*t@Ä*tÄ*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Å–@Å‡@Å@Å@Å@Å @Ä*z@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@ãë:@Ä*t@Ä*t@ãó>@ãët@ãî,@ãïv@ãôò@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*t@Ä*tˇˇHH5åÄ∫πŒd,Ld&4YhŸˇˇˇˇˇˇˇˇd&Ni∞ˇˇˇˇˇˇˇ»ˇÔ/`)HˇˇˇˇNL÷≥Δ≥Äˇ≤l≤l@Äµ‡@Å@Ä Δ@Äˇ0@Äˇ0@É†@Äˇ0@Äˇ0@Äˇ0@Åê@òQ¸@òS - Chuck Yeager's Air Combat Demo †Here’s how to remove the two-minute limit in the demonstration version of Chuck Yeager's Air Combat: CODE 04+$02A4 From: 6400 1110 To: 4E71 4E71. +$145E From: 650C To: 600C The first part removes the actual limit; the second part stops the game from telling you your time was up when you stop any time after two minutes. - Civilization †The following list is all the questions you may be asked after playing for 1000 years after starting the program. They are very simple and you will be given an approximate page number. Every 5 or 6 items here I have given page numbers, so that should make the choice of what I am talking about fairly easy. If you answer wrong, you might as well quit. Wrong answers will tell you that you were wrong. Picture of B2 Bomber Flight and Electricity Scroll in Star Map Mysticism and Mathematics Atom Theory of Gravity and Physics Old Car Combustion and Steel Piggy Bank Trade and the Republic Bridge Construction and Iron Working Black Pot on tripod(17) University and Medicine Sword with Scarf Horseback riding & Feudalism Statue of man with sword and scale Alphabet Combustion engine Refining and Explosives Soviet hammer cross Philosophy and Industrialization IBM PC Computer Mathematics & Computers Plain soldiers(35) Republic and Explosives Hand holding hammer over inc. house Masonry and Currency Coins and Dollars Bronze Working Three hands over flag Philosophy and Literacy Kite in lightning Metallurgy & Magnetism Circuit board Enginerring and Electricity Circuit design under ruler Wheel and Construction Explosives Gunpowder and Chemistry Castle on Hill Masonry and Monarchy Man with Wings Combustion and Physics Two Atoms splitting Nuclear Power and Superconductor Molecular Splicing(47) Medicine and the Corporation Old gun with Gunpowder Bag Invention and Iron Working Factory emitting Smoke Railroad and Banking Old Phonograph Engineering and Literacy Shield and Spears Bronze Working Shaking Hands with Shovel and Axe Mass Production and Communism Open book with 3 closed in back Writing and Code of Laws Magnet(64) Navigation and Physics Map Alphabet 3 Cars Automobile and the Corporation Abacus adding machine Alphabet and masonry Red Cross with Snaking lines Philosophy and Trade Smelting Ore cup pouring(78) Gunpowder and University Crown Ceremonial Burial and Code of Laws Suppliant Meditating Ceremonial Burial Ship Wheel Map Making Nuclear Explosion Atomic Theory & Mass Production Nuclear Sign Electronics and Nuclear Fission Pensive Sitting Statue(86) Mysticism and Literacy Wheel Scale with two arrows Mathematics and Navigation Plastic Engine Refining and Space Flight Train(92) Steam Engine and Bridge Building Recycle Sign Mass Production and Democracy Robotic Implements(112) Plastics and Computers Rocket Advanced Flight and Electronics View of Earth Computers and Rocketry Steam Engine Physics and Invention Pouring Steel Metallurgy and Industrialization Two Meters Plugged into Wall Plastics and Mass Production 4 Men in front of Graph(118) Banking and Industrialization Eagle on Globe Code of Laws and Literacy Balls falling with arrows on sides Astronomy and University Hands Exchanging coins(122) Currency and Code of Laws Scholar's Cap Mathematics and Philosophy Writing Quill(124) Alphabet I couldn’t find the location of the $ in the game before, so finally I said to hell with it, I’ll just find somewhere where it accesses it and hack there. (It seems to only decipher the $ when it needs to and the encrypt/hide it as I had searched the entire range of program memory for it at various interupt points.) ... Anyways to make buying a unit/improvementt give you $32,000 (!!!) just do this: Civilization CODE #14 +4E48 6E00B6FA->363C7D00 +4E6E 9750->3083 To make it give you $32000 whenever you sell anything (unecessary if yopu do the first one, but the first one may be to much of a cheat for some people) +5340 700AC1D0->303C7D00 +5352 D150->3080 of course these ruin the game, but hey so what you now know that you can dominate the game and thus do not have to waste the rest of '93 playing it. - courtesy of DOOM Nemo’s cheat for Civilization! Sure the challenge of Civilization is the entertaining part of the game, but there's something to be said about nuking the shit out of the other guys. So, here's a cheat so that you can buy anything that’s being produced in your city without losing any money. Also it stops you from losing any money each turn by low taxes or whatever: Change CODE 14 This patches the buying Offset:$4E00 From: $6E12 To: $4E71 Offset:$4E48 From: $6E00 B6FA To: $4E71 4E71 Offset:$4E6E From: $9750 To: $4E71 Offset:$62F6 From: $9150 To: $4E71 Change CODE 13 This patches losing money each turn Offset:$18B8 From: $6E00 0088 To: $4E71 4E71 Offset:$18DA From: $9150 To: $4E71 Nemo’s cheats for Civilization! AKA - ‘Civilization Championship Edition’ Fifth Revision Sure the challenge of Civilization is the entertaining part of the game, but there’s something to be said about nuking the shit out of the other guys. So, here’s a bunch of cheats that I made for ‘stress relief.’ i) Allows you to buy anything for your city without losing any money ii) Stops you from losing any money each turn, for low taxes, or whatever. iii) Allows you to see what’s under the black (where you haven’t been) on the map. Unfortunately, you can't see other cities unless you’ve been there. iv) Prevents Global Warming v) Prevents you from losing any offensive battles. Doesn't work for other people attacking you. vi) Prevents losing troops and settlers from food shortages Side effect - your cities don't grow. vii) All items can walk on water! viii) All boats can swim on land! You can attack cities, but you can't take them over (yet). ix) SuperTechnology - all technology takes one turn. Enemy technology also takes one turn. x) Airplanes can't run out of fuel. xi) Build cities on water xii) Troops can attack from boats or the water without landing Change CODE 14 This patches the buying Offset: $4E00 From: $6E12 To: $4E71 Offset: $4E48 From: $6E00 B6FA To: $4E71 4E71 Offset: $4E6E From: $9750 To: $4E71 Offset: $62F6 From: $9150 To: $4E71 Offset: $6316 From: $5350 To: $4E71 Offset: $6330 From: $5350 To: $4E71 Offset: $6354 From: $5350 To: $4E71 Change CODE 13 This patches losing money each turn Offset: $18B8 From: $6E00 0088 To: $4E71 4E71 Offset: $18DA From: $9150 To: $4E71 Change CODE 3 This patches the map Offset: $3B28 From: $6712 To: $4E71 Change CODE 7 This patches the global warming Offset: $5544 From: $6624 To: $6024 Change CODE 7 This patches the battles Offset: $3DA From: $672A To: $602A Offset: $40C From: $662C To: $4E71 Offset: $456 From: $6C06 To: $4E71 Offset: $590 From: $6E18 To: $4E71 Change CODE 14 This patches the food shortages Offset: $37E8 From: $6600 0080 To: $6000 04AE Offset: $6FE From: $6600 To: $6000 Change CODE 11 This patches walking on water Offset: $2118 From: $6600 To: $6000 Change CODE 11 This patches boats on land Offset: $271E From: $664A To: $604A Change CODE 14 This patches the SuperTechnology Offset: $602C From: $6C28 To: $4E71 Offset: $6046 From: $670E To: $4E71 Change CODE 11 This patches the airplane fuel. Offset: $3F74 From: $6C14 To: $6014 Change CODE 11 This allows you to build cities on water. Offset: $1978 From: $6700 00DE To: $6000 0096 Change CODE 11 This allows troops to attack from water. Offset: $21FE From: $662A To: $602A The two most useful cheats I know are: 1: Save the game before the last piece moves, then quit and start your saved game. All your pieces will be able to move again. 2: Engineers can accomplish any one task in one turn if after you assign them a task, you repeatedly click on them, wake them up, and reassign the task. - CIVILIZATION V1.0.7 EFFECT: Select any item in the password dialog box. HOW TO: LOCATE CODE RESOURCE 9 CHANGE THE WORD AT OFFSET 31C6 FROM 6662 TO 4E71 CHANGE THE WORD AT OFFSET 2D58 FROM 4267 TO 4E71 CHANGE THE WORD AT OFFSET 2D5A FROM 4EBA TO 4E71 CHANGE THE WORD AT OFFSET 2D5C FROM 0008 TO 4E71 CHANGE THE WORD AT OFFSET 2D5E FROM 548F TO 4E71 if you don't want to see the dialog at all you can change all the words between (and including) offsets 1D0C and 1F1C to 4E71. For Civ 1.07 or 1.08, this completely bypasses the question dialog. In CODE 9: Change the word at $2d4e from $4eba to $4e71 Change the word at $2d50 from $0014 to $4e71 Change the word at $2d56 from $6x08 to $6008 (I forget the actual value that x represents above, but it doesn't really matter.) -•CIVILIZATION V1.0.7 & V1.0.8 EFFECT: Bypasses copy protection. HOW TO:In CODE 7, at offset 410E, change the word 6624 -> 6024 - Claris Impact v1.0 0003119496 - Claris Works 1120000 - Coach & Coach Pro 1000001 1234567 (1st+6th digit=7th) - Collage 06-1405-6209 - ColorIt v2.0 CI20A-xxxxx (Notice that it is CI and not C1) ^-L one-^ - Color Studio CS27968 CS11305 - Color Switch v2.3.0 †To patch ColorSwitch 2.3.0 so you can register without a License Code, change: CCOD -4060 + $458..$471 from: 4217 2052 4868 0100 2F07 2F3C 0100 0100 4EAC 2A1E 4A1F 508F 6736 to: DEFC 000A 2F08 2F09 2047 2252 43E9 0100 22D8 22D8 22D8 225F 205F If you want to reregister, erase the ColorSwitch License file (514 bytes) from the Preferences Folder. - Command HQ †GetPassW +314 6?->60 or - COMMAND HQ V1.0 EFFECT: The password dialog will never show up HOW TO: LOCATE CODE RESOURCE 7 CHANGE THE WORD AT OFFSET 0F0C TO 4E71 CHANGE THE WORD AT OFFSET 0F0E TO 4E71 - Comment 1234567 (1st+6th digit=7th) †v2.0 Search for: B02E FFFE 6604 Change to: " " " " 4E71 Search for: 4A28 0068 6600 Change to: " " " " 6000 Search for: 670C 206E 0008 Change to: 600C " " " " This will cause it not to ever ask for name and serial number. if you really want a name and company name, type them in along with any serial number then use MacsBug to exit to shell (type ES at the prompt). - Compactor Pro 16225913 †v1.33 To register Compact Pro 1.33 and enable encryption, change: CODE 4+$2EA4 From: 67 To: 60 When it asks you for the registration code, type any 8 characters. If you want to reregister your copy (to change the name), change any number of bytes in the CLOC resource (don’t change the size). If you have a copy of Compact Pro 1.33 that won't enable encryption (if there’s an ‘*’ after your name in the about dialogbox and no ‘Set password…’ item in the Misc menu), make sure CODE 4+$2F44 is $66 (not $60) and reregister.) Version 1.34 1) Open up the application with ResEdit 2) Open up the CODE resource 3) Open up CODE ID 3 4) Search for Offset 4856 5) Change 6718 to 6018 6) Quit ResEdit and save all changes 7) Open up Compactor Pro 8) Click Register 9) Type in a name and any serial number you wish 0) Now hit the return key! Compact Pro 1.34 Krak CODE 3 +47B8 6600 009E->4E71 4E71 +4856 6718 ->6018 or For Version 1.34 Actually, here's a slightly better version of the crack. This one leaves the registration intact: Go to offset 47A8 in Code 3 Find 0C2E 001F Change to 6000 00C6 ====================== Compact Pro 1.3.4 CODE 0003 offset 47AE Locate 6200 00A8 Change to 6000 00C0 Any registration code will now work. ====================== - Concepts Atlas †Search for:4267 2F2E 0008 4EBA FED2 195F FFFE 600E Change to: 3F3C 0101 4E71 4E71 4E71 " " " " " " Eliminates updating of the free trials left number, Get unlimited tries. - Copy II Mac †To get rid of that stupid startup message in versions 4.3 to 5.2 change: Search for:486E FECE 3F3C 0032 3F3C 003C Change to: 6000 0204 " " " " " " " " - Cosa After Effects XH9-SVJ1-B5K - Crash Barrier v1.0? 1982487924 v1.1 852328092 1852328092 v1.03 †Open w/ resdit, change: cdev+$14D4 From: 2F0E 4EBA FDFA To: 4E71 4E71 4E71 Worked for me (version 1.03). v1.1 Change: cdev -4064+$4724 From: 6606 To: 4E71 - Creepy Castle †V1.0 (ATTENTION: Patch also disables internal virus check!) So that the password dialog will never show up change: In file ‘Data A’ CODE 4+$3D4E From: 4E56 To: 4E75 CODE 3+$7176 From: 4EBA To: 7000 +$7178 From: E582 To: 7000 or try, In file ‘Data A’ CODE 3+$57B6 From: 6704 7000 6050 To: 6054 7000 6700 This patch will disable the game's automatic virus checker for the mods and it’s shorter somewhat. This will also make it so the trivia dialog will never show up: In file ‘Data A’ search for: 4EBA E582 3B40 A7C0 change to: 7000 4E71 " " " " search for: 0C85 60EB 6953 670E change to: " " " " " " 600E or try, To bypass the Trivia dialog in Creepy Castle, change: In file ‘Data A’ CODE 3+$56FE From: 2F07 3F3C To: 6000 00B8 So that the built in virus checker doesn’t detect the change the code checksum: In file ‘Data A’ CODE 4+$3DA6 From: 60EB 6953 To: 2267 9A4C - Cribbage †Search for: FA75 C74C 511 Change to: FB74 " " " Search for: 6851 8EDF 775C Change to: 6950 " " " " - Crimson Crown †Search for: 2F10 4217 205F 4E90 Change to: 203C 99C4 5501 4E71 - Crush Beta tioga (case sensitive) †Search for:6704 7001 6002 7000 Change to: " " 7000 " " " " Only search the resource fork. There are 5 or 6 places where this string can be found. You must replace all of them. When entering the “0” for the “1” in 7001, make sure to enter just one “0” and write each sector. That's it, happy crushing… - Cryptomatic v1.01 346190 - Crystal Caliburn †a hack that lets you play crystal calibourn on a 12" screen (by doing this you can see most of your flippers instead of none.) use resourcerer and open the 13" WIND template change to: top 0 bottom 612 left 0 right 512. it's not perfect but it is playable this way - it also lets you see the left part of the game. - Curse of the Azure Bonds †v1.0 (bw) So that the password dialog will never show up, change: CODE 7+$6772 To: 4E75 ========== v1.1 (color) (2/1/91) So that the password dialog will never show up, change: HOW TO: CHANGE THE WORD AT OFFSEA IN CODE RESOURCE 14 TO 4E75 [EH?!?!? Does some one have the offset?] - Cutthroats †Search for: 6FDA 1006 6706 3B7C Change to: 6004 " " " " " " 2nd Crack Use Block Edit on block 44 and change byte 15D from 67 to 60 or try: Move to block 002C, position 015D, change 67 to 60 - Dark Queen of Krynn †- DARK QUEEN OF KRYNN (ATTENTION: Patch also disables internal viruscheck!) EFFECT: The password dialog will never show up HOW TO: LOCATE CODE RESOURCE 11 CHANGE THE WORD AT OFFSET 655A TO 4E71 CHANGE THE WORD AT OFFSET 655C TO 4E71 CHANGE THE WORD AT OFFSET 65B4 TO 4E71 - DARK QUEEN OF KRYNN V 1.0 EFFECT: Defeats password protection. Works for b&w version, not tested for color. Patch 1.0 This keeps the password dialog, but it doesn’t matter what password you use. After the 3th try the program starts. HOW TO: Locate code resource 15, change the word at offset $1DB6 from $4EBA to $4E71 and offset $1DB8 from $5586 to $4E71 You must type something as password - Daymaker v1.0 59AINA4AAOAC1G v1.01 59AINA4AAOAC1G 13A39ADAAHA1QU v2.0 59AINA4AA0AC1G 0148D-0F68F9-1F100 †v2.03 If the installer does not recognize your disks as originals, simply make these changes to the installer with RESEDIT. Open the Installer file and change: infn 1001+$456 From: 6704 To: 6004 +$562 From: 6704 To: 6004 +$462 From: 6EDE To: 4E71 or try, (This is a partial CRACK) Open the 'DayMakerInstall' file with ResEdit: To make it think the disks are real install disks, change: infn 1500+$0004 From: 4EBA 00BC To: 4E71 4E71 infn 1001+$0030 From: 4EBA 0ABA To: 4E71 4E71 To allow anything as a serial number, change: infn 1001+$019A From: 6F0C To: 600C +$01B2 From: 6704 To: 4E71 Daymaker 2.0 - Allows anything for a serial number. in the file "DayMakerInstall" “infn” #1001 +$1B2 $67->$66 - Datebook Pro TB6I14233S2KE1CS buvc0z9s8h1n7dab - dBase Mac 0000000-00 - DeBabelizer v1.2.15 APB120-2836-14690 MC14-2836-1001340 v1.4.02 MC14-2836-1001340 v1.5 MC14-2836-1001340 †CODE 8+$1CB6 From: 6710 To: 6010 - Deja Vu †Before making these changes, you must do the following: (1) Sector copy with format, tracks 1 to 58 from the original. (2) Then sector copy tracks 60 to 79. Track 59 hangs up on all copiers. then change: Search for: 56C0 671E 7200 Change to: 51C0 601E " " Search for: 56C0 6722 223C Change to: 51C0 6022 " " Search for: 6708 41F8 00EC Change to: 6008 " " " " Search for: 6748 486E FDEA Change to: 6048 " " " " Search for: 56C0 6720 322D Change to: 51C0 6020 " " Search for: 57C0 670C 41FA Change to: 50C0 600C " " Search for: 57C0 6716 41FA Change to: 50C0 6016 " " - Deja Vu (Rubicon) †Search for: 6708 4EAD 019A Change to: 6008 " " " " Search for: 6706 1B7C 0002 F58B Change to: 6006 " " " " " " - Delta Graph Pro 2000002464 v3.0 DGM3000900 - Desk Toppers †Search for: OC40 FFAF Change to: " " 0000 - DiagnoSYS v1.0 B102131444366 - DietMac †v1.0 Search for: 4267 42A7 3F3C 0 Change to: 60FA " " " " " - Dimensions v1.0 DAW100R3104865-875 DAW100R3100720-191 PCA100000100953 - Director v3.0 D300-31239-CP4U D300-11114-CP4U D300-12935-CP4U - DiskCopy †v4.2 To get rid of the dialog box, change: CODE 1+$150C From: 67 To: 60 - DiskDup †v2.3 & older All you need is when at the “number of Copies” dialog field - just arrow key to the right of the number “1” and type 3 (three) blank spaces. This should register the application. - Disk Express II JV103761 JE103744 JI103774 JV103735 JX103737 JX103763 JY103738 JZ103739 - DiskTop v4.0 06412 (any 5 #s) v4.0x (any 5 #s) v4.5 0065449 - DMS †DMS+ Search for: 0C6D 0034 8990 6700 0618 Change to: " " " " " " 6000 " " ========== DMS 4.0a (messy crack, but effective) Search for: 4A5F 671A 4267 Change to: " " 601A " " Search for: B06D 82B0 671A 4267 Change to: " " " " 601A " " Search for: 101F 6602 A9F4 Change to: " " 6002 " " (3 times) Search for: C001 6766 102E 0008 Change to: " " 6066 " " " " Search for: B240 662E 486E Change to: " " 602E " " Search for: 4A6D CF12 6766 102E Change to: " " " " 6066 " " - Dollars & Sense † Block (Hex) Byte From To -------------------------------- 425 146 6704 4E71 0FC 6700 6600 468 1E0 487A 6606 If you do not find these bytes on these blocks, you may have to search the disk. Dollars and Sense A Move to block 00B8, position 017C, change 56C0 to 4E71 Dollars and Sense B Move to block 01A9, position 0146, change 6704 to 4E71 Move to block 01A9, position 00FC, change 6700 to 6600 Move to block 01D4, position 01E0, change 487A to 6606 Dollars and Sense C Move to block 019E, position 01EF, change to 4E71 Move to block 019E, position 01F1, change to 4E71 ========== v1.3 Search for: 0A00 0001 6768 3F3C 0102 Change to: " " " " 6068 " " " " - Double Helix DHMC180800011V30R1 - Double Talk † Change serial number in DATA resourse near the line 3D0. The serial number is not exactly the same, it’s swapped to avoid detection. - Douglas CAD AutoRouter v7.30 †guaranteed - Just hit cancel when asked for key disk Code #5 +25F8 670C->4E71 OR unguaranteed - but high degree of certainty - no key disk request at all Code #5 +25E8 4267->6010 - Douglas CAD Professional Layout v7.30 †guaranteed - Just hit cancel when asked for key disk Code #2 +2832 670C->4E71 OR unguaranteed - but high degree of certainty - no key disk request at all Code #2 +2822 4267->6010 - Dragons Lair 2 †Search for: 426D 027A 0C6D Change to: 4E71 4E71 " " Be sure the folder format is EXACT! Put all files in a folder called DL2. The code is a 5 digit code, and this patch allows for any 5 digit combo. Even if you type a wrong serial code it will run the game anyway. Don’t forget to remove 32bit QuickDraw when running the game. P.S. it hates MultiFinder. [and therefore probably bombs under S7?] When your game is over. Just hit "0" to start over. Another patch that will get rid of the jump to the serial code dialog box Search for: 6100 04C2 Change to: 4E71 4E71 The patch seems to work just fine and without the code dialog you do not have to insert a code. - Dragon's Lair 3 † Unlike DL2, the DL3 app is buggy under certain circumstances. Even though the data files are installed on the hard disk, DL3 will try to look in the floppy drive, anyway! Here's wathca do: Copy file "disk1" to disk named “EscDisk1” Copy file "disk2" to disk named “EscDisk2” . . . etc... You might as well run it off floppies so copy “Escape” app to "EscDisk1" as well. DRAGON’S LAIR WILL NOW RUN FINE! - DragonWave †v2.0 Open up the DragonWave 2.0 application and change: CODE 18+$F5A From: 6720 To: 6020 - Dragonworld †Search for: 4EBA 0052 4A40 6748 Change to: 604E " " " " " " - Dreams of the Phoenix Fix † Many DOTP programs DAs and FKEYS have trouble on the Mac II. In particular DA Installer + Q&D Terminal, Q&D Dialer, AVailable key, super note pad. The problems vary from minor inconvenience to crashing. This patch will fix them all. It won’t hurt them in any way :-) Search for: 3082 2040 0000 4E75 Change to: " " " " A000 " " has to do with self modifying code. Change all occurrences. - DX-7 Patch Editor †v1.15 Search for: 8438 3F3C 0001 A Change to: 76BE " " " " " - EG Word 51122400002818 - Elastic Reality 80862801118 - Electric Checkbook †v1.0? Search for: 3E1F 206E FCF0 Change to: 4E71 " " " " v1.1 Search for: 67DE 4A46 6728 487A Change to: 4E71 " " 6028 " " - Elements of Style ESM 113904 T - Empower Name:Administrator PW:Admin vI & II Name:Administrator PW:Admin - Enforcer v2.9 (Old) 876855327801 - Ensemble †v1.0 Read block 338 ($152) change bytes as follows byte 1A from 67 to 4E 1B from 92 to 71 7E from 67 to 60 If the original bytes are not correct then perform the following searches: Search for: 6756 4267 3F3C 0001 Change to: 6056 " " " " " " Search for: 6792 2F0B A983 Change to: 4E71 " " " " - Eric's Ultimate Solitaire †try using "Weasel" as your name - Evelyn Wood †(versions .5 to 1.0) Search for: 3444 3F3C 0001 A9 Change to: 256E " " " " " - ExperLisp †v1.4 Search for: 670E 2FFE 0008 486E Change to: 600E " " " " " " Search for: 6738 486D F1DC A851 Change to: 6038 " " " " " " v1.02 Search for: 6738 4860 F200 A851 Change to: 6038 " " " " " " Search for: 670E 2F2E 0008 486E Change to: 600E " " " " " " - F/A 18 Hornet †- F/A-18 Hornet 1.1.0 EFFECT: Makes it possible to enter any word in the password dialog HOW TO: LOCATE 'CODE' ID 4 FIND Offset $000B40 ~From: 6598 7000 To: 6598 7001 - F/A -18 HORNET v1.1.0fc EFFECT: Prevents the "Enter nth Word on Page p" dialog from appearing. HOW TO: LOCATE 'CODE' RESOURCE 6 OFFSET $178C CHANGE WORD FROM $6600 TO $6000 - FA/18 HORNET 1.0.1 EFFECT: The program will never ask you the question. HOW TO: Locate CODE 6, Find offset $189E, Change the word $6700 to $6600. or - F/A-18 HORNET 1.0.0 EFFECT: Makes it possible to enter any word in the password dialog HOW TO: LOCATE 'CODE' ID 4 FIND Offset $000C30 ~From: 0006 6604 7000 600C To: 0006 6604 7001 600C - F/A -18 HORNET v1.0.0 EFFECT: Prevents the "Enter nth Word on Page p" dialog from appearing. HOW TO: LOCATE 'CODE' RESOURCE 6, OFFSET $18EC CHANGE WORD FROM $6600 TO $6000 - Faces †Search for: 4240 4840 80FC 0030 4840 3D40 Change to: 4280 " " " " " " " " " " It will ask you who beat Napoleon at Waterloo. The answer is Welling. or try, Here is the complete crack: CRACK PATCH Open Faces 1.0 with ResEdit and change: CODE 3+$652 From: 486D 01CA To: 603A 4E71 +$694 From: FEED To: FED4 Open Color Faces 1.0 with ResEdit and change: CODE 3+$7C2 From: 486D 017A To: 603A 4E71 +$804 From: FEED To: FED4 - Fact Finder †v1.0 Factfinder A Search for: 6604 A002 6002 A003 3D40 0012 Change to: " " " " " " " " 4E71 4E71 Factfinder B Search for: 670A 206E FEF6 2D50 Change to: 600A " " " " " " Factfinder ? Move to block 015E, position 016C, change to 4280 - Fahrenheit 451 †Search for: 0C42 005A 6F00 0014 Change to: " " " " 4E71 4E71 The mod is (using FEdit) Sector 59 of the Fahrenheit 451 file - offset 39F (or if you like, Seg #2 of CODE) - change JSR (4EBA 00A0) to NOP's (4E71 4E71). - Falcon MC †Game Controls: Pause ------------------------------ P,Q,ESC Return to Cockpit ------------------ Command R Quit ------------------------------- Command Q All Sound -------------------------- Command S Music ------------------------------ Command M Switch MouseSticks ----------------- Command T Exiting the Simulation : Abort Mission ---------------------- Command A End Mission ------------------------ Command E Eject ------------------------------ Command Option E Jettison Keys : Jettison tanks --------------------- Option T Jettison all A-G stores ------------ Option K Jettison ECM pod ------------------- Option C General Controls : Autopilot on/off ------------------- A Chat ( head-to-head only ) --------- ' Ranging TWI on/off ----------------- H View stores ------------------------ V Waypoint increment ----------------- U Waypoint decrement ----------------- Y Detail Controls : None ------------------------------- Command 1 Far Terrain ------------------------ Command 2 Gradient Horizon ------------------- Command 3 Mountains -------------------------- Command 4 Medium Terrain --------------------- Command 5 Complex Rivers --------------------- Command 6 Ground Detail ---------------------- Command 7 All -------------------------------- Command 8 Flight Controls : Forward stick ---------------------- (UP ARROW), I, numeric keypad 8 Back stick ------------------------- (DOWN ARROW), M, numeric keypad 2 Left stick ------------------------- (LEFT ARROW), J, numeric keypad 4 Right stick ------------------------ (RIGHT ARROW), L, numeric keypad 6 Increase throttle ------------------ 1, - Afterburner ------------------------ /, numeric keypad * Left rudder ------------------------ [ Right rudder ----------------------- ] Speed brakes ----------------------- B Flaps ------------------------------ F Weapon Controls : Trigger ---------------------------- Spacebar, numeric keypad 0 Select air-to-air weapon ----------- Return, numeric keypad = Select air-to-ground weapon -------- Delete, numeric keypad / Target select ---------------------- T Clear taget lock ------------------- X, numeric keypad CLEAR LCOS on/off ------------------------ O Landing Keys : Activate ILS HUD ------------------- \ Landing gear up/down --------------- G Wheel brakes on/off ---------------- W REO controls : Rader on/off ----------------------- R Boresight scan rader mode ---------- < Tracking scan rader mode ----------- > Map display on/off ----------------- C Countermeasures : ECM pod on/off --------------------- E Chaff ------------------------------ Tab, numeric keypad . Flares ----------------------------- ', numeric keypad ENTER View Keys : Front view ------------------------- 3, numeric keypad 1 Left view -------------------------- 4, numeric keypad 7 Right view ------------------------- 5, numeric keypad 9 Rear view -------------------------- 6, numeric keypad 3 Track view ------------------------- 7 Camera view ------------------------ 8 Chase view ------------------------- 9 Missile view ----------------------- 0 View Control Keys : Display info on/off ---------------- D Zoom in ---------------------------- F1, Option 1 Zoom out --------------------------- F2, Option 2 Rotate left ------------------------ F3, Option 3 Rotate right ----------------------- F4, Option 4 Rotate over ------------------------ F5, Option 5 Rotate under ----------------------- F6, Option 6 Widen fisheye ---------------------- F7, Option 7 Narrow fisheye --------------------- F8, Option 8 Set wide fisheye ------------------- F9, Option 9 Set narrow fisheye ----------------- F10, Option 0 - FALCON MC (v1.0.1) EFFECT: The first time Falcon launches, it will quit immediately after you click your mouse to select items, but a good Falcon Settings file will be created for your macintosh without dialog showing up asking for documented answers. The following launches of Falcon will be successful with the correctsettings file. HOW TO: Open CODE resource 1, at offset 0041A4, change word to $4E71 Open CODE resource 21, at offset 0009DE, change words to $4E71 4E71 at offset 0009E8, change words to $4E71 4E71 4E71 or - FALCON MC 1.0.1 EFFECT: The program will never ask you the question. HOW TO: Locate CODE 1, Find offset $3F48, Change the word $6700 to $6000. or -•FALCON MC 1.0 EFFECT: The first time Falcon launches, it will quit immediately after you click your mouse to select items, but a good Falcon Settings file will be created for your macintosh without dialog showing up asking for documented answers. The following launches of Falcon will be successful with the correct settings file. HOW TO: Open CODE resource 1, at offset 00430A, change word $6404 to $4E71 Open CODE resource 21, at offset 000AA4, change words $4EAD 08BA to $4E71 4E71, at offset 000AAE, change words $4EAD 015A A9F4 to $4E71 4E71 4E71 - FaxSTF v3.0 S200200 T100300 - Feathers & Space †Search for: 6706 38BC FFC2 600C Change to: 6006 " " " " " " (6 times) - Ferrari Grand Prix †v1.27 Search for: 0280 1234 FFFF 48E7 7FFE 41FA Change to: 4240 21FC D9CD B903 0A80 4E75 - Fetch v1.0 51-1007-201194631 - Field Assistant 8E06D026670F0550 - File Buddy v1.6.2 M526 E803 J1120 v2.04 BDK 689 JEM †To reregister a registered copy, remove the prefs file. or try, This krak works for version 1.51 and 1.62 of FileBuddy. You only need to search for the first four hex bytes of each step: Search for: 6718 3F3C 0082 3F3C 0012 4EAD 038A Change to: 6018 " " " " " " " " " " " " Search for: 662A 3F3C 003F 486E FDC2 486B 0004 Change to: 4E71 " " " " " " " " " " " " - File Force †1.0 X-442540368699 - FileGuard v2.0.2 Mike v2.7.1 77151-111159-201238 00111-683277-201548 v2.7.2 67188-222480-206181 77151-111159-201238 v2.7.3 04264-904468-226561 †Change: HIGH 5+$52 From: 4EBA 05E2 To: 4E71 4E71 This will block the whole routine ‘CheckLicence’ which checks if it is registered, and if another computer on the network has the same serial number. - File Maker vPro 1120000 †(probably not for pro version…) Search for: 6702 2854 200C 57C0 Change to: 6002 " " " " " " FileMaker Pro 2.0 P/W Solved! (kind of) Cool...is it a resource? If so, I'll run a ResCompare and see where the password sits in various files. Perhaps change the password by a small amount here and there, and hopefully come up with the methodology used to encrypt it... Well, thanks to the clues I've figured out how to find and eliminate FMPro passwords - and I've had a 100% success rate thus far (8 databases). I'm using SUM Tools (I know, I know, ancient but it works) which shows a 16-byte line of hex data. What you should look for is the string 01FF. I think the reason there was a problem, was because he was looking for XXXXXX01FF as his five unique bytes before the password. The first three DO change; 01FF seems to be common. Anyways, if you look for 01FF, you'll find a ton of them. You'll know you have password info when you see something like: XXXX XXXX XX01 FF07 AAAA AAAA AAAA AAXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XX07 AAAA AAAA AAAA AAXX Note: 01FF is what you're searching for 07 is the number of characters in this particular password AAAA etc. is encrypted password data. Note that 07 is mirrored two lines down. Change both the 07's to 00's, and that password is eliminated (it gets changed to '(no password)' in the selection dialog). That's all there is to it! Keep searching and you'll get them all. enjoy! And thanks to *TUC403* for doing the dirty work for me! Nope, it's all in the data fork. I guess you could copy the data fork into a single resource, and use res-compare that way (I wrote my own compare routine, so haven't needed to try that. And... don't ask for it, it's a very poor hack, and I'd hate to show it to anyone!!) Hmmm, I see that I'm going to have a late night hacking. The difference between what you've done here, and in the hack I was working on (the one that works 100% in FM II and Pro 1.0), is that there is also a single byte somewhere within the file that says "yes I do, or no I don't" have any passwords. Changing that 1 byte will make FM come up w/o asking for any passwords (just as if the file were not passworded). Ok, I just came up with my notes, and here's what I found concerning removing passwords from FileMaker files... FileMaker II (100% accurate): Search String: C117 4002 01aa 42xx The aa is data that doesn't matter (we just read it to move the pointer) The xx is the password flag. Anything other than 01 means passwords exist, 01 means NO passwords FileMaker Pro 1.0 (100% accurate): Search String: C0C1 17C1 xx The xx is the password flag. Anything other than 00 means passwords exist, 00 means NO passwords FileMaker Pro 2.0 (75+% accurate): Search String: C0C1 17C1 0540 Starting at the 40, replace with 42 0500 55AA 55AA C105 C0C0 so the line becomes: C0C1 17C1 0542 0500 55AA 55AA C105 C0C0 That's it. I hope this helps anyone trying to crack it... Ok, here's the crack for FileMaker Pro 2.0 files. (it seems I was in the right area, but screwing with the wrong bytes!) He was partially right, in that you look for 01FF, and there are A LOT of them, but, if you look for 0301FF, there only seems to be ONE of them in the entire file, and this is the mark for the primary password! Look below... ______ xx C0C10841 280301FF 0D385930 5E2B4A38 412F0200 00000008 01441642 0B4A1841 005F3DD8 00000000 0D185910 5EC0C0C0 xx First, you search the database for 0301FF (I won’t get into which editor to use, but I use Norton). The following byte (in this case, 0D is a password length byte). Here, he was completely correct. Change this byte to 00. Next, 32 bytes away, you’ll see the same byte again, change it to a 00 also, an tada, it's fixed. Now, when you open the file, it opens straight up, without asking for a password. The beauty of this method (over the one that I described earlier), is this still leaves all other passwords intact. The only difference, is that in the define passwords section, the main/primary password will show as (no password), and of course, you can change that. The previous method destroyed all passwords. FileMaker Pro 2.0 Password revisited... It appears that my previous post was a bit of “premature ejaculation,” uh, I mean “elation.” Every file I checked last night had the primary password preceeded by 0301FF, but files I’ve checked today don’t! One things for sure (so far) though, an 01FF followed by a byte, with that byte duplicated 32 bytes away, IS a password. Here’s another wrench, I removed the passwords (using this method) from the Products DB file on here, it opened just fine, with FULL access to all fields, except that the Access Privs.. menu option is ghosted (non-selectable). I’ll have to play with that some more. FileMaker Pro 2.0 P/W Solved!!! Congrats! I'll check out the 03 trick right away... looks cool though; I’m thinking of writing a drag&drop that does just this. Worth my time, or will your Masterkey do this? Bummer. Just read your message. I never had the access privs problem happen to me...strange indeed. I’ll look into it some more as well. I think the drag & drop is still very possible: Write a data fork search engine that looks for 01FF, then looks at the next byte, jumps 32 bytes and checks out the following byte. If it's the same as the byte following 01FF, then change both to 00. Ugh. Sorry, my brain hurts, and if that didn't make any sense then I’m not surprised. Funny, though, did you check out the encoded passwords? I had a 7 character password of ‘aaaaaaa’, and it was encoded as: C101 412B EA01 FF07 3455 3455 3455 34FF FA48 6DC4 084E BAFA 943E 1F3D 4700 124C DF00 C04E 5E20 5F07 1455 1455 1455 14C0 Interesting, no? It’s encoded as 3455 3455 3455 34 on the top line, and 1455 1455 1455 14 on the bottom. Also, I believe that the FF and C0 following the password is some kind of checksum (changing it brought up an error dialog when the database was being loaded). That’s the same method I intend to use to find the p/w. I noticed that about the passwords last night... but haven’t been able to figure out the encoding (haven’t really tried though). I imagine if you gave a pw of “abba”, it should clue you in to something. - Filevision †On block CE of the file Filevision, at byte 1B0 change 6604 to 4E71 or try, Filevision Alternate Crack: Search for: 6700 FEC6 (should be on Block 227, Byte 118) Change to:..4E71 4E71 - Finder 7 Menus v1.3/2.x cc5187efH28b911af - First Class Server 35058 v1.6 admin/password vReg 5 100015 vTel 250 & CLUI 350058 vGateways 1000025 vWindows 1200597 vIPX 1300141 vReg 10 & Gateways 2100165 vReg 100 & Gateways 2100236 vTel 100 & Gateways 3000396 vTel 1000 & CLUI 4200000 - First Things First v1.x 101006058 101006048 v2.0 2001762695 v3.0 3001515541 3001677975 †Change CSEG 128+$6D3E From: 6716 To: 4E71 Restart after altering the Extension so that it will re-load the altered commands. Now it will accept anything as a valid serial number. - Flight Simulator †v1.0 Use Fedit and open the FS file "Load2" Search for: 6700 0068 Change to: 41FA FEA0 20BA FE98 4E75 - Flo' 1340 - Fokker Triplane †v.a Search for: 41FA 001E 20B8 Change to: 4280 4E75 20B8 v.b Search for: 43FA 1452 41FA 1446 20FC Change to: 6000 0116 " " " " " " Search for: 6600 FE9A 41FA FCCE Change to: 4E71 4E71 " " " " Search for: 6600 FE7E A9B4 4EBA Change to: 4E71 4E71 " " " " Search for: 6600 41E6 2F34 07D4 Change to: 4E71 4E71 " " " " Search for: 0010 6EFA DFFC 0000 0032 207C 0007 2700 Change to: " " " " " " 6000 00AA " " " " " " - FolderBolt v1.02 00993699 v1.02e 1028817 - Fontographer v4.0 Key #: FM5104l3823gc527 Serial#: 1104008 Key #: FM1194C9779N7C7D Serial#: 1100009 - Forecast †v1.2/1.3 Search for: 4EAD 022A 101F 6754 Change to: 4E71 4E71 " " " " - Form Z †If this expires you can get around it by changing: CODE 24+$09D6 To: 4E71 +$09D7 To: 4E71 - Foxbase Serial #:FMD027877 Activate:emzxpyei - FrameMaker v2.1 2-01320-27 2-01880-14 2-02071-17 v3.0 2-01320-27 2-01880-14 2-02071-17 2-150753-47 2-151967-07 - FreeHand v1.x/2.x 08-1004-0268684 v3.0 02-1235-002302134 02-3008-000036469 02-4008-200010087 02-6023-000345263 04-1000-000006699 11-1009-200021734 06-0001-100000000 02-0000-000000000 v4.0 xx-xxxx-xxxxxxxxx 02-1235-002302134 02-3008-000036469 11-1009-200021734 02-4008-200010087 12-1234-123456789 †To change or modify the name or serial number of a personalized copy of Freehand 4 open it with Resedit and open the aldp resource. Aldus employs this serialization scheme (xx-xxxx-xxxxxxxxx). Any number from any Aldus product using this scheme will work. - Frogger † They named the Frogger program “Finder” and made it invisible, locked, and Bozo bit set, so just use setfile and undo all three and copy it to your disk, and then set the original back to the way it was. Now you have Frogger as a single file!!! One note of interest: After each game it executes the file named “Finder” Since that was what it was called. So if you don’t want to have to reclick on it everytime you want to play, then make sure the Frogger program is named Finder. [One thing of note, under System 7, the Bozo bit is now the stationary bit (like any one used the Bozo bit anymore…). Since you can’t execute stationary :-), I don’t know how this will affect the program. Of course, it probably doesn’t work on System 7 anyways…] - FrontDesk †Search for: 4EAD 046A 101F 675C Change to: 4E71 4E71 " " 4E71 - Frontier v1.0 ULF.10108.100 - Full Impact v1.1 0000000-00 (XXXXXXX-AA X=any #, AA = sum of x's) - FullWrite Pro v1.x 0000000-00 (XXXXXXX-AA X=any #, AA = sum of x's) PN=1013409103 SN= 8052167-29 - Fun Pak †Search for: 4A5F 6708 48 Change to: " " 6008 " - Futuria †Finder copy all the Files on the Futuria disk and then take Fedit to the file Futuria. Search for: 4EBA FC18 205F 4EFA FE16 Change to: 4E71 4E71 " " " " " " or try, Search for: 3CBA 000C 4EBA Change to: 4E71 4E71 " " - FWB HD Toolkit v1.1 - 1.3 10033B7E 10829C7I 10000B9S (^-FWB’s :-) ) v1.4 - 1.5 J51332B3S v1.2.1PE P58115C71 †HDT PRIMER Search for: 6714 2F3C 0000 121F Change to: 6014 " " " " " " 0r HDT PRIMER Version 1.2.1 CODE 2+$1B82 From: 6714 To: 6014 HDT WORLD CONTROL Search for: 6712 486D E46C 2F3C Change to: 6012 " " " " " " Or HDT WORLD CONTROL Version 1.2.1 CODE 2+$107C From: 6720 To: 6020 +$134C From: ???? To: 6012 ^^^^--(might be 6712?) - FWB CD ROM Toolkit v1.0/1.01 C34012798 v1.0.3 C12348678 N90307999 †FWB CD 1.05 The personalization information is stored in the resource 'Font' ID -4048, which must always have a size of 148. The first byte is the length of the name, and the name is encrypted by XORing the bytes by $93. The byte at offset $40 is the length of the organization and, the subsequent bytes are the organization itself, encrypted by XORing the bytes by $7C. The byte at offset $80 is the length of the Serial Number, and the subsequent bytes are the serial number itself, encrypted by XORing the bytes by $E9. The crack so that the serial number always looks good is: Open it up in ResEdit Open up the resource 'cdev' ID -4064 Change it at offset: $56DA From: $59FF To: $5A00 FWB CD ROM Toolkit 1.0.3 The serial number for 1.0/1.0.1 doesn’t work in 1.0.3. Here’s how to crack it (or you can just use the 1.0.3 Serial Number): The personalization information is stored in the resource 'Font' ID - 4048, which must always have a size of 148. The first byte is the length of the name, and the name is encrypted by XORing the bytes by $93. The byte at offset $40 is the length of the organization and, the subsequent bytes are the organization itself, encrypted by XORing the bytes by $7C. The byte at offset $80 is the length of the Serial Number, and the subsequent bytes are the serial number itself, encrypted by XORing the bytes by $E9. The crack so that the serial number always looks good is: cdev -4064+$56DA From: 59FF To: 5A00 Now any serial number in the correct format except C34012798 will work! The personalization information is stored in the resource 'Font' ID -4048, which must always have a size of 148. The first byte is the length of the name, and the name is encrypted by XORing the bytes by $93. The byte at offset $40 is the length of the organization and the subsequent bytes are the organization itself, encrypted by XORing the bytes at $7C. The byte at offset $80 is the length of the serial number and the subsequent bytes are the serial number itself, encrypted by XORing the bytes by $E9. The crack so the serial number will always look good is: Open it up in ResEdit Open the resource 'CDEV' ID -4064 Change offset $56DA from $59FF to $5A00 - Gato †Search for: 4A01 6700 0006 4EAD Change to: " " 6000 " " " " v1.2 On a MacClone Copy of Gato Search for: 4EAD 044A 206E FFF8 D1FC 0000 00F2 Change to: 4E71 4E71 " " " " " " " " " " Search for: 4EAD 044A 4EFA 0016 4EFA 0012 0C00 0001 Change to: 4E71 4E71 " " " " " " " " " " " " Then using MacZap 3.0, read block E6 using Address marks of D5ADAD (I think).Change the Address marks to the normal marks and write the block back to the disk. Use Fedit to write the changes to the code and unprotect,unlock & make visible the file CTEX. 2nd Gato 1.2 Search for: 4A01 6700 0006 4EAD Change to: " " 6000 " " " " ========== v1.3: Search for: 6B00 00F6 203C 0000 0258 Change to: 6000 " " " " " " " " ========== Gato Search for: 4A01 6700 0006 4EAD Change to: " " 6000 " " " " - Geometry †Search for: 4E71 4E71 4E71 4E71 0280 ABCD Change to: 4240 21FC 9FFB B503 0A80 4E75 - GIF Converter v2.2 (& up) 162-37-77-f4-de-a8-8b-b2 862-37-77-f4-de-a8-8b-b2 - Go †1.02 Go Questions: The first golden age in the history of Japanese Go occured in which century? 17 Traditionally, the stones used in the game of Go are kept in what kind of containers? bowls The high quality white stones in the game of Go are made from what substance? clam shells Traditionally, the black stones in the game of Go are made from what substance? slate What is the term for mutual life in the game of Go? seki The Go game board 19 x19 has 361 positions called what? points What does one player say to the other when making a play that threatens capture of opponent stones? atari In what month and year was the first international computer Go competition held in Taiwan? November 1986 Where are the first four handicap stones placed at the beginning of a game of Go? star points How long has Go been played? 40 centuries - GraceLAN v1.1.1/2.0 359006812187 - Gradient Designer †Try "KPT273" to unlock the expert mode - GraphMaster v1.1 US100000598 - Great Plains Accounting User:MANAGER PW:ACCESS - Grid Wars †To make grid wars easily copyable, try this: Search for: C934 C1B6 9592 F588 5DF2 D666 0D2A A200 Change to: C834 " " " " " " " " " " " " " " Search for: 5CBE 4BDE 27DC 8052 D7DC B346 9FF4 18BE Change to: 5DBE " " " " " " " " " " " " " " Make these changes to a sector copy, then bit copy track#72 with any bit copier or try Search for: F329 AE80 Change to: F329 CF46 Search for: 03BE 03BF Change to: 9E18 8868 Search for: C62E BB42 97E2 Change to: C12E " " " " - Griffon Terminal †Search for: 6712 4267 3F3C Change to: 6012 " " " " Search for: 670A 2F0E 4EBA Change to: 600A " " " " - Guaranteed Undelete v2.0 211204515 211252619 - Guns or Butter †(with problems) EFFECT: The password dialog will never show up HOW TO: LOCATE CODE RESOURCE 9 CHANGE THE WORD AT OFFSET 18EE TO 4E71 CHANGE THE WORD AT OFFSET 18F0 TO 4E71 CHANGE THE WORD AT OFFSET 18F6 TO 4E71 CHANGE THE WORD AT OFFSET 18F8 TO 4E71 - Haba Checkminder †Search for: 0CAE 0001 81CD FED8 676C Change to: " " " " " " " " 606C - Haba-Comm †SEARCH: 3B5F F3D2 4A6D F3D2 662C REPLAC: 602C " " " " " " " " SEARCH: 101F 0A00 0001 670A REPLAC: 600A " " " " " " 2nd Crack Search for: 672C 2E3C 0000 Change to: 602C " " " " - Habadex †v1.1 Search for: 0167 0A2F 0E Change to: 0160 " " " - Hacker †Search for:2F10 4217 205F 4E90 Change to: 203C 99C4 5501 4E71 or try, Search for: A552 F6C8 44B0 3DC0 1564 Change to: CF40 9035 1857 73BB 1995 - HardBall II †Open HARDBALL II with ResEdit and change: CODE 4+$2A6 From: 70FF To: 7000 +$2B2 From: 70FE To: 7000 There, that should get you pass the code wheel portion (this crashed my computer). or try, CODE 4+$928 From: 67 To: 60 - Harrier †To make Harrier Strike Mission easily copyable, try this: Search for: 03FA 87EC EFD4 BB42 870C 10AC 476C DC5A Change to: 02FA " " " " " " " " " " " " " " Search for: 9A84 1198 6996 BA8C 1116 7900 C18E 52F0 Change to: 9B84 " " " " " " " " " " " " " " Make these changes to a sector copy and then bit copy track#4 with any bit copier. - Hayden SAT †Search for: 6608 45FA 003A Change to: 4E71 " " " " Search for: 6610 3F3C 0000 Change to: 4E71 " " " " - Hayden Speller †Search for: 225F 508F 4ED1 4E56 FFC0 Change to: " " " " " " 4E71 4EF9 0000 E888 or try, Search for: 4E56 FFC0 41EE Change to: 4E71 6000 0AA8 or try Search for: 4EBA 02BA 2E1F 4E5E Change to: 4E71 4E71 " " " " or try Search for: 2007 0A00 0001 6700 Change to: 4E71 7000 " " " " - Hearts †v2.2 Using TeachText, create a file named 'RP' that contains the word ‘Hearts’. Put this together with the files from the Hearts disk on a HD. Hearts will not work on a floppy. It must be on a hard drive to work because on a floppy, it thinks there is a disk input output error (-36) when it trys to read the RP file. The original copy protection wouldn’t let you copy the RP file from the floppy using the finder or other file copying programs. Hearts checks this file and its contents to see if you have a valid copy. You had to bit copy the whole disk to make a copy. Although a normal copier couldn’t read the file, the Hearts program could but only if it was on the protected disk. It can’t if it was on an unprotected disk because it uses a different driver meant for the protected disk. This limitation doesn’t apply to the hard drive though. There is one major bug: you can’t insert a disk after you start Hearts until you restart the Mac because the Mac will crash. If Hearts doesn’t work on your Macintosh because it crashes at MCOD 45+$42, try changing MCOD 45+$3E from 6A to 60. This will skip over the part: +$42 MOVE.B #$D5,$00FCC0E1 +$4A MOVE.B #$AA,$00FCC0E3 The address $FCC0xx is probably hardware I/O addresses for the old Macs. I couldn’t figure out what the $FCC0xx was for the new ones. These addresses are not the same on all Macs and programs that use them are bound to crash on some Macs. This program works only under System 6.07 or earlier, not under System 7.0. - Heaven & Earth †Search for: 671E 0C79 FFFF Change to: 601E " " " " Search for: 4EAD 0AEA 508F Change to: 4E71 4E71 " " The preceding patch was installed in the 13” color version after the install. - Helium v2.0.2 40859 v2.1.1 2020-3000 † To register Helium 2.0.2, copy the cdev from the patched Helium cdev resource file (found elsewhere) into your Helium control panel replacing the old cdev. After quiting ResEdit, open Helium. If it wasn't registerred already, it will give an alert telling you what the registration code is. It will display the same alert if you type in the wrong code. To reregister under a new name or reset the 15 day limit on unregisterred copies, erase the preferences file in the preferences folder. - Hellcats † I hacked into Hellcats to get rid of that annoying cp box. Load up Symantic Tools or the like and open a COPY of Hellcats and change: Search for: 4AAD ED64 6700 Change to: 4AAD ED64 6000 or try, Hellcats Leyte - a starting point: CODE 5 - Anon 8 - dialog filter handling the protection screen. CODE 5 - Anon 10 - the procedure handling the protection screen. or -•HELLCATS EFFECT: Get rid of password HOW TO: LOCATE CODE RESOURCE 2 CHANGE THE WORD AT 1F70 FROM 660A TO 600A - HELLCATS EFFECT: Get rid of password LOCATE CODE 8, offset $290 CHANGE 486E FED0 486E FED4 4EAD 057A 508F TO 3B7C FFFF FF42 4E71 4E71 4E71 4E71 -•HELLCATS (VERSION 1.0) EFFECT: The password dialog is eliminated HOW TO: LOCATE CODE, RESOURCE 8 CHANGE THE WORD AT OFFSET 23A, CHANGE 6700 TO 6000 - HELLCATS - LEYETE MISSIONS EFFECT: The password dialog is eliminated HOW TO: LOCATE CODE, RESOURCE 8 CHANGE THE WORD AT OFFSET 236, CHANGE 6700 TO 6000 - Help v1.04 5840344 6949477 - Hermes † Serial numbers, copy them to the clipboard, then choose “Register Hermes” from teh Apple menu in the Application. v1.9 DDD78BE7792ABA98BB60A5B73F08B37714BF51E3F775EDC0351D245EA7CF1D40B68ABBAA B7C3E51E05EB54B7F3C89C49165C89922A48D72115F4DE699EF7DC6BE370F4CCD4369244 9B131754F29C8458A2C931DAB81FBC5624A71204FC8357E541B4159B7883FE864C31220C v2.0 857F08EC420C9B3C9B049B149B349B2C9B1C9B1C9B1C9B1C9B1C9B1C9B1C9B1C9B1C9B1C 9473C6E55F6BE380178E781A080F6E81BD99449DE5F3F231D67FB517525F08A3AC2FEAAA 857F08ECDEDC0F6B6FA8E956339CA4A0B5282BA83B1B893C578110503692DCD36FB8BF7B 877665542C1777677767777F775F77477747774777477747774777477747774777477747 851234566C83AEE3AEF3AECBAECBAEFBAED3AED3AED3AED3AED3AED3AED3AED3AED3AED3 F44D4F0515519F44AD855850FDAD10868EA8EC1F9C2240E233503628D57F083599A41085 - Hex †Search for: 4A40 4E75 0000 0000 41FA 006E Change to: 4240 " " B7DA B300 " " " " Search for: 48E7 7FFE 41FA Change to: 6032 " " " " - Hippo Alamanac †v1.1 Search for: 67EA 2F09 A9A3 Change to: 4E71 " " " " - Hippo C †Level 1 Search for: 6110 4CDF 7FFE 3E80 4ED0 CCAF Change to: 4E71 " " " " " " " " " " Level 2 Search for: 6110 4CDF 7FFE 3E80 Change to: 4E71 " " " " " " - Hippo Jokes †Search for: 6606 4EF9 0040 000A Change to: 6006 " " " " " " Search for: 67EA 2F09 A9A3 9FFC Change to: 4E71 " " " " " " - Hippo Lock †Search for: 6608 45FA 003C Change to: 4E71 " " " " Search for: 6618 4267 Change to: 4E71 " " - Hitchhiker’s Guide †Search for: 6FDA 1006 6706 3B7C Change to: 6004 " " " " " " or try, Search for: 6702 4206 5257 Change to: 6002 " " 5247 (if this doesn’t work, try leaving that last word at 5257) - Holiday Lemmings 1993 †- HOLIDAY LEMMINGS 1993 EFFECT: Gets rid of passwords for individual levels HOW TO:In CODE 3, at offset 0xD80, replace exactly 88 bytes (11 lines in ResEdit's general editor) with the following 88 bytes (11 lines) of garble: 48E7 1F18 47ED CEAE 4245 101B 0C00 0030 6D14 0C00 0039 6E0E 4880 0440 0030 CAFC 000A DA40 60E4 0C45 0020 6E1A 4A45 6F16 5345 3B45 DC58 2005 48C0 81FC 0010 3B40 DC88 7001 600A 426D DC58 426D DC88 7000 4CDF 18F8 4E75 4E75 You'll probably want to update the corresponding dialog to make the prompt more appropriate. I changed item 4 of DITL 2001 to read "Enter level number (1 = Flurry 1, 17 = Blizzard 1):" so that I won't forget this is a patched copy. - Home Accountant †Search for: 4A6E FFFE 6D08 1D7C 0001 000C Change to: 4E71 4E71 4E71 " " " " " " Search for: 0240 0001 6700 FF74 3F3C 0FD2 Change to: 303C " " " " " " " " " " ========== v1.02 Search for: 6D08 1D7C 0001 000C Change to: 4E71 " " " " " " Search for: 302D FE34 B06D Change to: 302D FE32 " " Search for: 662C 4267 2F0E 4EBA Change to: 4E71 4267 2F0E 4EBA - HyperCard †HyperCard 2.1 Remove password protection from HC stacks! Just the IDEA that some bozo put in a password... ARGH! I have a problem with that. In your HyperCard 2.1 file: Search for: 6704 6000 02A2 42A7 3F3C 008C 42A7 Change to: 60 " " " " " " " " " " " " " for HC to accept any password you give it, and let you into the protection dialog (remember, to get pswd. dialog in a protected stack, hold CMD while choosing Protection from File menu). You can still assign pswds to stacks you make, and the pswd protection will still work on other people’s HCs, unless they have also applied this Kpatch. ========== 2.0 Light (the copy that [used to] come with your mac) To gain user level five do the following: In the first card of the HomeStack: Hit [Command] + M Type:go cd "User Preferences" [enter] magic [enter] Select Level Five (Scripting) (They hid half the user levels with an opaque button over UserLevel 3,4,5) NOTE: This does not work with Hypercard Player, which doesn’t allow Userlevels 3, 4, or 5 at ALL. Boo... - HyperStudio 101M-101392 - I know it's here someplace †Search for: 6700 0106 4267 3F3C Change to: 6000 " " " " " " Search for: 6602 7C01 6000 FF62 Change to: 4E71 " " " " " " - Illustrator v3.0 AAW3021019783 v5.0 AAW30210197831-337 AAW500U3105408-140 AAW500U7106717-802 AAW500R3102631-456 AAW500R3102632-373 AAW500U3106069-338 AAW500U7104713-896 AAW500U3106121-969 AAW500U3118733 AAW500U3101332 AAW500U3126375 AAW500U3127582-773 - Image Express †Search for: 3B5F F33A 4A6D F33A 6622 Change to: " " " " " " " " 4E71 Search for: 4EAD 0B62 4EAD 166A 4EAD 16DA Change to: 4E71 4E71 4E71 4E71 4E71 4E71 Search for: 4EAD 257A A9F4 4E5E 4E75 Change to: " " " " 4E71 " " " " Projector: Search for: 4A6D FDCE 664C 4EAD 056A Change to: " " " " 4E71 Transporter: Search for: 3B5F FBB8 4A6D FBB8 6600 01E6 Change to: " " " " " " " " 4E71 4E71 Search for: 57C0 4A00 6700 010E Change to: " " " " 4E71 4E71 - In Control v2.0 0000-0000000-0 - The Incredible Machine †Password 'awe' - this password works for every level Here is a little help for those of you currently playing "The Incredible Machine". Of the total number of 160 puzzles, the following passwords are for the first forty. 01. (NR) 11. BASEBALL 21. COUNTDOWN 31. COMPACT DISK 02. SIERRA 12. BEAR 22. PSALMS 32. SHAVER LAKE 03. DYNAMIX 13. FISH 23. TANK 33. RHEUMATISM 04. MACHINE 14. DALE 24. NIGHT 34. HARPSICHORD 05. DISK 15. CHESTERTON 25. GAMES 35. MARKET 06. SHUTTLE 16. SIZE 26. WESTERN 36. DEST 07. SATURN 17. IRELAND 27. LOG HOME 37. MYRTLE 08. KING 18. WORD 28. GRAPHICS 38. QUATERNION 09. DRAGON 19. BRIEF 29. KNUTH 39. SHOE 10. ANTS 20. HOT DOG 30. DONALD 40. FLOWER - Indiana Jones and the Last Crusade †- INDIANA JONES AND THE LAST CRUSADE V5.1.6 (Mac 1.7 8/17/90) EFFECT: This is a patch with which I can Save and Open File at any moment HOW TO: Find Resource CODE 6 : Replace all the occurences of (there are 4 occurences) EXT.W D1 | 4881 MULS.W D1,D0 | C1C1 with EXT.W D1 | 4881 MOVEQ #$01,D0 | 7001 [this patch seems different from others so I would be interested in knowing what the EXT.W AND THE D1 AND THE 4881 etc means.] - Informed Designer †CODE 79+$D72 From: 66 To: 60 +$F18 From: 66 To: 60 - Informed Manager †CODE 72+$D72 From: 66 To: 60 +$F18 From: 66 To: 60 or Informed Manager 1.3.3 (Application file) & Informed Designer 1.3.3 (Single Test Cracks) Talk about reusable code, these guys reused half the friggin program or more, including, hilariously enough the same copy protection routines down to the byte (ie they were compiled from the same source with the same version of the compiler) the only difference was at link time apparently. Thus these code changes are for CODE #72 for Informed Manager, and CODE #79 for Informed Designer 1.3.3 To simply run the program without personalization (from unpersonalized copy obviously) change +D72 6600->6000 (believe it's personalized) OR: if you want it personalized then follow these steps: 1: change +F18 6642->6042 (allow anything for serial # when personalizing) 2: run the program and personalize (use anything you want for a serial #), Quit (duh). 3: change +D72 6600->6000 (believe it's personalized) 4: that's it it should work fine, in fact the first change isn't needed anymore. this is the best that can be done with an actual serial number as the check for a valid serial # is also the check for wether or not to personalize. - In Control v2.0 2000-0031184-1 2000-0031185-8 - Infini-D v1.x.x 01-1400-6350 31-9326-1679 v2.0.1 01-1400-6350 v2.5 01-1400-6350 01-1820-0916 31-9326-1679 †v1.02 Hex Changes: Search for: 4EBA 0796 (You should find this 2 times, at Sectors 392 & 3FE) Change to : 4E71 4E71 - INIT Info Pro B102131444366 - Inline Sync 122343 - Inspiration v3.0.1a 4130T1247J6521 †Change CODE 1+$66CA From: 67 To: 60 Change CODE 24+$724 From: 67 To: 60 Change CODE 24+$74A From: 67 To: 60 - Intellidraw 37-1006-000647252 - Interlace †v1.1/1.2 Search for: 0010 6600 003A Change to: " " 4E71 4E71 Search for: 51C9 FFF8 4A42 66 Change to: " " " " " " 60 - Ishido †V1.1 bw CODE 2+$0742 To: 4E71 4E71 ========== v1.1c CODE 2+$07E0 To: 4E71 4E71 or - ISHIDO 1.1c EFFECT: Allow the setup code to run and will present the code entry dialog. Hit the "Quit" button to continue with the game, or enter the password. HOW TO: Locate CODE resource #12 Change WORD at offset 4032 from 4EAD -> 606C Change WORD at offset 4034 from 00EA -> 4E71 To Change the Dialog boxes Locate DLOG resource #163 Open Item #1 -> Change name from "OK" -> "Enter Code" Change Top -> 92 Bottom -> 112 Change Left -> 234 Right -> 316 Open Item #2 -> Change name from "Quit" -> "Bypass Code" Change Top -> 92 Bottom -> 112 Change Left -> 123 Right -> 215 - ISHIDO V1.1 bw EFFECT: The password dialog will never show up HOW TO: LOCATE CODE RESOURCE 2 CHANGE THE WORD AT OFFSET 0742 TO 4E71 CHANGE THE WORD AT OFFSET 0744 TO 4E71 - ISHIDO V1.1C EFFECT: The password dialog will never show up HOW TO: LOCATE CODE RESOURCE 2 CHANGE THE WORD AT OFFSET 07E0 TO 4E71 CHANGE THE WORD AT OFFSET 07E2 TO 4E71 - Jack Nicklaus Golf †To completely skip protection dialog, change: CODE 7+$D56 From: 670A To: 600A or try, In case that isn’t a full crack this one weeds its way through the protection code. This is in the "Protect" routine - (the offsets are LOCAL OFFSETS-ie add $C8 to each to get the offset into CODE 2, as is shown in the first one) CODE 2+$C8+$1DE From: 6D08 To: 6008 +$250 From: 661E To: 601E +$282 From: 6700 FF0E To: 4E71 4E71 +$2CC From: 673E To: 603E +$334 From: 6620 To: 4E71 - KAI's Power Tools Password: KPT273 - Kid’s Desk †To get to administrator mode type Command-Option-A - Kid Pix personalization †Well, I know it's not a crack per se, but if anyone has a copy of Kid Pix with some other kid's name on it (other than your own kid's name, not your name, that is… Kid Pix IS for kids =) ), you can remove/change it in the following trivial Resedit hack: Open the kID resource, open the one resource inside it, and you should see a short chunk of hex. The first digit is the number of letters in the name, and the rest of the string is the name. To change it, hilite the ASCII on the right hand side and type in the name you want ENCRYPTED in this ultra-secure, defense-department standard code: shift each letter one to the right (i.e., JOE becomes KPF) - Kid Talk †Search for:6730 3F3C 0002 Change to: 6030 " " " " Search for: 67B4 426D F750 Change to: 4E71 " " " " or try Search for: 6602 5200 5901 6AF4 Change to: 6018 " " " " " " - King’s Bounty †v1.0 CODE 2+$47E4 To: 4E71 4E71 or try, v1.01 Search for: 4EBA FB96 Change to: 4E71 4E71 or try, v1.01 Search for: 4EBA FBA6 Change to: 4E71 4E71 Here's a little trick to get more gold, leadership, and commission… Open one of your saved games. with Norton, go to Sector 8 of your file. On line 160: XXXX AAAA BBBB CCCC the A’s and B’s are your leadership, put the same value in each, the C’s are your commission/week. Yes, there is a 64K limit to your leadership and comm. On line 448: AAAA AAAA all the A's are your gold, just put 0F in the first AA and you'll have about 250 million. - Kiwi Envelopes v3.x KE301120RA KE304244RC KE311870RK KE311120RA - KiwiFinder v1.0 VB1011672KF KE304244RC KE301120RA KE311120RA KE311870RK - Kiwi Power Windows 10KPW002996b †with ResEdit, in the second "LDEF" (ID 27420(?)), change the first four bytes from "FFFF FFFF" to "0000 0000". You will now be able to postpone registering at startup. Each time you start-up you have to postpone again. - KPT Gradient Filler KPT273 (unlocks expert mode) - Kung-Fu Chivralry †The continue password for Kung-Fu Chivralry is 90179240. This number is stored in hex format at CODE 5+$4EE2 and occupies 4 bytes. To make it so that you can continue no matter what you type, change: CODE 5+$4EE8 From: 6600 0070 To: 4E71 4E71 If you do this and you don't want to continue, just type Command-Q and the current game will end and the program will go back to the main screen. - LabView v2.2.1 SN 27645; PN 4224446-24 - Legacy †Search for: 6702 604C 4EAD 0112 Change to: 6002 " " " " " " Search for: 670C 487A 00CC 4EAD Change to: 600C " " " " " " - Lemmings †v1.4.2 CODE 2+$1DE0 From: 6DC4 To: 4E71 +$1DE6 From: 6610 To: 6010 Lemmings Codes Rating: FUN Rating: TRICKY Rating: TAXING Rating: MAYHEM 1 - (none) 1 - HCEONONPDX 1 - MFMCCJONFM 1 - NKMFLGCLHP 2 - IJJLDNCCCN 2 - CINNONHQDL 2 - FMCKKMMOFO 2 - KNOHGONMHS 3 - NJLDLCADCY 3 - CAJJLDMBEV 3 - ICGNOONPFM 3 - ONHGGKONHM 4 - HNLHCIOECW 4 - KJHLDMCCEO 4 - CKNOMFMQFL 4 - FLGKJOMOHK 5 - LDLCAJNFCK 5 - OHLLICADEO 5 - GCJKNLHBGT 5 - HGCNOMNPHL 6 - DLCIJNLGCT 6 - HLDMCMOEEX 6 - KKKLLHGCGL 6 - GOOMMNHQHX 7 - LCANLLDHCO 7 - LDMCCJNFEP 7 - NKNDHGCDGR 7 - GCJKLDMBIQ 8 - CINNLDLICJ 8 - DMCMJLLGEY 8 - ILDLGKOEGL 8 - KJILDMGCIX 9 - CEKHMDLJCO 9 - ICGNLNMHEC 9 - LDLGCJOFGU 9 - NILDMGCDIU 10 - MJHMDLCKCW 10 - CMNLLDMIEO 10 - DLGKJOLGGO 10 - ILDMGKOEIO 11 - OJOLHCGLCO 11 - CCJIMDMJEP 11 - LGCNOLDHGL 11 - LLIGCJMFIK 12 - HMDLCIOMCJ 12 - KKIOLICKEP 12 - GKNOLDLIGU 12 - DMGKJOLGIR 13 - MDLCAKLNCS 13 - OHOLICALEJ 13 - GCJIMLHJGY 13 - MGCNOLDHIO 14 - DLCIJNMOUM 14 - HMDMCINMEL 14 - KKIMDLGKGO 14 - GKNOLDMIIX 15 - LCANNMDPCJ 15 - MDMCAJLNEU 15 - NIMDLGGLGO 15 - GGJIMDMJIL 16 - CINNMDLOCS 16 - LMBIJNOOEY 16 - IMDLGONMGX 16 - KJIMDMGKIQ 17 - CAKHLFLBDU 17 - ICANNMLPEQ 17 - MDLGCJMNGM 17 - NKMDMGCLIP 18 - IJJLNHCCDS 18 - CINLMDMQET 18 - DLGOJMMOGJ 18 - IMDMGKNMIW 19 - NJNNHCADDR 19 - CCKHNNIBFP 19 - LGGNMMDPGW 19 - OLIGCKMNIW 20 - HLFLCMNEDW 20 - KJKLFMCCFU 20 - GKNOOLHQGT 20 - LIGKJOOOIQ 21 - LNHCAKNFDS 21 - NILFMCGDFT 21 - GCJINNHBHU 21 - MGCNOMDPIX 22 - FLCMKLLGDJ 22 - KNNICONEFU 22 - KJKLFLGCHJ 22 - GKNOMDMQIQ 23 - LCAOLLFHDS 23 - NNICGKOFFO 23 - OINNHGCDHL 23 - GGJILFMBJU 24 - CIOLLFLIDL 24 - NMBKJONGFU 24 - ILFLGONEHR 24 - OJILFMGCJO 25 - CEJHOFHJDO 25 - MCCOMLFHFY 25 - LFLGCJOFHY 25 - NKLFMGCDJJ 26 - OKHMFLCKDM 26 - BKNONFIIFP 26 - NHGOKONGHM 26 - ILFMGONEJU 27 - NJMFLCACDU 27 - CCJKMFMJFU 27 - LGCNOLFHHO 27 - LNIGCJMFJU 28 - HMNHCIOMDQ 28 - OKKONICKFY 28 - GOOOLNHIHQ 28 - FMGKJOLGJU 29 - ONHCAKNNDN 29 - OIMFMCCLFJ 29 - GCJIOFHJHV 29 - MGCNOLFHJR 30 - FHCMKLMODO 30 - KMFMCKNMFT 30 - KJIMFLGKHQ 30 - GKNONNIIJQ or - LEMMINGS EFFECT: The Copy-Protect dialog will still come up, but you can press return to bypass it now. Don't enter anything in the box or it will give you the standard message that the code isn't correct. HOW TO: LOCATE CODE ID=2 FOR 5A83 CHANGE 5A83 TO 0000 - LEMMINGS EFFECT: Omits the dialog box HOW TO: LOCATE CODE 3 CHANGE WORDS AT OFFSET $2588 WITH $302D DB60. - LEMMINGS EFFECT: The quiz dialog will show up but anything will be valid HOW TO: Locate code resource #2 Change the words at offset 1F58 from B06D DB60 670C to 3B40 DB60 4E75 - Leprechaun v3.0 68uwxw58 (case sensitive) †v3.0 CODE 6+$292 From: 4EBA To: 6062 - LetraStudio †v1.5 rename font to "Stand Font (Corinthian Bold)" - Lexi-Cross †CODE 5+$05AE From: 67 To: 60 or try, CODE 5+$05AE From: 67 To: 60 +$0590 From: 4EBA 227C To: 4E71 4E71 Now you don't even have to hit <CR> - Liaison v3.0 40026825185 40063496992 40063576094 v2.0 40026825185 40063496992 40063576094 - Life and Death †v1.01 CODE 2+$5842 From: 674A To: 604A - LightSpeed C †Ser. # Removal In case you might need it, the serial number is hidden in the Lightspeed C file sector offset 281, byte 320 in decimal ASCII, you can’t miss it. - Lock Finder 5.0 & above. † Search for: 3C38 0210 BE6D FF16 6730 Change to: " " " " " " " " 6030 Search for: 3C38 0210 BE6D FF16 674E Change to: " " " " " " " " 604E - Lode Runner †Search for: 6058 4EBA 00EA Change to: 4E71 " " " " Search for: 7E01 602E 4FBC Change to: 7E1C " " " " Lode Runner (new) Search for: 6100 EBE6 42A7 Change to: 4E71 4E71 " " - Luscher Profile †Search for: 3DF1 9C0F 2E Change to: 5C37 0227 8B2C - Mac+ ][ †Search for:6700 0250 2C7C 0001 8000 Change to :4E71 4E71 " " " " " " Mac+ ][ 3.0 Search for: 6700 0250 2C7C 00 Change to: 4E71 4E71 " " " - Mac a Mug †Search for:4569 2487 18D6 Change to: 24AF BAA3 0A42 Search for: 31E3 70F7 C897 Change to: 36E3 " " " " - MacAttack †1.0 Move to block 002F, position 0174. Change 67FA to 4E71 MacAttack 1.4 USE MACTOOLS, AND UNLOCK, UNPROTECT, AND MAKE VISIBLE ALL FILES. THEN, USE FEDIT, OPEN UP 'PLAYFIELD1'. Find 67FA 4EAD and change to 4E71 4E71 COPY THE FILES OVER USING MACTOOLS (LOCKED DISK) AND COPY PLAYFIELD1, SYSTEM & THE TWO FILES SCORES & STEMP,YOU NEED THEIR SYSTEM BECAUSE IT HAS TEN FONTS FOR THE GAME. YOU CAN, IF YOU WISH, TAKE THIS FILE AND USING RESEDIT, COPY THE FONT FILES FROM THE SYSTEM AND THEN PASTE THEM INTO PLAYFIELD ONE. THEN YOU MAY USE ANY SYSTEM FILE. MacAttack 1.6 Search for: F49E 67FA 4EAD 023A 41ED Change to: " " 4E71 " " " " " " - MacBackup †v2.3 Search for: 6700 0026 317C 0001 Change to: 6000 " " " " " " ========== v3.0 Search for:4EBA 0170 4A40 6700 0016 4EBA Change to :4E71 4E71 " " " " " " " " ========== v3.5 Search for: 4EBA 0170 4A40 6700 Change to: 4E71 4E71 " " " " - MacBZone †- MACBZONE 1.3.1 EFFECT: Remove the serialziation dialog box HOW TO: Locate code resource #3 Change the byte at offset 2A80 from 67 to 60 Run the program and hit return at the serialization dialog, leaving zeros in both fields. You'll never be bothered again. EFFECT: Free serial number from author HOW TO: Use Serial: 5000 Access code:48406914 - MacCommand †Search for: 4EEA 0010 31FC 0001 Change to: 6000 E8F4 " " " " Copy files MC, HIscore, and startup screen and MCScreen. or try, Search for: 41FA 007A 209F 203A Change to: 4E75 " " " " " " or try, Search for: 6614 2A7A ECAA Change to: 4E71 " " " " Search for: 6700 0014 41FA 01BE Change to: 4E71 4E71 " " " " Search for: 6700 0008 41FA Change to: 6000 " " " " - MacDraft †v1.0 Search for: 6750 4267 4EAD 0D4A 1C1F Change to: 6050 " " " " " " " " or try, Search for:6726 2F0E 4EBA FF90 Change to :6026 " " " " " " Search for:4EAD 00E2 395F FFFE Search for:4E71 4E71 " " " " ========== v1.1 Search for: 6726 2F0E 4EBA FEC4 Change to: 6026 " " " " " " Search for: 4EAD 00EA 395F FFFE Change to: 4E71 4E71 " " " " or try, Search for: 6750 4267 4EAD 0D4A 1C1F Change to: 6050 " " " " " " " " or try, To unprotect MacDraft v1.1, try this: Make this Change to a sector copy: Search for: 6744 1F3C 0002 486E FEE2 4EAD 0CEA 1007 Change to: 6644 " " " " " " " " " " " " " " Then: 1. Using MacZap Tools, Change data marker to D5 FC AD, then read block 3A hex from original. 2. Change marker back to default (D5 AA AD), then write block to sector copied disk. - Mac Edge †Search for: 4EAD 00E2 4A6D FA48 6624 Change to: 4E71 4E71 " " " " 4E71 Search for: 4EAD 00C2 4A6D FD14 662C Change to: 4E71 4E71 " " FA48 4E71 Search for: 4EAD 00C2 4A6D FD9C 662C Change to: 4E71 4E71 " " FA48 4E71 Search for: 4EAD 00D2 4A6D F534 6624 Change to: 4E71 4E71 " " FA48 4E71 Search for: 4EAD 00C2 4A6D F828 6624 Change to: 4E71 4E71 " " FA48 4E71 Search for: 4EAD 00E2 4A6D F81E 6624 Change to: 4E71 4E71 " " FA48 4E71 Search for: 4EAD 00DA 4A6D E652 6624 Change to: 4E71 4E71 " " FA48 4E71 Search for: 4EAD 00D2 4A6D EC06 661C Change to: 4E71 4E71 " " FA48 4E71 ========== MacEdge II Search for: 672E 4267 487A Change to: 4E71 " " " " Search for: 6752 4267 487A (The rest is missing, pure speculation, but the next line might be: Change to: 4E71 " " " " But that’s a guess…) - MacEKG v2.0.6 12345Z9L2416 - MacFATS †v1.0 Search for: 6600 00E4 3F3C Change to: 6000 " " " " - MacFerret Marty - Mac Fortran †Search for: 6700 000A 43FA Change to: 6000 " " " " Search for: 6602 604C Change to: 4E71 " " ========== v2.0a Search for: 361F 6616 487A 0C54 Change to: " " 4E71 " " " " Search for: 6602 604C 3F3C Change to: 4E71 " " " " Search for: 0016 A017 4A39 Change to: " " 4E71 " " ========== v2.0b Search for: 6100 FF22 6600 0016 47A0 6B4 Change to: 4E71 4E71 4E71 4E71 " " 6B4 - MacGammon/Cribbage †Search for: FA75 C74C 511 Change to: FB74 " " 511 Search for: 6851 8EDF 775C Change to: 6950 " " " " - Mac Golf †Search for:21C2 022E 4A40 6700 002E Change to: " " " " " " 6000 " " MacGolf (font Change for nonstandard System) Search for: 487A 04EF 487A FFE4 A900 Change to: 4E71 4E71 4E71 4E71 4E71 Search for: 3F3A FFDE A887 3F3C 000E A88A Change to: 3F3C 0189 " " " " 000C " " - MacIndexer †v1.0 Search for: 6700 00EA 486D F9 Change to: 6000 00EA 486D F9 - Macintercomm vLite 1.1.1 v1.1b21 ToasT (case sensitive) †Open MacIntercomm Lite 1.1.1 with your favorite resource editor and Find: CODE resource 2. Find: hex offset 0B7E change 4EAD to 4E71 and 1382 to C080 - Mac Jack II & Poker †Works on both games. Open ‘Finder’ Search for: 2007 4FBC 00FF Change to: 6016 " " " " Rename ‘Finder’ to whatever. You will have to use Fedit or Mactools to rename as the Finder does not allow itself to be renamed from the desktop. (To Change the routine that ejects and make it exit to the Finder, useful on Hard Disks) Search for: A017 3D40 000E 4E5E Change to: A9F4 " " " " " " - MacLabeler v1.0 Search for: 0002 2E4E 4D00 Change to: 4002 " " " " - MacLink v6.0 00678935 v7.5 603050-1601 204612-7000 - MacMatch †Search for: 6616 4267 6016 Change to: 6716 " " " " or try, Search for: 4EBA 0690 101F 6702 A9F4 Change to: 4E71 4E71 " " 6002 " " - Mac Pascal †Move to block 0209, position 0039, Change 41EE to 6000 Move to block 0209, position 003B, Change FFB0 to 008A Move to block 0229, position 0105, Change 41EE to 6000 Move to block 0229, position 0107, Change FFB0 to 008A Move to block 024B, position 01FB, Change 41EE to 6000 Move to block 024B, position 01FD, Change FFB0 to 008A (Disk vs. file level) SECTOR COPY THE DISK, THEN PERFORM THE FOLLOWING PATCHES.. SEARCH DISK FOR 41EE FFB0 Change EACH TO 6000 008A (I FOUND IT IN ABOUT 8 PLACES) SEARCH FOR B26E 0008 6702 60 TO 60 (FOUND ON 2 BLOCKS) MacPascal V2.0 'Beta Plus' Search for: 61 00 00 62 66 00 00 0A 61 00 00 C2 Change to 40 - MacPassword v3.8.7 Nov301954May261951 v3.8.8/3.9.0 Nov301954May261951 - MacPlot v1.6 Search for: 6738 4267 3F3C Change to: 6038 " " " " ========== MacPlots // 1.01 Search for: EBAF D364 2A7 Change to: 4E71 4E71 2A7 - MacPublisher †(mounted as 1st volume) Search for: 316E 0014 0016 4268 001C A007 Change to: 317C FFFF " " " " " " " " (mounted as 2nd volume) Search for: 316E 0014 0016 4268 001C A007 Change to: 317C FFFE " " " " " " " " ========== v1.25 Search for: 4EAD 0552 41ED 0552 Change to: 4E71 4E71 " " " " ========== v1.3 Search for:6760 102D FF22 Change to: 6660 " " " " Search for: 6626 102D FF22 Change to: 6726 " " " " Search for: 6606 197C 0001 Change to: 6706 " " " " ========== MacPublisher II 2.0 Search for: 8310 2DFF 0E67 24 Change to: " " " " 0E60 24 Search for: 1F0A 0100 01C0 0167 00 Change to: " " " " " " 0160 00 - Mac Racquetball †For harddrives. Enable you to use MacRacquetball on it without the reset. Search for: D8FF 6C00 007A 4267 Change to: " " 6000 " " " " Search for: 4EBA 5E92 91C8 317C Change to: 4E71 4E71 " " " " - MacRenderman v1.3 978862966 - MacRISK †Patch for Mac II, 1-bit mode ONLY: Search for: C1E8 000C 48C0 Change to: " " " " 4E71 I don’t know what the programmer was trying to do, but the above patch will allow MacRISK to work on the Mac II without ExitToShell happening all the time. All it does is replace an EXT.L D0 with a NOP. D0 was already in long form from the result of a MULS and on the Mac II the EXT.L was making D0 go negative. Not too good for a handle size… (Try running it in 1 bit mode if you have problems) The above patch will _ONLY_ work in 1 bit mode. To make MacRISK work in all modes on all Macs do the following long patch: Search for: 4E56 FFFC 486D FBCC A910 XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX 4E5E 4E75 5341 Change to: 4E56 FFFC 486D FBCC A910 203C 0000 5080 A122 4A40 6702 A9F4 2B48 FBC8 A029 206D FBC8 2050 2B48 FBBA 3B7C 0040 FBBE 2B7C 0014 0000 FBC0 2B7C 0156 0200 FBC4 206D FBCC 4868 0002 486D FBBA 486D FBC0 486D FBC0 4267 42A7 A8EC 4E71 4E71 4E71 4E71 4E71 4E71 4E71 4E71 4E71 4E71 4E71 4E71 4E71 4E71 4E71 4E71 4E71 4E5E 4E75 5341 This patch completely rewrites the “save the bits” routine. If you really want all the details disassemble from "SAVESCRE"+0 to see the new code. - MacRobots †Search for: 3CBA 000C 4EBA Change to: 4E71 4E71 4EBA - MacroMedia †All you need for a MacroMedia serial number is D310-12345-CP4U. The first set of numbers stands for the “D” in Director. The “310” is the version 3.1. “CP4U” is for all Mac programs. Therefore, using this formula you can get the serial number for any Macromedia program. For example; Macromedia Three-D would be T110-12345-CP4U for the 1.1 version, and MM Accelerator would be A300-12345-CP4U for the 3.0 version. The “12345” is any five numbers you want. - MacroMind 3D T100-12407-CPU4 D300-31239-CP4U - MacroMind Accelerator A300-12935-CP4U A300-31239-CP4U - MacroMindDirector D300-12935-CP4U D300-31239-CP4U D300-11114-CP4U D300-13580-CP4U v3.0 D300-31239-CP4U D300-11114-CP4U D300-12935-CP4U †For a general serial # scheme for Director 3.0 try: d300-AxBxC-CP4U where the x is anything you want and (A+B)/2=C. For example d300-69696-CP4U works. Or: I think all you need for a MacroMedia serial number is D310-12345-CP4U. The first set of numbers stands for the “D” in Director. The “310” is the version 3.1. “CP4U” is for all mac programs. Therefore, using this formula you can get the serial number for any Macromedia program. For example Macromedia Three-D would be T110-12345-CP4U for the 1.1 version, and A300-12345-CP4U would be for the Accelerator version 3.0. The “12345” is any five numbers you want. - MacroModel v1.5 BETA Password:AlexY (Case sensitive) - MacSki †- MACSKI V1.0.1 EFFECT: This change allows the setup code to run and will present the (randomly occurring) question dialog. Hit the "OK" button to continue with the game, the password is now ignored. HOW TO: Locate CODE resource #3 Change WORD at offset 5F00 from 660A -> 6054 To change dialog box: Locate DLOG resource #1015 Open Item #1 -> Change name from "OK" -> "Ignore Question" Change Top -> 140 Bottom -> 164 Change Left -> 16 Right -> 133 - MACSKI V1.0.1 EFFECT:The program will never ask you the question. HOW TO: Locate CODE 3, Find offset $5E76 Change the word $661C to $600C - MacSnoop †CODE 2+$1CA2 From: 67 To: 60 The Date experation is now disabled. - MacSpace †Search for: 0C46 0072 6F00 Change to: " " 0000 " " - MacSpin †Search for: 486E FF36 4EAD 0BBA Change to: " " " " 4E71 4E71 Search for: FF36 0A00 0001 6706 Change to: " " " " " " 6006 v1.1 Search for: 486E FF36 4EAD 0F0A Change to: " " " " 4E71 4E71 Search for: FF36 0A00 0001 6706 Change to: " " " " " " 6006 - MacTopas †v1.0 dealer demo Search for: 6742 204D D1FC FFFF 62BE 2F10 4EBA Change to: 6042 " " " " " " " " " " " " Search for: 6718 7001 2F00 7200 2F01 4878 013F Change to: 6018 " " " " " " " " " " " " Search for: 4884 4CEE 18F0 FE8A 4E5E 4E75 Change to: 4E71 " " " " " " " " " " Search for: 4EBA FE80 4E5E 4E75 8A44 7261 Change to: 4E71 4E71 " " " " " " " " Search for: 4EAD 1FCA 204D D1FC FFFF 951C 4A90 6640 Change to: 4E71 4E71 " " " " " " " " " " 4E71 - MacType †Search for: 6700 000A 43FA FEFF Change to: 6600 " " " " " " - MacVegas †Search for: 3BF7 C246 4539 Change to: DE35 " " " " Search for: AEDC 95E8 1883 Change to: A9DB " " " " Search for: BFFE D160 " " Change to: B8F9 " " 09A0 Search for: 1FBF 5266 04BB Change to: 18B8 " " " " Search for: D932 4853 6E6E Change to: DE35 " " " " Search for: 664D B7AD 9395 F2 Change to: 614A " " " " " - MacZap †v3.0 (removes serial number from Copy and Tools) Change block 288 byte $AE to 0000 0000 Change block 307 byte $0A to 1122 3344 Change block 383 byte $DE to 0000 0000 Change block 394 byte $78 to 1122 3344 ========== MacZap 4.1 Serial # Removal For all three of the Mac Zap series programs the serial number may be searched for and replaced. It is not converted to hex. For instance if your number is '30' =$00003045 in ASCII, you may change those to $00000000 or anything else you wish. But first apply the patches below. MAC ZAP COPY 4.1 Search for:B380 0C80 1122 3344 6600 025A Change To :4E71 4E71 4E71 4E71 4E71 4E71 MAC ZAP PATCHER 4.1 Search for: B380 0C80 1122 3344 66ED Change To : 4E71 and Search for: 0010 A9C4 6600 E943 Change To : 4E71 4E71 MAC ZAP TOOLS 4.1 Search for: 11 2233 66ED Change To : 4E71 Search for: 0010 A9C4 6600 E8E9 Change To : 4E71 4E71 - Maelstrom †1.02 I was plugging along through the Maelstrom code when I came upon a way to have the bonus timer count forward instead of backwards. Search for: 700A 91AD FCB2 4AAD Change to: 700A D1AD " " " " This changes the SUB.L D0,-$034E(A5) to ADD.L D0,-$034E(A5) or try, 1. Invincibility. When you should die because of a collision or a hit, it says "Sweet!" instead and you live. Shields are no longer needed. CODE Resource #2: Location 06DE: Old Data: 66 New Data: 60 Location 0752: Old Data: 66 New Data: 60 Location 0B14: Old Data: 67 1E New Data: 4E 71 Location 0B22: Old Data: 66 10 New Data: 4E 71 2. Initial goodies (3x fire power, long shots, rapid fire, retro brakes). Luck and shields are no longer important when you’re invincible, so they’re not fooled with. CODE Resource #3: Location 0ECA: Old Data: 42 6D FC EA 42 6D FC EC New Data: 2B 7C 00 01 00 01 FC EA Location 0ED6: Old Data: 42 6D FC F0 42 6D FC F2 New Data: 2B 7C 00 01 00 01 FC F0 3. Initial bonus points in a new wave. Set it to whatever you want. CODE Resource #3: Location 1284: Old Data: 00 00 07 D0 or try, Run Maelstrom, start a game, and then drop into MacsBug. type the following commands: sm (a5)-30e 1 sm (a5)-30c 1 sm (a5)-30a 1 sm (a5)-308 1 sm (a5)-306 1 then type: g When you return to the game, you’ll find you have quite a few goodies. You can selectively cheat by only executing a subset of those "sm" commands. ========== v1.03 To eliminate the small rocks COMPLETELY, change CODE #2 +CB0 From 4EBA 21DE to 4E71 4E71 +C98 From 3F3C 0003 to 3F3C 0000 or The Official Maelstrom 1.03 Cheat Guide Here is a list of points. Small asteroid -> 300 points Medium asteroid -> 100 points Big asteroid -> 50 points Vortex -> 500 points Autonominous mine -> 700 points Super nova -> 1000 points Hitting a steel asteroid -> 100 points Blowing up a steel asteroid -> 5000 points Big Enemy -> 1000 points Little enemy -> 2000 points Picking up a stranded pilot gives you and extra life. Here is a list of cheats for Maelstrom 1.03: The Official Maelstrom 1.03 Cheat Guide To start playing on any level you like, hit the 'L' key while you are at the main screen. A dialog box will come up that lets you choose what level to start on. The 'Turbofunk' option makes the game run as fast as it can, instead of the constant 30fps it normally uses. Here are some neat little cheats that make Maelstrom interesting. You’ll need Maelstrom 1.03 for all of these cheats, DO NOT try them with an earlier version (you might crash your machine). You'll also need MacsBug; it is widely available on AOL and other information services. To install it, just drag 'MacsBug' and 'Debugger Prefs' into your System Folder and reboot. Once you've installed MacsBug, load up Maelstrom 1.03 and hit 'P' to start playing the game. When you want to use a cheat, hit the interrupt switch on your Macintosh to drop it into MacsBug; take care to hit the right switch: one reboots the machine, the other will drop you into MacsBug. On Machines like the ][si (which doesn't have an interrupt switch), hold down the Command key and hit the Power On key to drop you into MacsBug. Now for the cheats: Type: SW (A5)-$338 1 <return> for ACME XQJ-37 Retro Thrusters Type: SW (A5)-$336 1 <return> for Machine Guns Type: SW (A5)-$334 1 <return> for Luck Type: SW (A5)-$332 1 <return> for Long Shots Type: SW (A5)-$330 1 <return> for Triple Shots Type: SW (A5)-$384 #X <return> where X is the number of lives you want Type: SW (A5)-$32C #300 <return> for Maximum sheilds After you’ve finished cheating, Type: G <return> to continue playing. I was plugging along through the Maelstrom code when I came upon a way to have the bonus timer count forward instead of backwards. Search for: 700A 91AD FCB2 4AAD Change to: 700A D1AD " " " " This changes the SUB.L D0,-$034E(A5) to ADD.L D0,-$034E(A5) Here's a little tip I came across that seems to be an "undocumented feature" in Maelstrom 1.30 that will allow you to get huge scores that are eligible for the contest ($300 cash prize, I think?) Note that this will only work on v1.30, not 1.3.1 or 1.3.2. 1) Launch Maelstrom 1.30. 2) Press "L" to display the TurboMode dialog. 3) Set the beginning level to 40 and number of ships to 40. 4) Check the "TurboMode" box. TurboMode is required for the feature to surface. 5) Play the TurboMode game! Try to stay alive as long as possible as this determines how long you'll enjoy higher bonus scores. 6) When the TurboMode games ends, play the normal, contest mode of Maelstrom. Notice that the timer does not count down! What Happens: Due to a bug in the Maelstrom 1.30 code, (Thanks Andrew!) playing a Turbo game before a normal game DISABLES the bonus point countdown. As a side-effect, the CAPS LOCK Pause feature is also disabled. Since the clock does not decrement, you will always receive at least 2000 points at the end of each round. All comets and multipliers add to the score as normal. Since you are no longer hindered by the timer, you can take the opportunity to plug away at those metal asteroids (100 points each time you hit one) and explore the sector (assmall as it is). NOTE: The counter will eventually reset itself. I've found that the longer you survive in the TurboMode game, the longer the timer will be disabled. Roughly, the ratio is 1:8 (1 minute in Turbo game = 8 minutes of timerless normal play). - Mail Center †Search for: A94F B12F 06D8 E629 C230 C3FE 548C D0C8 Change to: A84E " " " " " " " " " " " " " " Search for: 6E48 9651 FBA4 96A0 7AB6 830E BC1A 2724 Change to: 6F49 " " " " " " " " " " " " " " Make these changes to a sector copy - now its fully broken. If you copy it to a hard drive, also copy the invisible file called ‘VIDEX KEY FILE’ MAIL INSTALL To crack VIDEX MAIL CENTER INSTALL, do this: Search for: 6F6C D0F5 28A1 9AD7 E41A 703B B19B EE0E Change to: " " " " 29A0 " " " " " " " " " " Search for: 9E19 B170 0844 8BF8 8845 5A9A 428B C85F Change to: " " " " " " 8AF9 " " " " " " " " - Manx C †There are patches to the Manx Aztec C compiler system which remove the need to insert the KEY DISK every time it is started up: Shell 1.D sect:32 byte:BC was:4E56 0000 now:7000 4E75 Shell 1.F sect:39 byte:FE was:4E56 0000 now:7000 4E75 they also work after the shell and system are copied to the Hyperdrive. ========== v1.0 Move to block 00D6, position 0107, Change 01 to 00 ========== v1.06d Search for:52456000FF2E7001 Change to:52456000FF2E7000 - Master Juggler G00161 G09123 G00000 G04294 GU013228 - Master Type †Change block $0074, byte $01A5 from $40 to $50,on the MasterType file 2nd Crack: SEARCH FOR: 00010000180000 1^2^3^ & SO ON, REPLACE WITH THE FOLLOWING STARTING FROM BYTE 15 SO AFTER THE 0018 (ABOVE) SKIP OVER NINE 00'S, AND START CODING… REPLACE WITH: 303C3F0033C00000E5E0303CFFB93F006056 NOW, SEARCH FOR:A0023F00 (SHOULD BE ON SAME BLOCK ABOUT, 10-20 BYTES DOWN) REPLACE WITH:A0026098 3rd Crack: Move to block 0153, position 0149, Change 3F00 to 6098 Move to block 0153, position 01B0, Change 3F00 to 6098 - Math Blaster †Search for: 56C0 4400 1B40 FF40 Change to: 51C0 " " " " " " - Mathematica v2.03 Disk 1 PW: 1862-40876-83824-2660 †Mathematica 2.102 Enhanced CODE #2 "Main2" Global Offset Routine Name Local Offset From Bytes -> To Bytes +603E ParsePas +4C 6600 00BC 4E71 4E71 +6052 ParsePas +60 6700 00A8 4E71 4E71 +6156 CheckPas +3E 6F24 4E71 +615E CheckPas +46 6C1C 4E71 +6E0A DoSealDi +130 6700 00CA 4E71 4E71 +6E24 DoSealDi +14A 6700 00B0 4E71 4E71 This allowed me to register with a bogus serial. Now network checking is still enabled, I believe, though I'm sure I could circumvent this easily too, but I haven't got a network with 2 machines with fpu's so I cannot test it. Instead, for now, I suggest changing the two longwords listed below as I beleive they are the keys that are unique to each copy of Mathematica - these may or may not have to be certain values, if so simply find these routines (by their name) in another copy of Mathematica and try the numbers there - chances are you have a second (nth) valid Mathematica. (PS: I have a high degree of certainty that these two numbers are the serialization keys, thus we should develop a list of them if any two #'s do not work [I haven't had time to check yet]) +6B46 GetProdu +6 xxxx xxxx +6B60 GetMagic +6 xxxx xxxx if this doesn't work try +6CBC CheckSea +86 6704 6604 this probably won’t work for very long as I believe it calls “AnnoyNet” and “CheckNet” periodically - that is where to look if you need a net crack. - McCad PCB Design †(v3.1 to 3.8) Search for: 4E34 3FC0 0001 A9F0 Change to: 3CE2 " " " " " " - McCad Schematic †v1.0 Search for: 55C2 3F3C 0001 Change to: 40A2 " " " " - McCad PCB/SMT †v1.0 Search for: 53A8 3F3C 0001 Change to: 4268 " " " " - MediaMaker v1.5 MED150 1987-1065-3071 - Meeting Maker v1.0 MV 000563 vXP 50 User VF6C-B724Q-7R6R2 50 User PF6C-B724A-6R6R2 †Administration Pwrd: admin - Megadesk †Search for: 670C 3F3C 0002 1F3C Change to: 600C " " " " " " Search for: 6700 0114 4EBA EDFC Change to: 4E71 4E71 " " " " - Megafiler †Move to block 02A2, position 01C4, Change to 3EBC Move to block 02A2, position 01C6, Change to 0100 Move to block 02A2, position 01C8, Change to 4E71 Move to block 02A2, position 01CA, Change to 4E71 - MegaForm †v2.0 Search for: 6700 00EE 4267 Change to: 6000 " " " " ========== v2.1 Search for: 6700 00EE 4267 Change to: 6000 " " " " - MegaMerge †v3.0 Search for: 6700 00EE 4267 3F3C Change to: 6000 " " " " " " - MGM Cad v2.5 II 220301 - MGM Station †v1.0 Search for: 671C 302E FFFE Change to: 601C " " " " Search for: 101F 0A00 0001 6704 Change to: " " " " " " 6004 ========== v1.01 Search for: 6728 302E FFFC Change to: 6028 " " " " Search for: 6704 4EAD 0262 Change to: 6004 " " " " - MicroLeague Baseball ][ †For the MLB Application: Search for: 4EAD 0652 2000 6708 Change to: 4E71 4E71 " " 6008 For the General Manager Application: Search for: 4EBA 11EA 4A80 Change to: 4E71 4E71 " " - Microphone II v3.0 B 008617 †MicroPhone II 4.0 Contains a bug that prevents the program from downloading files to mounted volumes with more than 32768 blocks free. Here's a ResEdit patch you can apply to fix the problem. Use this only if you feel comfortable using ResEdit and ONLY with a copy of MicroPhone II 4.0. Do not modify your master disks. Patch 1 fixes XMODEM and YMODEM. Patch 2 fixes Kermit. Patch 1: CODE 21+$192 From: 302E FFC4 48C0 To: 4280 302E FFC4 Patch 2: CODE 31+$11A8 From: 302E FFEA 48C0 To: 4280 302E FFEA - Microplanner †v4.4 Search for: 6722 487A 0052 Change to: 6022 " " " " ========== Microplanner+ 5.2 - 5.7 Search for: 6700 00D4 2F0E Change to: 6000 " " " " - MidiMac †I had to dissassemble all of CODE 7. By following the code, I was able to figure out how to decrypt code 7 (It's encrypted in three parts). To dissassemble it I used Nosy by the way. I copied pieces of code 7 to decrypt code 7 each time I came to a part that decrypts something. After I got all of CODE 7, I had figured out all of the decrypting procs, trap and vector changes etc. When code 7 is done it's disk checks and copy protection, it uses code 6 to change the first jump table item to code 1+5744 and it decrypts the jump table (which is pointed to by A5+CurJtOffset and is the same info as in CODE 0). I copied the procedure that decrypted code 0 and used that to give my a copy of the CODE 0 resource, except decrypted now. CODE 7 jumps to either CODE 1+5744 or CODE 8+0. It changes the first jump table item to code 8+0 if you put in a copy (I guess) and then jumps to the first jump table item after disposing itself. CODE 8 gives that big dialog that lets you install copies, run the original, run the copy or return to the finder. If you put in the original copy in the first place, it goes directly to CODE 1+$5744. The _Loadseg instructions in the jump table call GetResource. GetResource was patched by CODE 7 to decrypt CODE resources. I had the proc to decrypt the other code resources, but I was missing a number, a creation date or longint in the boot block I guess. By looking at the decrypted CODE 0 jump table, I was able to figure out what the first bytes of each code resource were supposed to be because they tell where in the jump table this code resource is used and how many items it has in the jump table. The decrypting proc uses some calculation to get a byte each iteration to EOR with the CODE resource byte. The procedure was complicated but it turned out (by tracing it) that it was only adding $2D to the byte used to EOR with the CODE bytes each time. Knowing this and what the eor byte should be for the first 4 bytes, I got the number I was missing. (I only needed 8 bits of the 32 bit number). I replaced all the resources with the decrypted resources and code 0 pointing to 1+5744 as the new start of the program and it worked! It seems none of the other resources do any copy protection (except for probably code 8 which isn't used any more because code 7 isn't used anymore). I made no patches, just decrypted the codes. - Might & Magic I †- MIGHT AND MAGIC I V1.0.1 EFFECT: Removes the password dialog HOW TO: Code 4 offset 06a0 change 4eba to 4e71 Code 4 offset 06a2 change fb5a to 4e71 - Might & Magic II †COLOR V1.0.2 (with possible FREEZE, try out) EFFECT: The password dialog will never show up HOW TO: LOCATE CODE RESOURCE 4 CHANGE THE TWO WORDS AT OFFSET 02F4 TO 4E71 2D49 - Might & Magic III †Type 'BLASTOFF' in a mirror portal to see the ned of the game - Mind Prober †Search for: 6718 486D F314 A851 Change to: 6018 " " " " " " - MindShadow †Search for: 2F10 4217 205F 4E90 Change to: 203C 99C4 5501 4E71 or try, Search for: A552 F6C8 44B0 3DC0 1564 Change to: CF40 9035 1857 73BB 1995 - Mindsight †v1.1 Search for 2924 3F3C 0001 Change to: 21CE " " " " - MiniCAD v4.0+ 1400-07710400 †v2.01 Search for: 5E2E 9F4E 7550 4154 204E 56FE EC Change to: " " " " " " " " 2000 0000 00 Search for: FA3F 2EFF FE48 6EFE F14E AD02 02 Change to: " " " " " " " " F100 0000 00 ========== v2.43 Search for: BC6E 000C 6F00 00F4 42A7 Change to: " " " " 6000 " " " " Search for: 200C 6700 00C6 4247 Change to: " " 6000 " " " " - Minotaur †Network Crack: CODE 6+$1D90 From: 67 To: 60 - MINOTAUR EFFECT: Disables network serial number checking so you can play multi-player games with the same copy of Minotaur. HOW TO: Open CODE resource 6 at offset $1D8A, change word to $4E71 - Mission Thunderbolt †In the application: $129 Change 1EF0-1FB0 to 0000-0000 Then just type RETURN when asked to enter the code ========== v1.06 STRS #129, Change $1BF0-1CAF to 0000-0000 or CODE 11+$280C From: 67F6 To: 60F6 or - MISSION THUNDERBOLT (version unknown) EFFECT: allows any entry including return for password HOW TO: LOCATE CODE RESOURCE 11 CHANGE THE WORK AT offset $280C, FROM 67F6 to 60F6 (Thanks to Dean C) -•MISSION THUNDERBOLT 1.0.1 EFFECT: Bypasses COPY PROTECTION: HOW TO: CODE 000B+280C find: 67F6 replace: 60F6 - The Mist †Search for: F92C 443C 994E Change to: D15D F737 " " Search for: 6094 21A4 7948 Change to: 6794 " " " " Search for: 101A 69D0 A505 Change to: 71DC F456 E3E0 - MitemView 11089 - MobileMath for Newton 2100012050337131 - Monopoly v2.01 †- MONOPOLY2.01 (COLOR) Virgin Games' EFFECT: The password dialog will never show up HOW TO: LOCATE CODE RESOURCE 8 CHANGE THE WORD AT OFFSET 3BBC FROM 6600 TO 6000 - MONOPOLY2.05 (COLOR) Virgin Games' EFFECT: The password dialog will never show up HOW TO: LOCATE CODE RESOURCE 8 CHANGE THE WORD AT OFFSET 3D1A FROM 6600 TO 6000 - MONOPOLY2.05 (B&W) Virgin Games' EFFECT: The password dialog will never show up HOW TO: LOCATE CODE RESOURCE 8 CHANGE THE WORD AT OFFSET 3DA6 FROM 6600 TO 6000 - MORE †Name in STR 63. Organization in STR 64. Personalized information is encoded. - More Disk Space 1982487924 †v1.1 Key words for successful use of MDS To install, make a diskcopy image, boot from that floppy (very important). Go into options under file. Select which disk to install on (or sets of disks). Install (File menu). 2nd most important thing: Don’t let it go automatic on you. The automatic is eating people although we've had NO NO NO NO NO NO NO problems with it here or our collective 750 meg of hard drives on 7 machines. You can still reap the benefits of MDS by just smashing programs and games etc MANUALLY. You’ll still get 30-40 meg of hard drive space, your programs will not launch any slower, sometimes even faster and you won't have to publish any more messages about how it ate your precious files that you didn’t have backed up properly. To remove MDS: Run program from HD, Hold down Command key File menu’s formerly dimmed “Install” item will appear undimmed as “Remove” Just make sure you have your hard disk selected in the options dialog or it won’t know which machine to remove from. - More Lemmings † W I C K E D 02 - NICMITUODP 03 - OCCLWUGPDL 04 - CKLVUFOQDS 05 - GAHPVMHBEF 06 - IHSTDNGCEM 07 - MQTDJGEDEI 08 - QVMHGMMEEK 09 - VMHGAHVFEP 10 - ELGIHTTGEQ 11 - NGCLTTDHEQ 12 - GKLWVLJIES 13 - GEHQUDLJEM 14 - OISWLHGKEQ 15 - MPUDLGCLEQ 16 - PUMHGIMMEM 17 - UMHGEITNEJ 18 - DNGIHTUOEK 19 - HGCMUWLPEP 20 - GKMUUELQED 21 - GGHPTFNBFJ 22 - MHQTFNGCFR 23 - LPTGNGCDFM 24 - STFNGILEFF 25 - TGLGAHWFFN 26 - GLGIHVTGFF 27 - LGCLWTFHFE 28 - GMLWTNJIFF 29 - GAHSUGLJFO 30 - KHSUGLGKFJ 31 - MQUOJFGLFO 32 - SUGNGKLMFR 33 - UGLGCHWNFI 34 - FLGOHTUOFR - Morph v1.1 1300670063 v2.0 1406016346 - Mouse Stampede †Search for: 3F3C 0006 4EBA 03EC 6000 0096 Change to: 4E71 4E71 4E71 4E71 4E71 4E71 or try, Search for: 3F3C 0006 4EBA 0CEC 6000 0096 Change to: 4E71 4E71 4E71 4E71 4E71 4E71 - Mouse Write †v1.1 Search for: 6760 2F0E 4EBA Change to: 6060 " " " " Search for: 6700 0088 206E Change to: 6000 " " " " Search for: 6606 2F0E 4E Change to: 6006 " " " v2.3 Search for: 6606 2F0E 4EBA FF18 Change to: 6006 " " " " " " Search for: 6700 0088 206E 0008 Change to: 6000 " " " " " " Search for: 6606 2F0E 4EBA FD00 Change to: 6006 " " " " " " Search for: 6706 2F0E 4EBA FC62 Change to: 6006 " " " " " " - Movie Magic †To break the copy protection of Movie Magic, here’s what ya do. Use ResEdit to find the place where the copy protected name is stored. Simply backspace over it, deleting it. The name is also stored in the footnotes. If you disable it, the machine will bomb if anyone tries to use a footnote. So place an invisible box over the footnote box so no one will even think of using it in the first place. - MS Chart †Search for: 6081 BEDD 608B BEDD Change to: 4E71 " " " " " " - MS Excel v3.0 00-065-0300-92000809 v4.0 00-065-0400-46250964 †v1.0 Search for: 608E BEDD Change to: B103 6ADD or try, Search for: 37CF 0267 DD79 Change to: 00CF " " " " or try, MS Excel crack 1.0 Search for: 0000 A5A5 Change to: 045B BAAB 2nd crack Search for: 37CF 0267 DD79 Change to: 00CF " " " " MS Excel Serial # Removal To remove the hidden ser# on excel, search for 7A43 5856 425A. Change the *next* 3 words to 0000 0000 0000. Some may be zeros already. - MS File †Search for: 1260 82BE DD Change to: 124E 71BE " ========== v1.02 Search for: 608F BEDD 608E Change to: 678F " " " " ========== v1.04 Search for: 608E BEDD 608F Change to: 678E " " " " - MS Word †v1.05 Search for: DD 6084 BEDD Change to: " 4E71 " " ========== v1.15 Search for: 608E BEDD Change to: 4E71 " " MS Word A Search for: DD 608B BEDD Change to: " 4E71 " " MS Word B Search for: DD 6084 BEDD Change to: " 4E71 " " - MS Multiplan †v1.02 Search for: 1260 8007 BE Change to: 4E71 " " " - Multi-Ad Creator 100911030 100733861 100733861 100063800 100066120 v2.0 000002784 100911030 v2.2 100911030 000002784 v3.0 000716055 †For the General Manager Application: Search for: 4EBA 11EA 4A80 Change to: 4E71 4E71 " " ========== v3.0 In the application: CODE 14+$1C56 From: 6776 To: 4E71 +$1D28 From: 6700 007E To: 4E71 4E71 +$1D2E From: 6700 00F2 To: 4E71 4E71 +$1D4A From: 6708 To: 4E71 +$1E26 From: 662A To: 4E71 This both cracks the program and removes the network check. ========== v3.5 Forget the install process... Copy the disk files to your hard drive and extract the files yourself & put into a folder (files from disk 1&2 have to be done this way, the other can be run on their own), now in the application change: CODE 10+$000E From: 67 To: 60 this works and gives me and registered to blank, serial #. - Multi Ad Search 100063800 100066120 - Multi-Disk PS001604(001) - MusicShop v1.0 210.100.000115xx (x = any number) - Mutant Beach 000234 003557 - myDiskLabeller †v1.0 Search for: 6600 05B0 41ED 0352 Change to: 4E71 4E71 " " " " - My Office †Search for: 6600 00A2 2813 6700 Change to: 6000 " " " " " " - My School 6580040 - My Town 8620045 - Nascar Challenge †Bill Elliots NASCAR Challenge: CODE 3+$07E0 From: 6700 FF46 To: 4E71 4E71 +$07E8 From: 6604 To: 4E71 this totally removes the protection as you do not even have to press a key or try, Bill Elliot's Nascar Challenge! As always, open it up with ResEdit (The Application 'benc'). CODE 3+$0B5E From: 6704 To: 4E71 This is quite a cool 'Turbo' feature. CODE 12+$05D8 From: 006D To: whaver The lower the number you change it to, the faster you go. For instance, if you want to double your speed (Doesn’t change the other cars’ speeds), change it to $0036 (Half of $006D). If you want to have fun, and just fly out of the stadium, set it to below $0010. If you for any reason, want to go really slow, set it to something like $0100. - Negotiation Edge †Search for:FDD0 6718 486D Change to: " " 6018 " " - Net-Cal †v1.3 Search: FFDE B0AE FFDA 6F0C Change: " " " " " " 600C - Nightingale v1.01 195121 - Nightwatch †Nightwatch is a slick new protection scheme for hard disks. It is supposed to prevent anyone from accessing your hard disk, but really doesn't do much good. Basically it alters the hard disk so it seems to be permantely write protected. If the disk is write protected, you can write out the Desktop file, and the mac won't mount it. How to crack it! 1) Bring a disk with the System on it and Mactools from copy ii mac. MAKE SURE that Mactools is the “startup” application, so you won’t even get into the Finder and see this desktop shit. 2) Boot the disk on the nightwatched system and you'll be up into Mactools with the ‘nightwatched’ hard disk mounted, ready to be leached! (For more fun, bring another HD and leach the whole fucking thing!) Alternately, you can set startup to any application and use Disktools or Disktop to open up nightwatch. - Nisus 3.0x 90040236 - Nok Nok 9300 49591 9300 49799 9300 59593 - Notify 0005940166 - Now Compress v1.0x NCA-100-0001-003575417719 - Now Up-To-Date v1.0 UDA-100-0001-011445453986 v2.0 UDU-200-0001-002377188121 - NUBase v1.3 0000000-00 - NuPaint 10111220 - O.G.R.E. †Search for: 6700 000E A017 21FC 0000 Change to: 6000 " " " " " " " " Must use the system that comes with the game (lots of resources). HFS disks: remove all files from folders. - Object Master v2.0.2 L\002428392663 - Oh, no! More Lemmings! †- OH, NO! MORE LEMMINGS EFFECT: Gets rid of passwords for individual levels in Oh No! More Lemmings HOW TO: In CODE 3, at offset 0xDB2, replace exactly 88 bytes (11 lines in ResEdit's general editor) with the following 88 bytes (11 lines) of garble: 48E7 1F18 47ED D02C 4245 101B 0C00 0030 6D14 0C00 0039 6E0E 4880 0440 0030 CAFC 000A DA40 60E4 0C45 0064 6E1A 4A45 6F16 5345 3B45 DC52 2005 48C0 81FC 0014 3B40 DC82 7001 600A 426D DC52 426D DC82 7000 4CDF 18F8 4E75 4E75 You'll probably want to update the corresponding dialog to make the prompt more appropriate. I changed item 4 of DITL 2001 to read "Level? (1 = Tame 1, 21 = Crazy 1, 41 = Wild 1, 61 = Wicked 1, 81 = Havoc 1)" so that I won't forget this is a patched copy. or -•OH, NO! MORE LEMMINGS EFFECT: This will remove the personalisation requirement HOW TO: CODE 2 Offset $1410 From: 661C To: 4E71 CODE 2 Offset $1E78 From: 6700 To: 6000 CODE 2 Offset $1F60 From: 6706 To: 6006 CODE 3 Offset $0506 From: 671E To: 601E - Oids †CODE 12+$1F58 From: 670C To: 4E71 +$1F5E From: EC70 To: EC72 +$1F62 From: EC72 To: EC70 v1.3 CODE 12+$1F7C From: 670C To: 4E71 +$1F82 From: EC2E To: EC30 +$1F86 From: EC30 To: EC2E - OmniPage v3.0 0102E-%001705 0132A-%002643 v2.0 2801G-%001327 v2.1 0102E-%001705 0132A-%002643 - Omnis 3+ †Search for: 6612 2F2E 0008 Change to: 6012 " " " " Search for: 6624 2006 0A00 Change to: 4E71 " " " " - Omnis 7 v1.0.3 Mac 7MDI 102344 37554 7MDI 103039 37065 Name each disk D1, D2, D3 v1.0.3 Win 3.x 7WDI 108844 18592 Name each disk D1, D2, D3, D4, D5 Unzip to FLOPPIES then install through Windows v1.1 Mac 7MDI 102344 37554 7MDI 103039 37065 7MDI 103247 37782 v1.1 Windows 7WDI 108844 18592 v2.0 7MDSI25119011700 - One on One †Search for: 2CE0 075B 4274 01C5 Change to: 42BF D8BD 9A4B 3915 Search for: D8EF F320 B611 Change to: D8BD 96C6 C05D - Operation Combat †It took me a few hours, but I finally figured out a crack for this program. The only problem is that you cannot quit except through the monitor… You know, press the interupt switch and type SM 0 A9F4, G 0 or in MacsBug type ‘es’... Search for: 102D 9E0A 6700 FEE2 4EBA 1A2E Change to: " " " " 6000 " " " " " " This trades a BEQ for a BRA. Works great. - Operation Desert Storm †(B&W & Color) Search for: 6700 FF44 2F2C FFEC Change to: 4E71 4E71 " " " " - Operation Tsunami †Level Passwords (case sensitive): Normal: Hard: Level 1 Area 2 FrGdSL ThrfrG Area 3 vdThWr ndMkDs Area 4 ldThtH cplsfl Level 2 Area 1 GvHsnl lNtnsB Area 2 Bgttns tzngTh Area 3 nThtTh mnThNm Area 4 sWhBlv fThFth Level 3 Area 1 thnHmM rndfTh Area 2 ghtNtP SnndfT Area 3 BtHvtr hHlySp Area 4 nlLfJh rtMtth Level 4 Area 1 ThrSxt wTwnty Area 2 nKngJm ghtTwn Area 3 sVrsnf tyNwnt Area 4 ThHlBb nlVrsn Level 5 Area 1 lPrsGd PrsJss - OptiMem v1.4.2 AVFA-SHAA-LLAO-LBPUA - Out of This World †CODE 5+$325C From: 67C0 To: 4E71 File 0146 is a GIF that has a secret message.... Codes: 1) LDKD 2) HTDC 3) CLLD 4) FXLC 5) KRFK 6) XDDJ 7) LBKG 8) KLFB 9) TTCT 10) DDRX 11) TBHK 12) BRTD 13) CKJL 14) LFCK 15) BFLX 16) XJRT 17) HRTB 18) HBHK 19) JCGB 20) HHFL 21) TFBB 22) TXHF - OverVUE †Search for: 1842 8112 3C00 314E Change to: 0242 " " " " " " ========== v2.0? Move to block 030B, position 019C, Change to 0000 Move to block 030B, position 01A0, Change to 0000 or Search for: 1842 8112 3C00 314E Change to: 0242 " " " " " " - Oxyd †Here are the first 2nd to 11 level codes: 2) 218780766 3) 10232399 4) 32882199 5) 13794470 6) 28197802 7) 17887807 8) 51761122 9) 83882268 10) 6071220 11) 58037867 Oxyd Patch Here's the patch I found for removing the Oxyd CP. Maybe it can be added to the new Cracks and Numbers file? - OXYD 3.4 Depending on which version you want to run (B&W or Color) you need to alter the appropriate Data A file. (Note: this only works with 3.4; I have no idea if it works with 3.3) **NOTE: you require a Disk/File editor such as Norton Disk Utilites rather than Resedit because you are editing the Data fork not Resource fork. EFFECT: This patch allows you to enter in the level number you want to play, instead of the annoying 'secret code'. Data A Color +$0001BC48 (#113736): Data A Mono +$0001C18A (#115082): change: 6F6E DEC8 FFFD D823 to 614A 0080 FFF7 CFFA and Data A Color +$0001BC5A (#113754): Data A Mono +$0001C19C (#115100): change: 4CFF FFF6 to CFFF FEFA Now you can just enter in the level number you want to play (preceded by the appropriate number of 0's, so level 12 would be 00000012). EFFECT: This patch allows you to press any key to remove the 'magical tokens' which block your path. Data A Color +$0002C9F6 (#182774): Data A Mono +$0002CF36 (#184118): change: 669F to DE43 Data A Color +$0002CA22 (#182818): Data A Mono +$0002CF62 (#184162): change: 669F to DE43 Data A Color +$0002CA4E (#182862): Data A Mono +$0002CF8E (#184206): change: 669F to DE43 or - OXYD 3.4 Depending on which version you want to run (B&W or Color) you need to alter the appropriate Data A file. (Note: this only works with 3.4; I have no idea if it works with 3.3) **NOTE: you require a Disk/File editor such as Norton Disk Utilites rather than Resedit because you are editing the Data fork not Resource fork. EFFECT: This patch allows you to enter in the level number you want to play, instead of the annoying 'secret code'. Data A Color +$0001BC48 (#113736): Data A Mono +$0001C18A (#115082): change: 6F6E DEC8 FFFD D823 to 614A 0080 FFF7 CFFA and Data A Color +$0001BC5A (#113754): Data A Mono +$0001C19C (#115100): change: 4CFF FFF6 to CFFF FEFA Now you can just enter in the level number you want to play (preceded by the appropriate number of 0's, so level 12 would be 00000012). EFFECT: This patch allows you to press any key to remove the 'magical tokens' which block your path. Data A Color +$0002C9F6 (#182774): Data A Mono +$0002CF36 (#184118): change: 669F to DE43 Data A Color +$0002CA22 (#182818): Data A Mono +$0002CF62 (#184162): change: 669F to DE43 Data A Color +$0002CA4E (#182862): Data A Mono +$0002CF8E (#184206): change: 669F to DE43 - PacerForum License Key: 5 User Key: B-6MX00096002114 - PacerTerm v1.0 B-43C78920099091 - Pagemaker v4.x 02-4008-200010087 02-6023-000345263 02-3013-000-196593 08-1003-000357503 02-0004-000094245 02-3008-000036469 02-0000-000000000 v5.0b1 11-1009-200021734 v5.0 11-1009-200021734 11-1516-200723741 †v1.0 Search for: 4E56 FFFE 422E 0008 486E Change to: 205F 301F 1F3C 0001 4ED0 ========== v5.0 Open up the PageMaker App itself with ResEdit (or your favorite Brand X resource editor) and find the 'KXRX' resource. The net ID number is located between offsets 0A and 1F inclusive. You will find all of the bytes at these offsets have already been zeroed. Change them to whatever makes you happy (as long as it's unique for each machine on the net). ========== v1.1 Search for: 6B00 00F4 203C 0000 Change to: 6000 " " " " " " Search for: 670E 4267 4EBA FCF0 Change to: 600E " " " " " " Search for: 670C 4267 4EBA FCD4 Change to: 600C " " " " " " ========== v1.2 Search for: 676E 4267 2F07 4EAD Change to: 606E " " " " " " ========== Pagemaker Ser. # Removal: To erase the serial number of Page Maker: - Start Fedit - Open File Page Maker - Read sector 0 of the file - At location $158 you will find a string like “xxxx 69xx xxxx 69xx xxxx xxxx” which is the serial number. They, of course, encoded it but with a simple key. They used the creator string "ALDU" and pass each letter in turn to encode each number of the serial number. Ex.: $71 XOR $41 (A) = $30 (0) $7E XOR $4C (L) = $32 (2) $69 XOR $44 (D) = $2D (-) and so on... - If you just change the numbers to put out a 00-000-00000, the program bombs out of its skull. - A little more digging uncovers the preceding two bytes. $156 is the address where the serial number check begins. It is normally a $0D so the checking doesn’t begin until the 6th number ($15D) in the serial number string (which starts at $158). - $157 is the number of digits to print in the serial number box when the program starts. If the number is less then $0C (original number), the string “Serial number” before the actual number doesn’t get printed. - So, to turn the number to 00-000-00000: * Read sector 0 of the Page Maker file * Go to byte $156 * Hex modify: 0D0C XXXX 69XX XXXX 69XX XXXX XXXX To: 140C 717C 6965 717C 6965 717C 7465 * Write the sector back - Painter (Fractal Painter) v1.x OOOOOOOAAA 0013951HZY 0014731DJN v2.0 0011187QBO (The last 3 are letters) †Painter 1.2 To make it so you can use any serial number (7 digits, 3 letters), change: GWIL 1+$322 From: 6600 FEF8 To: 4E71 4E71 Registerred copies will not have a GWIL 1 resource and can’t be registerred without one. After registerring, a CPHR 0 resource is added that holds your name and serial number. ========== v2.0 GWIL GWIL main CHANGES +21A +FE 6718->6018 +286 +16A 6FB8->4E71 +2E2 +1C6 6FAC->4E71 +322 +206 6600 FEF8 -> 4E71 4E71 +3DA +2BE 6EB6->4E71 +40A +2EE 670C->4E71 CODE 2 +12EA 6600 FE46 -> 4E71 4E71 +131C 6FDB -> 4E71 +134C 6FD8 -> 4E71 - Panorama II †Hex Changes Search for: 6730 4EBA 02E8 4AAC 90AE 6602 A9F4 (Found on sector 494) Change to : 6730 4E71 4E71 4E71 4E71 4E71 4E71 Panorama 2.01 01-1400-6350 1-19292-VQLFEBC - Pararena †v2.0 Change CODE 2+327C from: 4EBA FED6 1E00 4A2D E383 to: 1B7C 0000 E383 6000 0016 AND Change CODE 2+32A0 from: 1007 to: 7001 - Passport Producer v1.0 PV1-0-01018-0580 - Pathways into Darkness †Demo! Sure, it's only a demo, but it was fun to crack anyways. Hopefully it will work on the release version too... Anyways, here they are: *********************************************** To have unlimited ammo in your gun: Open up CODE 6 in ResEdit Change it at offset $5952 From: $6774 To: $6074 *********************************************** To prevent enemies from firing at you: Open up CODE 6 in ResEdit Change it at offset $8BC From: $6D00 FCB4 To: $4E71 4E71 Pathways into Darkness QUICKIE PATHWAYS HACK: Poke around with a sector editor and look for: 00 33 00 00 0008 ---last digit could be less than 8 That's a German gun clip. Try to find a couple of them. Change them to: 00 32 00 00 00 08 -- a 40mm grenade launcher 00 31 00 00 00 08 -- an AK-47 machine gun 00 35 00 00 0F FF -- AK-47 clip with 4,000 rounds 00 3B 00 00 0F FF -- 40mm Fragmentation Shell with 4,000 rounds Another cutie is: 00 45 00 00 00 08 -- Green Crystal. Summons Earthquakes. Kills all in sight or - PATHWAYS OF DARKNESS (v1.0 I think) EFFECT: This will remove the "match the monsters" box. HOW TO: LOCATE 'CODE' ID 2 FIND Offset $002E From: 4EBA 1106 To: 4E71 4E71 - PATHWAYS OF DARKNESS (v1.0 I think) EFFECT: This will allow you to play even after you enter the wrong sequence of monsters three times. HOW TO: LOCATE 'CODE' ID 2 FIND Offset $0036 From: A9F4 To: 4E71 - PATHWAYS INTO DARKNESS (note - somepeople say this doesn't work) EFFECT: You don't have to worry about the dialog any more. HOW TO: Open the CODE resource with ID 2 and jump to offset $2E. Change from $4EBA to $6008 - Patton Strikes Back †Search for: 4E56 E136 48E7 1F08 41FA Change to : 4E75 - Pax Imperia †v1.02 Open Pax Imperia with ResEdit: To have unlimited abilities for your race: Change CODE 23 at $1208, $13B4, $1560, $170C From: $6C22 To: $4E71 To have unlimited abilities when you create your own drives (Click New in the Tech window): Change CODE 4 at $3162, $3242 From: $6F0E To: $600E To have unlimited abilities when you create your own shields (Click New in the Tech window): Change CODE 4 at $2D96, $2E76, $2F56 From: $6F0E To: $600E To have unlimited abilities when you create your own sensors (Click New in the Tech window): Change CODE 4 at $260A From: $6F08 To: $6008 Change CODE 4 at $2752, $289E, $29EA, $2B36 From: $6F0C To: $600C To have unlimited abilities when you create your own weapons (Click New in the Tech window): Change CODE 4 at $1A62, $1B18 From: $6F08 To: $6008 Change CODE 4 at $1CC4, $1D84, $1F34, $1FF4, $21A4, $2264, $2414, $24D4 From: $6F0C To: $600C - PB Tools (Billy Steingberg’s) PB1310340 (there might be a space afterthe PB) - Penguin's Revenge †Search for:4EBA56C089191012 Change to:4E7556C089191012 - PenPal †v1.3.1 Open the file "PenPal™ Prefs" in the Preferences Folder (Sys 7) or the System Folder (Sys 6): Add resource 'PPPS' 128. Type in your name (in ASCII - the right hand column), then enter the number of charactacters (in hex) at the beginning of the resource (in HEX - the left column). Examples: Me - Length = 2 so... 02 (Hex for 2) + 'Me' The Cool Guys - Length = 13 so... 0D (Hex for 13) + 'The Cool Guys' Everyone in the World - Length = 21 so... 15 (Hex for 21) + 'Everyone in the World' If you want it to be blank, just type 00 in the left hand column. - Pensate †Search for:1B7C 0001 DD00 Change to:4E71 4E71 4E71 - Performer †v1.21 Search for:660000064EFA Change to:4E714E714EFA Search for:EBA00E20C400018 Change to:31FC01F301204E71 Performer 1.22 Search for:660000064EFA Change to:4E714E714EFA Search for:185700715A08000 Change to:679F38F9570472B8 - Personal Press 2C91036 - Persuasion v2.0 08-0000-000000000 08-2001-200201529 02-3008-000036469 - PFS †Search string--6704600003B23B7C (TWICE). Changed the first byte (the 67) to 60 (a BRA) and it worked-- PFS A.03 Search for:660845FA00283012 Change to:4E7145FA00283012 Search for:6604426760083F3C Change to:4E71426760083F3C - PFS File/Report †Search for:600003B2 Change to:4E714E71 - PGA Tour Golf †To patch it so you don't need the codes, change CODE 1+$3C70 from 2F3000004EAD078A to 4E714E714E714E71 and change CODE 1+$3C92 from 67 to 60. or - PGA GOLF V1.0 EFFECT: The password dialog will never show up. (It doesn't get rid of the diaglog box, but as with the other patch you can safely enter any distance.) HOW TO: LOCATE CODE RESOURCE 1 CHANGE THE WORD AT OFFSET 3C70 TO 4E71 CHANGE THE WORD AT OFFSET 3C72 TO 4E71 CHANGE THE WORD AT OFFSET 3C74 TO 4E71 CHANGE THE WORD AT OFFSET 3C76 TO 4E71 CHANGE THE WORD AT OFFSET 3C98 TO 4E71 CHANGE THE WORD AT OFFSET 3C9A TO 4E71 -•PGA TOUR GOLF 1.0.1 ONLY [this patch works but the "before" code is NOT 660A] EFFECT: It doesn't disable the green length box, but it doesn't matter what length you enter. HOW TO: LOCATE CODE 1, OFFSET 3884 CHANGE 660A TO 600A - Phonenet PC 3022152-2F82 - Photoshop v2.x PCA 100000100-953 PDA 100001185-501 PDA 100001517-722 v2.0 PDA200100141-356 PCA200102249-484 PCA107011754-639 PCA200110733-522 PCA100002582-359 PDA100001185-501 PDA100001517-722 PDA100000915-575 PCA100000100-953 PMW200100345-605 PDA100001018-372 PCA200108975-448 PCA200102474-344 PHW200100021-751 v2.5 beta shakti, in lower case v2.5 (same as 2.0) - Pinball Construction Set †Search for:22084EBAFE86 Change to:203CE1B2FAA1 Search for:207983AEFE9B Change to:224DDAE58809 Search for:225F32CE4CCB3450 Change to:4C00ED28F7A071BA Search for:ED7AFD9F8384 Change to:ED289BF79E9A - Pipedream †v1.1 EFFECT: The password dialog will never show up HOW TO: LOCATE CODE RESOURCE 2 CHANGE THE BYTES AT OFFSET 25 FROM AD 01 4A TO 71 4E 71 IN CODE RESOURCE 3, CHANGE THE BYTE AT OFFSET 16060 FROM 6F TO 60 or Change CODE 3+$17EA (A few characters over from 17E8) from: 025A to: 0172 This simple crack just jumps over waiting for you to enter the password, and lands right at the part where it sets the memory that says you got the password right. - Player Pro v4.09 v4.10 v4.15 †Crack for Player Pro 4.15 Code 7 Offset 18FE Change to 6012 Offset 1930 Change to 6012 Offset 16FA Change 4E90 -> 4E71 Crack for Player PRO v4.09: ------------------------ So it will register: 1) Open up the application with ResEdit 2) Open up the Code resource 3) Open up Code ID 7 4) Search for Offset +1970 5) Change 6712 -> 6012 6) Quit and save all changes. 7) Open the application and register yourself under the apple menu. Be sure to have your name a decent length. I believe it will only accept a name 4 chars or more. I would suggest your enter the code as 0123456789... (Just in case) 8) Have fun! And I would suggest you register the program. Its worth it, and the author doesn't ask for much. Besides, you get the manual and shit. This program likes to disable MacsBug so us crackers can't hack it. Not today! Heres a crack to enable the usage of MacsBug: 1) Open up the Code resource 2) Open up Code ID 2 3) Hex search for 42B80120 4) Change all 42B80120 -> 4E714E71 5) Open up Code ID 7 6) Repeat steps 3 and 4 again. 7) Quit and save all changes! 8) Enjoy! Crack for Player PRO v4.10: ------------------------ To register: 1) Open up the application with ResEdit 2) Open up the Code resource 3) Open up Code ID 7 4) Search for Offset +2622 5) Change 6712 -> 6012 6) Quit and save all changes. 7) Open the application and register yourself under the apple menu. Be sure to have your name a decent length. I believe it will only accept a name 4 chars or more. I would suggest your enter the code as 0123456789... (Just in case) 8) Have fun! And I would suggest you register the program. Its quite good, and the author doesn't ask for much. Besides, you get the manual. - PlayMaker Football †v2.0 Find CODE 90+$608 is $6700 FF18 change CODE 90+$59E to $4E71 and CODE 90+$5F2 to $6018 change the message in DLOG 800 to "Press Command-G and hit OK until the game begins. Then you will never see this dialog box again." or Code #90 +54A 66D6->4E71 +552 670A->600A +464 6714->4E71 or - PLAYMAKER FOOTBALL 2.0 This patch takes several steps, since PMFB checks to see if its code has been modified while a game plays; if it has, the game will crash. This is why previous patches have failed. However, it doesn't ask for a password every time; instead, it asks after several games have been played since it last got a valid password. After a valid password has been entered, all you need to do is lock the application in the Finder. Then it will not be able to remember how many times you've played, and will not ask you for the password again. If you haven't enetered a valid password (and no longer have the user's manual) modify the program with ResEdit as follows: Open CODE 90, find word at offset $100; change the word from $A861 to $4E71. (This replaces the random number generator, so you will always be asked for the same password.) Then run PMFB and ask to play a game. It will ask you for word 4 on page 13, paragraph 3. The word is "are". After it accepts this password, DO NOT PLAY THE GAME! It will see it has been modified and crash. Instead, open ResEdit and change the word in CODE 90 back to its original value of $A861. Then lock PMFB in the Finder. It should never ask you for the password again. I don't know for sure that this will always work; I've only had my copy of Playmaker Football to test it on. - Playroom †- THE PLAYROOM (COLOR) V 2.0.1 HOW TO: The password dialog entry box will never show up (used to show up every fifth invocation). HOW TO: Locate CODE resource #11 (number eleven) Change WORD at offset 0DC2 from 526D -> 426D - Pool of Darkness †In the application: Check 'CODE' $B $6d92 2 $4ead $01d2 Modify 'CODE' $B 4 $6d92 $4e71 $6d94 $4e71 $6dc8 $600c $6dec $4e71 or - POOLS OF DARKNESS (ATTENTION: Patch also disables internal viruscheck!) EFFECT: The password dialog will never show up HOW TO: LOCATE CODE RESOURCE 11 CHANGE THE WORD AT OFFSET 6D92 TO 4E71 CHANGE THE WORD AT OFFSET 6D94 TO 4E71 CHANGE THE WORD AT OFFSET 6DEC TO 4E71 - POOLS OF DARKNESS V1.0 EFFECT: Defeats password protection. Works for b&w version, not tested for color. This keeps the password dialog, but it doesn’t matter what password you use After the 3th try the program starts. HOW TO: Locate code resource 15, change the word at offset $1AB4 from $4EBA to $4E71 offset $1AB6 from $5442 to $4E71 - Pool of Radiance †V1.1 EFFECT: The password dialog will never show up HOW TO: LOCATE CODE RESOURCE 2 CHANGE THE TWO WORDS AT OFFSET 3E94 TO 4E71 4E71 - PosterWorks 1883-BKHMEAFGHI - Power Launcher †V1.6 Search for : 6716 1B7C 0001 F643 4206 554F Change to : 6016 That will eliminate the check-sum routine that detects that the code has been modified. Search for : 6718 3F3C 0080 4EAD 019A 554F Change to : 6018 That will allow anything for your registration dialog. If it doesn’t ask for the registration then trash the pref. file before you launch it and it will ask you to register. If you want it un-registered just click ok. This crack also removes the annoying dialog everytime you change sets. - PowerMerge v1.0 PM1-002897 - PowerView 1-38620-KVEASRD - Practica Musica v1.x 00215052 PM220569 692878 v2.295 226835 - Premiere v1.0 PRB100101253-785 v2.0 PRW200100586-763 v3.0 PRW200100586-763 PRW200101810-587 PRW200101890-129 - Preprint v1.0/1.5 11-1009-200021734 02-0001-100000000 11-1000-200027072 - Presenter †1.5 Demo! This will make Presenter 1.5 Demo act as though it is not a demo. There are three global variables which say in what way it is limited - such as Demo (INIT), Demo (ADB), and all that. From looking at the resources - there's one called 'EvE ', it seems that this uses the EvE protection scheme... So, the crack just changes the variables that says whether or not it has found the EvE. Open CODE 12 in ResEdit Change it at offset $5EC0 From: $6F3E To: $603E Change it at offset $6B7C From: $6708 To: $4E71 Change it at offset $6BC4 From: $6708 To: $4E71 Change it at offset $7268 From: $6728 To: $6028 - PressWise 02-000-00000 - Prince of Persia †EFFECT: The Potion Level never appears HOW TO: LOCATE CODE RESOURCE 2 CHANGE THE WORD AT OFFSET 1F70 FROM 660A TO 600A or To Patch Prince of Persia 1.0 so there are unlimited chances to get the right potion in the potion level, change CODE 3+$55A6 from $5240 to $7000. Note: The potion level has to be done again only if you quit Prince of Persia and run it again later. To get rid of the potion level altogether, change CODE 2+$1DF2 from $0002 to $FFFF. This is for new games and opening from the file menu. Change CODE 2+$1DD6 from $3B6D BA64 BA62 to $3B7C FFFF BA62 for opening from the desktop. Prince of Persia saved games: The format of the save files for version 1.0 is 2 bytes each for: minutes left; fraction of a minute out of $2D0 (max is $2CF); level ($F is potion level, $E is last level or princess level, $C and $D are level 12 part 1 and part 2: Jaffer level, $1-$B is level 1 to 11 and $0 is the demo level); potions; unknown; prizes (people killed, items obtained, big potions etc); how many times prince died; checksum (which=$1B39 - min*$B - frac - level*$11 - potions*$25 - unknown*$C1 - prize*$17 - died*$D. To eliminate the need to calculate the checksum, change CODE 2+ $15AC from $663A to $4E71. (POP 0.15B saved files do not have prizes or died and are therfore, only 12 bytes instead of 16. The checksum does not include prizes or died. To eliminate the need to calculate the checksum for 0.15B, change CODE 2+$181C from $662E to $4E71.) Prince of Persia speed up: The 'Turbo POP' updater program changes CODE 2+$102 from $90 to $D0 to speed up the animation. Prince of Persia Editor 2.01 Change CODE 3+$05FA (A few characters over from $05F8) from: 4EBA FE84 to: 4E71 4E71 AND Change CODE 3+$0990 from: 670E to: 600E - Print Shop †1.0 - 1.2 Search for: 21FC D9BE B403 0A80 4E75 Change to: 4E71 4E71 4E71 4E71 0280 (They took out the CP in v1.3) - Pro-Cite v2.02 MP12460 - Professional Bibliographic System †v2.52 Search for:6700022C42A74EAD Change to:6000022C42A74EAD v2.6 Search for:670001A042A74EAD Change to:600001A042A74EAD - Professional Composer †Search for:670001FC3F3C7D00 Change to:600001FC3F3C7D00 - Psion Chess †Search for:00024E926700DA56 Change to:000247FA4D484E71 Search for:000100010141 Change to:010001000141 v1.5 Search for:4E926700DA34 Change to:47FA4D264E71 Search for:000100010141 Change to:010001000141 - Public Utilities v1.0x B102145276305 003182327 v2.0 003182327 330-01315-301 330-01436-301 †v1.0.1 Make the following change to Installer Script. Search for : 670E 2F0B 4EBA 031C 3C00 Change to : 4E71 - Puppy Love †Search for:67064EAD02FA6028 Change to:4E714EAD02FA6028 Search for:4EF90040000A Change to:A9F40040000A - Puzzle Gallery †- PUZZLE GALLERY V1.8 EFFECT: This game is NOT copy protected at all, but it does not run under Systems 7.0 or 7.0.1. This may be a good forum to publish this fix to allow the program run under these systems. N.B. Do not EVER run copies of this modified program under Systems pre 6.0.2 (i.e. System 6.0, 4.2 etc.) As Egon said in GhostBusters, "it would be very bad". Locate CODE resource #1 (number one) Change WORD at offset 24C8 from 0002 -> 0000 The program will now run correctly (Systems 6.0.2 and greater) - Quark Xpress v3.0 XX51123585 v3.1 XU60541345 XU51210588 XU50002863 XU58494583 XU60541345 XX51123585 XU43914334 XU43950295 XU44134121 XU44317350 XU51785218 XU51849192 XU52404768 XU52443418 XU52628863 XU52911967 XU52928917 XU53277674 XU55081085 XU55082842 XU55082949 XU55404875 XU57046139 XU57046246 XG50002863 XR22000765 XR22246199 XU23262295 XU23326276 XU43158960 v3.2 XU30435782 XU30435247 XU50002863 XU60541345 XU44267530 XU56693459 XU51636790 †** TIP ** Use a number that you know works and add 107 to it. If you replace XU with XM the installer accepts the SN and I believe installs a multi-user version. QuarkXpress Network Bypass: (as of 6/29/91) For each additional copy you need to run on the network do the following: - Make a copy of the original program. - Open the copy with ResEdit and open the DATA resources. - Now open the DATA ID 0 resource. - Search for the string QuarkXPress (check spelling and case). - The next character after the string is a "<" symbol. - Change the "<" character to the character "1" for the second copy you want to run on the net and to "2" for the third copy and so on. - Now close ResEdit and save your changes. NOTE: For each additional copy you want you MUST make a copy of the original to modify. That should get you on your way to lots of copies on the net. also any serial numbers from the gamma should work just change the first two letters to XU instead of XG serial numbers from 3.0 should work fine also if you use the updater it will ask if you want to change the current SN to another SN (great for getting an additional SN) my hunch: if you replace XU with XM the installer accepts the SN and I believe (i havent had a chance to verify it) installs a multi-user version. - Quark Xpress SXetch Pad 63AC-DAF4-5CBD-AB98 - Quartet †v1.0 Search for:F5CCF5C800640000 Change to:0000F5C800640000 - Quest †Search for:611C 4CDF 7FFE Change to:4E71 4CDF 7FFE - QuickCurcuit †v2.0 Search for 670C3F3C000E4EAD Change to 600C3F3C000E4EAD Search for 67081D7C0001000860104267 Change to 4E711D7C0001000860104267 - QuickFormat v6.3/7.0 QF!DD45FPDACC16LS †QuickFormat 7.0 Byte Changes (You should find the SEARCH string only ONE TIME!) Search: 4EBA FE14 4EAD 02E2 4EBA FEBE 4EBA FF22 4EBA F82A Change: 4E71 4E71 QuickFormat 7.1 CODE 3 +$3B6 From $6606 to $4E71 - QuicKeys II v2.0 23545 69402 6817 115565 40391 6817 23545 62402 v2.1 115565 v2.1.2a 104511 v2.1.3 19628 56406 v3.0 1000888 †QuicKeys 2.0x to 3.0 QuicKeys stores its personalization information in the Qky2 resource with ID 1. To patch it, just nuke the existing resource (ID 1, not ID 0) if there is one, and create a new one with ID 1. Then open it up and enter your personalization info. The strings you create here are Pascal type. In other words, you must precede the actual string with a length byte. Figure out how many characters there are in each piece of information that you enter and convert that number to a two digit hex number. Then type in that number followed by the hexadecimal ASCII codes for your string (or just enter the characters in the ASCII section if you're using ResEdit or a similarly enlightened editor). Pad the end of each string with nulls (0 in hexadecimal). Enter your name (or bogus name substitute) at offset 0. Enter you company name or related fiction at offset 20 (remember, that's a hex number). Enter the serial number (which can be anything at all) at offset 40. Don't enter anything after the serial number. So, for example, to be Hari Seldan at Herman's House of Lint and have the serial number 666, I would enter the following (in goofy ResEdit hex editor form): 000000 0B48 6172 6920 5365 Hari Se 000008 6C64 616E 0000 0000 ldan 000010 0000 0000 0000 0000 000018 0000 0000 0000 0000 000020 1648 6572 6D61 6E27 Herman' 000028 7320 486F 7573 6520 s House 000030 6F66 204C 696E 7400 000038 0000 0000 0000 0000 000040 0336 3636 666 (Note that non-printing characters have been removed from the ASCII output on the right side.) And that's it. You don't even need to restart to begin accessing QuicKeys. And best of all, you can apply the patch to a pre-installed version of QuicKeys, so that you will never have to do it again. QuicKeys 2.1.2 Search for:6F00 FE38 2F2E FFFC A983 7001 B06E FFEC Change to:4E71 4E71… Search for:662C 426748 6EFE A048 6EFE A970 4C2F 00 Change to 4E71… Search for:7001 B06E FFEC 57C0 4400 1D40 0008 Change to :103C 00FF 4E71 4E71 4E71… v2.1.3 Change 'QkyC' -14341+$3A80 from: $56C0 to: $4E71 The personalization data is stored in 'Qky2' ID 1. When you register it, with this crack, it will use the serial number 19628, which is presumably the default one. To see the personalization, go to 'About QuicKeys™...' in the option menu when editing keysets. Quick Keys 2.1.3 For those who can't find a serial number this work around worked for me. 1 Install Quickeys with extensions, etc you desire 2 Install Quickeys 2.1 (no serial number needed) cdev only and reboot, should open 3 Re-install Quickeys 2.1.3 cdev only and reboot, should now open without asking for serial number - QuickFlix!Q F1009383-0045 - QuickMail v2.2 40866 †Crack for 2.0 serial numbers patch: Open up the QUICKINIT file with ResEdit: Look in INIT 25 "QuickInit", offset $24, for an ASCII sequence of digits (they directly follow a string that looks like QuickMai, e.g., QuickMai00000). ASCII modify them to any serial # you want, preferably something far away from what other people are using. You see, that serial # is a BASE serial number, from which the Quickmail software will increment x # of times, where x is the # of users allowed by that particular pack. There is one more spot where it's stored, and that's in the DATA -14144 resource, offset $5C, again, it's five ASCII digits. Change them to the same # you installed into the INIT 25 resource. Once you've made your changes, be sure to save them, and then reboot with the new files installed in your System Folder to see them take effect. I know it's not a patch to remove the serial number check process altogether, but since I do not know how the scheme is intrinsically tied to the actual workings of the client/server mechanism, I'd rather not play around with that and possibly create reliability problems. If you want to invest loads of time looking into it, feel free and please post the results; but I think if all you want to do is get your office up and running with Quickmail for everyone, then this should meet your needs. - QuickSANE v1.0 QS-91337004 - Quickset †Search for:670000144267 Change to:600000144267 - QuikCircuit †v2.0 Search for:670C3F3C000E4EAD Change to:600C3F3C000E4EAD Search for:67081D7C0001000860104267 Change to:4E711D7C0001000860104267 - Racter †Search for:0FF58205DEA9 Change to:08F58205DEA9 Search for:F7BBCA71CA64 Change to:967DCE5BE849 - Ragtime v3.1 Serial Number: 6601120 Production Number:8739401 †Search for:4E56FFC041EEFFC0316E00080016216E000A0012A017 Change to :4E75FFC041EEFFC0316E00080016216E000A0012A017 Ragtime 3.0 Serial Number:6601120 Production Number:8739401 Ragtime 3.1 Serial Number:6601120 Production Number:8739401 - Railroad Tychoon †Krak Patch Hex search for: 28 00 02 B0 69 06 84 66 08 08 AD Hex change the bold values to 4E 71 This should appear on sector 301, byte 25848 of the file. or Find Hex string 0684 6646 486E Replace it with 0684 4E71 486E When you hit the choose the locomotive screen, any choice you make will be valid The krak listed above allows the game to continue to limit your play to two trains at a time. or - RAILROAD TYCOON 1.0 EFFECT:The program will never ask you the question. HOW TO: Locate CODE 24, Find Offset $1F0A, Change the word $6646 to $4E71 Find Offset $207E, Change the word $6608 to $4E71 - RAILROAD TYCOON RRT has the PICTs and STR#s all in the application, where they can be copied into a WORD document that you can have on your hard disk. There's an easier way to avoid needing the Railroad Tycoon manual (suggested, I believe, by some previous poster in this group): Just spend a few minutes with ResEdit and add the names of the engines to the PICTs. Then the answer is right in front of you every time. - Rambo †Search for:DB49D669B2FD Change to:DC49D669B2FD Search for:4B6F26851ED8 Change to:2AA9BB036063 - RAMdisk †v3.16 Leave three blank spaces after your name to register - RAM Doubler †Ramdoubler 1.0.1b1 krak Code #2 +11A0 630E->600E Ramdoubler 1.0 the correct SINGLE BYTE crack is CODE #2 +114A 6620->6020 RAM Doubler 1.0 fix While playing around with RAM Doubler 1.0 you may have noticed that if you replace your System File from a backup or even just move it out of your System Folder and immediately back in again, upon the next restart RAM Doubler gives you an error message saying that RAM Doubler did not load because it has been moved. Here is why: During installation the RAM Doubler installer places two invisible files into your System Folder, "MacsBug Mgr" and "Load RAMDblr." If you look at your HD's boot blocks with Norton Disk Editor you will see that the RAM Doubler installer also changed the boot blocks' Debugger Name from the normal "MacsBug" to "MacsBug Mgr." Obviously the installer does this to ensure that RAM Doubler resources get loaded absolutely first thing during bootup. Presumably it also changes the boot blocks' Debugger Name from the normal "MacsBug" to "MacsBug Mgr" so that it can load your MacsBug debugger (if you use it) secondly, after the RAM Doubler code during bootup. The only problem is that if you swap out your System File or even merely move it out of your System Folder and immediately back in again, your boot blocks get re-written by the Mac's ROM routines such that the Debugger Name gets changed back to "MacsBug" and presto, RAM Doubler won't load, forcing a re-installation from the RAM Doubler floppy. (Anything you do that causes the miniature Mac on the face of your System Folder icon to disappear and reappear reflects this automatic rewriting of your boot blocks.) What a hassle! Solution: if you're NOT using a debugger (or anything else you've named MacsBug, e.g., there was once a screen saver that needed to be called MacsBug) simply use DiskTop, ResEdit or any other disk editor that can see invisible files to go into your System Folder and change the name of "MacsBug Mgr" to "MacsBug" and then move your System File out & back into your System Folder to force the boot blocks rewrite. Then you'll never need to reinstall RAM Doubler whenever you mess with your System File. Voila! - RapidTrak 600001201 - RayDream Designer v2.0.3 RDD5-1230-48398 RDD5-1550-52358 - Real Poker †Search for:43FA FE80 32BC FFDC Change to:4E71 4E71 4E71 4E71 Make the files "Saloon File" & "Poker Data" visible. Also, there is a poker font in the fonts file you have to have on your system. - Red Ryder †v11.0 Find:6630 42A7 4879 434F 4445 3F3C Replace 42A7 with 6030 - Rendermania Beta 3273071853 4027723341 3574598582 2518174477 4011405915 - Resolve (Claris) †v1.0 Hex Changes: Search : 486E FFFC 4EBA FCF6 4A00 588F 670E Change : 4E71 4E71 600E - Retrospect Remote Authorization Numbers: 650-729-7746 543-999-2682 647-741-1178 595-161-0202 577-533-0106 545-366-9586 602-708-6450 592-374-9842 577-330-3898 652-350-7410 Registration Number: 05030000180 - Reversi †Search for:6708487A01904EBAF69 Change to :66008487A01904EBAF696 Search for:6708487A01524EBAF988 Change to :6008487A01524EBAF988 Search for:4EBA08C23E1F4EF9 Change to :A9F408C23E1F4EF9 Search for:4EBA0BF03E1F4EF9 Change to :A9F408C23E1F4EF9 Search for:4EBA04D03E1F4EF9 Change to :A9F408C23E1F4EF9 - RightWriter TGMC 113695 - Robosport †How to remove the copy protection from Maxis' game "RoboSport": Search for 4EAD 066A 4FEF 000A 3E00 4A47, using a Utility such as ResEdit or SUM Tools.(This sequence is in code resource 2 at offset 2A8C if you look with ResEdit. Replace the first two words with 7001 7001, and everything should be OK. Or try: EFFECT: The password dialog will never show up HOW TO: LOCATE CODE RESOURCE 2 CHANGE THE WORDS AT OFFSET 2A82-98 (2A82, 2A84, ..., 2A98) TO 4E71 CHANGE THE WORDS AT OFFSET 2AB2-C8 (2AB2, 2AB4, ..., 2AC8) TO 4E71 Or try: COMPATIBILITY NOTES If you play RoboSport on a MAC PLUS or MAC CLASSIC, turn OFF the Preview Movie Sound option in the Preferences Window otherwise the program may lock during Turn Generation due to a sound chip incompatability. You need MORE THAN 1MB RAM to play RoboSport under MultiFinder. If you only have 1 MB RAM, you must play RoboSport under the Finder. RoboSport is not compatible with the Apple CD-ROM init. RoboSport is not compatible with the Now Menus in the Now Utilities. APPLETALK NOTES To remove a SECONDARY machine from an AppleTalk network game, the person on the PRIMARY machine must: (1) Select REMOVE SECONDARY from the EDIT MENU (2) Click the radio button next to the player you want to remove, and (3) Click on the REMOVE SECONDARY button. AppleTalk Zones are not supported in this version of RoboSport—only direct machine to machine AppleTalk. KRAK NOTES Run the program. <IN PROGRAM> Marvel at the cool sounds. Go to the dialog box in which you're asked to input the three symbols appearing on some page in the manual. Pick any three symbols. Break into TMON. <IN TMON> Choose MAGIC RETURN from User window. <IN PROGRAM> Hit OK button. <IN TMON> GOSUB a few times; do not GOSUB over pascal case statement beginning (TRACE through it to avoid hanging TMON). Notice quite a few BRAs to Code0005+BCC. Decide too many IFs to handle, so hack logic at source, decision stage (Code0003+15A, Code0003+16E). A #$00 returned from decision routine in D0 means a faulty code, a #$01 returned in D0 means good code. Change all MOVE #$00,D0 to MOVE #$01,D0 so every code is good. KRAK IT YOURSELF Hex Search: 70 00 60 12 52 6E FF EC Hex change: …01… Hex Search: 70 00 4E 5E 4E 75 4E 56 Hex change: …01… or CODE 2+2A8C from: 4EAD 066A 4FEF 000A to: 4E71 4E71 4E71 7001 or - ROBOSPORT V1.0 EFFECT: The password dialog will never show up HOW TO: LOCATE CODE RESOURCE 2 CHANGE THE WORDS AT OFFSET 2A82-98 (2A82, 2A84, ..., 2A98) TO 4E71 CHANGE THE WORDS AT OFFSET 2AB2-C8 (2AB2, 2AB4, ..., 2AC8) TO 4E71 - ROBOSPORT V1.11 EFFECT: The password dialog will never show up HOW TO: Locate CODE resource 2 Change the words at offsets 2C30 through 2C46 to 4E71 Change the words at offsets 2C60 through 2C76 to 4E71 - Rocket Share 1.0 640-0207-01 - Rogue †To make Rogue easily copyable, try this: Search for:3BEA 7702 C370 54EC 8BA8 208E F5E8 139C Change to:3AEB Make these Changes to a sector copy; then bit copy track #33 with any bit copier. or try Search for:29DC948CA37E Change to:01AD2787A37E Search for:34E06DF0C594 Change to:33E06DF0C594 - Sailing Master v1.1 00920ASIP - Sargon III †Search for:660845FA0020301290416604 Change to:4E7145FA0020301290416604 - S.C.OUT †Codes 2 RAFAFE LAXUDI 4 ZOLATU XOVUPI 6 MILOZI ZOKILE 8 BETIXA LOMACE 10 JEFIME TUDEJE 12 JAKURI BOJIRA 14 JILEZO MUBALI 16 LAMANE VOXOLI 18 TEBUMU NUCIDO 20 DOKALE CEMATE 22 XUJIFU RUJELI 24 MOLOJA VONIFU 26 MIXEDU ZUMAVO 28 XUKEXE BIFUTA 30 DAMUDA PAKUNE 32 BEMUMA KAVIMO 34 NUREXA RURAPI 36 JEJAPI NAFAXI 38 FACABA MENIMI 40 MELENA TIVAFA 42 BIJAME LITOVO 44 POMINU TALOLA 46 DUNAVE FIVIDO 48 BUXALI CUFIBO 50 MAMOFU LAVONO 52 ZOBATA REDECA 54 DUMANI LUMERA 56 FUZIBU NICONA 58 JEBINI LAKEXO 60 PIJERU MUVUKA 62 TIKOKE PIVECI 64 XIPAXI VEDAPU 66 CIFABU FADAMA 68 NODOTI MUFUPO 70 MACINE CUDODI 72 KUMEKI MAXULE 74 DEMIFA KATAXE 76 CIZEBE DEFIVE 78 ZICODA KOVABI 80 ZOFOKU FITOJI 82 DUTEJO XUXETE 84 REJITA NIRIPE 86 NAPEMI XERECA 88 KENAVO VUDERU 90 DIRONO JIRURE 92 TEBOVI KORAKA 94 NELARI TAXEDA 96 NUPAXO VACETE 98 FADIMA DONIKO 100 LUTANO ZETIPO Infinite Lives cheat is CODE 9 +1AE 536D 9254 66 ->4E71 4E71 60 S.C.OUT 1.3.1 Infinite men cheat, but makes it impossible to abort game - must quit and restart to play a different level. CODE 9 +1AE 536D 9254 660A -> 4E71 4E71 600A - ScreenScapes 10SSM005528A - Scriptor †v1.4 Search for:5EA43F3C0001A9 Change to:4FA63F3C0001A9 - Sculpt 3D 101164 - Secret of the Silver Blade †You can bypass the journal entry codes by changing CODE 14+$4020 from $4267 3F3C to $6000 01DA. To bypass the rule book codes, change CODE 2+$39E from $4EAD 037A to $6000 01F8. or EFFECT: The password dialog will never show up HOW TO: CHANGE THE WORD AT OFFSET 16AE IN CODE RESOURCE 15 TO 6052 These are the journal entry codes: 1) word #5 entry #3 page #28 = BLACK 2) word #2 entry #5 page #28 = TALKING 3) word #4 entry #6 page #28 = MINERS 4) word #1 entry #13 page #29 = BLIND 5) word #3 entry #9 page #29 = TALE 6) word #5 entry #11 page #29 = BEHOLDER 7) word #3 entry #15 page #30 = FROST 8) word #4 entry #18 page #30 = SILVER 9) word #2 entry #19 page #31 = AMULET 10) word #1 entry #22 page #31 = DYING 11) word #6 entry #23 page #31 = MAGES 12) word #2 entry #24 page #32 = GUARD 13) word #4 entry #25 page #32 = WELL 14) word #3 entry #27 page #32 = STORY 15) word #6 entry #28 page #32 = VORPAL 16) word #3 entry #30 page #33 = GEMS 17) word #4 entry #33 page #33 = AM 18) word #6 entry #34 page #33 = FLAMING 19) word #6 entry #37 page #34 = SMALL 20) word #1 entry #40 page #35 = LEDGER 21) word #3 entry #43 page #36 = MARCUS 22) word #3 entry #47 page #37 = YULASH 23) word #3 entry #46 page #37 = MULMASTER 24) word #2 entry #48 page #38 = GLOWING 25) word #7 entry #51 page #39 = HOUSE 26) word #4 entry #55 page #40 = SERVED 27) word #4 entry #59 page #41 = WOUNDED 28) word #4 entry #63 page #42 = AMAZONIAN 29) word #1 entry #67 page #43 = MAD 30) word #5 entry #70 page #44 = CIRCLE These are the rule book codes: 1) word #3 "CIVILIZATION" page #9 = TOWN 2) word #4 "USING MENUS" page #2 = MENU 3) word #5 "BEGINNING TO PLAY" page #2 = GAME 4) word #4 "INTRODUCTION" page #1 = OFFICIAL 5) word #5 "GETTING STARTED QUICKLY" page #1 = BLADES 6) word #4 "BEFORE YOU PLAY" page #1 = COPY 7) word #4 "COMBAT" page #10 = COMPUTER 8) word #4 "ENCOUNTERS" page #10 = COMES 9) word #1 "MODIFYING CHARACTERS" page #3 = THE 10) word #6 "MAGIC" page #8 = OPTIONS 11) word #4 "ADVENTURING OPTIONS" page #7 = CONTROL 12) word #6 "ENCAMP" page #7 = LIKE 13) word #1 "NON-PLAYER CHARACTERS" page #4 = DURING 14) word #4 "CHARACTER STATUS" page #4 = THAT 15) word #4 "VIEWING CHARACTERS" page #4 = DISPLAYS 16) word #3 "ADVENTURING" page #6 = UP 17) word #1 "DISPLAY SCREENS" page #6 = SECRET 18) word #1 "ADVENTURING" page #6 = AFTER 19) word #2 "CHARACTER STATUS" page #4 = STATUS 20) word #3 "VIEWING CHARACTERS" page #4 = COMMAND - Seize The Day ID# 9312M00014 UNLOCK KEY - Q1B9J - Sensible Grammar 103855 119303 - ShadowLan †"Paris" allows 5 users to connect. - Shanghai †Search for:55083F3C0001A9 Change to:41783F3C0001A9 - Sherlock Holmes †Search for:660000044E75 Change to:4E714E714E75 - Signpost †v2.0 This bypasses the hardkey and accepts anything put in for name and serial #. However, it seems to hang when plotting to a file… (help needed). For name and serial check. Search for: 6C00 000C 7003 3F00 A9C8 6000 Change to : 6000 Search for: 6700 000C 7003 3F00 A9C8 6000 FF56 Change to : 6000 For hardkey bypass Search for:6600 0008 3D6E 8002 801E 302E Change to :6016 4E71 This might work for the "program has been modified" Search for: 6700 0006 4EFA 0018 558F 3F2E Change to : 4E71 4E71 - Silverlining please (use on 2nd attempt) - SimCity †Typing when the cursor is in the toolbox: FUND: gets you an infusion of cash SimCity Change CODE 2+6E44 from: 2F2D C298 A915 2F2D C298 A91F to: 4E71 4E71 4E71 4E71 4E71 4E71 AND Change CODE 2+6F1E from: 4EBA 00AC 3D40 FFFE 4A6E FFFE to: 7001 426D D544 3D40 FFB6 6056 (Note: Maxis took out ALL CP in v1.4) - SIMCITY (B/W) CONCERNING SIMCITY (B/W), THE GENERAL CONSENSUS (I THINK) IS THAT YOU SHOULD UPGRADE TO SIMCITY V1.4 USING AN UPDATER RELEASED MY MAXIS AVAILABLE AT sumex-aim.stanford.edu (36.44.0.6). VERSION 1.4 DOES NOT HAVE COPY PROTECTION. - SimCity 2000 †The cheat is activated when you issue a bond. Simply issue a bond and then immediately repay the bond. You will now have added a kewl million bucks to your money plus the value of the bond. I could not be bothered to change the many routines involved to prevent money being subtracted when spent. There were simply too many. Launch resedit and... Code 4 ------ Address 3376 change 04B9 0000 2700 FFFF EFAC to 06B9 000F 4240 FFFF EFAC or SC 2000 ultimate cheat when in full zoom mode, type: porntipsguzzardo and you'll get $500,000 and all technologies enabled. - SimEarth †This patch to SimEarth 1.0 eliminates the annoying quiz at the beginning. This patch appears to work on both the color and black & white versions. The first patch disables the quiz for new planets, the second for loading existing planets. They simulate a successful call to the quiz procedure. CODE 11 offset $61C (newgame) change 4EAD 008A (color version) or 4EAD 00EA (B&W) to 4E71 7001 CODE 14 offset $D8 (loadgame) change 4EAD 008A (color version) or 4EAD 00EA (B&W) to 4E71 7001 or EFFECT: The password dialog will never show up HOW TO: CHANGE THE WORD AT OFFSET 127E IN CODE RESOURCE 2 TO 4E71 SIMEARTH V1.1 EFFECT: The password dialog will never show up HOW TO: LOCATE CODE RESOURCE 2 CHANGE THE WORD AT OFFSET 47E4 TO 4E71 CHANGE THE WORD AT OFFSET 47E6 TO 4E71 Typing when the cursor is in the toolbox: FUND :gets you an infusion of cash JOKE :displays a joke SMOO :smooths coastlines ERAD :eradicates all plants & animals life. SIMEARTH (v1.1) EFFECT: It doesn't ask for a word at start-up any more. HOW TO: Open CODE resource 2 at offset 0012DA, change word to $4E71 -•SIMEARTH (B&W) V1.0 EFFECT: The password dialog entry box and question never show up. HOW TO: Locate CODE resource #2 (number two) Change WORD at offset 127E from 6706 -> 4E71 - SitComm SCxxxxx SRxxxxx †Go to CODE 6 at Offset +BD2 change 6628 to 6028 - Sketch v1.0 SMKB8MMKZ6SM8EV - Sketcher v1.0 0400102LUA - SkyFox †Search for:2F104217205F4E90 Change to:203C99C455014E71 - Smooth Talker †1.0A Search for:124321FAFF56022E0C400000 Change to:000021FAFF56022E0C40FFB9 1.0B Search for:6608 45FA 0038 3012 Change to:4E71 45FA 0038 3012 Search for:6614 4267 3B7C Change to:4E71 4267 3B7C - Snoopy's Yearn to Learn 304E1342E †Serial Number info ~~~~~~~~~~~~~~~~~~ Before you run the program for the first time, make a copy of the virgin "YL Pref" file (in the System Folder [not the Preferences folder]). Then whenever you want to repersonalize, just drag a virgin copy into the System Folder. If you lose your virgin "YL Pref" file, you can make one yourself by creating a plain text file with a single ellipsis character (opt-;) [that's option semicolon] and set the file type to TEXT and the creator to ????. BTW, if you copy the YEARN 2 LEARN folder to another Mac and run it, it will say it caught you pirating. What you forgot to do was put a copy of the "YL Pref" file into the System Folder of the new Mac. The two serial numbers posted (304E2180E & 304E1342E) work fine. It seems that most any numbers plugged into the pattern ( ###E####E ) work. Example: 123E4567E doesn't work, but 444E4444E does. - SoftPC v2.5x C7SC707UT9T3 hbadc1s8pvv1 v3.0 751n51kd6c74 SN=UN-13042600/001 PW=v5vm51q8tud8 v3.1 Pro S/N - PR-24004178/OO1 Password - rtu0j1m3tgt3 SN=PR-24002279/001 PW=2encc1(L)d6jt3 (L) lowercase L - SoftPC Windows barb70t35710 v3.1 SN=WD-64000911/001 PW=17rn004urp00 - SoftAT v2.5 2ld0j1j1ssl7 wvu1e0335rv1 †Change 'CODE' ID 10 at: Offset: $0D80 From: $4EAD 0782 To: $4E71 4E71 Change 'CODE' ID 15 at: Offset: $1D82 From: $670C To: $4E71 Offset: $1D8E From: $6612 To: $6012 Offset: $19F8 From: $6610 To: $6010 Offset: $1AB2 From: $660E To: $600E To get the max speed out of SoftAT this is what to do: 1 run system 6.0x 2 don't use 32bit QD 3 put the monitor in 16 colour mode or B&W mode 4 give SoftAT as much memory as you can 5 put SoftAT and the HD file (at least) on a RAM disk 6 run under FINDER only, not Multifinder It sounds like a pain, but with "SystemSwitcher", it's easy. - SoftNode Pwd:3ubgr065j1w1 ikkt51borw1 S#: ND-39003394/001 - Songpainter †Search for:4EAD 00D2 101F 6712 Change to:4E71 4E71 101F 6012 - Sound Designer †v1.1 Search for:55083F3C0001A9 Change to:41783F3C0001A9 - Space Quest I †- SPACE QUEST I EFFECT: Press enter when asked program asks for original disk to avoid inserting original HOW TO: LOCATE CODE 8 FIND THE OFFSET 390 AND CHANGE THE NUMBER 66 TO 67 - Space Quest II 112929060100656 - Spaceways 2000 †Beta To play at higher levels: At CODE 6 +1E78 Change: 000A to: 002F Spaceway 2000 AKA - 'Spaceway 2000 Championship Edition' Sure the challenge of Spaceway is really fun, but there's something to be said about kicking the shit out of the other computer. So, here's a bunch of cheats that I made for 'stress relief'. i) *TURBO* patch Hint: go in low-gear, unless you are really psycho ii) Rapid Fire Fore and Aft Weapons Hint: if Fore is on, Aft will not work, because the bullet buffer is full! iii) Unlimited Fore/Aft Weapons iv) Unlimited Time v) Unlimted Shields vi) Choose your Fore/Aft Weapons * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Change CODE 5 This patches the turbo Offset: $20D6 From: $6EE8 To: $4E71 * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Change CODE 5 This patches Fore Rapid Fire Offset: $2AB2 From: $6712 To: $4E71 Offset: $2AF0 This patches Aft Rapid Fire From: $6712 To: $4E71 * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Change CODE 5 This patches the Unlimited Fore Weapons Offset: $2532 From: $536D CE88 To: $4E71 4E71 Offset: $253C From: $422D CB93 To: $4E71 4E71 Offset: $2630 From: $6700 00AA To: $4E71 4E71 Offset: $266E From: $536D CE88 To: $4E71 4E71 Offset: $35A6 From: $536D CE88 To: $4E71 4E71 * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Change CODE 5 This patches the Unlimited Aft Weapons Offset: $2736 From: $536D CE96 To: $4E71 4E71 Offset: $2782 From: $6700 01E0 To: $4E71 4E71 Offset: $27A8 From: $6F1E To: $4E71 Offset: $27BE From: $536D CE96 To: $4E71 4E71 Offset: $27D6 From: $601C To: $4E71 Offset: $2856 From: $6F00 010C To: $4E71 4E71 Offset: $289C From: $6F00 00C6 To: $4E71 4E71 Offset: $28B8 From: $6700 00AA To: $4E71 4E71 Offset: $28F6 From: $536D CE96 To: $4E71 4E71 Offset: $2956 From: $536D CE96 To: $4E71 4E71 Offset: $35AC From: $536D CE96 To: $4E71 4E71 * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Change CODE 5 This patches the Unlimited Time Offset: $20B4 From: $4EBA 20A2 To: $4E71 4E71 * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Change CODE 5 This patches the Unlimited Shields Offset: $309A From: $4E56 0000 To: $6000 008A * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Change CODE 5 This patches Choosing your Fore Weapon Offset: $247C From: $302D CE80 To: $4E71 700? * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Offset: $270A This patches choosing your Rear weapon From: $302D CE8E To: $4E71 700? NOTE: Replace the '?' with one of the following: 1 - Normal Gun 2 - Mines 3 - Smart Bombs 4 - Homing Mines 5 - Freeze the Enemies 6 - Super Speed NOTE: You must first put ANY weapon other than the standard weapon into it, then it will use the weapon you choose with ResEdit. Cracked by Nemo - Space Rogue †The codes are: Page 1:scout Page 7:have Page 8:when Page 9:seasoned Page 10:dock Page 12:shown Page 14:else Page 15:three Page 18:instance Page 19:deadly Page 20:shields Page 21:control Page 22:helm Page 24:gates Page 25:quickly Page 28:flashy Page 39:should Page 41:colonization or -•SPACE ROGUE 1.0 EFFECT: Can load old games w/o looking up words in manual. HOW TO: LOCATE CODE ID=3 FIND Offset Change to from 3D0A 6032 4EAD 3D3E 6064 6630 - Spectre vpre-1.0 XVL224U 8FL224V XME224W C8E224X Q7D224Y GDD224Z v1.0 LV8252W LV82HPQ LV836AJ LV83ADH LV83G43 LV83KT5 LV866AC LV86CYN LV86RMG LV87E8A LV87JB9 LV87PZT LV87TQV LV8AE84 LV8ALWE LV8AZK8 LV8BN62 LV8BS8Z LV8BXXK LV8C3NM LV8EN5U LV8EUU6 LV8F9GY LV8FW3S LV8G26R LV8G7VB LV8GBLD LV8JW3L LV8K4RW LV8KHEQ LV8L5ZJ LV8LA4H LV8LFT3 LV8LKJ5 LV8P5ZC LV8PCPN LV8PRCG LV8QDXA LV8QJ29 LV8QPQT ZC224R6 DMT24BV 8FL224V XME224W C8E224X Q7D224Y GDD224Z 9ET2FG2 v2.0d AVN2227 XPW23Z5. v2.0 LV82VNN LV83ABG LV83WWA LV842Z9 LV848PT LV84CEV LV86WW4 LV875LE LV87J98 LV886U2 LV88AWZ LV88GMK LV88LCM LV8B6TU LV8BDJ6 LV8BS6Y LV8CERS LV8CJUR LV8CQKB LV8CUAD LV8FERL LV8FMFW LV8G24Q LV8GNPJ LV8GSSH LV8GYH3 LV8H485 LV8KNPC LV8KVDN LV8LA2G LV8LWMA LV8M2Q9 LV8M8ET LV8MC5V LV8PWM4 LV8Q5BE LV8QHY8 LV8R6K2 LV8RAMZ LV8RGCK LV8RL3M LV8U6JU LV8UD96 LV8URVY LV8VEGS LV8VJKR LV8VQAB LV8VTZD LV8YEGL LV8YM6W LV8YZTQ LV8ZNEJ LV8ZSHH LV8ZY83 LV93YKU LV947A6 LV94KWY LV958HS LV95CLR LV95JBB LV95N2D LV988HL LV98F7W LV98TUQ LV99GFJ LV99LJH LV99S93 LV99VY5 LV9CGFC LV9CP5N LV9D3SG LV9DQDA LV9DUG9 LV9E26T LV9E5VV LV9GQD4 LV9GX3E LV9HBQ8 LV9HYB2 LV9J4DZ LV9JA4K LV9JDTM LV9LYAU LV9M6Z6 LV9MKMY LV9N88S LV9NCBR LV9NJ2B LV9NMRD LV9R88L LV9REWW LV9RTKQ LV9SG6J LV9SL9H LV9SRY3 LV9SVP5 LV9VG6C LV9VNUN LV9W3HG LV9WQ4A LV9WU79 LV9WZVT LV9X5LV LV9ZQ44 LV9ZWSE LVA2A7J LVA2EAH LVA2KZ3 LVA2PQ5 LVA5A7C LVA5GVN LVA5VJG LVA6J5A LVA6N89 LVA6TWT LVA6XMV LVA9J54 LVA9QTE LVAA5G8 LVAAS32 LVAAW5Z LVAB3UK LVAB7KM LVADS2U LVADYR6 LVAEDDY LVAEZYS LVAF63R LVAFBSB LVAFFHD LVAHZYL LVAJ8NW LVAJMBQ LVAK9WJ LVAKDZH LVAKKQ3 LVAKPF5 LVAN9WC LVANGLN LVANV9G LVAPHUA LVAPMX9 LVAPTMT LVAPXCV LVASHU4 LVASQJE LVAT578 LVATRS2 LVATVUZ LVAU3KK LVAU7AM LVAWRRU LVAWYG6 LVAXD4Y LVAXZPS LVAY5SR LVAYBHB LVAYF8D LVB2BV4 LVB2JKE LVB2X88 LVB3KT2 LVB3PVZ LVB3VLK LVB3ZBM LVB6KSU LVB6SH6 LVB775Y LVB7TQS LVB7XTR LVB85JB LVB899D LVBATQL LVBB2EW LVBBF3Q LVBC3NJ LVBC7RH LVBCDG3 LVBCH75 LVBF3NC LVBFACN LVBFNZG LVBGBLA LVBGFP9 LVBGMDT LVBGR4V LVBKBL4 LVBKJAE LVBKWX8 LVBLKJ2 LVBLPLZ LVBLVBK LVBLZ2M LVBPKHU LVBPS86 LVBQ6UY LVBQTFS LVBQXJR LVBR59B LVBR8YD LVBTTFL LVBU25W LVBUESQ LVBV3DJ LVBV7GH LVBVD73 LVBVGW5 LVBY3DC LVBYA3N LVBYNQG LVBZBBA LVBZFE9 LVBZM4T LVBZQTV LVC3MGL LVC3U6W LVC48TQ LVC4VEJ LVC4ZHH LVC5783 LVC5AX5 LVC7VEC LVC844N LVC8GRG LVC95CA LVC99F9 LVC9F5T LVC9JUV LVCC5C4 LVCCC2E LVCCQP8 LVCDDA2 LVCDHCZ LVCDP3K LVCDSSM LVCGD9U LVCGKY6 LVCGYLY LVCHM7S LVCHRAR LVCHWZB LVCJ2QD LVCLM7L LVCLTVW LVCM8JQ LVCMV5J LVCMZ8H LVCN6X3 LVCNAN5 LVCQV5C LVCR3TN LVCRGGG LVCS53A LVCS969 LVCSEUT LVCSJKV LVCV534 LVCVBRE LVCVQE8 LVCWCZ2 LVCWH3Z LVCWNSK LVCWSHM LVCZCYU LVCZKP6 LVCZYBY LVD2379 LVD28VT LVD2CLV LVD4X44 LVD55SE LVD5JF8 LVD6722 LVD6B4Z LVD6GTK LVD6LJM LVD96ZU LVD9DQ6 LVD9SCY LVDAEXS LVDAK2R LVDAQRB LVDAUGD LVDDEXL LVDDMMW LVDE2AQ LVDENVJ LVDESYH LVDEYP3 LVDF4E5 LVDHNVC LVDHVKN LVDJA8G LVDJWTA LVDK2W9 LVDK8LT LVDKCBV vSupreme (MacExpo) DMT24BV BVU247M FLH242T LNB24WB VDP257N ACR25MM XPW23Z5 45FGT67 45LKJ67 Supreme (release) LTS24QW ENF2BB5 V6GHC5S 23XHC5N ENF2BB5 CME2438 45fgt67 45lkj67 buu24m flh242t lnb24wb wdp257n acr25mm xpw23z5 LV8252W LV82HPQ LV836AJ LV83ADH LV83G43 LV83KT5 LV866AC LV86CYN LV86RMG LV87E8A LV87JB9 LV87PZT LV87TQV LV8AE84 LV8ALWE LV8AZK8 LV8BN62 LV8BS8Z LV8BXXK LV8C3NM LV8EN5U LV8EUU6 LV8F9GY LV8FW3S LV8G26R LV8G7VB LV8GBLD LV8JW3L LV8K4RW LV8KHEQ LV8L5ZJ LV8LA4H LV8LFT3 LV8LKJ5 LV8P5ZC LV8PCPN LV8PRCG LV8QDXA LV8QJ29 LV8QPQT ZC224R6 DMT24BV 8FL224V XME224W C8E224X Q7D224Y GDD224Z 9ET2FG2 LTS24QW 23XHC5N V6GHC5S ENF2BB5 CME2438 45FGT67 45LKJ67 ACR25MM FLH242T LNB24WB WDP257N XPW23Z5 vVR MB7565LD †Spectre 1.0 These are serial numbers for Spectre 1.0. To play multi player games, you need to have each copy registerred under a different serial number. Just copy your Spectre, delete the 'STR ' resource ID 997 in the copy using ResEdit (this erases the old serial number so you can reregister using a new one), and run the copy. When it asks you to register your copy, use one of these serial numbers. Use a different serial number for each copy. Extra Note: try typing GOD (or dog) when playing the game, at the option selection screen or in the demo. or To make anything a serial number: CODE 2+$19DE From: 660C To: 600C AND CODE 2+$19EE From: 67A4 To: 4E71 To really spice up the customizable tank: CODE 25+$2F8 From: 6744 To: 6044 This will allow you to have up to 127 for your 3 attributes. For a really fun game, try putting things in negative! ========== Spectre Supreme (MacWorld Special Edtn) NOTE: There is a bug in the way the program searches for the matrix file, so to launch the application, double click the matrix file. Perhaps this bug might be because it passes $910 to FS<something> instead of the correct low- memory global (maybe #920 (CurDirStore))? Your guess is as good as mine... To allow anything as a serial number... CODE 2+$2A26 From: 6614 To: 6014 AND CODE 2+$2A3E From: 6796 To: 4E71 The name and serial number are stored in the 'STR ' resource ID 997. To spice up the customizable tank Change CODE 23+$310 From: 6624 To: 4E71 AND CODE 23+$334 From: 6708 To: 6008 or Search the Spectre App for : 4eba fcf6 1e1f 1007 6614 1007 Change the Specter App to : 6014 Search the Spectre App for : 6797 42a7 4240 102e fefc 5840 Change the Spectre App to : 4e71 or try Patch to Fix Spectre Supreme 2.0b3 Search for: 6614 3F3C 2AFA 4EAD 07EA Change to: 6014 3F3C .... Search for: 6796 42A7 4240 102E FEFC Change to: 4E71 42A7 .... After these patches, you can enter ANY number or string as a serial number. To remove the serial number so that you can repersonalize it, just delete 'STR' 997, and run the program again. or try Copy the STR resource from the 1.1 developer version. Replace the STR in 2.0b3 with the one from 1.1. This will give you one serial number. For another serial number, delete the STR resouce in 1.1d, load it up and enter any serial number. Repeat the process to get a copy of 2.0b3 with a different serial number. or try These are serial numbers for Spectre 2.0. To play multi player games, you need to have each copy registerred under a different serial number. Just copy your Spectre, delete the 'STR ' resource ID 997 in the copy useing ResEdit, and run the copy. When it asks you to register your copy, use one of these serial numbers. Use a different serial number for each copy. Extra Note: try typing GOD (or dog) when playing the game, at the option selection screen or in the demo. ========== Spectre Supreme (release) Sometimes, but not always, you can re-personalize a copy of Spectre or Spectre Supreme without knowing a valid serial number. If you open the personalization resource with ResEdit (#995 or #997), all the personalization info will be there. Delete everything from inside the resource, but not the resource itself. Then type in a random hexidecimal number and save. Then for each copy you wish to make, type in another, different random hex number. What I think happens is this: Spectre first checks to see if there is the personalization resource (#997). If there is no STR# 997 then it will bring up the serial # dialog box. But since there is (you didn't delete it, 'member?) it continues. Then it checks the net for copies with the same SN, and supposedly all your copies will have different ones. For some reason, at random times, a dialog has come up saying that the same SN is on the net when, for the life of me, I can't find it. I'm still trying to figure out why this be. Spectre VR network If you really, really, really want to play Spectre VR over a network but still haven't found any more SNs floating around, do the following hex patch. This will make Spectre take any Name and SN as valid. Only problem is that it will ask you for this every time you load it up. So just make sure that the random crap you type in is nothe same on different machines. CODE 2 OFFSET 359A 6614 3F3C 2AFA 4EAD 096A 3F3C to 6714 and CODE 2 OFFSET 35B2 679C 102D 842D 4880 122D 842D to 669C These offsets should be right, but if not the target code is right next to it. or: To play Spectre VR without a SN: Search for: 4EAD 03BA 101F 6606 4EAD 097A A9F4 4267 Change to : 4E71 4E71 6706 or - SPECTRE/SPECTRE SUPREME Here are some patches for Spectre. One of the password patches worked on Spectre Supreme (noted below). Patches are arranged in: resource # : module : module offset (resource offset) The "module" is that as named under the "Module" menu in ResEdit 2.1.1 using Code Editor 2.9 . They may differ on other versions. Both ResEdit and the Code Editor are available via anonymous ftp to ftp.apple.com in the directory /dts/mac/tools/resedit . I highly recommend both of them. (IF YOU DO NOT HAVE CODE EDITOR THEN USE THE RESOURCE OFFSET RATHER THAN MODULE OFFSET .....AC) First the original code is listed, including the assembly command just before and after the one(s) to be changed. The numbers to be changed are just above the character "|". The first number to be changed corresponds exactly to the offset number. When installing patches, you should ALWAYS verify that the original code is exactly the same as what's listed as "original". If not, you might patch the wrong location, which would have an unknown effect on the patched application. EFFECT: Bypass the initial password (a number of ways). (i) and (ii) still allow for entry / display of a password and username. (iii) COMPLETELY bypasses the initial password dialog: Spectre will always have a NULL password and username using (iii). If you want a personalized version, you MUST use (i) or (ii). (i) do BOTH (a) and (b): (a) CODE 2 : "Anon42" : offset 00C2 (resource offset 19DE) original: 1007 660C 3F3C 000A changed: 1007 600C 3F3C 000A and (b) Code 2 : "Anon42" : offset 00D2 (resource offset 19EE) original: 1007 67A4 42A7 4240 changed: 1007 4E71 42A7 4240 The patch IMMEDIATELY following will work with SPECTRE SUPREME (Thanks Cj!) (ii) CODE 2 : " 2345678" : offset 0018 (resource offset 16EC) original: 51C8 FFFC 422E 0010 206E 0008 changed: 51C8 FFFC 50EE 0010 206E 0008 (iii) CODE 3 : "Anon6" : offset 0048 (resource offset 06AC) original: A851 4267 486E FFF7 4EAD 02D2 101F changed: A851 50E7 426E FFF7 4E71 4E71 101F EFFECT: Bypass the NET password: (i) Startup NET password check: Code 3 : "Anon5" : offset 0016 (resource offset 0552) original: B06D FECC 660A 1D7C 0001 0008 changed: B06D FECC 4E71 1D7C 0001 0008 (ii) NET-play password check: Code 18 : "Anon14" : offset 000C (resource offset 0692) original: 266E 000C 422E 0010 203C 0FFF FFFF changed: 266E 000C 50EE 0010 203C 0FFF FFFF MORE SPECTRE PATCHES ******************** EFFECT: I assume it bypasses the copy protection HOW TO: Open open the CODE resource, then open CODE ID 3. At offset 000550 you will see the line F6DE 660A 1D7C 0001 You should change this to |||| F6DE 4E71 1D7C 0001 Then, open CODE ID 14. At offset 000688 you will see the line 000C 422E 0010 203C You should change this to |||| 000C 50EE 0010 203C EVEN MORE SPECTRE/SPECTRE SUPREME PATCHES ***************************************** Here are patches for Spectre 1.0 and Spectre Supreme 2.0.2: Registration is kept in STR resource 997. Spectre v1.0 =========== To disable registration serial number verification: CODE resource 2 (Anon 42): Offset (from beginning of CODE resource) $19DE: 660C -> 600C Offset (from beginning of CODE resource) $19EE: 67A4 -> 4E71 To disable limits on custom spectres: CODE resource 25 (Anon 7): Offset (from beginning of CODE resource) $310: 6624 -> 4E71 Offset (from beginning of CODE resource) $334: 6708 -> 6008 To disable net checking of serial numbers: CODE resource 3 (Anon5): Offset (from beginning of CODE resource) $552: 660A -> 4E71 CODE resource 18 (Anon 14): Offset (from beginning of CODE resource) $692: 422E -> 50EE Spectre Supreme v2.0.2 ===================== To disable registration serial number verification: CODE resource 2 (Anon 53): Offset (from beginning of CODE resource) $2C1E: 6614 -> 6014 Offset (from beginning of CODE resource) $2C36: 679C -> 4E71 To disable limits on custom Spectres: CODE resource 23 (Anon 7): Offset (from beginning of CODE resource) $310: 6624 -> 4E71 Offset (from beginning of CODE resource) $334: 6708 -> 6008 To disable net checking of serial numbers: CODE resource 3 (Anon5): Offset (from beginning of CODE resource) $552: 660A -> 4E71 CODE resource 14 (Anon 14): Offset (from beginning of CODE resource) $68A: 422E -> 50EE - SPECTRE VR 1.0.1 EFFECT: Removes the duplicate serial number checking on a network. HOW TO: CODE 0003 +05E2: 660E -> 600C CODE 0003 +05F0: 6772 -> 6072 CODE 0005 +0708: 6610 -> 6010 - Speedbeep v2.0.6 PRETZEL †To register Speed Beep, Cmd-Opt-Shf-Click on Title and "RoNertL" - SpeedReader II †Search for:670260504EBA Change to:4E7160504EBA - Speed up Finder 4.1 †Search:6100 B754 42AF 3F Change:4E71 B754 42AF 3F Speed up Finder 4.1 Open Finder with the Open File command in FEdit, then find these hex strings and change to 4E71's (NOP's). If they're not at these exact locations, just do a hex search for the strings. Sector:13 Pos:308 Look for:486E FFF8 A8A1 486E FFE0 A8A1 Change all to:4E71 Sector:13 Pos:380 Look for:486E FFE0 A8A1 486E FFE8 A8A1 486E FFE0 A8A1 Change all to:4E71 This stops the FrameRects (Zooming effect) from happening when you open or close a window from the Desktop, kinda weird, why do this? I don't know! - SpeedyCD v1.2.4 02F614C99EB36FD8 †SpeedyCD 1.1.1 (Single Test Crack) cdev #1 +3C66 6616->6016 (Think it’s Registered/use invalid serial #) +2798 670C->600C To Register with anything for a serial number +272B 6604->4E71 +27CC 6706->6006 - Spiral 000000 (six zeros) - Spirit of Excalibur †Color EFFECT: The password dialog will never show up HOW TO: CHANGE THE BYTE AT OFFSET 1830 IN CODE RESOURCE 1 TO 60 - Spreadbase v1.0 OSI-1-F-001-00105-100 v1.01 OSI-1-F-002-00105-100 (That’s osi at start) - SPSS 510456 - Star Fleet †To avoid Star Fleet a certain word on a certain line on a certain page. Open Resedit, load the Star Fleet disk, Open "Star Fleet I". Then open "STR#" then open "STR ID=10000". Then delete all of the text in all of the strings. Save the changes and then quit. When you get to the security screen, just hit continue. - Star League Baseball †Search for:7CA835C80D5C Change to:7BA835C80D5C Search for:88A2E158DD9D Change to:E9647CFC9CF6 - Stella †v1.2 Search for:24A03F3C0001A9 Change to:07443F3C0001A9 - StrataStudio Pro A156241377081 - Stratego †v1.1.1 change CODE 10+$1628 from $4EAD 0672 to $4E71 7001 to get rid of the codes. - Streamline v3.0 SAW300R3113443-487 SAW300R3100127-190 - Studio 1 4682119240 - Studio 8 v2.0 9248372456 †Crack In ResEdit open code ID 3. At offset $011A change $671A to $601A. Any 10 digit password will now work - Studio 32 3006003068 - Studio Session †This crack works for both the Player and the Editor. Use a sector editor to change the following. Search for:CD08 CD66 FD5A Change to:CA08 CA66 FD5A - StuffIt Deluxe v2.0x A 09000 A 09000 A 12345 A xxxxx (x=any digit) v3.0x Bxxxxx (The 1st num can NOT be a zero) †v3.0 beta Use any disk editor. Search for: 1107 02FF D663 0ED4 Replace with: D660 Eliminates the expiration date. v3.0x To change the registration info, edit the data fork of StuffIt Deluxe. The serial number is a 4 byte hex value at offset $144. If you want to find out what serial number you used, take the negative if it was a 'B' serial number and subtract 50000 from it. Your name follows the serial number with a preceding length byte. You can just change the serial number bytes to 0, run the program and reregister. KRAK magic menu Stuffit Engine Patch Here's a nifty patch I made to "fix" the Stuffit Engine so that it no longer asks "this archive is corrupted, do you wish to continue working with it?" whenever I use the Magic Menu "Expand" command to expand old archives. (Interstingly enough in this dialog, yes means yes and no also means yes.) If you don't know what I'm talking about then you don't need this patch. However, if you find yourself in situations unpacking multiple archives from the MagicMenu, and have cursed Stuffit's stupidity in refusing to recognize its own older archives, then use this patch. Hex search for 66 1C 20 6C 78 F8 0C A8 72 4C 61 75 Hex change 66 1C to 4E 71 Hex search for 66 0E 20 6C 78 F8 20 2C 79 18 B0 A8 Hex change 66 0E to 4E 71 Hex search for 67 24 2F 2C 78 F8 42 A7 42 A7 42 A7 A9 8B Hex change 67 to 60 - StuffIt Installer Maker I347000001 I347000002 I347000003 - StuffIt Lite v3.0x L297000000 L347000001 L397000002 L447000003 L497000004 L547000005 L597000006 L647000007 L697000008 L747000009 L267000010 L317000011 L367000012 L417000013 L467000014 L517000015 L567000016 L617000017 L667000018 L717000019 L237000020 L287000021 L337000022 L387000023 L437000024 L487000025 L537000026 L587000027 L637000028 L687000029 L207000030 L257000031 L307000032 L357000033 L407000034 L457000035 L507000036 L557000037 L607000038 L657000039 L177000040 L227000041 L277000042 L327000043 L377000044 L427000045 L477000046 L527000047 L577000048 L627000049 L147000050 L197000051 L247000052 L297000053 L347000054 L397000055 L447000056 L497000057 L547000058 L597000059 - StuntCopter MUHAHA - S.U.M. II D952906J - SuperATM v3.5-3.6 GHB100R3100136-472 GHW100R3106316-197 - SuperDisk †On message, open Control Panel, Touch: Alerts, Security, More Options, Memory - SuperLaserSpool 042401 - Super Maze Wars †- SUPER MAZE WARS EFFECT: When you start up, it will no longer ask for a registration number. In the About window, you can enter any registration number in the format:xxx-xxx-xxxx This allows you to have unique identities on the network. HOW TO: CODE 5 + $472A : Change $3007 -> $7000 CODE 5 + $47D4 : Change $1E00 -> $7EFF - SuperOffice v2.0 For the release 102600776 102600768 For the Upgrade 1026001535 1026001527 1026001451 - SuperPaint †v3.0 Name, Organization, and Serial Number info for SuperPaint 3.0 When the Aldus Installer installs SuperPaint 3.0, it will install an Application with only one 'PLoc' Resource, which is a location of the preferences file (ID 0). It also creates an invisible file called 'SomeFile', type 'rsrc'/creator 'RSED' containing only one resource - 'PLoc' ID 1. The format of this resource is similar to that of an owner resource - 1 byte indicating the length, then the data of that length. This would contain your serial number (i.e 'US 30-300....'), not encrypted. When you run SuperPaint for the first time, it expects that file to be in the same directory as the application, otherwise it says 'Personalization Failed.....'. If that file is there, is will ask you for your name and organization, and display your serial number. Then, it will add resource PLoc ID 1 to the Application with your Name, Organization, and Serial Number stored as consecutive encrypted strings. Since strings are 256 bytes, 256 * 3 = 768 bytes = Size of the resource. The application never checks this resource, so you can screw with it to your hearts content, as long as it stays the same size. As for the format of the resource, I played with it and came up with this: The first and second bytes are intact (the length, and the first character of the string). The rest of the string seems to conform to this format: First Nibble of the byte: 0 1 2 3 4 5 6 7 8 9 A B C D E F becomes (BitXor $2) 2 3 0 1 6 7 4 5 A B 8 9 E F C D Second Nibble of the byte: 0 1 2 3 4 5 6 7 8 9 A B C D E F becomes (BitXor $A) A B 8 9 E F C D 2 3 0 1 6 7 4 5 E.G. $41 (Hex)/'A' (Char)/65 (Dec.) would become (BitXor 2A) $6B (Hex)/'k' (Char)/107 (Dec). Look for an application to convert this for you! Hint: To depersonalize SuperPaint just delete PLoc ID 1, Open ResEdit, Create a New File, add resource type 'PLoc', create a new resource, type in anything as a serial number, get the length, convert it to hex, then insert that as the first character. Run SuperPaint, and it should ask you for you name/org with that serial number! - Super Tetris †Color: Patch App by first verifiying that CODE 6+$2B0 is $D9A4. If this is the case, it is changed to $D7A0. - System 7 Pack v3.4.1 summer v3.2 817GRGN5JKFH78H -- Registers APP-DOC linker portion CC5187EFH28B911AF - Registers Finder 7 Portion If you register the APP-DOC linker portion first then you can also register the Finder 7 Portion. †v3.3 Code 1 +6800 670A -> 4E71 Code 1 +6840 6738 -> 4E71 Here are a couple of serial numbers for System 7 Pack: 817GRGN5JKFH78H - Registers APP-DOC linker portion CC5187EFH28B911AF - Registers Finder 7 Portion If you register the APP-DOC lionker portion first then you can also register the Finder 7 Portion... - Taskmaker v2.0 †Taskmaker 2.0 Code #2 +5B58 6706 -> 6042 Code #7 +1D82 4294 4293 286E -> 24BC LongWord 1 +1D88 FFF8 486E FFFC -> 28BC LongWord 2 +1D8E 2F0A 2F3C 434F -> 26BC LongWord 3 +1D94 4445 4EBA -> 6000 00F4 where LongWord i = Longword at CCHK #1000 +(4*(i-1)) ==================================================== Ex if your CCHK#1000 resource is +00 EF965EB1 +04 00023800 +08 00000008 Then you would do Code #7 +1D82 4294 4293 286E -> 24BC EF96 5EB1 +1D88 FFF8 486E FFFC -> 28BC 0002 3800 +1D8E 2F0A 2F3C 434F -> 26BC 0000 0008 +1D94 4445 4EBA -> 6000 00F4 ==================================================== info about the crack: when i first tried to crack TM 2.0 I had endless problems since every time I actually changed some code or left breakpoints set in the debugger it would freeze-up. It was about this time that I realized it was checksumming (in some way) it's executable resources and checking them (periodically perhaps), so based on this thinking I then found where it was using (checking) the (mysteriously - very sore thumb) CCHK resource. At first I just made this return a good result (and still leave the bad calcuated values intact), but this caused a read/version error (i would later find out that this was when it was loading & de-encrypting the WRMS resource). Next I tried tracing thru this routine with my changes made (by using pc=pc+xxx to change the execuation while leaving my patches in so they could be checksummed) and recording the checksum values the code calculated - I then quite, replaced the values in the CCHK resource with these values - however to my amazement it still gave the read error - I went so far as to try this approach with only the code #2 (registration crack) patch installed and the modified date set to the original modified date and new prefs - it still errored out. Now I realize that the asshole must have actually encrypted some other resources with the cheksum values as a key (I can't believe he has gone to this much trouble) - so then I realize (using Macnosy to analyze the structure of the app calling chain) the only real solution is to make the checksumming routine produce the values in the CCHK resource, so that the encrypted resources will decompress correctly. Now the patch simply puts the correct values into the checksum (global variables #581-583 when in macnosy) variables and returns - it does not even waste time doing the actual checksumming! - in fact this leaves a few hundred bytes free after the end of the CODE #7 patch if anyone wants to write some cheat code or what not here. As a result of all this yu can now modify the code type resources at will - so if someone actually wants to hunt down the part where it initializes your registration status feel free.... ============================================================================ Invokable Phrases Dark Glasses - hidden options menu Eggs - useless Pronto - materialize temporary keyshop with price 200cp a key Faux Pas - materialize temporary magic shop heal - trade 1/2 your food for health at a 1:1 exchange monster - generate a monster somewhere refresh - redraw the screen who - meaningless go bulls - strenght & agility from stamina info - info about place your in - meaningless memory - see the intro again - meaningless gamble - the best command so far - win or lose a percentage of your gold psycheup - spirit and int from ??? or - TASK MAKER 2.0 (complete) EFFECT: Bypass Copy Protection WILL ALSO: - remove virus checker - modify to put up 'Master' menu (you normally get as a reward for finishing, all the time. Remove Copy Protection: CODE 2 @5F00 : 6620 -> 602C CODE 3 @565A : 426D D0F0 -> 6100 259A CODE 3 @581C : 426D D0F0 -> 4E71 4E71 CODE 3 @6C66 : 2F2D FF6E -> 6000 0F84 CODE 3 @7BEC : .... .... 2F3C EF96 [] This is added to the END of 5EB1 6000 F076 3B7C [] CODE 3, do not modify any 0001 D0F0 4E75 [] existing data while adding this. CODE 7 @1CB6 : 660A -> 600A Show 'Master' Menu: CODE 2 @0B3E : 6710 -> 4E71 - Tekalite †Search for:670001DC486EFC92 Change to:600001DC486EFC92 - TeleMagic M27964 vMU 10 Logon: Mac Pasword: Master - Teleport Fax KZW3 - Temple of Apsai †Search for:40C346FC2700205F Change to:4E7546FC2700205F Search for:CE353F359647 Change to:E6448C3E9647 Search for:779D2ABD0651 Change to:709D2ABD0651 Search for:1F137229B20C Change to:7ED5EFC06EE0 - Theorist v1.1x T-100-001351 T-110-001351 v1.11 T-111-003367 T-110-001351 v1.51 010626 †Version 1.51 Open CODE 4 in ResEdit Change it at offset $2BEE From: $670C To: $600C - Think Pascal 050000 65500 01064 66514 - Think Tank †Think Tank 128 Find:6608 3D6E FDAC 000C 6004 3D47 000C Change to:4E71… Find:670C 487A 01A6 4EBA DBA4 6000 0188 Change to:60… Think Tank 512 Search for:A002 6002 A402 Change to :4E71 """" """" Search for:674E 486D E184 Change to :60"" """" """" ThinkTank 512 1.0 Search for:A002 6002 A402 Change to:4E71 6002 A402 Search for:674E 486D E184 Change to:604E 486D E184 ThinkTank 512 1.1 Search for:6718 2F0E 4EBA FDDE Change to:6018 2F0E 4EBA FDDE - Thunder7 †v1.52 updater The Thunder7 1.52 updater expects you to update an uninstalled copy of Thunder7 1.51? Apply this patch and you can update your currently installed version: Hex search for: 670E 206D FDCA 2050 0070 Hex change: 670E to 4E71 - Tiles v1.0 100369 - Timbuktu v3.1 050018163839 050174884776 050243058119 050252496808 050299701200 050420220047 050470581085 050538983926 050567356715 050579697881 050594487420 050762732586 050813441353 050900000811 050971260731 052103887941 054518991799 060936195911 067591117475 067358023312 067174563045 067597854241 067598447877 067393760509 067086572435 067488972118 067295045299 067288614997 067586461043 194348358889 194349765253 194350935223 194351125878 194352881122 194353792211 194354250737 194355028487 194356685831 194357496910 194358884475 194359352810 194360472202 194361920335 194362198898 v4.0.x 051-068-845-152 051-097-722-701 052-894-620-727 067-086-572-435 067-288-614-997 067-295-045-299 067-393-760-509 067-488-972-118 067-586-461-043 067-598-447-877 191-560-555-335 191-561-674-837 228-610-931-242 228-611-484-200 228-612-364-808 228-613-166-253 228-614-408-908 228-615-466-223 228-616-330-503 228-617-131-139 228-618-474-703 228-619-662-715 228-620-096-279 228-621-706-815 228-622-895-726 228-623-240-291 228-624-950-827 228-625-903-106 228-626-093-017 228-627-335-582 228-629-767-845 228-631-150-533 228-632-583-288 228-633-083-420 228-634-534-479 228-635-346-015 228-636-966-551 228-637-769-196 228-638-231-146 228-639-931-501 229-000-127-282 229-001-457-825 229-002-438-242 229-003-880-907 229-004-582-342 229-005-753-126 229-006-534-533 229-007-067-298 229-008-777-743 229-009-866-745 229-010-221-210 229-011-921-846 229-012-365-310 229-013-454-211 229-014-307-500 229-015-108-136 229-016-320-296 229-017-420-107 229-018-121-552 229-019-564-207 229-020-752-128 229-021-085-792 229-022-207-942 229-023-769-507 229-024-859-418 229-026-993-519 229-027-973-127 229-028-425-186 229-029-137-531 229-090-452-045 229-091-903-922 229-092-704-458 229-093-925-518 229-094-996-125 229-095-448-093 229-096-161-529 229-097-593-193 229-098-094-416 229-099-903-355 229-100-256-920 229-101-237-428 229-102-789-001 229-103-491-931 229-104-932-597 229-105-922-105 229-106-266-759 229-107-785-232 229-108-666-840 229-109-867-999 229-110-581-425 229-111-142-303 229-112-022-911 229-113-465-556 229-114-266-011 229-115-407-846 229-116-208-201 229-117-929-837 229-118-363-302 229-119-452-213 229-210-120-551 229-211-911-197 229-212-264-751 229-213-055-297 229-214-895-227 229-215-497-762 229-216-200-208 229-217-308-447 229-218-020-903 229-219-463-548 229-220-264-003 229-221-095-033 229-222-785-579 229-223-150-225 229-224-030-742 229-225-440-396 229-226-892-960 229-227-584-496 229-228-226-033 229-229-026-982 229-230-478-527 229-231-460-135 229-232-770-113 229-233-092-857 229-234-892-212 229-235-325-930 229-236-116-476 229-237-776-343 229-238-657-951 229-239-001-506 229-300-745-547 229-301-956-807 229-302-578-333 229-303-271-979 229-304-841-938 229-305-822-446 229-306-414-991 229-307-966-546 229-308-866-495 229-309-876-240 229-310-470-876 229-311-931-341 229-312-022-252 229-313-364-907 229-314-165-352 229-315-856-998 229-316-696-928 229-317-300-363 229-318-262-743 229-319-243-251 229-320-893-219 229-321-495-845 229-322-947-320 229-323-827-928 229-324-739-876 229-325-282-083 229-325-950-926 229-326-441-148 229-327-883-722 229-328-793-561 229-329-147-217 229-330-027-825 229-331-461-389 229-332-381-228 229-333-261-836 229-334-703-310 229-335-924-561 229-336-477-519 229-337-457-127 229-338-809-700 229-339-502-227 229-340-931-700 229-341-902-207 229-342-603-752 229-343-567-022 229-344-655-943 229-345-088-598 229-346-800-043 229-347-143-799 229-348-243-510 229-349-774-275 229-350-386-710 229-351-476-521 229-352-338-901 229-353-141-437 229-354-583-001 229-355-441-407 229-356-973-081 229-357-585-507 229-358-207-143 229-359-117-093 288-628-147-118 288-630-570-593 †Timbuktu 4.01 This patch works by changing the "check serial number" routine, to always accept the entered serial number as valid. Timbuktu checks the serial number in two places: (1) at startup in the INIT, and (2) in the DA when it is opened. Therefore, there are two patches: Rsrc ID Patch New Code INIT -15999 4E56 FFE6 48E7 1100 206E 205F 584F 1EBC 0001 4ED0 oTB2 1000 " " The INIT resource is in the Timbuktu startup document (naturally), but the oTB2 resource is in the Timbuktu Desk Accessory. In the version I had (4.0.1), which is posted on this board, the offsets for the patches in the resources were: Rsrc Offset to patch INIT $2E12 oTB2 $2BC0 Just make sure you don't enter the same serial number twice on the same network. The format for the Timbuktu 4.0.1 serial numbers is: ###-###-###-### - Timbuktu Pro v2.0 509-464-736-249 509-465-548-328 - Timbuktu Remote 09270295376 0177671543 2255000010 3120741165 4140343176 4215201110 5179990010 5147206610 8153781543 910216537 3120741165 4140343176 4293156232 8153781543 9102165376 - Time Slips III 1230 702060 80718162 - TimesTwo v1.0 22U3U1/65U6581 †Remember, T2 has killed peoples hard drives, ESPECIALLY boot drives. Non-boot drives seem to fare better. Go figure. - Tom Landry’s Strategy Football †v1.02 CODE 36 "Section37" Offset Original Cracked ------ --------- --------- 288 6600 00A2 601C 4E71 3C2 6604 4E71 or Change CODE 7+$45C From: $661C To: $4E71 Change CODE 7+$468 From: $6708 To: $4E71 or - TOM LANDRY STRATEGY FOOTBALL EFFECT: The protection will accept any code. HOW TO: CODE ID 36, offset 03C2: change 6604 -> 4E71 - TOPS v2.1 0247718M21 - Touchbase Pro TB6I14233S2KE1CS buvc0z9s8h1n7dab - Translator 100409599990 - Transylvania †Make all files visble using Set File or some such program. Copy all files except track2.text and track3.text onto another disk. Transylvania has the annoying habit of ejecting the disk and rebooting when you quit the program. You can cure this by doing the following: Use FEdit to look at Block#25 and change bytes 423 and 424 from A0 17 to ADF4. A017 is the OS Trap 'Eject' and ADF4 is the OS Trap 'ExitToShell' This will force the program to return to the Finder instead of ejecting and rebooting. - Triple Play †v1.0 The Back Gammon is the only program that is protected, The Serial # is on the modified block, so this crack kills the serial # also. change : 6720 487A 00C0 to : 66"" """" """" - Tristan 11300017816 †To patch Tristan™ 1.03 so you don't need to type in the codes, change CODE 5 + $7BE from A850 3F3C to 6000 0120. This should work for both the LC and the 13" version. or try EFFECT: The password dialog will never show up HOW TO: LOCATE CODE RESOURCE 2 CHANGE THE WORD AT OFFSET 281A FROM 4EAD TO 4E71 CHANGE THE WORD AT OFFSET 281C FROM 0262 TO 4E71 TRISTAN V1.0 EFFECT: The password dialog will never show up HOW TO: CHANGE THE WORD AT OFFSET 198E IN CODE RESOURCE 2 TO 4E75 TRISTAN V1.0.2 EFFECT: The password dialog will never show up HOW TO: LOCATE CODE RESOURCE 2 CHANGE THE TWO WORDS AT OFFSET 37AC TO 4E71 4E71 or - TRISTAN V1.0.3/LC EFFECT: The password dialog will never show up HOW TO: LOCATE CODE RESOURCE 2 CHANGE THE WORD AT OFFSET 281A FROM 4EAD TO 4E71 CHANGE THE WORD AT OFFSET 281C FROM 0262 TO 4E71 - Trivia Arcade †Search for:6604 302E Change TO:67… Search for:6756 3F3C Change TO:66… 2nd Crack SEARCH:A002 4EBA 0052 4A40 6604 REPLACE:A002 4EBA 0052 4E71 4E71 SEARCH:0C5F 24D3 6756 REPLACE:0C5F 24D3 6056 - Trivia Fever †Search for:0C4001A6 Change to:4E7501A6 - True Forms v2.0 TC2009001554 TDA2008000217 - Turbo Turtle †Search for 660845FA003A Change to:660845FA003A Search for 66103F3C0000 Change to:4E713F3C0000 - Typestry 1900582261 v1.1 1379000784 3478905948 - Typing Intrigue †Search for 672A 4267 486E Change to:4E71 4E71 486E - Ultima ][ †Crack Search: 6608 44FA 003C Replace 6608 with: 4E71 Search: 6616 4267 6016 Replace 6616 with: 4E71 You can then unprotect all the files, throw away "ForMaster", and have a finder-copyable version. or try Search for:660000083D7C0001FFEA Change to:4E714E713D7C0001FFEA Ultima ][ Cheats How to give yourself all the weapons, armor, All 99 abilities, 9999 HP and food: Boot up Mac Tools and open the Player File on the Ultima disk. Change this on the file: (XXXX= DON'T CHANGE) 0010: XXXX XXXX XXXX XXXX XXXX XXXX XXXX 0063 0020: 0063 0063 0063 0063 0062 270F 270F 270F THOSE ARE THE ABILITIES… STRENGTH, AGILITY, STANIMA, CHARISMA, WISDOM AND INTELLIGENCE. YOU CAN CHANGE THE NUMBER TO ANYTHING UP TO $63 BECAUSE THAT IS THE MAXIMUM, 99 DECIMAL. THE NEXT THREE SETS OF NUMBERS AND LETTERS ARE HIT POINTS, PROVISIONS, EXPERIENCE, GOLD PIECES. $270F (9999 DEC) IS THE MAXIMUM. THIS LINE IS FOR GIVING YOUR CHARACTER SPELLS, WEATHER YOUR THIEF OR MAGIC USER: 0050: 0063 0063 0063 0063 0063 0063 0063 0063 | | | ---------- SPELLS ------------ CLOTH ARMOR AT THE END OF THE LINE THERE IS CLOTH ARMOR. YOUR CHARACTER WILL HAVE THAT AND ALL THE ARMOR ON THIS LINE: 0060: 0063 0063 0063 0063 0063 0063 0063 0063 | | | --------- MORE ARMOR --------- DAGGER 0070: 0063 0063 0063 0063 0063 0063 0063 0063 | | | | | | | | MACE AXE BOW SWORD GREAT | PHASER QUICK SWORD | SWORD LIGHT SWORD THE NEXT FEW LINES YOU CAN TYPE ANY NUMBER BETWEEN 0000 (DON'T HAVE IT) TO 270F (9999 OF THE ITEM). THESE ARE WORDLY POSSESSIONS: 0090: 0063 0063 0063 0063 0063 0063 0063 0063 00A0: 0063 0063 0063 0063 0063 0063 0063 0063 THE ITEMS ARE:[RINGS, WANDS, STAFFS, BOOTS, CLOAKS, HELMS, GEMS, ANKHS, RED GEMS, SKULL KEYS, GREEN GEMS, BUTTONS, TASSLES, COINS, IDOLS, TRILITHIUMS] Ultima /// crack FIND:0A00 0001 1B40 FB19 CHANGE TO:4E71 7000 1B40 FB19 You can then unprotect all the files, throw away "ForMaster", and have a finder-copyable version. or try Search for:0A0000011B40FB19 Change to:4E7170001B40FB19 - UltraPaint v1.x 51736 88613 v1.0.3 19369 51736 - Uninvited †Search for:00320C4000316748 Change to:00320C4000316048 Search for:0C40FFFA56C04A006720 Change to:0C40FFFA56C04A006020 Search for:52404A4057C04A00660C Change to:52404A4057C04A00600C Search for:0C40001D57C04A006616 Change to:0C40001D57C04A006016 Search for:0C40004756C04A00671E Change to:0C40004756C04A00601E Search for:0C40000956C04A006722 Change to:0C40000956C04A006022 Search for:00410C4000406708 Change to:00410C4000406008 - Unlimited Adventures †- UNLIMITED ADVENTURES EFFECT: Removes the copy protection HOW TO: LOCATE resource code 12: code 12 offset 4510: replace the 4ead 0332 with 4e71 4e71 code 12 offset 4540: replace the 6604 with 6004 code 12 offset 4568: replace the 6708 with 4e71 to be able to type any word to get into the game: CODE 12 offset 4544: change 4A00 to 7001 CODE 12 offset 4568: change 4A00 to 7001 - UP Utilities 0002190715 - Updiff v1.0 309438180 †UpDiff 1.0 : Allows anything for Serial number CODE #2 +26A 67->60 --- SN: 309438180 Credit:Dr. Debug - UserLand Frontier ULF.13106.100 - Utopia †Search for:A00F201FDFFC00000032 Change to:6000F4FC… or try Search for:3CBA000C4EBA Change to:4E714E714EBA - Vegas Poker: †Open 'code' #1 with Resedit. At offset $273E CHANGE FROM 66 TO 60 - Verificateur †v1.8 Search for:67162F0E4EBAFF96 Change to:60162F0E4EBAFF96 - VersaTerm Pro v5.0 12345 Any number from 100 to 9999999 - Vette! †This contains all the codes, keys, and some patches for VETTE! Entering the codes: If you enter the wrong code on your second chance, the game will let you play for a couple times until it says "Sorry, you've been caught driving a stolen vette!" and quit on you. You also only have a limited amount of commands to use. eg you can't shift passed 2nd gear or get back to car view from the helicopter. You can patch the game so you don't have to enter the codes. For the Black and white Vette! change the byte in CODE 1 "Main" at offset $242 from $66 to $60. For ColorVette! do the samething with offset $602 instead. These are the commands that I could find: view inside car: cmd-1: left cmd-2: forward cmd-3: right cmd-4: helicopter view cmd-opt-4: reset controls viewing extras cmd-5 :show/hide dash cmd-6 :show/hide mirror B :show/hide buildings G :show/hide gears H :show/hide heading map D :show/hide damage W :wireframes on/off (B&W only) V :show/hide horizon and hand sound :E,S helicopter controls cmd-7 :up cmd-8 :down cmd-9 :tilt down cmd-0 :tilt up transmission: + :up shift to higher gear - :down shift R :reverse numberkeys :set gear ],zero :neutral X,Z :cruise A :automatic car controls: left gas right 7,U 8,I 9,O 4,J break 6,L 1,M 2,M 3,, use up/down arrow keys to select excuse for cop (or use -,+ if you don't have arrow keys). Sometimes he might let you go. These are all 32 of the questions and answers I found in the program: How many square blocks is Chinatown? (page 30) 16 What year was the first Corvette exhibited? (page 40) 1953 In 1956, where was the Corvette/ Thunderbird challenge? (page 41) DAYTONA Fuel injection was added in what model year? (page 41) 1957 What model year was the Stingray Corvette introduced? (page 42) 1963 What year was Golden Gate Park started? (page 29) 1887 What year was the Presidio established? (page 29) 1776 What year was Coit Tower built? (page 30) 1933 What year was the Golden Gate International Expo? (page 31) 1939 What year was the Moscone Center built? (page 32) 1981 At what rpm will the stock Corvette reach 245 bhp? (page 50) 4300 What is the curb weight (lbs) of the stock Corvette? (page 50) 3313 In inches, what is the height of the ZR1? (page 51) 46.7 What is the length of the Sledgehammer in inches? (page 53) 176.5 In inches, how long is the wheelbase of the Twin Turbo? (page 52) 96.2 What is the curb weight (lbs) of the Twin Turbo? (page 52) 3500 What is the displacement of the Countach engine in ccs? (page 55) 5167 What is the displacement of the Porsche engine in ccs? (page 54) 4957 Number of feet it takes the Testarossa to stop from 80? (page 56) 242 What is the total number of acres in the Presidio? (page 29) 1500 What is the nickname of the south of Market area? (page 31) SOMA What year did the fastback shape of the Corvette return? (page 43) 1978 What year did the Corvette join the horsepower race? (page 42) 1964 What is the standing 1/4 mi speed (mph) of the stock Vette? (page 50) 95 What top speed (mph) was recorded at Bonneville in 1967? (page 43) 192 What is the fuel capacity of the Countach in gallons? (page 55) 31.7 What is the fuel capacity of the Porsche in gallons? (page 54) 22.7 What is the standing 1/4 mi speed (mph) of the Twin Turbo? (page 52) 111 What is the curb weight of the F40 in pounds? (page 57) 2650 In inches, what is the length of the Porsche 928? (page 54) 178.1 The length of the Testarossa wheelbase in inches? (page 56) 100.4 In inches, what is the height of the Ferrari F40? (page 57) 44.5 Vette! trick: 1. Get to a gear higher than first 2. Switch to manual 3. press '1' for first gear 4. press '2' for brake for a second 5. press '8' for forward and keep it down 6. press 'a' for automatic 7. press '1' again 8. press 'x' for cruise control if you haven't ran into to anything yet. Vette Color V1.01 EFFECT: Use higher gears, if wrong password entered HOW TO: LOCATE CODE RESOURCE 1 CHANGE THEWORD AT OFFSET 0822 FROM 661E TO 6018 or - VETTE! 1.0 EFFECT:The program will never ask you the question. HOW TO: (B/W) Locate CODE 2 of the file "VETTE!", Find Offset $123C, From 4EAD 0032 to 4E71 4E71 (Color)Locate CODE 2 of the file "Color VETTE!", Find Offset $18D8, From 4EAD 004A to 4E71 4E71 - Victoire! †in the cdev +1DA6 661E->4E71 +1DCA 6738->4E71 This makes it think your registered, unless you go to the about box, and then it resets, i tried +2CAE 64 -> 60 to stop this prob, but this skips to much, will have to spend some more time to stop the about box problem, however i think it will work if you do not go to the about box. Victoire 1.0.2 - to get unlimited demo time, thus effectively registering it change INIT #128 +$976 6C02->6002 - VideoWorks †v1.0 Search for:A0073D40 Change to:4E713D40 This patch NOPs a call to Get_Vol_Info and may have some side effects. So far, none have surfaced. - Videx Calender †Search for:57C1C0014A6E Change to:50C1C0014A6E - Videx FunPak †Search for:4A5F670848 Change to:4A5F660848 (every INSTANCE!) - Videx MacCheckers †Move to block 0189, position 0155, change 67 to 60 Move to block 01C2, position 0137, change 67 to 60 - Videx MacGammon/Cribbage †BLOCK 202 CHANGE 1A8-1A9 FROM FA 75 TO FB 74 BLOCK 362 CHANGE 6B-6C FROM 68 51 TO 69 50 - Videx MacGammon †Move to block 00CA, position 01A8, change FA75 to FB74 Move to block 016A, position 006B, change 6851 to 6950 - Videx Mail Center †Installer: Search for:6F6C D0F5 28A1 9AD7 E41A 703B B19B EE0E CHANGE TO:6F6C D0F5 29A0 THEN Search for:9E19 B170 0844 8BF8 8845 5A9A 428B C85F CHANGE TO:9E19 B170 0844 8AF9 and to the Videx Mail Center app: Search for:A94F B12F 06D8 E629 C230 C3FE 548C D0C8 CHANGE TO:A84E THEN Search for:6E48 9651 FBA4 96A0 7AB6 830E BC1A 2724 CHANGE TO:6F49 Make these changes to a sector copy -- now its fully broken. If you copy it to a hard drive, also copy the invisible file called 'VIDEX KEY FILE'. - View to a Kill †Search for:9083EDE76099 Change to:B8F25EEC6099 Search for:39EB780FD09F Change to:3EEB780FD09F Search for:E9CDC07BFC7A Change to:880B5DFC273B - Virtus WalkThrough v1.1 EDVWT157-000-36F6 v1.0 Pro ECMAA621-000-AAF2 - Wayne Gretzky Hockey †CODE 10+FC4 from: 4EBA FBF6 to: 4E71 600E - WellTris †B&W In case you ended up with a version of Welltris that needs the flag codes to work here is a ResEdit crack that I picked up somewhere… Using ResEdit do the following: Open CODE resource with id 3 Go to Hex Offset 1212 Change the highlighted 66 to 60 Open CODE resource with id 5 Go to Hex Offset 1AC3 Change the highlighted 56 to 75 Go to Hex Offset 0A4E Change the highlighted 67 to 60 Open CODE resource with id 6 Go to Hex Offset 0D1C Change the highlighted 67 to 60 Weltris Color Open CODE resource with id 3 Go to Hex Offset 122E Change the highlighted 66 to a 60 Open CODE resource with id 5 Go to Hex Offset 17C9 Change the highlighted 56 to a 75 Go to Hex Offset 0A44 Change the highlighted 67 to a 60 Open CODE resource with id 6 Go to Hex Offset 0D1C Change the highlighted 67 to a 60 - Whiz Tools †v1.1 Search for: 6620 2F3C 000E 0011 2F2C 3ADA Change to: 6020 " " " " " " " " " " - WindoWatch 5009545683 - Winter Games †To make Winter Games by EPYX copyable, try this: Search for:0BFA 8712 F340 449C 9B98 109E 05F8 238C CHANGE TO:0AFA Make these changes to a sector copy, then bit copy tracks #78 & 79 with copy II Mac. - Wishbringer †Search for 6FDA100667063B7C change to 6004100667063B7C - Wizardry †Search for 0A00000167000090302EFFF2 change to 0A00000160000098302EFFF2 THAT REMOVES THE PROTECTION, BUT YOU STILL HAVE TO PUT SOME KIND OF DISK IN THE INTERNAL DRIVE WHEN IT ASKS FOR THE MASTER(ANY DISK). TO REMOVE THE EJECTS AND THE DISK REQUEST, DO THE FOLLOWING (AFTER YOU MAKE THESE MODS, IT WON'T WORK ON A HARD DRIVE THO..) (SO IF YOU HAVE A H.D., JUST DO THE FIRST PATCH) Search for 205FA0173E804ED14E56FFCE change to 205FA0173EBC00004E56FFCE Search for 216E000A0012A0173D40000E4E change to 216E000A00124E713D40000E4E Search for 2F2E00084EBAFF66A853 change to 2F2E00084E714E71A853 Search for FFF46620487A067E487A0632 change to FFF44E71487A067E487A0632 THAT'S, EITHER THE FIRST PATCH, OR ALL OF THEM, THE FILES ARE FINDER COPYABLE AND NO MORE CHECKS. or try Wizardry 1.1 Search for 4EAD 059A 41ED 059A change to 4E714E7141ED059A - Wizardry II Knight of Diamonds †- KNIGHT OF DIAMONDS (aka. WIZARDRY II) EFFECT: By-passes copy protection. HOW TO: Open CODE resource 73 at offset, change word to $4E75 - Wordtris †(color version) Search for: A915 3B7C 000C 962E 422D Change to : 4E71 Search for: 6600 FF4C 2F0C A983 1006 4CEE 10E0 Change to : 4E71 4E71 2F0C 4E71 Search for: A991 486D 95F2 7003 Change to : 4E71 (B/W version) Search for: A915 3B7C 000C 963C 422D Change to : 4E71 Search for: 6600 FF4C 2F0C A983 1006 4CEE 10E0 Change to : 4E71 4E71 2F0C 4E71 Search for: A991 486D 9600 7003 Change to : 4E71 or Open it with ResEdit and open CODE resource ID=1 with a hex editor. At position 07A0 you will find: 4EAD 056A 4A00 6606 4EBA 0BC8 A9F4 598F Change this to: 4E71 4E71 4E71 4E71 4E71 4E71 4E71 4E71 or - WORDTRIS v1.0 (B&W and Colour) EFFECT: It doesn't ask for a word at start-up any more. HOW TO: Open CODE resource 1 at offset 07A0, change word to $600C or WORDTRIS B/W EFFECT: The password dislog will never show up HOW TO: LOCATE CODE RESOURCE 1 CHANGE THE WORD AT OFFSET 07A0 TO 4E71 CHANGE THE WORD AT OFFSET 07A2 TO 4E71 CHANGE THE BYTE AT OFFSET 07A6 TO 60 - WORDTRIS V1.00 (COLOUR) 2 Patches, each works independant of the other so you can use one, the other or both. A) EFFECT: This will still bring up the dialog, but you just hit return 3 times and it will start. HOW TO: Code 1, "Main", anton 6 offset 0082-0086 replace with 4E71 B) EFFECT: This will stop the dialog from being brought up. If you want to be reall safe, do both, because the second just kills the dialog and under some ciramstances it might quit anyway. HOW TO: Code1, "Main", anton 6 offset 007A replace these two bytes with two 4E71's - Word Perfect v2.0x V0000005961 v3.0 V0000005961 - Word Perfect Works 1WW12XM0000099 - X-FerIT †name is "anonymous" number is 550035173-2 - Xerion †the following commands to wired things: Clear 5 - Next Level (Just like Dos Master said for Crazy Cars) Clear 6 - Directly to the bounus stage Clear 3 - Clears what ever is pulling you or making you wiggle Clear 1 - Make the paddel larger Clear 2 - Makes you catch the ball - Xyphus †Search for each string seperately and change the 67's to 60's. 4EBA 5F6C 101F 6708 4EBA 5E6A 101F 6708 4EAD 007A 101F 6708 or try Search for 670002502C7C00 change to 4E714E712C7C00 - ZephyrPalettes v1.3 2-130-3186163 - ZipIt v1.2 †Crack for ZipIt v1.2 Open up ZipIt in ResEdit Open CODE 2 in the Hex Editor Change it as follows: Offset:$2B3A From: $660E To: $600E Offset:$2B4A From: $0C39 To: $13FC Offset:$2B52 From: $6614 To: $4E71 Note that this does not actually register the program, it just makes it behave like it was registered. Also, it enables encryption! - Zone of Avoidance †Another collection of modifications to make games more fun! **************************************** This patch allows you to have unlimited missiles: Open CODE 4 in ResEdit Change it at offset $4392 From: $5379 To: $6004 **************************************** This patch gives you full abilites after you finish Level 1: Open CODE 4 in ResEdit Change it at offset $736E From: $6252 To: $4E71 AND Change it at offset $737A From: $4ED1 0C39 0004 To: $23FC 0404 0404 - ~~~~~ Cracking Tips ~~~~~ †“Single Test Crack” - refers to a crack that works in two halves (that have to applied seperately and in order) as the result of the program that is being cracked having a particularly simple and annoying personalization/registration scheme. Namely these programs test the same data (the serial number) (in one or more -usually 2 places) for two different reasons: #1 do I have a valid serial#? Yes -> Personalized. No -> Personalize #2 Is the serial # valid when Personalizing? Yes -> Save personalization and enter program No -> Quit or give alert saying try again. Now assuming we can circumvent these two checks (ie. always make the answer yes) we are left with a small dilemma: If we just circumvent check#1 (or check#1 and check#2) we will never get to personalize, and if we just circumvent check#2 we get it personalized and can use it once, but it will ask us to personalize every time we run it - clearly an unacceptable state of affairs. The two possible (CODE) solutions: --------------------------------- Method A: Just Patch Test#1 (simple but may cause crashes and/or not work - see below) Method B: Patch Test #2 Run Program and Personalize/Register Quit the program (this is obvious but included for completeness) Patch Test #1 (at this point the patch to test #2 is irrelevant) Method B is by far the preferred course of action - although it is a somewhat tedious 3 step process it is guaranteed (by me {iff the crack is correct}) to ALWAYS work as it mimicks exactly the way the original code was meant to work (aside from reversing the checks results). Method A is fraught with DANGER as it will definitely skip any special one time initialization/setup that is done by the personalization code, which at a minimum records your personalization info. Usually your personalization info is used for display in about boxes and such and if you go to one of these locations the program may or may not crash/screw up DEPENDING ENTIRELY on how it is programmed. Also you can never be absolutely sure that it won’t crash unless your capable of disassembling the whole program and analyzing it completely - go ahead make my day...(and you don’t need my help if you can - and the NSA has a job for you) - End Note †Any cracking tips will be added here at the end of the file. The main file will contain only actual cracks. Cracking tips will remain in the file for only a few months. - END