†Thanks to the many people from whose postings I have stolen KRAKs and Serial Numbers. Special thanks to those who have taken the trouble to EMail me to send me the KRAKs and Serial Numbers, and to the creator of this database to view the files!
-
----- Using the Cracks -----
†Using the cracks:
Most of these cracks can be installed either by using the Sector Editor option of Norton Utilities, or by using ResEdit...
Norton Utilities:
Run Norton Utilities and go to the Sector Editor option in the pull down menus. Select this. Open the drive the file is on. Open the file to be modified. Search for the string requiring modification using the find option. Select the bytes to be modified. Type in the changes.
ResEdit
Run ResEdit and select the file to be modified. Click on the resource indicated (ie - Code 1) If there is more than one entry under that heading select the entry indicated in the crack. Go to the address indicated (Offset - this is usually shown as $0000 and is in the leftmost column) At this location you should see the code you have to change. Select the code to be changed. Type in the changes.
-
][ in a Mac
†Search for: 6100 B754 42AF 3F
Change to: 4E71 B754 42AF 3F
v2.0
Search for: 4EBA 02C2 42A7 3F3C
Change to: 4E71 4E71 42A7 3F3C
-
1st Base
†Move to block 0232, position 006F, and change to 01
Move to block 0005, position 008C, and change to 01
Move to block 0233, position 019F, and change to 60
Move to block 0233, position 01B3, and change to 01
Move to block 0233, position 01C7, and change to 01
Move to block 0005, position 0082, and change to 80
-
4th Dimension
v2.01
A-342165175449
B-302260105256
C-362106850509
D-205200607255
D-225490055617
D-302200129276
D-342002870616
E-245191050449
E-332300119683
H-203030825071
H-243178434494
H-244656412618
H-282650130833
H-302304109610
H-382704134633
I-302502133617
M-362304172827
N-302000207053
N-382908192038
O-205376978623
O-262105273925
O-302101218161
O-342301152649
P-205230003253
Q-243126514449
R-205270127273
S-243160352309
S-244397274027
S-342590516249
T-302092506051
U-302191537161
V-302290527273
V-342104143616
W-243387755207
W-322505173725
X-242064960694
X-382806163033
Y-332305915083
Y-342104173749
Z-342000985694
v2.2
A-342165175449
H-243178434494
O-262105273925
U-302191537161
B-302260105256
H-244656412618
O-302101218161
V-302290527273
C-362106850509
H-282650130833
O-342301152649
V-342104143616
D-205200607255
H-302304109610
P-205230003253
W-243387755207
D-225490055617
H-382704134633
Q-243126514449
W-322505173725
D-302200129276
I-302502133617
R-205270127273
X-242064960694
D-342002870616
M-362304172827
S-243160352309
X-382806163033
E-245191050449
N-302000207053
S-244397274027
Y-332305915083
E-332300119683
N-382908192038
S-342590516249
Y-342104173749
H-203030825071
O-205376978623
T-302092506051
Z-342000985694
v3.0.1
34868520554560
v3.1
34868520554560
v3.0+
08020600
48020000
28020800
18020700
38020900
58020100
68020200
†v3.0.4
For 4D to recognize any disk as the key disk:
Search for: 0A00 0001 2207 8200 6700 FE82
Change to: " " 0000 " " " " " " " "
Search for: 660C 3F2E FF96 4EAD 1422 7E01
Change to: 4E71 " " " " " " " " " "
Search for: 6600 028A 47EC FE9E 7000 2740
Change to: 4E71 4E71 " " " " " " " "
Search for: 0A00 0001 802C FF4F 802C FF51
Change to: 0A00 0000 " " " " " " " "
Search for: 0A00 0001 802C FF4F 6700 FB30
Change to: 0A00 0000 " " " " " " " "
==========
v3.0.1
Partial Crack
1. Install the program
2. Make a copy of the program
3. Make the following changes in the copy:
CODE 31+$22E From 66 to 60
CODE 31+$290 From 6700 FE82 to 4E71 4E71
CODE 31+$44C From 6600 10FE to 4E71 4E71
4. Run the copy and insert the serial number: 34868520554560
This will create a preferences file on the hard drive
5. Delete the copy and run the original because the changes
cause crashes in the program. You will however no longer be asked for
a key disk at startup.
4th Dimension 3.0.1 On Line Help
Change CODE 3+$422E
From: 6718
To: 4E71
==========
v2.0.x
By following the directions below, you should be able to use just about an serial # you want (of the form A-123456789012) so share share SHARE AWAY!
(The following has been tested on 4D 2.0.10 and the 4D Runtime which came with it, though any 4D 2.x version should be similar enough)
CODE 1+$2544, From $FFAE, To $FF56
(if you are using a different version of 4D, search for the pattern:
486E FFAE 486E FF56
and change either of the two negative numbers so that one equals the other (either change the FFAE to be FF56, or change the FF56 to be FFAE))
(see also 4D Runtime)
-
4D Insider
v1.0.1
†To never see/enter the personalization just use this:
Code #47 +A00 6600 02B6 -> 6000 02B6
in the event that the above is an imperfect krak, remove it and try:
Code #47 +B20 57C1->7201
this will accept anything as a serial number, but you will have to repersonalize each time.
-
4D Online Help (GTec Systems - not ACIUS makes this)
v2.0.6
†CODE #3 +422E 6718->4E71
-
4D Runtime
†CODE 1+$2498, From $FFAE to $FF56
(see note in 4th Dimension if you have a different version of this file)
Note: It is CONCEIVABLE that the offsets may have changed between versions, so if you are having particular difficulty locating the pair of PEA instructions, scan for 486EFF sequences, and keep an eye out for a routine that looks like this:
MOVEQ #$1A,D0 | 701A
MOVE.L D0,-(A7) | 2F00
JSR *-$22FE ; 00171D1E | 4EBA DD00
MOVE.L (A7)+,D0 | 201F
MOVEQ #$41,D1 ; 'A' | 7241
ADD.L D1,D0 | D081
MOVE.W D0,D6 | 3C00
MOVE.B D6,-$00A9(A6) | 1D46 FF57
MOVE.B #$2D,-$00A8(A6) ; '-' | 1D7C 002D FF58
PEA -$0052(A6) | 486E FFAE
PEA -$00AA(A6) | 486E FF56
JSR *-$1FE8 ; 00172052 | 4EBA E016
MOVE.B (A7)+,$0010(A6) | 1D5F 0010
MOVEM.L (A7)+,D4-D7 | 4CDF 00F0
UNLK A6 | 4E5E
MOVEA.L (A7)+,A0 | 205F
ADDQ.W #$8,A7 | 504F
JMP (A0) | 4ED0
-
4D Network
†Search for: 4FBF CE60 0E42
Change to: 4E71 4E71 " "
-
4D Compiler
v2.0.x≤4
20996169929821
20996169928831
20996169927841
20996169926851
20996169925861
20996169924871
20996169923881
20996169922891
†v1.0
This patch does two things:
A) Tells the program not to look for the keydisk and
Instead of using the above patch you can get as many tries as you want by:
CODE 3+$40B2 From: 6C To: 60
and try the names below. See if you can match faces with the names and save the faces as screen dumps or write a description of the boxer.
The boxer's names are:
Lars Lugnut, Hammer McGee, Blam Blam, Glump Fistwhistle, Lefty Enright, Weegie Wonka, Clinch Roberts, Mac the ouch, and Butch McKenna
or
- 4D BOXING 1.0
EFFECT:The program will never ask you the question. HOW TO: Locate CODE 12, Find offset $0CFA,
Change the word $6604 to $6004.
-
4th Right
Butterball (case sensitive)
-
8 Ball Pinball Deluxe
6267EM11002
† Place the contents from all three disks into a folder and run the application. Let it uncompress all three files, when it gets to the
Registration Dialog, CANCEL it and exit to Finder. Change:
CODE 4+$1B8E From: 660E To: 600E
CODE 4+$1BAC From: 670E To: 600E
or try
After you first take it off the disks, run it once so that it will decompress itself, then cancel and change:
To use anything as a registration number:
This part changes the application tampering check:
CODE 4+$1BAC From: 670E To: 600E
This part changes the dialog handling procedure:
CODE 4+$2E47 From: 670E To: 600E
OK, now to spice up your game:
To get infinite lives:
{How do you end the game? I dunno… Try it for practice!!!}
CODE 5+$3EEA From: 661C To: 601C
To set your number of lives:
CODE 5+$371E From: 0004 To: Whatever! Ex.
1 = $0001
2 = $0002
4 = $0004
9 = $0009
10 = $000A
11 = $000B
16 = $0010
17 = $0011
Get the idea? Remember to make sure it's 4 characters long when you type it in! Also, when you play, you’ll only see a '-' for your ball, because it thinks that because you've got n balls left, and it ends at 4 (5?), you’ve got 4 (5?) - n (Probably a negative number) left!
or try
To really crack 8-Ball Deluxe, after you’ve done the crack in the readme, change:
CODE 2+$2EB2 From: 67 To: 60
Then you can copy the files all over the place.
or
-•EIGHT BALL DELUXE 1.0.1
EFFECT: Bypasses the check to reinstall the game from master disks,
if copied to another harddrive
HOW TO: CHANGE THE BYTE AT OFFSET 2EB2 IN CODE RESOURCE 2 TO 60
-
ABCBase
†Search for: A9F4 42A7
Change to: 4E71 " "
Search for: A9F4 4246
Change to: 4E71 " "
or try
Search for: A9F4 4246
Change to: 4E71 " "
-
Accelerator
A300-31239-CP4U
A300-11114-CP4U
A300-12935-CP4U
-
Access PC
v2.02
500056261
v3.0
0120 0000 0253 0278
0120 0000 4589 1115
-
Accountant Inc. Pro
18225
-
Accutext
v2.0
10900016
-
Acrobat
v1.0
MVW100R3100000-050-208 (50 User)
DEW100R3100564-885
-
AddDepth
AD-100-2-1272-46699
-
Adobe Illustrator
v3.x
AAW3021019783
†Name in ARTY 256 resource, organization in ARTY 257 resource.
-
Adobe Photoshop
v1.1
PCA100000100-953
PCA100002582-359
PDA100001185-501
PDA100001517-722
v2.0
PCA100000915-575
v2.01
PCA100000915-575
PCA107011754-639
v2.5a
"shakti"
(all LOWER CASE!!!)
v2.5
(same as 2.0x)
-
Adobe Type Library 1-265
†The "Type on Call bundle version" serial number would be:
AAB QWY SAHI MSRV
those are 12 letters however to add more fonts, you need to enter the 14 character. that would be CDW200B1753407
-
AD Disney Screen Saver
DIS-00670-6681
DSM-75689-8965
-
AD Marvel Comics Saver
MAR-00670-6681
EAM-30306-9708
†Crack for After Dark - Marvel Comic Edition
This is an FKEY which will patch the installer while it is running, and allow
you to enter a serial number. You cannot just switch a few bytes in a resource
because the resource is compressed. Also, it is on an installer disk, and if
you just want to mount the image, it is a pain to edit it.
Here is what to do:
- Open up your system file with ResEdit
- Open up the resource type 'FKEY'
- Hit Cmd-K (Create New Resource). It might say 'There is no Code in this...'.
If so, then open the new resource (ID 128) with the Hex Editor.
- Paste the FKEY Code in (down below)
- Close the Resource
- Select it and hit Cmd-I (Get Resource Info)
- Give it a unique ID (Between 4-9)
- Quit ResEdit (and save changes)
- Run the installer program
When it asks you for you Name, Rank & Serial Number, run the FKEY by hitting
Command + Shift + the ID number you gave it (E.G. Cmd Shift 3 is the screen
capture FKEY). Now just type whatever you want into the dialog box and hit OK.
If the FKEY Beeps, then it didn't work. Try again.
You should remove the FKEY now.
It would probably be a heck of a lot easier just to get a SN#!
Install the latest version of AfterDark (currently Marvel Comics) It will
run all the preceding modules (Disney, Star Trek, MOD etc)
-
AD Star Trek Screen Saver
KAM-21289-8489
STM-00670-6681
EAM-30306-9708
†ADga 1+$864 From: 6706 To: 6006
ADga 1+$882 From: 6604 To: 6004
ADga 1+$896 From: 6704 To: 6004
ADga 1+$8F4 From: 57C0 To: 4E71
Anything will work as a serial number when running the Installer program - you cannot just drag the control panel into your System Folder. The Name, Organization, and Serial Number are stored in the 'InaP' resources in the After Dark control panel. They are encrypted - didn't bother to figure that out.
or try
The crack is in the script file, resource ADga #1
Offset Original Cracked
2AC 67 60
362 6700FEE4 4E714E71
7A4 66 60
864 67 60
88E 6FE0 4E71
896 67 60
8B6 6DE8 4E71
8E6 6DD4 4E71
-
AgentDA
v1.x
102800455
v2.0
101208510
-
Airborne
†Search for: 6712 4267 3F3C 01F4 42A7
Change to: 6012 " " " " " " " "
-
Alarming Events
03478
-
Aldus After Effects
XH9-SVJ1-B5K
-
Aldus Fetch
v1.0
51-1003-102157313
51-1000-201176607
51-1007-201194631
-
Aldus FreeHand
v3.0x
02-1235-002302134
02-3008-000036469
02-4008-200010087
02-6023-000345263
12-1234-123456789
-
Aldus IntelliDraw
v1.0
Try any of the other
serial numbers for Aldus
-
Aldus Persuasion
08-2009-000379488
08-2001-200201529
02-3008-000036469
-
Aldus PrePrint
v1.x
02-0001-100000000
11-1009-200021734
11-1000-200027072
-
Alias Sketch
v1.x
SMKB8MMKZ6SM8EV
v1.5
SMDFQHB3THRH4LJ
-
ALLright Utilities
v1.0
1026439
-
Alsoft Power Pack
PS001604(001)
-
Alter Ego (male ver)
†Search for: 24D0 5DE0 3584
Change to : 23D0 5DE0 3584
Search for: B07A 09B0 05A5
Change to : D1BC 0DA4 3EC8
-
American Heritage Dictionary
v3.0
A9-L0010M3
A9-D0010M3
-
Ancient Art of War
†Search for: 4EAD 02DA B07C 0022 6700 0100 42A7
Change to : 246D E8BC 2B6A 0002 E9F2 6000 0102
-
Animal Kingdom
†Search for: 3CBA 000C 4EBA
Change to: 4E71 4E71 " "
-
Animation Toolkit
†Search for:6608 45FA 0020 3012 9041
Change to :600A " " " " " " " "
-
Animation Works
45482
-
App-Doc Linker
817GrGn5jkfh78h
-
Apple Easy Open
0120 0000 0253 0278
-
Appleshare
v4.0
B-341UFD-170-QEC-357-HZM-484-XDG-340
v3.0
B-341UFD-170-QEC-357-HZM-484-XDG-340
-
Arkanoid
† If you don't like relying on chance for the right power capsule to drop down, there is a way to make yourself a winner. First, boot the program and begin to play as you normally would. Then, type: dsimagic. Then, resume your play. You'll see a capsule called DS drifting down the screen. Catch it an press A to regain sound, then press the following keys to obtain the type of power capsule and feature you want:
A= Sound on/off
B or W= break to next round*
C= catch;
D= extra balls (3 total)
F= go to last round (33)
L= laser;
M= get three balls
P= player (extra life)
S= slow;
X= let the computer play
0= pause
9= resume.
*On some versions, when you press B, you see a screen called Boss Comming instead of the next level.
- ARKANOID (to run on most Mac's)
EFFECT: ??? (I guess it patches the game)
HOW TO: LOCATE CODE resource ID #4
Change byte 42 (hex) from hex 66 to hex 6D
Good luck, the only problems I have heard are from powerbooks, (a 140 crashed)
Oh, and it really likes it if you switch to B/W FIRST.
-
Armor Alley
3P6GXEH
8CW659X
H3PJ69D
HQQCDHA
JMNR9SC
DE5A8R3
v1.0.1
PWPWD92
PWPX939
PWX2QHX
PWX8TX3
PWX963Y
PWX99W6
PWXCAF9
PWXDEB2
PWXFL8Q
PWXL55F
PWXL98N
PWXN59J
PWXQHGF
PWXQNAH
PWXQNDN
PWX56SM
PWXT8BA
PWXWNQ9
PX29LNM
PX2B5N8
PX2BAHW
PX2D8E9
PX2DTES
PX2E9T8
PX2EQSG
PX2ES8L
PX2F9T6
PX2HF8Q
PX2J9YE
PX2JN98
PX2LFLM
PX2LLT5
PX2MD9A
PX2MW6X
PX2NPX5
PX2PY2R
PX2QAE8
PX2QP3X
PX2T3B6
PX2TJL9
PX2W6DW
PX2W6HY
PXC6FHX
PXC8A59
PXC8DWS
PXCBG5J
PXCEJJ9
PXCETED
PXCF5SS
PXCGRFQ
PXCHWSM
PXCJ3Q2
PXCJD35
PXCMN6B
PXCP3CA
PXCT52Y
v1.1
EXC2H3Y
EXC53RH
EXC5F33
EXCA992
EXCE8AT
EXCEDJM
EXCJMBF
EXCLBL6
EXCMTCN
EXCNCEP
EXCQRF5
EXCRR6X
EXCSDLL
EXCY2PP
EXD3XPA
EXD89FT
EXDB85R
EXDFPA5
EXDGPPG
EXDH8NL
EXDLAB2
EXDMWHM
EXDREBM
EXDS2QL
EXDTCHB
EXDTY9M
EXDYGQX
EXE3NMF
EXE669P
EXE9583
EXE9QQ3
EXEALLY
EXEDA9C
EXEEXRF
EXEFRMC
EXEHR25
EXEMPJL
EXEQR3E
EXESPMC
EXESXH2
EXEW6T5
EXEXSS3
EXF26LF
EXF3NWH
EXF58G6
EXF5HF6
EXFCBTG
EXFCJXJ
EXFFBFB
EXFFEHW
EXFLMYX
EXFNQ82
EXFR2NC
EXFSNBN
EXFWLQX
EXFWRHR
EXFX6NQ
EXG2A96
EXG563R
EXG8YW2
EXG9G9F
EXG9T2H
EXGBDS5
It appears that
any variation of the
C9X53TA serial
number works fine:
C9X53TA
C9X53TB
C9X53TC
etc.
also:
A3A56T3
A3A56T5
A3A56T8
A3A56D8
† To play a multiplayer game of Armor Alley, each copy needs to be registerred with a different serial number. These serial numbers are for Armor Alley™ 1.0.1. Some may have typos. Just make sure there is no Armor Alley prefs file in the system folder so you can register Armor Alley with a new serial number.
EFFECT: Disables network serial number checking.
HOW TO: Open CODE resource 6
at offset 03CE, change words to $4E71 4E71
-
artWORKS
†1.0
This is a two step crack:
Step #1: To get bogus personalization info into the program, and have the program init itself, change:
CODE 148+$00DC From: 6728 To: 6028
+$0116 From: 6670 To: 4E71
+$011E From: 6D66 To: 4E71
+$018A From: 6714 To: 6014
+$07E2 From: 670A To: 4E71
Run the program and personalize it, then quit and:
STEP #2: To make it believe the personalization is valid and skip repersonalizing, change:
CODE 14+$09B2 From: 6400 0224 To: 6000 0224
+$0BDE From: 6E00 0094 To: 4E71 4E71
Now you should have a personalized artWORKS that works perfectly!
Note this may or may not remove the network copy protection, but I think it probably does.
-
Ascend
†Change code #80 offset 05f0 from 66 to 67.
and just enter a name in the licensed to
and leave the rest blank under registration.
-
Ashlar Vellum
01399
-
Astound
3006005109
-
Atlas
v1.2
†Search for: 4EBA F9AA
Change to: 4E71 4E71
Search for: 6704 4EAD 02E2 42AD
Change to: 6004 " " " " " "
-
Atticus Vista
v1.0
126100023
-
Autoboot
v1.1.1
†Crack for Autoboot 1.1.1:
----------------------
1) Open up the CDEV Resource
2) Open up ID -4064
3) Find Offset 075C
4) Change 672E to 4E71
5) Quit and save changes!
6) Open up the Control Panel and click Register.
7) Enter in whatever the phuck you want.
-
AutoDoubler
vb12
tioga
-
AutoMenus
†Search for: 4A00 6600 00B0
Change to: " " 6000 " "
This will allow unlimited boots past the demo period.
-
Aztec C
†Aztec C (1.00c)
Change block 71 (decimal) byte $1A9 from 01 to 00
==========
v68K-C (commercial ver)
Apply this to sys:
Copy both disks with Diskutil or any program that will copy both disks. There are no bad blocks on the disk. Apply the following block patches:
Block 214 Byte 107 From: 01 To: 00
Block 212 Byte E0 From: xx xx xx xx xx xx To: 30 30 30 30 00 00
Where xx is the value of the serial # on your disk.
Apply to sys2:
Block 63 Byte 97 From: 01 To: 00
Block 61 Byte 6F From: xx xx xx xx To: 30 30 30 30
There’s a hidden serial number on the disk. It’s on Block 212 Byte E5-E6. Just zap it to 00 00. No need to do this on the second disk as the serial number (visible) is just junk, and the invisible one is gone.
==========
v1.06D,F
Search for: 5245 6000 FF2E 7001
Change to: " " " " " " 7000
==========
v1.7
In the file: SHELL.
Search for: 6700 00E4 3D7C 0001 FFAC
Change to: 6000 " " " " " " " "
-
BackBurner
03-1489-0280
03-1337-9988
† To fool BackBurner's personalization dialog into thinking any SN you enter is good, make the following changes to the BackBurner APP..
Search for: 4FEF 0022 6712 4EBA 005C
Change to: " " " " 6012 " " " "
-
Balance of Power
†Search for: 72A1 D3C1
Change to: 5AD0 60CA
Search for: 1B09 9629
Change to: 1C09 " "
Search for: 8BAF E645 DE98
Change to: EA69 7BA9 0AB5
-
Bane of the Cosmic Forge
†To eliminate the codes, use ResEdit, open Bane (on disk A) change:
CODE 1+$8406
From: 0C6D 0001 C268 6606
To: 3B7C " " " " 4E71
or try
Bypass the journal entry codes by changing:
CODE 14+$4020
From 4267 3F3C
To: 6000 01DA.
Bypass the rule book codes by changing:
CODE 2+$39E
From: 4EAD 037A
To: 6000 01F8.
or
- BANE OF THE COSMIC FORGE
EFFECT: This will remove the "match the codes" box.
HOW TO: LOCATE 'CODE' ID 1 FIND Offset $83FE From: 0C6D 0001 C268 6606
To: 3B7C 0001 C268 4E71
The following is a BANE patch that appears to work correctly (the previously
posted one works fine until you get into combat --- then you always miss!) - BANE OF THE COSMIC FORGE (Apr 24, 1991 version)
EFFECT: While you will still be prompted for a password the first time you restore a game, any old word works.
HOW TO: CODE ID = 1
Offset was change to
86D0 6C 60
8702 67 60
(just killing off the JSR to the password grabbing routine didn't work, so this will have to do unless someone makes a little more effort)
†Here is a crack for the date check to eliminate the need
to re-insert the install disk.
Search for : 4EAD 137A 4EAD 136A 4A40
Change to : 4E71 4E71
-
Calculator Construction Set
†Search for: 0C40 0000 6700 0006 4EED
Change to: " " " " 4EFA " " " "
or try
Search for: 4EAD 00A2 0C40
Change to: 4E71 4E71 " "
-
Canvas
v2.0
2005355
1234567
(1st+6th digit=7th)
v3.0
3001700735
4753234241
2090414360
†To kill the ser# protection:
Search for: 6D00 FE94 0C6E
Change to: 600C " " " "
-
Capitalist Pig
†v1.02
CODE 4+$1F0E From: 6706 To: 6006
Also: to cheat break in at the inital setup dialog and set a breakpoint at SetUpDia +200 which is a MOVE.L #$F4240,-13A(A6) The $F4240 = 1,000,000 Decimal, which is the initial funds you start with simply change this value to say 100,000,000 or whatever you want.
or
- CAPITALIST PIG
EFFECT: When password dialog appears, press enter to bypass protection. HOW TO: LOCATE CODE 4...FIND THE OFFSET 1F08
AND CHANGE THE NUMBER 6706 TO 6006
- CAPITALIST PIG V1.0.2
EFFECT: Enter any number you wish into the password dialog box HOW TO: LOCATE CODE RESOURCE 4
CHANGE THE WORD AT OFFSET 1F10 FROM 4EAD TO 4E71
CHANGE THE WORD AT OFFSET 1F12 FROM 013A TO 4E71
CHANGE THE WORD AT OFFSET 1F14 FROM A9F4 TO 4E71
if you don't want to see the dialog at all you can change all the words between (and including) offsets 1D0C and 1F1C to 4E71.
-
Carbon Copy Mac
100003660
100003661
† No Checksum, etc. on the number; the serial number is REAL EASY to find with ResEdit, etc. Just change it and save changes, and presto — a “New Copy.”
†So that the password dialog will never show up, change:
CODE 1+$0088 To: 60
AMPC 42+$1D6EA To: 6060
$1D754 To: 4E71
-
Checkminder
†Search for: 3B5F F6C8 4A6D F6C8 6707
Change to: " " " " " " " " 6007
Search for: 101F 0A00 0001 670A
Change to: " " " " " " 600A
or try
Search for: 3B5F F6C8 4A6D F6C8 6706
Change to: " " " " " " " " 6006
Search for: 101F 0A00 0001 670A
Change to: " " " " " " 600A
-
Chequebook
†Search for: 6718 4267 3F3C 040B
Change to: 6018 " " " " " "
-
ChemDraw Plus
v3.0
Serial Number: 40770
Registration Code: CQXWPQ
-
Chem3D Plus
60086
KYAKRP
†If you’re using MS Word 5 and System 7, place the "EGO for Word" plug-in module in the Word Commands folder that is found in the folder containing the Word 5.0 application.
Keep the ChemDraw folder in the same folder as the CSC ChemDraw application
-
Chessmaster 2000
†Search for: A851 4EBA 30A8 42A7
Change to: " " " " " " 602E
Search for: 584F 4A40 6724 362E 0008
Change to: " " " " 4E71 " " " "
CHESSMASTER 2000
[Ed: This looks different from previous patches, it might be one that requires a disk editor]
EFFECT: Disable copy protection
HOW TO:
Search for:A8514EBA30A842A7
Change to:A8514EBA30A8602E
Search for:584F4A406724362E0008
Change to:584F4A404E71362E0008
-
Chuck Yeager's Air Combat
†CHUCK YEAGER'S AIR COMBAT (CYAC) v1.0
EFFECT: Prevents the copy protection dialog from appearing.
HOW TO:
Locate 'CODE' resource 9 at offset $44C4
Change word
FROM: $4E56
TO: $4E75
-
Chuck Yeager's Air Combat Demo
†Here’s how to remove the two-minute limit in the demonstration version of Chuck Yeager's Air Combat:
CODE 04+$02A4 From: 6400 1110 To: 4E71 4E71.
+$145E From: 650C To: 600C
The first part removes the actual limit; the second part stops the game from telling you your time was up when you stop any time after two minutes.
-
Civilization
†The following list is all the questions you may be asked after playing for 1000 years after starting the program. They are very simple and you will be given an approximate page number. Every 5 or 6 items here I have given page numbers, so that should make the choice of what I am talking about fairly easy. If you answer wrong, you might as well quit. Wrong answers will tell you that you were wrong.
Picture of B2 Bomber Flight and Electricity
Scroll in Star Map Mysticism and Mathematics
Atom Theory of Gravity and Physics
Old Car Combustion and Steel
Piggy Bank Trade and the Republic
Bridge Construction and Iron Working
Black Pot on tripod(17) University and Medicine
Sword with Scarf Horseback riding & Feudalism
Statue of man with sword and scale Alphabet
Combustion engine Refining and Explosives
Soviet hammer cross Philosophy and Industrialization
IBM PC Computer Mathematics & Computers
Plain soldiers(35) Republic and Explosives
Hand holding hammer over inc. house Masonry and Currency
Coins and Dollars Bronze Working
Three hands over flag Philosophy and Literacy
Kite in lightning Metallurgy & Magnetism
Circuit board Enginerring and Electricity
Circuit design under ruler Wheel and Construction
Explosives Gunpowder and Chemistry
Castle on Hill Masonry and Monarchy
Man with Wings Combustion and Physics
Two Atoms splitting Nuclear Power and Superconductor
Molecular Splicing(47) Medicine and the Corporation
Old gun with Gunpowder Bag Invention and Iron Working
Factory emitting Smoke Railroad and Banking
Old Phonograph Engineering and Literacy
Shield and Spears Bronze Working
Shaking Hands with Shovel and Axe Mass Production and Communism
Open book with 3 closed in back Writing and Code of Laws
Magnet(64) Navigation and Physics
Map Alphabet
3 Cars Automobile and the Corporation
Abacus adding machine Alphabet and masonry
Red Cross with Snaking lines Philosophy and Trade
Smelting Ore cup pouring(78) Gunpowder and University
Crown Ceremonial Burial and Code of Laws
Suppliant Meditating Ceremonial Burial
Ship Wheel Map Making
Nuclear Explosion Atomic Theory & Mass Production
Nuclear Sign Electronics and Nuclear Fission
Pensive Sitting Statue(86) Mysticism and Literacy
Wheel Scale with two arrows Mathematics and Navigation
Plastic Engine Refining and Space Flight
Train(92) Steam Engine and Bridge Building
Recycle Sign Mass Production and Democracy
Robotic Implements(112) Plastics and Computers
Rocket Advanced Flight and Electronics
View of Earth Computers and Rocketry
Steam Engine Physics and Invention
Pouring Steel Metallurgy and Industrialization
Two Meters Plugged into Wall Plastics and Mass Production
4 Men in front of Graph(118) Banking and Industrialization
Eagle on Globe Code of Laws and Literacy
Balls falling with arrows on sides Astronomy and University
Hands Exchanging coins(122) Currency and Code of Laws
Scholar's Cap Mathematics and Philosophy
Writing Quill(124) Alphabet
I couldn’t find the location of the $ in the game before, so finally I
said to hell with it, I’ll just find somewhere where it accesses it and hack
there. (It seems to only decipher the $ when it needs to and the encrypt/hide it as I had searched the entire range of program memory for it at various interupt points.) ... Anyways to make buying a unit/improvementt give you $32,000 (!!!) just do this:
Civilization CODE #14
+4E48 6E00B6FA->363C7D00
+4E6E 9750->3083
To make it give you $32000 whenever you sell anything (unecessary if yopu do
the first one, but the first one may be to much of a cheat for some people)
+5340 700AC1D0->303C7D00
+5352 D150->3080
of course these ruin the game, but hey so what you now know that you can
dominate the game and thus do not have to waste the rest of '93 playing it.
- courtesy of DOOM
Nemo’s cheat for Civilization! Sure the challenge of Civilization is the entertaining part of the game, but there's something to be said about nuking the shit out of the other guys. So, here's a cheat so that you can buy anything that’s being produced in your city without losing any money. Also it stops you from losing any money each turn by low taxes or whatever:
Change CODE 14 This patches the buying
Offset:$4E00 From: $6E12 To: $4E71
Offset:$4E48 From: $6E00 B6FA To: $4E71 4E71
Offset:$4E6E From: $9750 To: $4E71
Offset:$62F6 From: $9150 To: $4E71
Change CODE 13 This patches losing money each turn
Offset:$18B8 From: $6E00 0088 To: $4E71 4E71
Offset:$18DA From: $9150 To: $4E71
Nemo’s cheats for Civilization!
AKA - ‘Civilization Championship Edition’
Fifth Revision
Sure the challenge of Civilization is the entertaining part of the game, but there’s something to be said about nuking the shit out of the other guys. So, here’s a bunch of cheats that I made for ‘stress relief.’
i) Allows you to buy anything for your city without losing any money
ii) Stops you from losing any money each turn, for low taxes, or whatever.
iii) Allows you to see what’s under the black (where you haven’t been) on the map.
Unfortunately, you can't see other cities unless you’ve been there.
iv) Prevents Global Warming
v) Prevents you from losing any offensive battles.
Doesn't work for other people attacking you.
vi) Prevents losing troops and settlers from food shortages
Side effect - your cities don't grow.
vii) All items can walk on water!
viii) All boats can swim on land!
You can attack cities, but you can't take them over (yet).
ix) SuperTechnology - all technology takes one turn.
Enemy technology also takes one turn.
x) Airplanes can't run out of fuel.
xi) Build cities on water
xii) Troops can attack from boats or the water without landing
Change CODE 14 This patches the buying
Offset: $4E00
From: $6E12
To: $4E71
Offset: $4E48
From: $6E00 B6FA
To: $4E71 4E71
Offset: $4E6E
From: $9750
To: $4E71
Offset: $62F6
From: $9150
To: $4E71
Offset: $6316
From: $5350
To: $4E71
Offset: $6330
From: $5350
To: $4E71
Offset: $6354
From: $5350
To: $4E71
Change CODE 13 This patches losing money each turn
Offset: $18B8
From: $6E00 0088
To: $4E71 4E71
Offset: $18DA
From: $9150
To: $4E71
Change CODE 3 This patches the map
Offset: $3B28
From: $6712
To: $4E71
Change CODE 7 This patches the global warming
Offset: $5544
From: $6624
To: $6024
Change CODE 7 This patches the battles
Offset: $3DA
From: $672A
To: $602A
Offset: $40C
From: $662C
To: $4E71
Offset: $456
From: $6C06
To: $4E71
Offset: $590
From: $6E18
To: $4E71
Change CODE 14 This patches the food shortages
Offset: $37E8
From: $6600 0080
To: $6000 04AE
Offset: $6FE
From: $6600
To: $6000
Change CODE 11 This patches walking on water
Offset: $2118
From: $6600
To: $6000
Change CODE 11 This patches boats on land
Offset: $271E
From: $664A
To: $604A
Change CODE 14 This patches the SuperTechnology
Offset: $602C
From: $6C28
To: $4E71
Offset: $6046
From: $670E
To: $4E71
Change CODE 11 This patches the airplane fuel.
Offset: $3F74
From: $6C14
To: $6014
Change CODE 11 This allows you to build cities on water.
Offset: $1978
From: $6700 00DE
To: $6000 0096
Change CODE 11 This allows troops to attack from water.
Offset: $21FE
From: $662A
To: $602A
The two most useful cheats I know are:
1: Save the game before the last piece moves, then quit and start your saved
game. All your pieces will be able to move again.
2: Engineers can accomplish any one task in one turn if after you assign them
a task, you repeatedly click on them, wake them up, and reassign the task.
- CIVILIZATION V1.0.7
EFFECT: Select any item in the password dialog box.
HOW TO: LOCATE CODE RESOURCE 9
CHANGE THE WORD AT OFFSET 31C6 FROM 6662 TO 4E71 CHANGE THE WORD AT OFFSET 2D58 FROM 4267 TO 4E71 CHANGE THE WORD AT OFFSET 2D5A FROM 4EBA TO 4E71 CHANGE THE WORD AT OFFSET 2D5C FROM 0008 TO 4E71 CHANGE THE WORD AT OFFSET 2D5E FROM 548F TO 4E71
if you don't want to see the dialog at all you can change all the words between (and including) offsets 1D0C and 1F1C to 4E71.
For Civ 1.07 or 1.08, this completely bypasses the question dialog. In CODE 9:
Change the word at $2d4e from $4eba to $4e71
Change the word at $2d50 from $0014 to $4e71 Change the word at $2d56 from $6x08 to $6008
(I forget the actual value that x represents above, but it doesn't really matter.)
-•CIVILIZATION V1.0.7 & V1.0.8
EFFECT: Bypasses copy protection.
HOW TO:In CODE 7, at offset 410E, change the word 6624 -> 6024
-
Claris Impact
v1.0
0003119496
-
Claris Works
1120000
-
Coach & Coach Pro
1000001
1234567
(1st+6th digit=7th)
-
Collage
06-1405-6209
-
ColorIt
v2.0
CI20A-xxxxx
(Notice that it is
CI and not C1)
^-L one-^
-
Color Studio
CS27968
CS11305
-
Color Switch
v2.3.0
†To patch ColorSwitch 2.3.0 so you can register without a License Code,
If you want to reregister, erase the ColorSwitch License file (514 bytes) from the Preferences Folder.
-
Command HQ
†GetPassW +314 6?->60
or
- COMMAND HQ V1.0
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 7
CHANGE THE WORD AT OFFSET 0F0C TO 4E71
CHANGE THE WORD AT OFFSET 0F0E TO 4E71
-
Comment
1234567
(1st+6th digit=7th)
†v2.0
Search for: B02E FFFE 6604
Change to: " " " " 4E71
Search for: 4A28 0068 6600
Change to: " " " " 6000
Search for: 670C 206E 0008
Change to: 600C " " " "
This will cause it not to ever ask for name and serial number. if you really want a name and company name, type them in along with any serial number then use MacsBug to exit to shell (type ES at the prompt).
-
Compactor Pro
16225913
†v1.33
To register Compact Pro 1.33 and enable encryption, change:
CODE 4+$2EA4 From: 67 To: 60
When it asks you for the registration code, type any 8 characters. If you want to reregister your copy (to change the name), change any number of bytes in the CLOC resource (don’t change the size).
If you have a copy of Compact Pro 1.33 that won't enable encryption (if there’s an ‘*’ after your name in the about dialogbox and no ‘Set password…’ item in the Misc menu), make sure CODE 4+$2F44 is $66 (not $60) and reregister.)
Version 1.34
1) Open up the application with ResEdit
2) Open up the CODE resource
3) Open up CODE ID 3
4) Search for Offset 4856
5) Change 6718 to 6018
6) Quit ResEdit and save all changes
7) Open up Compactor Pro
8) Click Register
9) Type in a name and any serial number you wish
0) Now hit the return key!
Compact Pro 1.34 Krak
CODE 3
+47B8
6600 009E->4E71 4E71
+4856
6718 ->6018
or
For Version 1.34
Actually, here's a slightly better version of the crack. This one leaves the
Eliminates updating of the free trials left number, Get unlimited tries.
-
Copy II Mac
†To get rid of that stupid startup message in versions 4.3 to 5.2 change:
Search for:486E FECE 3F3C 0032 3F3C 003C
Change to: 6000 0204 " " " " " " " "
-
Cosa After Effects
XH9-SVJ1-B5K
-
Crash Barrier
v1.0?
1982487924
v1.1
852328092
1852328092
v1.03
†Open w/ resdit, change:
cdev+$14D4 From: 2F0E 4EBA FDFA To: 4E71 4E71 4E71
Worked for me (version 1.03).
v1.1
Change:
cdev -4064+$4724 From: 6606 To: 4E71
-
Creepy Castle
†V1.0 (ATTENTION: Patch also disables internal virus check!)
So that the password dialog will never show up change:
In file ‘Data A’
CODE 4+$3D4E From: 4E56 To: 4E75
CODE 3+$7176 From: 4EBA To: 7000
+$7178 From: E582 To: 7000
or try,
In file ‘Data A’
CODE 3+$57B6 From: 6704 7000 6050 To: 6054 7000 6700
This patch will disable the game's automatic virus checker for the mods and it’s shorter somewhat. This will also make it so the trivia dialog will never show up:
In file ‘Data A’
search for: 4EBA E582 3B40 A7C0
change to: 7000 4E71 " " " "
search for: 0C85 60EB 6953 670E
change to: " " " " " " 600E
or try,
To bypass the Trivia dialog in Creepy Castle, change:
In file ‘Data A’
CODE 3+$56FE From: 2F07 3F3C To: 6000 00B8
So that the built in virus checker doesn’t detect the change the code
checksum:
In file ‘Data A’
CODE 4+$3DA6 From: 60EB 6953 To: 2267 9A4C
-
Cribbage
†Search for: FA75 C74C 511
Change to: FB74 " " "
Search for: 6851 8EDF 775C
Change to: 6950 " " " "
-
Crimson Crown
†Search for: 2F10 4217 205F 4E90
Change to: 203C 99C4 5501 4E71
-
Crush Beta
tioga
(case sensitive)
†Search for:6704 7001 6002 7000
Change to: " " 7000 " " " "
Only search the resource fork. There are 5 or 6 places where this string can be found. You must replace all of them. When entering the “0” for the “1” in 7001, make sure to enter just one “0” and write each sector. That's it, happy crushing…
-
Cryptomatic
v1.01
346190
-
Crystal Caliburn
†CRYSTAL CALIBURN 1.0.2
EFFECT: Gets rid of the 'Your data file as been installed improperly dialog box.
HOW TO:
LOCATE CODE RESOURCE 2
CHANGE THE WORD AT 3510 FROM 6710 TO 6010
a hack that lets you play crystal calibourn on a 12" screen
(by doing this you can see most of your flippers instead of none.)
use resourcerer and open the 13" WIND template change to:
top 0 bottom 612 left 0 right 512.
it's not perfect but it is playable this way - it also lets you see the left
part of the game.
-
Curse of the Azure Bonds
†v1.0 (bw)
So that the password dialog will never show up, change:
CODE 7+$6772 To: 4E75
==========
v1.1 (color) (2/1/91)
So that the password dialog will never show up, change:
HOW TO: CHANGE THE WORD AT OFFSEA IN CODE RESOURCE 14 TO 4E75
[EH?!?!? Does some one have the offset?]
-
Cutthroats
†Search for: 6FDA 1006 6706 3B7C
Change to: 6004 " " " " " "
2nd Crack
Use Block Edit on block 44 and change byte 15D from 67 to 60 or try:
Move to block 002C, position 015D, change 67 to 60
-
Dark Queen of Krynn
†- DARK QUEEN OF KRYNN (ATTENTION: Patch also disables internal viruscheck!)
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 11
CHANGE THE WORD AT OFFSET 655A TO 4E71
CHANGE THE WORD AT OFFSET 655C TO 4E71 CHANGE THE WORD AT OFFSET 65B4 TO 4E71
- DARK QUEEN OF KRYNN V 1.0
EFFECT: Defeats password protection.
Works for b&w version, not tested for color. Patch 1.0
This keeps the password dialog, but it doesn’t matter what password you
use.
After the 3th try the program starts.
HOW TO: Locate code resource 15, change the word at offset $1DB6 from $4EBA to $4E71 and offset $1DB8 from $5586 to $4E71
You must type something as password
-
Daymaker
v1.0
59AINA4AAOAC1G
v1.01
59AINA4AAOAC1G
13A39ADAAHA1QU
v2.0
59AINA4AA0AC1G
0148D-0F68F9-1F100
†v2.03
If the installer does not recognize your disks as originals, simply make these
changes to the installer with RESEDIT. Open the Installer file and change:
infn 1001+$456 From: 6704 To: 6004
+$562 From: 6704 To: 6004
+$462 From: 6EDE To: 4E71
or try,
(This is a partial CRACK)
Open the 'DayMakerInstall' file with ResEdit: To make it think the disks are
real install disks, change:
infn 1500+$0004 From: 4EBA 00BC To: 4E71 4E71
infn 1001+$0030 From: 4EBA 0ABA To: 4E71 4E71
To allow anything as a serial number, change:
infn 1001+$019A From: 6F0C To: 600C
+$01B2 From: 6704 To: 4E71
Daymaker 2.0 - Allows anything for a serial number.
in the file "DayMakerInstall"
“infn” #1001 +$1B2 $67->$66
-
Datebook Pro
TB6I14233S2KE1CS
buvc0z9s8h1n7dab
-
dBase Mac
0000000-00
-
DeBabelizer
v1.2.15
APB120-2836-14690
MC14-2836-1001340
v1.4.02
MC14-2836-1001340
v1.5
MC14-2836-1001340
†CODE 8+$1CB6 From: 6710 To: 6010
-
Deja Vu
†Before making these changes, you must do the following:
(1) Sector copy with format, tracks 1 to 58 from the original.
(2) Then sector copy tracks 60 to 79. Track 59 hangs up on all copiers.
then change:
Search for: 56C0 671E 7200
Change to: 51C0 601E " "
Search for: 56C0 6722 223C
Change to: 51C0 6022 " "
Search for: 6708 41F8 00EC
Change to: 6008 " " " "
Search for: 6748 486E FDEA
Change to: 6048 " " " "
Search for: 56C0 6720 322D
Change to: 51C0 6020 " "
Search for: 57C0 670C 41FA
Change to: 50C0 600C " "
Search for: 57C0 6716 41FA
Change to: 50C0 6016 " "
-
Deja Vu (Rubicon)
†Search for: 6708 4EAD 019A
Change to: 6008 " " " "
Search for: 6706 1B7C 0002 F58B
Change to: 6006 " " " " " "
-
Delta Graph Pro
2000002464
v3.0
DGM3000900
-
Desk Toppers
†Search for: OC40 FFAF
Change to: " " 0000
-
DiagnoSYS
v1.0
B102131444366
-
DietMac
†v1.0
Search for: 4267 42A7 3F3C 0
Change to: 60FA " " " " "
-
Dimensions
v1.0
DAW100R3104865-875
DAW100R3100720-191
PCA100000100953
-
Director
v3.0
D300-31239-CP4U
D300-11114-CP4U
D300-12935-CP4U
-
DiskCopy
†v4.2
To get rid of the dialog box, change:
CODE 1+$150C From: 67 To: 60
-
DiskDup
†v2.3 & older
All you need is when at the “number of Copies” dialog field - just arrow key to the right of the number “1” and type 3 (three) blank spaces. This should register the application.
-
Disk Express II
JV103761
JE103744
JI103774
JV103735
JX103737
JX103763
JY103738
JZ103739
-
DiskTop
v4.0
06412
(any 5 #s)
v4.0x
(any 5 #s)
v4.5
0065449
-
DMS
†DMS+
Search for: 0C6D 0034 8990 6700 0618
Change to: " " " " " " 6000 " "
==========
DMS 4.0a (messy crack, but effective)
Search for: 4A5F 671A 4267
Change to: " " 601A " "
Search for: B06D 82B0 671A 4267
Change to: " " " " 601A " "
Search for: 101F 6602 A9F4
Change to: " " 6002 " " (3 times)
Search for: C001 6766 102E 0008
Change to: " " 6066 " " " "
Search for: B240 662E 486E
Change to: " " 602E " "
Search for: 4A6D CF12 6766 102E
Change to: " " " " 6066 " "
-
Dollars & Sense
† Block (Hex) Byte From To
--------------------------------
425 146 6704 4E71
0FC 6700 6600
468 1E0 487A 6606
If you do not find these bytes on these blocks, you may have to search the disk.
Dollars and Sense A
Move to block 00B8, position 017C, change 56C0 to 4E71
Dollars and Sense B
Move to block 01A9, position 0146, change 6704 to 4E71
Move to block 01A9, position 00FC, change 6700 to 6600
Move to block 01D4, position 01E0, change 487A to 6606
Dollars and Sense C
Move to block 019E, position 01EF, change to 4E71
Move to block 019E, position 01F1, change to 4E71
==========
v1.3
Search for: 0A00 0001 6768 3F3C 0102
Change to: " " " " 6068 " " " "
-
Double Helix
DHMC180800011V30R1
-
Double Talk
† Change serial number in DATA resourse near the line 3D0. The serial
number is not exactly the same, it’s swapped to avoid detection.
-
Douglas CAD AutoRouter
v7.30
†guaranteed - Just hit cancel when asked for key disk
Code #5 +25F8 670C->4E71
OR
unguaranteed - but high degree of certainty - no key disk request at all
Code #5 +25E8 4267->6010
-
Douglas CAD Professional Layout
v7.30
†guaranteed - Just hit cancel when asked for key disk
Code #2 +2832 670C->4E71
OR
unguaranteed - but high degree of certainty - no key disk request at all
Code #2 +2822 4267->6010
-
Down to Business
SSN719
-
Dragons Lair 2
†Search for: 426D 027A 0C6D
Change to: 4E71 4E71 " "
Be sure the folder format is EXACT! Put all files in a folder called DL2. The code is a 5 digit code, and this patch allows for any 5 digit combo. Even if you type a wrong serial code it will run the game anyway. Don’t forget to remove 32bit QuickDraw when running the game.
P.S. it hates MultiFinder. [and therefore probably bombs under S7?]
When your game is over. Just hit "0" to start over.
Another patch that will get rid of the jump to the serial code dialog box
Search for: 6100 04C2
Change to: 4E71 4E71
The patch seems to work just fine and without the code dialog you do not have to insert a code.
-
Dragon's Lair 3
† Unlike DL2, the DL3 app is buggy under certain circumstances. Even though the data files are installed on the hard disk, DL3 will try to look in the floppy drive, anyway!
Here's wathca do:
Copy file "disk1" to disk named “EscDisk1”
Copy file "disk2" to disk named “EscDisk2”
.
.
.
etc...
You might as well run it off floppies so copy “Escape” app to "EscDisk1" as well. DRAGON’S LAIR WILL NOW RUN FINE!
-
DragonWave
†v2.0
Open up the DragonWave 2.0 application and change:
CODE 18+$F5A From: 6720 To: 6020
-
Dragonworld
†Search for: 4EBA 0052 4A40 6748
Change to: 604E " " " " " "
-
Dreams of the Phoenix Fix
† Many DOTP programs DAs and FKEYS have trouble on the Mac II. In particular DA Installer + Q&D Terminal, Q&D Dialer, AVailable key, super note pad. The problems vary from minor inconvenience to crashing. This patch will fix them all. It won’t hurt them in any way :-)
Search for: 3082 2040 0000 4E75
Change to: " " " " A000 " "
has to do with self modifying code. Change all occurrences.
-
DX-7 Patch Editor
†v1.15
Search for: 8438 3F3C 0001 A
Change to: 76BE " " " " "
-
Earl Weaver Baseball
v1.5
†
-
EG Word
51122400002818
-
Elastic Reality
80862801118
-
Electric Checkbook
†v1.0?
Search for: 3E1F 206E FCF0
Change to: 4E71 " " " "
v1.1
Search for: 67DE 4A46 6728 487A
Change to: 4E71 " " 6028 " "
-
Elements of Style
ESM 113904 T
-
Empower
Name:Administrator
PW:Admin
vI & II
Name:Administrator
PW:Admin
-
Enforcer
v2.9 (Old)
876855327801
-
Ensemble
†v1.0
Read block 338 ($152) change bytes as follows
byte
1A from 67 to 4E
1B from 92 to 71
7E from 67 to 60
If the original bytes are not correct then perform the following searches:
Search for: 6756 4267 3F3C 0001
Change to: 6056 " " " " " "
Search for: 6792 2F0B A983
Change to: 4E71 " " " "
-
Eric's Ultimate Solitaire
†try using "Weasel" as your name
-
Evelyn Wood
†(versions .5 to 1.0)
Search for: 3444 3F3C 0001 A9
Change to: 256E " " " " "
-
ExperLisp
†v1.4
Search for: 670E 2FFE 0008 486E
Change to: 600E " " " " " "
Search for: 6738 486D F1DC A851
Change to: 6038 " " " " " "
v1.02
Search for: 6738 4860 F200 A851
Change to: 6038 " " " " " "
Search for: 670E 2F2E 0008 486E
Change to: 600E " " " " " "
-
F/A 18 Hornet
†Here are some of the cracks available for F/A-18 which may or may not work
with 1.1.2. Everything here except for the first one was taken from Patchlist
v2.4.
CODE 4 OFFSET 08E8: 6704 7000 -> 4E71 7001
(This one works for me with versions 1.1.2 and 1.1.3b1)
- F/A-18 HORNET 1.1.1
EFFECT: Removes serial#, lookup and unlock code requirement
HOW TO: CODE 4 OFFSET 275A: 4EAD 0CAD -> 4E71 4E71
EFFECT: Removes network serial conflicts (ARA network not checked)
HOW TO: CODE 12 OFFSET 7AAE: 6704 -> 6004
CODE 12 OFFSET 7ABC: 49C0 -> 7001
- F/A-18 HORNET
- To remove both serial number and password check.
- CODE 4, offset 08DA
- change 7000 1014
to 7001 6046
- CODE 4, offset 0944
- change 7000 1013 1239
to 7001 6000 00AC
(Definitely works for version 1.0 all the way up to 1.1.1)
- F/A-18 Hornet 1.1.0
EFFECT: Makes it possible to enter any word in the password dialog
HOW TO: LOCATE 'CODE' ID 4 FIND Offset $000B40
~From: 6598 7000
To: 6598 7001
- F/A -18 HORNET v1.1.0fc
EFFECT: Prevents the "Enter nth Word on Page p" dialog from appearing.
HOW TO: LOCATE 'CODE' RESOURCE 6 OFFSET $178C
CHANGE WORD
FROM $6600
TO $6000
- FA/18 HORNET 1.0.1
EFFECT: The program will never ask you the question. HOW TO: Locate CODE 6, Find offset $189E,
Change the word $6700 to $6600.
or
- F/A-18 HORNET 1.0.0
EFFECT: Makes it possible to enter any word in the password dialog
HOW TO: LOCATE 'CODE' ID 4 FIND Offset $000C30
~From: 0006 6604 7000 600C
To: 0006 6604 7001 600C
- F/A -18 HORNET v1.0.0
EFFECT: Prevents the "Enter nth Word on Page p" dialog from appearing. HOW TO: LOCATE 'CODE' RESOURCE 6, OFFSET $18EC
CHANGE WORD FROM $6600 TO $6000
F/A-18 HORNET v1.1.0
EFFECT: Prevents the "Enter nth Word on Page p" dialog from appearing.
HOW TO:
LOCATE 'CODE' RESOURCE 6 OFFSET $17A4
CHANGE WORD FROM $6600 TO $6000
F/A-18 HORNET v1.1.0
EFFECT: To remove both serial number and password check.
EFFECT: Removes serial#, lookup and unlock code requirement
HOW TO: 4 275A: 4EAD 0CAA -> 4E71 4E71
EFFECT: Removes network serial conflicts (I haven't checked ARA network)
HOW TO:
12 79C2: 6704 -> 6004
12 79D0: 49C0 -> 7001
[I _think_ the "4" and the "12" are for CODE 4 & 12]
F/A-18 HORNET 1.1.0
EFFECT: Makes it possible to enter any word in the password dialog
HOW TO:
LOCATE 'CODE' ID 4 FIND Offset $000B40
From: 6598 7000
To: 6598 7001
-
Faces
†Search for: 4240 4840 80FC 0030 4840 3D40
Change to: 4280 " " " " " " " " " "
It will ask you who beat Napoleon at Waterloo. The answer is Welling.
or try,
Here is the complete crack:
CRACK PATCH
Open Faces 1.0 with ResEdit and change:
CODE 3+$652 From: 486D 01CA To: 603A 4E71
+$694 From: FEED To: FED4
Open Color Faces 1.0 with ResEdit and change:
CODE 3+$7C2 From: 486D 017A To: 603A 4E71
+$804 From: FEED To: FED4
-
Fact Finder
†v1.0
Factfinder A
Search for: 6604 A002 6002 A003 3D40 0012
Change to: " " " " " " " " 4E71 4E71
Factfinder B
Search for: 670A 206E FEF6 2D50
Change to: 600A " " " " " "
Factfinder ?
Move to block 015E, position 016C, change to 4280
-
Fahrenheit 451
†Search for: 0C42 005A 6F00 0014
Change to: " " " " 4E71 4E71
The mod is (using FEdit) Sector 59 of the Fahrenheit 451 file - offset 39F (or if you like, Seg #2 of CODE) - change JSR (4EBA 00A0) to NOP's (4E71 4E71).
-
Falcon MC
†Game Controls:
Pause ------------------------------ P,Q,ESC
Return to Cockpit ------------------ Command R
Quit ------------------------------- Command Q
All Sound -------------------------- Command S
Music ------------------------------ Command M
Switch MouseSticks ----------------- Command T
Exiting the Simulation :
Abort Mission ---------------------- Command A
End Mission ------------------------ Command E
Eject ------------------------------ Command Option E
Jettison Keys :
Jettison tanks --------------------- Option T
Jettison all A-G stores ------------ Option K
Jettison ECM pod ------------------- Option C
General Controls :
Autopilot on/off ------------------- A
Chat ( head-to-head only ) --------- '
Ranging TWI on/off ----------------- H
View stores ------------------------ V
Waypoint increment ----------------- U
Waypoint decrement ----------------- Y
Detail Controls :
None ------------------------------- Command 1
Far Terrain ------------------------ Command 2
Gradient Horizon ------------------- Command 3
Mountains -------------------------- Command 4
Medium Terrain --------------------- Command 5
Complex Rivers --------------------- Command 6
Ground Detail ---------------------- Command 7
All -------------------------------- Command 8
Flight Controls :
Forward stick ---------------------- (UP ARROW), I, numeric keypad 8
Back stick ------------------------- (DOWN ARROW), M, numeric keypad 2
Left stick ------------------------- (LEFT ARROW), J, numeric keypad 4
Right stick ------------------------ (RIGHT ARROW), L, numeric keypad 6
Set narrow fisheye ----------------- F10, Option 0
- FALCON MC (v1.0.1)
EFFECT: The first time Falcon launches, it will quit immediately after you click your mouse to select items, but a good Falcon Settings file will be created for your macintosh without dialog showing up asking for documented answers. The following launches of Falcon will be successful with the correctsettings file.
HOW TO: Open CODE resource 1,
at offset 0041A4, change word to $4E71
Open CODE resource 21,
at offset 0009DE, change words to $4E71 4E71
at offset 0009E8, change words to $4E71 4E71 4E71
or
- FALCON MC 1.0.1
EFFECT: The program will never ask you the question.
HOW TO: Locate CODE 1, Find offset $3F48,
Change the word $6700 to $6000.
or
-•FALCON MC 1.0
EFFECT: The first time Falcon launches, it will quit immediately after you click your mouse to select items, but a good Falcon Settings file will be created for your macintosh without dialog showing up asking for documented answers. The following launches of Falcon will be successful with the correct
settings file.
HOW TO: Open CODE resource 1,
at offset 00430A, change word $6404 to $4E71
Open CODE resource 21,
at offset 000AA4, change words $4EAD 08BA to $4E71 4E71,
at offset 000AAE, change words $4EAD 015A A9F4 to $4E71 4E71 4E71
-
FaxSTF
v3.0
S200200
T100300
-
Feathers & Space
†Search for: 6706 38BC FFC2 600C
Change to: 6006 " " " " " " (6 times)
-
Ferrari Grand Prix
†v1.27
Search for: 0280 1234 FFFF 48E7 7FFE 41FA
Change to: 4240 21FC D9CD B903 0A80 4E75
-
Fetch
v1.0
51-1007-201194631
-
Field Assistant
8E06D026670F0550
-
File Buddy
v1.6.2
M526 E803 J1120
v2.04
BDK 689 JEM
†To reregister a registered copy, remove the prefs file.
or try,
This krak works for version 1.51 and 1.62 of FileBuddy.
You only need to search for the first four hex bytes of each step:
Search for: 6718 3F3C 0082 3F3C 0012 4EAD 038A
Change to: 6018 " " " " " " " " " " " "
Search for: 662A 3F3C 003F 486E FDC2 486B 0004
Change to: 4E71 " " " " " " " " " " " "
-
File Force
†1.0
X-442540368699
-
FileGuard
v2.0.2
Mike
v2.7.1
77151-111159-201238
00111-683277-201548
v2.7.2
67188-222480-206181
77151-111159-201238
v2.7.3
04264-904468-226561
†Change:
HIGH 5+$52 From: 4EBA 05E2 To: 4E71 4E71
This will block the whole routine ‘CheckLicence’ which checks if it is registered, and if another computer on the network has the same serial number.
-
File Maker
vPro
1120000
†(probably not for pro version…)
Search for: 6702 2854 200C 57C0
Change to: 6002 " " " " " "
FileMaker Pro 2.0 P/W Solved! (kind of)
Cool...is it a resource? If so, I'll run a ResCompare and see where the password sits in various files. Perhaps change the password by a small amount here and there, and hopefully come up with the methodology used to encrypt it...
Well, thanks to the clues I've figured out
how to find and eliminate FMPro passwords - and I've had a 100% success rate thus far (8 databases). I'm using SUM Tools (I know, I know, ancient but it works) which shows a 16-byte line of hex data.
What you should look for is the string 01FF. I think the reason
there was a problem, was because he was looking for XXXXXX01FF as his five unique bytes before the password. The first three DO change; 01FF seems to be common. Anyways, if you look for 01FF, you'll find a ton of them. You'll know you have password info when you see something like:
XXXX XXXX XX01 FF07 AAAA AAAA AAAA AAXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XX07 AAAA AAAA AAAA AAXX
Note: 01FF is what you're searching for
07 is the number of characters in this particular password
AAAA etc. is encrypted password data.
Note that 07 is mirrored two lines down. Change both the 07's to 00's, and that password is eliminated (it gets changed to '(no password)' in the selection dialog).
That's all there is to it! Keep searching and you'll get them all.
enjoy! And thanks to *TUC403* for doing the dirty work for me!
Nope, it's all in the data fork. I guess you could copy the data fork into a single resource, and use res-compare that way (I wrote my own compare routine, so haven't needed to try that. And... don't ask for it, it's a very poor hack, and I'd hate to show it to anyone!!)
Hmmm, I see that I'm going to have a late night hacking. The difference between what you've done here, and in the hack I was working on (the one that works 100% in FM II and Pro 1.0), is that there is also a single byte somewhere within the file that says "yes I do, or no I don't" have any passwords. Changing that 1 byte will make FM come up w/o asking for any passwords (just as if the file were not passworded).
Ok, I just came up with my notes, and here's what I found concerning removing passwords from FileMaker files...
FileMaker II (100% accurate):
Search String: C117 4002 01aa 42xx
The aa is data that doesn't matter (we just read it to move the pointer)
The xx is the password flag. Anything other than 01 means passwords exist, 01 means NO passwords
FileMaker Pro 1.0 (100% accurate):
Search String: C0C1 17C1 xx
The xx is the password flag. Anything other than 00 means passwords exist, 00 means NO passwords
FileMaker Pro 2.0 (75+% accurate):
Search String: C0C1 17C1 0540
Starting at the 40, replace with 42 0500 55AA 55AA C105 C0C0
so the line becomes:
C0C1 17C1 0542 0500 55AA 55AA C105 C0C0
That's it. I hope this helps anyone trying to crack it...
Ok, here's the crack for FileMaker Pro 2.0 files.
(it seems I was in the right area, but screwing
with the wrong bytes!)
He was partially right, in that you look for 01FF, and there are A LOT of them, but, if you look for 0301FF, there only seems to be ONE of them in the entire file, and this is the mark for the primary password! Look below...
______ xx
C0C10841 280301FF 0D385930 5E2B4A38
412F0200 00000008 01441642 0B4A1841
005F3DD8 00000000 0D185910 5EC0C0C0
xx
First, you search the database for 0301FF (I won’t get into which editor to use, but I use Norton). The following byte (in this case, 0D is a password length byte). Here, he was completely correct. Change this byte to 00. Next, 32 bytes away, you’ll see the same byte again, change it to a 00 also, an tada, it's fixed. Now, when you open the file, it opens straight up, without asking for a password.
The beauty of this method (over the one that I described earlier), is this still leaves all other passwords intact. The only difference, is that in the define passwords section, the main/primary password will show as (no password), and of course, you can change that. The previous method destroyed all passwords.
FileMaker Pro 2.0 Password revisited...
It appears that my previous post was a bit of “premature ejaculation,” uh, I mean “elation.” Every file I checked last night had the primary password preceeded by 0301FF, but files I’ve checked today don’t! One things for sure (so far) though, an 01FF followed by a byte, with that byte duplicated 32 bytes away, IS a password.
Here’s another wrench, I removed the passwords (using this method) from the Products DB file on here, it opened just fine, with FULL access to all fields, except that the Access Privs.. menu option is ghosted (non-selectable). I’ll have to play with that some more.
FileMaker Pro 2.0 P/W Solved!!!
Congrats! I'll check out the 03 trick right away... looks cool though; I’m thinking of writing a drag&drop that does just this. Worth my time, or will your Masterkey do this?
Bummer. Just read your message. I never had the access privs problem happen to me...strange indeed. I’ll look into it some more as well. I think the drag & drop is still very possible: Write a data fork search engine that looks for 01FF, then looks at the next byte, jumps 32 bytes and checks out the following byte. If it's the same as the byte following 01FF, then change both to 00. Ugh. Sorry, my brain hurts, and if that didn't make any sense then I’m not surprised.
Funny, though, did you check out the encoded passwords? I had a 7 character password of ‘aaaaaaa’, and it was encoded as:
C101 412B EA01 FF07 3455 3455 3455 34FF
FA48 6DC4 084E BAFA 943E 1F3D 4700 124C
DF00 C04E 5E20 5F07 1455 1455 1455 14C0
Interesting, no? It’s encoded as 3455 3455 3455 34 on the top line, and 1455 1455 1455 14 on the bottom. Also, I believe that the FF and C0 following the password is some kind of checksum (changing it brought up an error dialog when the database was being loaded).
That’s the same method I intend to use to find the p/w. I noticed that about the passwords last night... but haven’t been able to figure out the encoding (haven’t really tried though). I imagine if you gave a pw of “abba”, it should clue you in to something.
-
Filevision
†On block CE of the file Filevision, at byte 1B0 change 6604 to 4E71
or try,
Filevision Alternate Crack:
Search for: 6700 FEC6 (should be on Block 227, Byte 118)
Change to:..4E71 4E71
-
Finder 7 Menus
v1.3/2.x
cc5187efH28b911af
-
First Class Server
35058
v1.6
admin/password
vReg 5
100015
vTel 250 & CLUI
350058
vGateways
1000025
vWindows
1200597
vIPX
1300141
vReg 10 & Gateways
2100165
vReg 100 & Gateways
2100236
vTel 100 & Gateways
3000396
vTel 1000 & CLUI
4200000
-
First Things First
v1.x
101006058
101006048
v2.0
2001762695
v3.0
3001515541
3001677975
†Change CSEG 128+$6D3E From: 6716 To: 4E71
Restart after altering the Extension so that it will re-load the altered commands. Now it will accept anything as a valid serial number.
†If this expires you can get around it by changing:
CODE 24+$09D6 To: 4E71
+$09D7 To: 4E71
-
Foxbase
Serial #:FMD027877
Activate:emzxpyei
-
FrameMaker
v2.1
2-01320-27
2-01880-14
2-02071-17
v3.0
2-01320-27
2-01880-14
2-02071-17
2-150753-47
2-151967-07
-
FreeHand
v1.x/2.x
08-1004-0268684
v3.0
02-1235-002302134
02-3008-000036469
02-4008-200010087
02-6023-000345263
04-1000-000006699
11-1009-200021734
06-0001-100000000
02-0000-000000000
v4.0
xx-xxxx-xxxxxxxxx
02-1235-002302134
02-3008-000036469
11-1009-200021734
02-4008-200010087
12-1234-123456789
†To change or modify the name or serial number of a personalized copy of
Freehand 4 open it with Resedit and open the aldp resource.
Aldus employs this serialization scheme (xx-xxxx-xxxxxxxxx).
Any number from any Aldus product using this scheme will work.
-
Frogger
† They named the Frogger program “Finder” and made it invisible, locked, and Bozo bit set, so just use setfile and undo all three and copy it to your disk, and then set the original back to the way it was. Now you have Frogger as a single file!!! One note of interest: After each game it executes the file named “Finder” Since that was what it was called. So if you don’t want to have to reclick on it everytime you want to play, then make sure the Frogger program is named Finder.
[One thing of note, under System 7, the Bozo bit is now the stationary bit (like any one used the Bozo bit anymore…). Since you can’t execute stationary :-), I don’t know how this will affect the program. Of course, it probably doesn’t work on System 7 anyways…]
-
FrontDesk
†Search for: 4EAD 046A 101F 675C
Change to: 4E71 4E71 " " 4E71
-
Frontier
v1.0
ULF.10108.100
-
Full Impact
v1.1
0000000-00
(XXXXXXX-AA X=any #,
AA = sum of x's)
-
FullWrite Pro
v1.x
0000000-00
(XXXXXXX-AA X=any #,
AA = sum of x's)
PN=1013409103 SN= 8052167-29
-
Fun Pak
†Search for: 4A5F 6708 48
Change to: " " 6008 "
-
Futuria
†Finder copy all the Files on the Futuria disk and then take Fedit to the file
Futuria.
Search for: 4EBA FC18 205F 4EFA FE16
Change to: 4E71 4E71 " " " " " "
or try,
Search for: 3CBA 000C 4EBA
Change to: 4E71 4E71 " "
-
FWB HD Toolkit
v1.1 - 1.3
10033B7E
10829C7I
10000B9S
(^-FWB’s :-) )
v1.4 - 1.5
J51332B3S
v1.2.1PE
P58115C71
†HDT PRIMER
Search for: 6714 2F3C 0000 121F
Change to: 6014 " " " " " "
0r
HDT PRIMER Version 1.2.1
CODE 2+$1B82 From: 6714 To: 6014
HDT WORLD CONTROL
Search for: 6712 486D E46C 2F3C
Change to: 6012 " " " " " "
Or
HDT WORLD CONTROL Version 1.2.1
CODE 2+$107C From: 6720 To: 6020
+$134C From: ???? To: 6012
^^^^--(might be 6712?)
-
FWB CD ROM Toolkit
v1.0/1.01
C34012798
v1.0.3
C12348678
N90307999
†FWB CD 1.05
The personalization information is stored in the resource 'Font' ID
-4048, which must always have a size of 148. The first byte is the
length of the name, and the name is encrypted by XORing the bytes by $93.
The byte at offset $40 is the length of the organization and, the
subsequent bytes are the organization itself, encrypted by XORing the
bytes by $7C. The byte at offset $80 is the length of the Serial Number,
and the subsequent bytes are the serial number itself, encrypted by XORing the
bytes by $E9.
The crack so that the serial number always looks good is: Open it up in
ResEdit Open up the resource 'cdev' ID -4064 Change it at offset: $56DA
From: $59FF To: $5A00
FWB CD ROM Toolkit 1.0.3
The serial number for 1.0/1.0.1 doesn’t work in 1.0.3. Here’s how to crack it (or you can just use the 1.0.3 Serial Number):
The personalization information is stored in the resource 'Font' ID - 4048, which must always have a size of 148.
The first byte is the length of the name, and the name is encrypted by XORing the bytes by $93.
The byte at offset $40 is the length of the organization and, the subsequent bytes are the organization itself, encrypted by XORing the bytes by $7C.
The byte at offset $80 is the length of the Serial Number, and the subsequent bytes are the serial number itself, encrypted by XORing the bytes by $E9.
The crack so that the serial number always looks good is:
cdev -4064+$56DA From: 59FF To: 5A00
Now any serial number in the correct format except C34012798 will work!
The personalization information is stored in the resource 'Font' ID -4048,
which must always have a size of 148. The first byte is the length of the
name, and the name is encrypted by XORing the bytes by $93. The byte at offset $40 is the length of the organization and the subsequent bytes are the organization itself, encrypted by XORing the bytes at $7C. The byte at offset $80 is the length of the serial number and the subsequent bytes are the serial number itself, encrypted by XORing the bytes by $E9.
The crack so the serial number will always look good is:
Then using MacZap 3.0, read block E6 using Address marks of D5ADAD (I think).Change the Address marks to the normal marks and write the block back to the disk. Use Fedit to write the changes to the code and unprotect,unlock & make visible the file CTEX.
2nd Gato 1.2
Search for: 4A01 6700 0006 4EAD
Change to: " " 6000 " " " "
==========
v1.3:
Search for: 6B00 00F6 203C 0000 0258
Change to: 6000 " " " " " " " "
==========
Gato
Search for: 4A01 6700 0006 4EAD
Change to: " " 6000 " " " "
-
Geometry
†Search for: 4E71 4E71 4E71 4E71 0280 ABCD
Change to: 4240 21FC 9FFB B503 0A80 4E75
-
GIF Converter
v2.2 (& up)
162-37-77-f4-de-a8-8b-b2
862-37-77-f4-de-a8-8b-b2
-
Go
†1.02
Go Questions:
The first golden age in the history of Japanese Go occured in which century?
17
Traditionally, the stones used in the game of Go are kept in what kind of containers?
bowls
The high quality white stones in the game of Go are made from what substance?
clam shells
Traditionally, the black stones in the game of Go are made from what substance?
slate
What is the term for mutual life in the game of Go?
seki
The Go game board 19 x19 has 361 positions called what?
points
What does one player say to the other when making a play that threatens capture of opponent stones?
atari
In what month and year was the first international computer Go competition held in Taiwan?
November 1986
Where are the first four handicap stones placed at the beginning of a game of Go?
Make these changes to a sector copy and then bit copy track#4 with any bit copier.
-
Hayden SAT
†Search for: 6608 45FA 003A
Change to: 4E71 " " " "
Search for: 6610 3F3C 0000
Change to: 4E71 " " " "
-
Hayden Speller
†Search for: 225F 508F 4ED1 4E56 FFC0
Change to: " " " " " " 4E71 4EF9 0000 E888
or try,
Search for: 4E56 FFC0 41EE
Change to: 4E71 6000 0AA8
or try
Search for: 4EBA 02BA 2E1F 4E5E
Change to: 4E71 4E71 " " " "
or try
Search for: 2007 0A00 0001 6700
Change to: 4E71 7000 " " " "
-
Hearts
†v2.2
Using TeachText, create a file named 'RP' that contains the word ‘Hearts’. Put this together with the files from the Hearts disk on a HD.
Hearts will not work on a floppy. It must be on a hard drive to work because on a floppy, it thinks there is a disk input output error (-36) when it trys to read the RP file. The original copy protection wouldn’t let you copy the RP file from the floppy using the finder or other file copying programs. Hearts checks this file and its contents to see if you have a valid copy. You had to bit copy the whole disk to make a copy. Although a normal copier couldn’t read the file, the Hearts program could but only if it was on the protected disk. It can’t if it was on an unprotected disk because it uses a different driver meant for the protected disk. This limitation doesn’t apply to the hard drive though.
There is one major bug: you can’t insert a disk after you start Hearts until you restart the Mac because the Mac will crash.
If Hearts doesn’t work on your Macintosh because it crashes at MCOD 45+$42, try changing MCOD 45+$3E from 6A to 60. This will skip over the part:
+$42 MOVE.B #$D5,$00FCC0E1
+$4A MOVE.B #$AA,$00FCC0E3
The address $FCC0xx is probably hardware I/O addresses for the old Macs. I couldn’t figure out what the $FCC0xx was for the new ones. These addresses are not the same on all Macs and programs that use them are bound to crash on some Macs.
This program works only under System 6.07 or earlier, not under System 7.0.
-
Heaven & Earth
†Search for: 671E 0C79 FFFF
Change to: 601E " " " "
Search for: 4EAD 0AEA 508F
Change to: 4E71 4E71 " "
The preceding patch was installed in the 13” color version after the install.
-
Helium
v2.0.2
40859
v2.1.1
2020-3000
† To register Helium 2.0.2, copy the cdev from the patched Helium cdev resource file (found elsewhere) into your Helium control panel replacing the old cdev. After quiting ResEdit, open Helium. If it wasn't registerred already, it will give an alert telling you what the registration code is. It will display the same alert if you type in the wrong code. To reregister under a new name or reset the 15 day limit on unregisterred copies, erase the preferences file in the preferences folder.
-
Hellcats
† I hacked into Hellcats to get rid of that annoying cp box. Load up Symantic Tools or the like and open a COPY of Hellcats and change:
(if this doesn’t work, try leaving that last word at 5257)
-
Holiday Lemmings 1993
†- HOLIDAY LEMMINGS 1993
EFFECT: Gets rid of passwords for individual levels
HOW TO:In CODE 3, at offset 0xD80, replace exactly 88 bytes
(11 lines in ResEdit's general editor) with the following 88 bytes
(11 lines) of garble:
48E7 1F18 47ED CEAE
4245 101B 0C00 0030
6D14 0C00 0039 6E0E
4880 0440 0030 CAFC
000A DA40 60E4 0C45
0020 6E1A 4A45 6F16
5345 3B45 DC58 2005
48C0 81FC 0010 3B40
DC88 7001 600A 426D
DC58 426D DC88 7000
4CDF 18F8 4E75 4E75
You'll probably want to update the corresponding dialog to make the prompt more appropriate. I changed item 4 of DITL 2001 to read "Enter level number (1 = Flurry 1, 17 = Blizzard 1):" so that I won't forget this is a patched copy.
-
Home Accountant
†Search for: 4A6E FFFE 6D08 1D7C 0001 000C
Change to: 4E71 4E71 4E71 " " " " " "
Search for: 0240 0001 6700 FF74 3F3C 0FD2
Change to: 303C " " " " " " " " " "
==========
v1.02
Search for: 6D08 1D7C 0001 000C
Change to: 4E71 " " " " " "
Search for: 302D FE34 B06D
Change to: 302D FE32 " "
Search for: 662C 4267 2F0E 4EBA
Change to: 4E71 4267 2F0E 4EBA
-
HyperCard
†HyperCard 2.1
Remove password protection from HC stacks!
Just the IDEA that some bozo put in a password... ARGH! I have a problem with that. In your HyperCard 2.1 file:
Search for: 6704 6000 02A2 42A7 3F3C 008C 42A7
Change to: 60 " " " " " " " " " " " " "
for HC to accept any password you give it, and let you into the protection dialog (remember, to get pswd. dialog in a protected stack, hold CMD while choosing Protection from File menu).
You can still assign pswds to stacks you make, and the pswd protection will still work on other people’s HCs, unless they have also applied this Kpatch.
==========
2.0 Light (the copy that [used to] come with your mac)
To gain user level five do the following:
In the first card of the HomeStack: Hit [Command] + M
Type:go cd "User Preferences" [enter]
magic [enter]
Select Level Five (Scripting)
(They hid half the user levels with an opaque button over UserLevel 3,4,5)
NOTE: This does not work with Hypercard Player, which doesn’t allow Userlevels 3, 4, or 5 at ALL. Boo...
-
HyperStudio
101M-101392
-
I know it's here someplace
†Search for: 6700 0106 4267 3F3C
Change to: 6000 " " " " " "
Search for: 6602 7C01 6000 FF62
Change to: 4E71 " " " " " "
-
Illustrator
v3.0
AAW3021019783
v5.0
AAW30210197831-337
AAW500U3105408-140
AAW500U7106717-802
AAW500R3102631-456
AAW500R3102632-373
AAW500U3106069-338
AAW500U7104713-896
AAW500U3106121-969
AAW500U3118733
AAW500U3101332
AAW500U3126375
AAW500U3127582-773
-
Image Express
†Search for: 3B5F F33A 4A6D F33A 6622
Change to: " " " " " " " " 4E71
Search for: 4EAD 0B62 4EAD 166A 4EAD 16DA
Change to: 4E71 4E71 4E71 4E71 4E71 4E71
Search for: 4EAD 257A A9F4 4E5E 4E75
Change to: " " " " 4E71 " " " "
Projector:
Search for: 4A6D FDCE 664C 4EAD 056A
Change to: " " " " 4E71
Transporter:
Search for: 3B5F FBB8 4A6D FBB8 6600 01E6
Change to: " " " " " " " " 4E71 4E71
Search for: 57C0 4A00 6700 010E
Change to: " " " " 4E71 4E71
-
In Control
v2.0
0000-0000000-0
-
The Incredible Machine
†Password 'awe' - this password works for every level
Here is a little help for those of you currently playing "The Incredible
Machine". Of the total number of 160 puzzles, the following passwords
are for the first forty.
01. (NR) 11. BASEBALL 21. COUNTDOWN 31. COMPACT DISK
02. SIERRA 12. BEAR 22. PSALMS 32. SHAVER LAKE
03. DYNAMIX 13. FISH 23. TANK 33. RHEUMATISM
04. MACHINE 14. DALE 24. NIGHT 34. HARPSICHORD
05. DISK 15. CHESTERTON 25. GAMES 35. MARKET
06. SHUTTLE 16. SIZE 26. WESTERN 36. DEST
07. SATURN 17. IRELAND 27. LOG HOME 37. MYRTLE
08. KING 18. WORD 28. GRAPHICS 38. QUATERNION
09. DRAGON 19. BRIEF 29. KNUTH 39. SHOE
10. ANTS 20. HOT DOG 30. DONALD 40. FLOWER
-
Indiana Jones and the Last Crusade
†- INDIANA JONES AND THE LAST CRUSADE V5.1.6 (Mac 1.7 8/17/90)
EFFECT: This is a patch with which I can Save and Open File at any moment HOW TO: Find Resource CODE 6 :
Replace all the occurences of (there are 4 occurences)
EXT.W D1 | 4881 MULS.W D1,D0 | C1C1
with
EXT.W D1 | 4881 MOVEQ #$01,D0 | 7001
[this patch seems different from others so I would be interested in knowing what
Talk about reusable code, these guys reused half the friggin program or more, including, hilariously enough the same copy protection routines down to the byte (ie they were compiled from the same source with the same version of the compiler) the only difference was at link time apparently. Thus these code changes are for CODE #72 for Informed Manager, and CODE #79 for Informed Designer 1.3.3
To simply run the program without personalization (from unpersonalized copy obviously) change
+D72 6600->6000 (believe it's personalized)
OR:
if you want it personalized then follow these steps:
1: change +F18 6642->6042 (allow anything for serial # when personalizing)
2: run the program and personalize (use anything you want for a serial #), Quit (duh).
†To get to administrator mode type Command-Option-A
-
Kid Pix personalization
†Well, I know it's not a crack per se, but if anyone has a copy of Kid Pix with some other kid's name on it (other than your own kid's name, not your name, that is… Kid Pix IS for kids =) ), you can remove/change it in the following trivial Resedit hack:
Open the kID resource, open the one resource inside it, and you should see a short chunk of hex. The first digit is the number of letters in the name, and the rest of the string is the name. To change it, hilite the ASCII on the right hand side and type in the name you want ENCRYPTED in this ultra-secure, defense-department standard code: shift each letter one to the right (i.e., JOE becomes KPF)
-
Kid Talk
†Search for:6730 3F3C 0002
Change to: 6030 " " " "
Search for: 67B4 426D F750
Change to: 4E71 " " " "
or try
Search for: 6602 5200 5901 6AF4
Change to: 6018 " " " " " "
-
King’s Bounty
†v1.0
CODE 2+$47E4 To: 4E71 4E71
or try,
v1.01
Search for: 4EBA FB96
Change to: 4E71 4E71
or try,
v1.01
Search for: 4EBA FBA6
Change to: 4E71 4E71
Here's a little trick to get more gold, leadership, and commission…
Open one of your saved games.
with Norton, go to Sector 8 of your file.
On line 160: XXXX AAAA BBBB CCCC
the A’s and B’s are your leadership, put the same value in each, the C’s are
your commission/week. Yes, there is a 64K limit to your leadership and comm.
On line 448: AAAA AAAA
all the A's are your gold, just put 0F in the first AA and you'll have about
250 million.
-
Kiwi Envelopes
v3.x
KE301120RA
KE304244RC
KE311870RK
KE311120RA
-
KiwiFinder
v1.0
VB1011672KF
KE304244RC
KE301120RA
KE311120RA
KE311870RK
-
Kiwi Power Windows
10KPW002996b
†with ResEdit, in the second "LDEF" (ID 27420(?)), change the first four bytes
from "FFFF FFFF" to "0000 0000". You will now be able to postpone registering
at startup. Each time you start-up you have to postpone again.
-
KPT Gradient Filler
KPT273
(unlocks expert mode)
-
Kung-Fu Chivralry
†The continue password for Kung-Fu Chivralry is 90179240. This number is stored in hex format at CODE 5+$4EE2 and occupies 4 bytes. To make it so that you can continue no matter what you type, change:
CODE 5+$4EE8 From: 6600 0070 To: 4E71 4E71
If you do this and you don't want to continue, just type Command-Q and the current game will end and the program will go back to the main screen.
-
LabView
v2.2.1
SN 27645; PN 4224446-24
-
Legacy
†Search for: 6702 604C 4EAD 0112
Change to: 6002 " " " " " "
Search for: 670C 487A 00CC 4EAD
Change to: 600C " " " " " "
-
Lemmings
†v1.4.2
CODE 2+$1DE0 From: 6DC4 To: 4E71
+$1DE6 From: 6610 To: 6010
Lemmings Codes
Rating: FUN Rating: TRICKY Rating: TAXING Rating: MAYHEM
EFFECT: The Copy-Protect dialog will still come up, but you can press return
to bypass it now. Don't enter anything in the box or it will give you the standard message that the code isn't correct.
HOW TO: LOCATE CODE ID=2 FOR 5A83
CHANGE 5A83 TO 0000
- LEMMINGS
EFFECT: Omits the dialog box
HOW TO: LOCATE CODE 3
CHANGE WORDS AT OFFSET $2588 WITH $302D DB60.
- LEMMINGS
EFFECT: The quiz dialog will show up but anything will be valid HOW TO: Locate code resource #2
Change the words at offset 1F58 from B06D DB60 670C to 3B40 DB60 4E75
-
Leprechaun
v3.0
68uwxw58
(case sensitive)
†v3.0
CODE 6+$292 From: 4EBA To: 6062
-
LetraStudio
†v1.5
rename font to "Stand Font (Corinthian Bold)"
-
Lexi-Cross
†CODE 5+$05AE From: 67 To: 60
or try,
CODE 5+$05AE From: 67 To: 60
+$0590 From: 4EBA 227C To: 4E71 4E71
Now you don't even have to hit <CR>
-
Liaison
v3.0
40026825185
40063496992
40063576094
v2.0
40026825185
40063496992
40063576094
-
Life and Death
†v1.01
CODE 2+$5842 From: 674A To: 604A
-
LightSpeed C
†Ser. # Removal
In case you might need it, the serial number is hidden in the Lightspeed C file sector offset 281, byte 320 in decimal ASCII, you can’t miss it.
-
Lock Finder 5.0 & above.
†
Search for: 3C38 0210 BE6D FF16 6730
Change to: " " " " " " " " 6030
Search for: 3C38 0210 BE6D FF16 674E
Change to: " " " " " " " " 604E
-
Lode Runner
†Search for: 6058 4EBA 00EA
Change to: 4E71 " " " "
Search for: 7E01 602E 4FBC
Change to: 7E1C " " " "
Lode Runner (new)
Search for: 6100 EBE6 42A7
Change to: 4E71 4E71 " "
-
Luscher Profile
†Search for: 3DF1 9C0F 2E
Change to: 5C37 0227 8B2C
-
Mac+ ][
†Search for:6700 0250 2C7C 0001 8000
Change to :4E71 4E71 " " " " " "
Mac+ ][ 3.0
Search for: 6700 0250 2C7C 00
Change to: 4E71 4E71 " " "
-
Mac a Mug
†Search for:4569 2487 18D6
Change to: 24AF BAA3 0A42
Search for: 31E3 70F7 C897
Change to: 36E3 " " " "
-
MacAttack
†1.0
Move to block 002F, position 0174. Change 67FA to 4E71
MacAttack 1.4
USE MACTOOLS, AND UNLOCK, UNPROTECT, AND MAKE VISIBLE ALL FILES. THEN, USE FEDIT, OPEN UP 'PLAYFIELD1'. Find 67FA 4EAD and change to 4E71 4E71 COPY THE FILES OVER USING MACTOOLS (LOCKED DISK) AND COPY PLAYFIELD1, SYSTEM & THE TWO FILES SCORES & STEMP,YOU NEED THEIR SYSTEM BECAUSE IT HAS TEN FONTS FOR THE GAME. YOU CAN, IF YOU WISH, TAKE THIS FILE AND USING RESEDIT, COPY THE FONT FILES FROM THE SYSTEM AND THEN PASTE THEM INTO PLAYFIELD ONE. THEN YOU MAY USE ANY SYSTEM FILE.
MacAttack 1.6
Search for: F49E 67FA 4EAD 023A 41ED
Change to: " " 4E71 " " " " " "
-
MacBackup
†v2.3
Search for: 6700 0026 317C 0001
Change to: 6000 " " " " " "
==========
v3.0
Search for:4EBA 0170 4A40 6700 0016 4EBA
Change to :4E71 4E71 " " " " " " " "
==========
v3.5
Search for: 4EBA 0170 4A40 6700
Change to: 4E71 4E71 " " " "
-
MacBZone
†- MACBZONE 1.3.1
EFFECT: Remove the serialziation dialog box
HOW TO: Locate code resource #3
Change the byte at offset 2A80 from 67 to 60
Run the program and hit return at the serialization dialog,
leaving zeros in both fields. You'll never be bothered again.
EFFECT: Free serial number from author
HOW TO: Use Serial: 5000
Access code:48406914
-
MacCommand
†Search for: 4EEA 0010 31FC 0001
Change to: 6000 E8F4 " " " "
Copy files MC, HIscore, and startup screen and MCScreen.
1. Using MacZap Tools, Change data marker to D5 FC AD, then read block 3A hex from original.
2. Change marker back to default (D5 AA AD), then write block to sector copied disk.
-
Mac Edge
†Search for: 4EAD 00E2 4A6D FA48 6624
Change to: 4E71 4E71 " " " " 4E71
Search for: 4EAD 00C2 4A6D FD14 662C
Change to: 4E71 4E71 " " FA48 4E71
Search for: 4EAD 00C2 4A6D FD9C 662C
Change to: 4E71 4E71 " " FA48 4E71
Search for: 4EAD 00D2 4A6D F534 6624
Change to: 4E71 4E71 " " FA48 4E71
Search for: 4EAD 00C2 4A6D F828 6624
Change to: 4E71 4E71 " " FA48 4E71
Search for: 4EAD 00E2 4A6D F81E 6624
Change to: 4E71 4E71 " " FA48 4E71
Search for: 4EAD 00DA 4A6D E652 6624
Change to: 4E71 4E71 " " FA48 4E71
Search for: 4EAD 00D2 4A6D EC06 661C
Change to: 4E71 4E71 " " FA48 4E71
==========
MacEdge II
Search for: 672E 4267 487A
Change to: 4E71 " " " "
Search for: 6752 4267 487A
(The rest is missing, pure speculation, but the next line might be:
Change to: 4E71 " " " "
But that’s a guess…)
-
MacEKG
v2.0.6
12345Z9L2416
-
MacFATS
†v1.0
Search for: 6600 00E4 3F3C
Change to: 6000 " " " "
-
MacFerret
Marty
-
Mac Fortran
†Search for: 6700 000A 43FA
Change to: 6000 " " " "
Search for: 6602 604C
Change to: 4E71 " "
==========
v2.0a
Search for: 361F 6616 487A 0C54
Change to: " " 4E71 " " " "
Search for: 6602 604C 3F3C
Change to: 4E71 " " " "
Search for: 0016 A017 4A39
Change to: " " 4E71 " "
==========
v2.0b
Search for: 6100 FF22 6600 0016 47A0 6B4
Change to: 4E71 4E71 4E71 4E71 " " 6B4
-
MacGammon/Cribbage
†Search for: FA75 C74C 511
Change to: FB74 " " 511
Search for: 6851 8EDF 775C
Change to: 6950 " " " "
-
Mac Golf
†Search for:21C2 022E 4A40 6700 002E
Change to: " " " " " " 6000 " "
MacGolf (font Change for nonstandard System)
Search for: 487A 04EF 487A FFE4 A900
Change to: 4E71 4E71 4E71 4E71 4E71
Search for: 3F3A FFDE A887 3F3C 000E A88A
Change to: 3F3C 0189 " " " " 000C " "
-
MacIndexer
†v1.0
Search for: 6700 00EA 486D F9
Change to: 6000 00EA 486D F9
-
Macintercomm
vLite 1.1.1
v1.1b21
ToasT (case sensitive)
†Open MacIntercomm Lite 1.1.1 with your favorite resource editor and
Find: CODE resource 2.
Find: hex offset 0B7E
change 4EAD to 4E71 and 1382 to C080
-
Mac Jack II & Poker
†Works on both games.
Open ‘Finder’
Search for: 2007 4FBC 00FF
Change to: 6016 " " " "
Rename ‘Finder’ to whatever. You will have to use Fedit or Mactools to rename as the Finder does not allow itself to be renamed from the desktop.
(To Change the routine that ejects and make it exit to the Finder, useful on Hard Disks)
Search for: A017 3D40 000E 4E5E
Change to: A9F4 " " " " " "
-
MacLabeler
v1.0
Search for: 0002 2E4E 4D00
Change to: 4002 " " " "
-
MacLink
v6.0
00678935
v7.5
603050-1601
204612-7000
-
MacMatch
†Search for: 6616 4267 6016
Change to: 6716 " " " "
or try,
Search for: 4EBA 0690 101F 6702 A9F4
Change to: 4E71 4E71 " " 6002 " "
-
Mac Pascal
†Move to block 0209, position 0039, Change 41EE to 6000
Move to block 0209, position 003B, Change FFB0 to 008A
Move to block 0229, position 0105, Change 41EE to 6000
Move to block 0229, position 0107, Change FFB0 to 008A
Move to block 024B, position 01FB, Change 41EE to 6000
Move to block 024B, position 01FD, Change FFB0 to 008A
(Disk vs. file level)
SECTOR COPY THE DISK, THEN PERFORM THE FOLLOWING PATCHES..
SEARCH DISK FOR 41EE FFB0 Change EACH TO 6000 008A
(I FOUND IT IN ABOUT 8 PLACES)
SEARCH FOR B26E 0008 6702 60
TO 60
(FOUND ON 2 BLOCKS)
MacPascal V2.0 'Beta Plus'
Search for: 61 00 00 62 66 00 00 0A 61 00 00 C2
Change to 40
-
MacPassword
v3.8.7
Nov301954May261951
v3.8.8/3.9.0
Nov301954May261951
v4.0
†Krak for MacPassword Package 4.0.0:
****************************************
MacPassword™ Utility:
Locate CODE 2 offset 07C8
Change 663E to 4E71
Run MacPassword™ Utility and enter any text into the serial number field.
Quit the application and
Search for ALL instances of 4A2D FA3B 67
Change ALL instances to 4A2D FA3B 60
************************
MacPassword™ CDEV:
Search for ALL instances of 4A2C 6301 67
Change ALL instances to 4A2C 6301 60
****************************************
MacPassword™ INIT:
Search for ALL instances of 4A2C 6BB2 67
Change ALL instances to 4A2C 6BB2 60
****************************************
I suppose it does not matter, but just so you know for future reference should an update be released that does not work with this krak:
The routine to check if time has run out on the demo version calls the
following code: 7C3C 9C80. This loads up 60 (as in 60 days left to register)
and subtracts from it how many days have passed since it was first run. So change the 9C80 to 4E71 and you will forever have 60 days to register. You will probably have to do this to all three parts.
-
MacPlot
v1.6
Search for: 6738 4267 3F3C
Change to: 6038 " " " "
==========
MacPlots // 1.01
Search for: EBAF D364 2A7
Change to: 4E71 4E71 2A7
-
MacPublisher
†(mounted as 1st volume)
Search for: 316E 0014 0016 4268 001C A007
Change to: 317C FFFF " " " " " " " "
(mounted as 2nd volume)
Search for: 316E 0014 0016 4268 001C A007
Change to: 317C FFFE " " " " " " " "
==========
v1.25
Search for: 4EAD 0552 41ED 0552
Change to: 4E71 4E71 " " " "
==========
v1.3
Search for:6760 102D FF22
Change to: 6660 " " " "
Search for: 6626 102D FF22
Change to: 6726 " " " "
Search for: 6606 197C 0001
Change to: 6706 " " " "
==========
MacPublisher II 2.0
Search for: 8310 2DFF 0E67 24
Change to: " " " " 0E60 24
Search for: 1F0A 0100 01C0 0167 00
Change to: " " " " " " 0160 00
-
Mac Racquetball
†For harddrives. Enable you to use MacRacquetball on it without the reset.
Search for: D8FF 6C00 007A 4267
Change to: " " 6000 " " " "
Search for: 4EBA 5E92 91C8 317C
Change to: 4E71 4E71 " " " "
-
MacRenderman
v1.3
978862966
-
MacRISK
†Patch for Mac II, 1-bit mode ONLY:
Search for: C1E8 000C 48C0
Change to: " " " " 4E71
I don’t know what the programmer was trying to do, but the above patch will allow MacRISK to work on the Mac II without ExitToShell happening all the time. All it does is replace an EXT.L D0 with a NOP. D0 was already in long form from the result of a MULS and on the Mac II the EXT.L was making D0 go negative. Not too good for a handle size… (Try running it in 1 bit mode if you have problems)
The above patch will _ONLY_ work in 1 bit mode. To make MacRISK work in all modes on all Macs do the following long patch:
Search for:
4E56 FFFC
486D FBCC A910 XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX 4E5E 4E75 5341
Change to:
4E56 FFFC
486D FBCC A910 203C 0000 5080 A122 4A40
6702 A9F4 2B48 FBC8 A029 206D FBC8 2050
2B48 FBBA 3B7C 0040 FBBE 2B7C 0014 0000
FBC0 2B7C 0156 0200 FBC4 206D FBCC 4868
0002 486D FBBA 486D FBC0 486D FBC0 4267
42A7 A8EC 4E71 4E71 4E71 4E71 4E71 4E71
4E71 4E71 4E71 4E71 4E71 4E71 4E71 4E71
4E71 4E71 4E71 4E5E 4E75 5341
This patch completely rewrites the “save the bits” routine. If you really want all the details disassemble from "SAVESCRE"+0 to see the new code.
-
MacRobots
†Search for: 3CBA 000C 4EBA
Change to: 4E71 4E71 4EBA
-
MacroMedia
†All you need for a MacroMedia serial number is D310-12345-CP4U. The first set of numbers stands for the “D” in Director. The “310” is the version 3.1. “CP4U” is for all Mac programs. Therefore, using this formula you can get the serial number for any Macromedia program.
For example;
Macromedia Three-D would be T110-12345-CP4U for the 1.1 version,
and MM Accelerator would be A300-12345-CP4U for the 3.0 version.
The “12345” is any five numbers you want.
-
MacroMind 3D
T100-12407-CPU4
D300-31239-CP4U
-
MacroMind Accelerator
A300-12935-CP4U
A300-31239-CP4U
-
MacroMindDirector
D300-12935-CP4U
D300-31239-CP4U
D300-11114-CP4U
D300-13580-CP4U
v3.0
D300-31239-CP4U
D300-11114-CP4U
D300-12935-CP4U
v4.0
DM400-5716-8070-7081
DM400-5713-8178-0037
DM400-3702-6075-3064
DM400-9762-3971-1056
DM400-3745-9071-4064
DM400-1799-3074-2073
†The installer for Director 4.0 requires that the installer file be named 'Director 4.0' and the other files are: Director 4.0.2, Director 4.0.3, etc to Director 4.0.10 - this will then install from any disks or hard drive.
For a general serial # scheme for Director 3.0 try:
d300-AxBxC-CP4U where the x is anything you want and (A+B)/2=C.
For example d300-69696-CP4U works.
Or:
I think all you need for a MacroMedia serial number is D310-12345-CP4U. The first set of numbers stands for the “D” in Director. The “310” is the version 3.1. “CP4U” is for all mac programs. Therefore, using this formula you can get the serial number for any Macromedia program. For example Macromedia Three-D would be T110-12345-CP4U for the 1.1 version, and A300-12345-CP4U would be for the Accelerator version 3.0.
The “12345” is any five numbers you want.
-
MacroModel
v1.5 BETA
Password:AlexY
(Case sensitive)
-
MacSki
†- MACSKI V1.0.1
EFFECT: This change allows the setup code to run and will present the (randomly occurring) question dialog. Hit the "OK" button to continue with the game, the password is now ignored.
HOW TO: Locate CODE resource #3
Change WORD at offset 5F00 from 660A -> 6054
To change dialog box:
Locate DLOG resource #1015
Open Item #1 -> Change name from "OK" -> "Ignore Question" Change Top -> 140 Bottom -> 164
Change Left -> 16 Right -> 133 - MACSKI V1.0.1
EFFECT:The program will never ask you the question. HOW TO: Locate CODE 3, Find offset $5E76
For all three of the Mac Zap series programs the serial number may be searched for and replaced. It is not converted to hex. For instance if your number is
'30' =$00003045 in ASCII, you may change those to $00000000 or anything else you wish. But first apply the patches below.
MAC ZAP COPY 4.1
Search for:B380 0C80 1122 3344 6600 025A
Change To :4E71 4E71 4E71 4E71 4E71 4E71
MAC ZAP PATCHER 4.1
Search for: B380 0C80 1122 3344 66ED
Change To : 4E71
and
Search for: 0010 A9C4 6600 E943
Change To : 4E71 4E71
MAC ZAP TOOLS 4.1
Search for: 11 2233 66ED
Change To : 4E71
Search for: 0010 A9C4 6600 E8E9
Change To : 4E71 4E71
-
Maelstrom
†1.02
I was plugging along through the Maelstrom code when I came upon a way to have the bonus timer count forward instead of backwards.
Search for: 700A 91AD FCB2 4AAD
Change to: 700A D1AD " " " "
This changes the SUB.L D0,-$034E(A5) to ADD.L D0,-$034E(A5)
or try,
1. Invincibility. When you should die because of a collision or a hit,
it says "Sweet!" instead and you live. Shields are no longer needed.
CODE Resource #2:
Location 06DE:
Old Data: 66 New Data: 60
Location 0752:
Old Data: 66 New Data: 60
Location 0B14:
Old Data: 67 1E New Data: 4E 71
Location 0B22:
Old Data: 66 10 New Data: 4E 71
2. Initial goodies (3x fire power, long shots, rapid fire, retro brakes).
Luck and shields are no longer important when you’re invincible, so
they’re not fooled with.
CODE Resource #3:
Location 0ECA:
Old Data: 42 6D FC EA 42 6D FC EC
New Data: 2B 7C 00 01 00 01 FC EA
Location 0ED6:
Old Data: 42 6D FC F0 42 6D FC F2
New Data: 2B 7C 00 01 00 01 FC F0
3. Initial bonus points in a new wave. Set it to whatever you want.
CODE Resource #3:
Location 1284: Old Data: 00 00 07 D0
or try,
Run Maelstrom, start a game, and then drop into MacsBug. type the
following commands:
sm (a5)-30e 1
sm (a5)-30c 1
sm (a5)-30a 1
sm (a5)-308 1
sm (a5)-306 1
then type:
g
When you return to the game, you’ll find you have quite a few goodies. You can selectively cheat by only executing a subset of those "sm" commands.
==========
v1.03
To eliminate the small rocks COMPLETELY, change CODE #2
+CB0 From 4EBA 21DE to 4E71 4E71
+C98 From 3F3C 0003 to 3F3C 0000
or
The Official Maelstrom 1.03 Cheat Guide
Here is a list of points.
Small asteroid -> 300 points
Medium asteroid -> 100 points
Big asteroid -> 50 points
Vortex -> 500 points
Autonominous mine -> 700 points
Super nova -> 1000 points
Hitting a steel asteroid -> 100 points
Blowing up a steel asteroid -> 5000 points
Big Enemy -> 1000 points
Little enemy -> 2000 points
Picking up a stranded pilot gives you and extra life.
Here is a list of cheats for Maelstrom 1.03:
The Official Maelstrom 1.03 Cheat Guide
To start playing on any level you like, hit the 'L' key while you are at the main screen. A dialog box will come up that lets you choose what level to start on. The 'Turbofunk' option makes the game run as fast as it can, instead of the constant 30fps it normally uses.
Here are some neat little cheats that make Maelstrom interesting. You’ll need Maelstrom 1.03 for all of these cheats, DO NOT try them with an earlier version (you might crash your machine).
You'll also need MacsBug; it is widely available on AOL and other information services. To install it, just drag 'MacsBug' and 'Debugger Prefs' into your System Folder and reboot.
Once you've installed MacsBug, load up Maelstrom 1.03 and hit 'P' to start playing the game. When you want to use a cheat, hit the interrupt switch on your Macintosh to drop it into MacsBug; take care to hit the right switch: one reboots the machine, the other will drop you into MacsBug. On Machines like the ][si (which doesn't have an interrupt switch), hold down the Command key and hit the Power On key to drop you into MacsBug.
Now for the cheats:
Type: SW (A5)-$338 1 <return> for ACME XQJ-37 Retro Thrusters
Type: SW (A5)-$336 1 <return> for Machine Guns
Type: SW (A5)-$334 1 <return> for Luck
Type: SW (A5)-$332 1 <return> for Long Shots
Type: SW (A5)-$330 1 <return> for Triple Shots
Type: SW (A5)-$384 #X <return> where X is the number of lives you want
Type: SW (A5)-$32C #300 <return> for Maximum sheilds
After you’ve finished cheating, Type: G <return> to continue playing.
I was plugging along through the Maelstrom code when I came upon a way to have the bonus timer count forward instead of backwards.
Search for: 700A 91AD FCB2 4AAD
Change to: 700A D1AD " " " "
This changes the SUB.L D0,-$034E(A5) to ADD.L D0,-$034E(A5)
Here's a little tip I came across that seems to be an "undocumented feature"
in Maelstrom 1.30 that will allow you to get huge scores that are eligible for the contest ($300 cash prize, I think?) Note that this will only work on
v1.30, not 1.3.1 or 1.3.2.
1) Launch Maelstrom 1.30.
2) Press "L" to display the TurboMode dialog.
3) Set the beginning level to 40 and number of ships to 40.
4) Check the "TurboMode" box. TurboMode is required for the feature to surface.
5) Play the TurboMode game! Try to stay alive as long as possible as this
determines how long you'll enjoy higher bonus scores.
6) When the TurboMode games ends, play the normal, contest mode of Maelstrom.
Notice that the timer does not count down!
What Happens:
Due to a bug in the Maelstrom 1.30 code, (Thanks Andrew!) playing a Turbo game before a normal game DISABLES the bonus point countdown. As a side-effect, the CAPS LOCK Pause feature is also disabled. Since the clock does not decrement, you will always receive at least 2000 points at the end of each round. All comets and multipliers add to the score as normal. Since you are no longer hindered by the timer, you can take the opportunity to plug away at those metal asteroids (100 points each time you hit one) and explore the sector (assmall as it is).
NOTE: The counter will eventually reset itself. I've found that the longer you survive in the TurboMode game, the longer the timer will be disabled. Roughly, the ratio is 1:8 (1 minute in Turbo game = 8 minutes of timerless normal play).
NOW, SEARCH FOR:A0023F00 (SHOULD BE ON SAME BLOCK ABOUT, 10-20 BYTES DOWN)
REPLACE WITH:A0026098
3rd Crack:
Move to block 0153, position 0149, Change 3F00 to 6098
Move to block 0153, position 01B0, Change 3F00 to 6098
-
Math Blaster
†Search for: 56C0 4400 1B40 FF40
Change to: 51C0 " " " " " "
-
Mathematica
v2.03
Disk 1 PW:
1862-40876-83824-2660
†Mathematica 2.102 Enhanced
CODE #2 "Main2"
Global Offset Routine Name Local Offset From Bytes -> To Bytes
+603E ParsePas +4C 6600 00BC 4E71 4E71
+6052 ParsePas +60 6700 00A8 4E71 4E71
+6156 CheckPas +3E 6F24 4E71
+615E CheckPas +46 6C1C 4E71
+6E0A DoSealDi +130 6700 00CA 4E71 4E71
+6E24 DoSealDi +14A 6700 00B0 4E71 4E71
This allowed me to register with a bogus serial. Now network checking is still enabled, I believe, though I'm sure I could circumvent this easily too, but I haven't got a network with 2 machines with fpu's so I cannot test it. Instead, for now, I suggest changing the two longwords listed below as I beleive they are the keys that are unique to each copy of Mathematica - these may or may not have to be certain values, if so simply find these routines (by their name) in another copy of Mathematica and try the numbers there - chances are you have a second (nth) valid Mathematica. (PS: I have a high degree of certainty that these two numbers are the serialization keys, thus we should develop a list of them if any two #'s do not work [I haven't had time to check yet])
+6B46 GetProdu +6 xxxx xxxx
+6B60 GetMagic +6 xxxx xxxx
if this doesn't work try
+6CBC CheckSea +86 6704 6604
this probably won’t work for very long as I believe it calls “AnnoyNet” and “CheckNet” periodically - that is where to look if you need a net crack.
-
McCad PCB Design
†(v3.1 to 3.8)
Search for: 4E34 3FC0 0001 A9F0
Change to: 3CE2 " " " " " "
-
McCad Schematic
†v1.0
Search for: 55C2 3F3C 0001
Change to: 40A2 " " " "
-
McCad PCB/SMT
†v1.0
Search for: 53A8 3F3C 0001
Change to: 4268 " " " "
-
MediaMaker
v1.5
MED150 1987-1065-3071
-
Meeting Maker
v1.0
MV 000563
vXP
50 User VF6C-B724Q-7R6R2
50 User PF6C-B724A-6R6R2
†Administration Pwrd:
admin
-
Megadesk
†Search for: 670C 3F3C 0002 1F3C
Change to: 600C " " " " " "
Search for: 6700 0114 4EBA EDFC
Change to: 4E71 4E71 " " " "
-
Megafiler
†Move to block 02A2, position 01C4, Change to 3EBC
Move to block 02A2, position 01C6, Change to 0100
Move to block 02A2, position 01C8, Change to 4E71
Move to block 02A2, position 01CA, Change to 4E71
-
MegaForm
†v2.0
Search for: 6700 00EE 4267
Change to: 6000 " " " "
==========
v2.1
Search for: 6700 00EE 4267
Change to: 6000 " " " "
-
MegaMerge
†v3.0
Search for: 6700 00EE 4267 3F3C
Change to: 6000 " " " " " "
-
MGM Cad
v2.5 II
220301
-
MGM Station
†v1.0
Search for: 671C 302E FFFE
Change to: 601C " " " "
Search for: 101F 0A00 0001 6704
Change to: " " " " " " 6004
==========
v1.01
Search for: 6728 302E FFFC
Change to: 6028 " " " "
Search for: 6704 4EAD 0262
Change to: 6004 " " " "
-
MicroLeague Baseball ][
†For the MLB Application:
Search for: 4EAD 0652 2000 6708
Change to: 4E71 4E71 " " 6008
For the General Manager Application:
Search for: 4EBA 11EA 4A80
Change to: 4E71 4E71 " "
-
Microphone II
v3.0
B 008617
†MicroPhone II 4.0
Contains a bug that prevents the program from downloading files to mounted volumes with more than 32768 blocks free. Here's a ResEdit patch you can apply to fix the problem. Use this only if you feel comfortable using ResEdit and ONLY with a copy of MicroPhone II 4.0. Do not modify your master disks.
Patch 1 fixes XMODEM and YMODEM. Patch 2 fixes Kermit.
Patch 1:
CODE 21+$192 From: 302E FFC4 48C0 To: 4280 302E FFC4
Patch 2:
CODE 31+$11A8 From: 302E FFEA 48C0 To: 4280 302E FFEA
-
Microplanner
†v4.4
Search for: 6722 487A 0052
Change to: 6022 " " " "
==========
Microplanner+ 5.2 - 5.7
Search for: 6700 00D4 2F0E
Change to: 6000 " " " "
-
MidiMac
†I had to dissassemble all of CODE 7. By following the code, I was able to
figure out how to decrypt code 7 (It's encrypted in three parts). To
dissassemble it I used Nosy by the way. I copied pieces of code 7 to decrypt
code 7 each time I came to a part that decrypts something. After I got all of
CODE 7, I had figured out all of the decrypting procs, trap and vector changes etc. When code 7 is done it's disk checks and copy protection, it uses code 6 to change the first jump table item to code 1+5744 and it decrypts the jump table (which is pointed to by A5+CurJtOffset and is the same info as in CODE 0). I copied the procedure that decrypted code 0 and used that to give my a copy of the CODE 0 resource, except decrypted now. CODE 7 jumps to either CODE 1+5744 or CODE 8+0. It changes the first jump table item to code 8+0 if you put in a copy (I guess) and then jumps to the first jump table item after
disposing itself. CODE 8 gives that big dialog that lets you install copies,
run the original, run the copy or return to the finder. If you put in the
original copy in the first place, it goes directly to CODE 1+$5744. The
_Loadseg instructions in the jump table call GetResource. GetResource was
patched by CODE 7 to decrypt CODE resources. I had the proc to decrypt the
other code resources, but I was missing a number, a creation date or longint
in the boot block I guess. By looking at the decrypted CODE 0 jump table, I
was able to figure out what the first bytes of each code resource were
supposed to be because they tell where in the jump table this code resource is used and how many items it has in the jump table. The decrypting proc uses
some calculation to get a byte each iteration to EOR with the CODE resource
byte. The procedure was complicated but it turned out (by tracing it) that it
was only adding $2D to the byte used to EOR with the CODE bytes each time.
Knowing this and what the eor byte should be for the first 4 bytes, I got the
number I was missing. (I only needed 8 bits of the 32 bit number). I replaced
all the resources with the decrypted resources and code 0 pointing to 1+5744
as the new start of the program and it worked! It seems none of the other
resources do any copy protection (except for probably code 8 which isn't used
any more because code 7 isn't used anymore). I made no patches, just decrypted the codes.
-
Might & Magic I
†- MIGHT AND MAGIC I V1.0.1
EFFECT: Removes the password dialog
HOW TO:
Code 4 offset 06a0 change 4eba to 4e71 Code 4 offset 06a2 change fb5a to 4e71
-
Might & Magic II
†COLOR V1.0.2 (with possible FREEZE, try out)
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 4
CHANGE THE TWO WORDS AT OFFSET 02F4 TO 4E71 2D49
-
Might & Magic III
†Type 'BLASTOFF' in a mirror portal to see the ned of the game
-
Mind Prober
†Search for: 6718 486D F314 A851
Change to: 6018 " " " " " "
-
MindShadow
†Search for: 2F10 4217 205F 4E90
Change to: 203C 99C4 5501 4E71
or try,
Search for: A552 F6C8 44B0 3DC0 1564
Change to: CF40 9035 1857 73BB 1995
-
Mindsight
†v1.1
Search for 2924 3F3C 0001
Change to: 21CE " " " "
-
MiniCAD
v4.0+
1400-07710400
†v2.01
Search for: 5E2E 9F4E 7550 4154 204E 56FE EC
Change to: " " " " " " " " 2000 0000 00
Search for: FA3F 2EFF FE48 6EFE F14E AD02 02
Change to: " " " " " " " " F100 0000 00
==========
v2.43
Search for: BC6E 000C 6F00 00F4 42A7
Change to: " " " " 6000 " " " "
Search for: 200C 6700 00C6 4247
Change to: " " 6000 " " " "
-
Minotaur
†Network Crack:
CODE 6+$1D90 From: 67 To: 60
- MINOTAUR
EFFECT: Disables network serial number checking so you can play multi-player games with the same copy of Minotaur.
HOW TO: Open CODE resource 6
at offset $1D8A, change word to $4E71
-
Mission Thunderbolt
†In the application:
$129 Change 1EF0-1FB0 to 0000-0000
Then just type RETURN when asked to enter the code
==========
v1.06
STRS #129, Change $1BF0-1CAF to 0000-0000
or
CODE 11+$280C From: 67F6 To: 60F6
or
- MISSION THUNDERBOLT (version unknown)
EFFECT: allows any entry including return for password HOW TO: LOCATE CODE RESOURCE 11
CHANGE THE WORK AT offset $280C, FROM 67F6 to 60F6
(Thanks to Dean C)
-•MISSION THUNDERBOLT 1.0.1
EFFECT: Bypasses COPY PROTECTION:
HOW TO: CODE 000B+280C
find: 67F6
replace: 60F6
-
The Mist
†Search for: F92C 443C 994E
Change to: D15D F737 " "
Search for: 6094 21A4 7948
Change to: 6794 " " " "
Search for: 101A 69D0 A505
Change to: 71DC F456 E3E0
-
MitemView
11089
-
MobileMath for Newton
2100012050337131
-
Monopoly
v2.01
†- MONOPOLY2.01 (COLOR) Virgin Games'
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 8
CHANGE THE WORD AT OFFSET 3BBC FROM 6600 TO 6000
- MONOPOLY2.05 (COLOR) Virgin Games'
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 8
CHANGE THE WORD AT OFFSET 3D1A FROM 6600 TO 6000
- MONOPOLY2.05 (B&W) Virgin Games'
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 8
CHANGE THE WORD AT OFFSET 3DA6 FROM 6600 TO 6000
-
MORE
†Name in STR 63. Organization in STR 64. Personalized information is encoded.
-
More Disk Space
1982487924
†v1.1
Key words for successful use of MDS
To install, make a diskcopy image, boot from that floppy (very important). Go into options under file. Select which disk to install on (or sets of disks). Install (File menu). 2nd most important thing: Don’t let it go automatic on you. The automatic is eating people although we've had NO NO NO NO NO NO NO problems with it here or our collective 750 meg of hard drives on 7 machines. You can still reap the benefits of MDS by just smashing programs and games etc MANUALLY. You’ll still get 30-40 meg of hard drive space, your programs will not launch any slower, sometimes even faster and you won't have to publish any more messages about how it ate your precious files that you didn’t have backed up properly.
To remove MDS:
Run program from HD,
Hold down Command key
File menu’s formerly dimmed “Install” item will appear undimmed as “Remove”
Just make sure you have your hard disk selected in the options dialog or it won’t know which machine to remove from.
-
More Lemmings
† W I C K E D
02 - NICMITUODP
03 - OCCLWUGPDL
04 - CKLVUFOQDS
05 - GAHPVMHBEF
06 - IHSTDNGCEM
07 - MQTDJGEDEI
08 - QVMHGMMEEK
09 - VMHGAHVFEP
10 - ELGIHTTGEQ
11 - NGCLTTDHEQ
12 - GKLWVLJIES
13 - GEHQUDLJEM
14 - OISWLHGKEQ
15 - MPUDLGCLEQ
16 - PUMHGIMMEM
17 - UMHGEITNEJ
18 - DNGIHTUOEK
19 - HGCMUWLPEP
20 - GKMUUELQED
21 - GGHPTFNBFJ
22 - MHQTFNGCFR
23 - LPTGNGCDFM
24 - STFNGILEFF
25 - TGLGAHWFFN
26 - GLGIHVTGFF
27 - LGCLWTFHFE
28 - GMLWTNJIFF
29 - GAHSUGLJFO
30 - KHSUGLGKFJ
31 - MQUOJFGLFO
32 - SUGNGKLMFR
33 - UGLGCHWNFI
34 - FLGOHTUOFR
-
Morph
v1.1
1300670063
v2.0
1406016346
-
Mouse Stampede
†Search for: 3F3C 0006 4EBA 03EC 6000 0096
Change to: 4E71 4E71 4E71 4E71 4E71 4E71
or try,
Search for: 3F3C 0006 4EBA 0CEC 6000 0096
Change to: 4E71 4E71 4E71 4E71 4E71 4E71
-
Mouse Write
†v1.1
Search for: 6760 2F0E 4EBA
Change to: 6060 " " " "
Search for: 6700 0088 206E
Change to: 6000 " " " "
Search for: 6606 2F0E 4E
Change to: 6006 " " "
v2.3
Search for: 6606 2F0E 4EBA FF18
Change to: 6006 " " " " " "
Search for: 6700 0088 206E 0008
Change to: 6000 " " " " " "
Search for: 6606 2F0E 4EBA FD00
Change to: 6006 " " " " " "
Search for: 6706 2F0E 4EBA FC62
Change to: 6006 " " " " " "
-
Movie Magic
†To break the copy protection of Movie Magic, here’s what ya do. Use ResEdit to find the place where the copy protected name is stored. Simply backspace over it, deleting it. The name is also stored in the footnotes. If you disable it, the machine will bomb if anyone tries to use a footnote. So place an invisible box over the footnote box so no one will even think of using it in the first place.
-
MS Chart
†Search for: 6081 BEDD 608B BEDD
Change to: 4E71 " " " " " "
-
MS Excel
v3.0
00-065-0300-92000809
v4.0
00-065-0400-46250964
†v1.0
Search for: 608E BEDD
Change to: B103 6ADD
or try,
Search for: 37CF 0267 DD79
Change to: 00CF " " " "
or try,
MS Excel crack 1.0
Search for: 0000 A5A5
Change to: 045B BAAB
2nd crack
Search for: 37CF 0267 DD79
Change to: 00CF " " " "
MS Excel Serial # Removal
To remove the hidden ser# on excel, search for 7A43 5856 425A.
Change the *next* 3 words to 0000 0000 0000. Some may be zeros already.
-
MS File
†Search for: 1260 82BE DD
Change to: 124E 71BE "
==========
v1.02
Search for: 608F BEDD 608E
Change to: 678F " " " "
==========
v1.04
Search for: 608E BEDD 608F
Change to: 678E " " " "
-
MS Word
†v1.05
Search for: DD 6084 BEDD
Change to: " 4E71 " "
==========
v1.15
Search for: 608E BEDD
Change to: 4E71 " "
MS Word A
Search for: DD 608B BEDD
Change to: " 4E71 " "
MS Word B
Search for: DD 6084 BEDD
Change to: " 4E71 " "
-
MS Multiplan
†v1.02
Search for: 1260 8007 BE
Change to: 4E71 " " "
-
Multi-Ad Creator
100911030
100733861
100733861
100063800
100066120
v2.0
000002784
100911030
v2.2
100911030
000002784
v3.0
000716055
†For the General Manager Application:
Search for: 4EBA 11EA 4A80
Change to: 4E71 4E71 " "
==========
v3.0
In the application:
CODE 14+$1C56 From: 6776 To: 4E71
+$1D28 From: 6700 007E To: 4E71 4E71
+$1D2E From: 6700 00F2 To: 4E71 4E71
+$1D4A From: 6708 To: 4E71
+$1E26 From: 662A To: 4E71
This both cracks the program and removes the network check.
==========
v3.5
Forget the install process... Copy the disk files to your hard drive and extract the files yourself & put into a folder (files from disk 1&2 have to be done this way, the other can be run on their own), now in the application change:
CODE 10+$000E From: 67 To: 60
this works and gives me and registered to blank, serial #.
-
Multi Ad Search
100063800
100066120
-
Multi-Disk
PS001604(001)
-
MusicShop
v1.0
210.100.000115xx (x = any number)
-
Mutant Beach
000234
003557
-
myDiskLabeller
†v1.0
Search for: 6600 05B0 41ED 0352
Change to: 4E71 4E71 " " " "
-
My Office
†Search for: 6600 00A2 2813 6700
Change to: 6000 " " " " " "
-
My School
6580040
-
My Town
8620045
-
Nascar Challenge
†Bill Elliots NASCAR Challenge:
CODE 3+$07E0 From: 6700 FF46 To: 4E71 4E71
+$07E8 From: 6604 To: 4E71
this totally removes the protection as you do not even have to press a key
or try,
Bill Elliot's Nascar Challenge!
As always, open it up with ResEdit (The Application 'benc').
CODE 3+$0B5E From: 6704 To: 4E71
This is quite a cool 'Turbo' feature.
CODE 12+$05D8 From: 006D To: whaver
The lower the number you change it to, the faster you go. For instance, if you want to double your speed (Doesn’t change the other cars’ speeds), change it to $0036 (Half of $006D). If you want to have fun, and just fly out of the stadium, set it to below $0010. If you for any reason, want to go really slow, set it to something like $0100.
-
Negotiation Edge
†Search for:FDD0 6718 486D
Change to: " " 6018 " "
-
Net-Cal
†v1.3
Search: FFDE B0AE FFDA 6F0C
Change: " " " " " " 600C
-
Nightingale
v1.01
195121
-
Nightwatch
†Nightwatch is a slick new protection scheme for hard disks. It is supposed to prevent anyone from accessing your hard disk, but really doesn't do much good. Basically it alters the hard disk so it seems to be permantely write protected. If the disk is write protected, you can write out the Desktop file, and the mac won't mount it.
How to crack it!
1) Bring a disk with the System on it and Mactools from copy ii mac. MAKE SURE that Mactools is the “startup” application, so you won’t even get into the Finder and see this desktop shit.
2) Boot the disk on the nightwatched system and you'll be up into Mactools with the ‘nightwatched’ hard disk mounted, ready to be leached!
(For more fun, bring another HD and leach the whole fucking thing!)
Alternately, you can set startup to any application and use Disktools or Disktop to open up nightwatch.
-
Nisus
3.0x
90040236
-
Nok Nok
9300 49591
9300 49799
9300 59593
-
Notify
0005940166
-
Now Compress
v1.0x
NCA-100-0001-003575417719
-
Now Up-To-Date
v1.0
UDA-100-0001-011445453986
v2.0
UDU-200-0001-002377188121
-
NUBase
v1.3
0000000-00
-
NuPaint
10111220
-
O.G.R.E.
†Search for: 6700 000E A017 21FC 0000
Change to: 6000 " " " " " " " "
Must use the system that comes with the game (lots of resources).
HFS disks: remove all files from folders.
-
Object Master
v2.0.2
L\002428392663
-
Oh, no! More Lemmings!
†- OH, NO! MORE LEMMINGS
EFFECT: Gets rid of passwords for individual levels in Oh No! More Lemmings HOW TO: In CODE 3, at offset 0xDB2, replace exactly 88 bytes (11 lines in ResEdit's general editor) with the following 88 bytes (11 lines) of garble:
48E7 1F18 47ED D02C
4245 101B 0C00 0030
6D14 0C00 0039 6E0E
4880 0440 0030 CAFC
000A DA40 60E4 0C45
0064 6E1A 4A45 6F16
5345 3B45 DC52 2005
48C0 81FC 0014 3B40
DC82 7001 600A 426D
DC52 426D DC82 7000
4CDF 18F8 4E75 4E75
You'll probably want to update the corresponding dialog to make the prompt more appropriate. I changed item 4 of DITL 2001 to read "Level? (1 = Tame 1, 21 = Crazy 1, 41 = Wild 1, 61 = Wicked 1, 81 = Havoc 1)" so that I won't forget this is a patched copy.
or
-•OH, NO! MORE LEMMINGS
EFFECT: This will remove the personalisation requirement
HOW TO: CODE 2 Offset $1410
From: 661C
To: 4E71
CODE 2 Offset $1E78
From: 6700
To: 6000
CODE 2 Offset $1F60
From: 6706
To: 6006
CODE 3 Offset $0506
From: 671E
To: 601E
-
Oids
†CODE 12+$1F58 From: 670C To: 4E71
+$1F5E From: EC70 To: EC72
+$1F62 From: EC72 To: EC70
v1.3
CODE 12+$1F7C From: 670C To: 4E71
+$1F82 From: EC2E To: EC30
+$1F86 From: EC30 To: EC2E
-
OmniPage
v3.0
0102E-%001705
0132A-%002643
v2.0
2801G-%001327
v2.1
0102E-%001705
0132A-%002643
-
Omnis 3+
†Search for: 6612 2F2E 0008
Change to: 6012 " " " "
Search for: 6624 2006 0A00
Change to: 4E71 " " " "
-
Omnis 7
v1.0.3 Mac
7MDI 102344 37554
7MDI 103039 37065
Name each disk D1, D2, D3
v1.0.3 Win 3.x
7WDI 108844 18592
Name each disk D1, D2, D3, D4, D5
Unzip to FLOPPIES then install through Windows
v1.1 Mac
7MDI 102344 37554
7MDI 103039 37065
7MDI 103247 37782
v1.1 Windows
7WDI 108844 18592
v2.0
7MDSI25119011700
7MIES 450M 000000 94312
-
One on One
†Search for: 2CE0 075B 4274 01C5
Change to: 42BF D8BD 9A4B 3915
Search for: D8EF F320 B611
Change to: D8BD 96C6 C05D
-
Operation Combat
†It took me a few hours, but I finally figured out a crack for this program. The only problem is that you cannot quit except through the monitor… You know, press the interupt switch and type SM 0 A9F4, G 0 or in MacsBug type ‘es’...
Search for: 102D 9E0A 6700 FEE2 4EBA 1A2E
Change to: " " " " 6000 " " " " " "
This trades a BEQ for a BRA. Works great.
-
Operation Desert Storm
†(B&W & Color)
Search for: 6700 FF44 2F2C FFEC
Change to: 4E71 4E71 " " " "
-
Operation Tsunami
†Level Passwords (case sensitive):
Normal: Hard:
Level 1
Area 2 FrGdSL ThrfrG
Area 3 vdThWr ndMkDs
Area 4 ldThtH cplsfl
Level 2
Area 1 GvHsnl lNtnsB
Area 2 Bgttns tzngTh
Area 3 nThtTh mnThNm
Area 4 sWhBlv fThFth
Level 3
Area 1 thnHmM rndfTh
Area 2 ghtNtP SnndfT
Area 3 BtHvtr hHlySp
Area 4 nlLfJh rtMtth
Level 4
Area 1 ThrSxt wTwnty
Area 2 nKngJm ghtTwn
Area 3 sVrsnf tyNwnt
Area 4 ThHlBb nlVrsn
Level 5
Area 1 lPrsGd PrsJss
-
OptiMem
v1.4.2
AVFA-SHAA-LLAO-LBPUA
-
Out of This World
†CODE 5+$325C From: 67C0 To: 4E71
File 0146 is a GIF that has a secret message....
Codes:
1) LDKD 2) HTDC 3) CLLD 4) FXLC 5) KRFK
6) XDDJ 7) LBKG 8) KLFB 9) TTCT 10) DDRX
11) TBHK 12) BRTD 13) CKJL 14) LFCK 15) BFLX
16) XJRT 17) HRTB 18) HBHK 19) JCGB 20) HHFL
21) TFBB 22) TXHF
-
OverVUE
†Search for: 1842 8112 3C00 314E
Change to: 0242 " " " " " "
==========
v2.0?
Move to block 030B, position 019C, Change to 0000
Move to block 030B, position 01A0, Change to 0000
or
Search for: 1842 8112 3C00 314E
Change to: 0242 " " " " " "
-
Oxyd
†Here are the first 2nd to 11 level codes:
2) 218780766 3) 10232399 4) 32882199
5) 13794470 6) 28197802 7) 17887807
8) 51761122 9) 83882268 10) 6071220
11) 58037867
Oxyd Patch
Here's the patch I found for removing the Oxyd CP. Maybe it can be added to
the new Cracks and Numbers file?
- OXYD 3.4
Depending on which version you want to run (B&W or Color) you need to
alter the appropriate Data A file. (Note: this only works with 3.4; I
have no idea if it works with 3.3)
**NOTE: you require a Disk/File editor such as Norton Disk Utilites
rather than Resedit because you are editing the Data fork not Resource
fork.
EFFECT: This patch allows you to enter in the level number you want to
play,
instead of the annoying 'secret code'.
Data A Color +$0001BC48 (#113736):
Data A Mono +$0001C18A (#115082):
change: 6F6E DEC8 FFFD D823 to 614A 0080 FFF7 CFFA
and
Data A Color +$0001BC5A (#113754):
Data A Mono +$0001C19C (#115100):
change: 4CFF FFF6 to CFFF FEFA
Now you can just enter in the level number you want to play (preceded by
the appropriate number of 0's, so level 12 would be 00000012).
EFFECT: This patch allows you to press any key to remove the 'magical
tokens'
which block your path.
Data A Color +$0002C9F6 (#182774):
Data A Mono +$0002CF36 (#184118):
change: 669F to DE43
Data A Color +$0002CA22 (#182818):
Data A Mono +$0002CF62 (#184162):
change: 669F to DE43
Data A Color +$0002CA4E (#182862):
Data A Mono +$0002CF8E (#184206):
change: 669F to DE43
or
- OXYD 3.4
Depending on which version you want to run (B&W or Color) you need to alter the appropriate Data A file. (Note: this only works with 3.4; I have no idea if it works with 3.3)
**NOTE: you require a Disk/File editor such as Norton Disk Utilites rather than Resedit because you are editing the Data fork not Resource fork.
EFFECT: This patch allows you to enter in the level number you want to play,
instead of the annoying 'secret code'.
Data A Color +$0001BC48 (#113736):
Data A Mono +$0001C18A (#115082):
change: 6F6E DEC8 FFFD D823 to 614A 0080 FFF7 CFFA and
Data A Color +$0001BC5A (#113754):
Data A Mono +$0001C19C (#115100):
change: 4CFF FFF6 to CFFF FEFA
Now you can just enter in the level number you want to play (preceded by the appropriate number of 0's, so level 12 would be 00000012).
EFFECT: This patch allows you to press any key to remove the 'magical tokens'
which block your path.
Data A Color +$0002C9F6 (#182774):
Data A Mono +$0002CF36 (#184118):
change: 669F to DE43
Data A Color +$0002CA22 (#182818):
Data A Mono +$0002CF62 (#184162):
change: 669F to DE43
Data A Color +$0002CA4E (#182862):
Data A Mono +$0002CF8E (#184206):
change: 669F to DE43
-
PacerForum
License Key: 5
User Key: B-6MX00096002114
-
PacerTerm
v1.0
B-43C78920099091
-
Pagemaker
v4.x
02-4008-200010087
02-6023-000345263
02-3013-000-196593
08-1003-000357503
02-0004-000094245
02-3008-000036469
02-0000-000000000
v5.0b1
11-1009-200021734
v5.0
11-1009-200021734
11-1516-200723741
†v1.0
Search for: 4E56 FFFE 422E 0008 486E
Change to: 205F 301F 1F3C 0001 4ED0
==========
v5.0
Open up the PageMaker App itself with ResEdit (or your favorite Brand X resource editor) and find the 'KXRX' resource. The net ID number is located between offsets 0A and 1F inclusive. You will find all of the bytes at these offsets have already been zeroed. Change them to whatever makes you happy (as long as it's unique for each machine on the net).
==========
v1.1
Search for: 6B00 00F4 203C 0000
Change to: 6000 " " " " " "
Search for: 670E 4267 4EBA FCF0
Change to: 600E " " " " " "
Search for: 670C 4267 4EBA FCD4
Change to: 600C " " " " " "
==========
v1.2
Search for: 676E 4267 2F07 4EAD
Change to: 606E " " " " " "
==========
Pagemaker Ser. # Removal:
To erase the serial number of Page Maker:
- Start Fedit
- Open File Page Maker
- Read sector 0 of the file
- At location $158 you will find a string like “xxxx 69xx xxxx 69xx xxxx
xxxx” which is the serial number. They, of course, encoded it but with a
simple key. They used the creator string "ALDU" and pass each letter in
turn to encode each number of the serial number.
Ex.:
$71 XOR $41 (A) = $30 (0)
$7E XOR $4C (L) = $32 (2)
$69 XOR $44 (D) = $2D (-)
and so on...
- If you just change the numbers to put out a 00-000-00000, the program bombs
out of its skull.
- A little more digging uncovers the preceding two bytes. $156 is the address
where the serial number check begins. It is normally a $0D so the checking
doesn’t begin until the 6th number ($15D) in the serial number string
(which starts at $158).
- $157 is the number of digits to print in the serial number box when the
program starts. If the number is less then $0C (original number), the
string “Serial number” before the actual number doesn’t get printed.
- So, to turn the number to 00-000-00000:
* Read sector 0 of the Page Maker file
* Go to byte $156
* Hex modify: 0D0C XXXX 69XX XXXX 69XX XXXX XXXX
To: 140C 717C 6965 717C 6965 717C 7465
* Write the sector back
-
Painter (Fractal Painter)
v1.x
OOOOOOOAAA
0013951HZY
0014731DJN
v2.0
0011187QBO
(The last 3 are letters)
†Painter 1.2
To make it so you can use any serial number (7 digits, 3 letters), change:
GWIL 1+$322 From: 6600 FEF8 To: 4E71 4E71
Registerred copies will not have a GWIL 1 resource and can’t be registerred without one. After registerring, a CPHR 0 resource is added that holds your name and serial number.
†To patch it so you don't need the codes, change CODE 1+$3C70 from
2F3000004EAD078A to 4E714E714E714E71 and change CODE 1+$3C92 from 67 to 60.
or
- PGA GOLF V1.0
EFFECT: The password dialog will never show up. (It doesn't get rid of the diaglog box, but as with the other patch you can safely enter any distance.)
HOW TO: LOCATE CODE RESOURCE 1
CHANGE THE WORD AT OFFSET 3C70 TO 4E71
CHANGE THE WORD AT OFFSET 3C72 TO 4E71
CHANGE THE WORD AT OFFSET 3C74 TO 4E71 CHANGE THE WORD AT OFFSET 3C76 TO 4E71
CHANGE THE WORD AT OFFSET 3C98 TO 4E71 CHANGE THE WORD AT OFFSET 3C9A TO 4E71
-•PGA TOUR GOLF 1.0.1 ONLY [this patch works but the "before" code is NOT 660A]
EFFECT: It doesn't disable the green length box, but it doesn't matter what length you enter.
CHANGE THE BYTES AT OFFSET 25 FROM AD 01 4A TO 71 4E 71
IN CODE RESOURCE 3, CHANGE THE BYTE AT OFFSET 16060 FROM 6F TO 60
or
Change CODE 3+$17EA (A few characters over from 17E8)
from:
025A
to: 0172
This simple crack just jumps over waiting for you to enter the password, and lands right at the part where it sets the memory that says you got the password right.
-
Player Pro
v4.09
v4.10
v4.15
†Crack for Player Pro 4.15
Code 7
Offset 18FE
Change to 6012
Offset 1930
Change to 6012
Offset 16FA
Change 4E90 -> 4E71
Crack for Player PRO v4.09:
------------------------
So it will register:
1) Open up the application with ResEdit
2) Open up the Code resource
3) Open up Code ID 7
4) Search for Offset +1970
5) Change 6712 -> 6012
6) Quit and save all changes.
7) Open the application and register yourself under the apple menu.
Be sure to have your name a decent length. I believe it will only
accept a name 4 chars or more. I would suggest your enter the code
as 0123456789... (Just in case)
8) Have fun! And I would suggest you register the program. Its worth it,
and the author doesn't ask for much. Besides, you get the manual and shit.
This program likes to disable MacsBug so us crackers can't hack it.
Not today!
Heres a crack to enable the usage of MacsBug:
1) Open up the Code resource
2) Open up Code ID 2
3) Hex search for 42B80120
4) Change all 42B80120 -> 4E714E71
5) Open up Code ID 7
6) Repeat steps 3 and 4 again.
7) Quit and save all changes!
8) Enjoy!
Crack for Player PRO v4.10:
------------------------
To register:
1) Open up the application with ResEdit
2) Open up the Code resource
3) Open up Code ID 7
4) Search for Offset +2622
5) Change 6712 -> 6012
6) Quit and save all changes.
7) Open the application and register yourself under the apple menu.
Be sure to have your name a decent length. I believe it will only
accept a name 4 chars or more. I would suggest your enter the code
as 0123456789... (Just in case)
8) Have fun! And I would suggest you register the program. Its quite good,
and the author doesn't ask for much. Besides, you get the manual.
-
PlayMaker Football
†v2.0
Find CODE 90+$608 is $6700 FF18
change CODE 90+$59E to $4E71 and CODE 90+$5F2 to $6018
change the message in DLOG 800 to
"Press Command-G and hit OK until the game begins.
Then you will never see this dialog box again."
or
Code #90
+54A 66D6->4E71
+552 670A->600A
+464 6714->4E71
or
- PLAYMAKER FOOTBALL 2.0
This patch takes several steps, since PMFB checks to see if its code has been modified while a game plays; if it has, the game will crash. This is why previous patches have failed. However, it doesn't ask for a password every time; instead, it asks after several games have been played since it last got a valid password. After a valid password has been entered, all you need to do is lock the application in the Finder. Then it will not be able to remember how many times you've played, and will not ask you for the password again.
If you haven't enetered a valid password (and no longer have the
user's manual) modify the program with ResEdit as follows:
Open CODE 90, find word at offset $100;
change the word from $A861 to $4E71.
(This replaces the random number generator, so you will
always be asked for the same password.)
Then run PMFB and ask to play a game. It will ask you for word 4 on page 13, paragraph 3. The word is "are". After it accepts this
password, DO NOT PLAY THE GAME! It will see it has been modified and crash.
Instead, open ResEdit and change the word in CODE 90 back
to its original value of $A861. Then lock PMFB in the Finder. It should never ask you for the password again.
I don't know for sure that this will always work; I've only had my
copy of Playmaker Football to test it on.
-
Playroom
†- THE PLAYROOM (COLOR) V 2.0.1
HOW TO: The password dialog entry box will never show up (used to show up every fifth invocation).
HOW TO: Locate CODE resource #11 (number eleven)
Change WORD at offset 0DC2 from 526D -> 426D
-
Pool of Darkness
†In the application:
Check
'CODE'
$B
$6d92
2
$4ead
$01d2
Modify
'CODE'
$B
4
$6d92
$4e71
$6d94
$4e71
$6dc8
$600c
$6dec
$4e71
or
- POOLS OF DARKNESS (ATTENTION: Patch also disables internal viruscheck!)
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 11
CHANGE THE WORD AT OFFSET 6D92 TO 4E71
CHANGE THE WORD AT OFFSET 6D94 TO 4E71
CHANGE THE WORD AT OFFSET 6DEC TO 4E71
- POOLS OF DARKNESS V1.0
EFFECT: Defeats password protection.
Works for b&w version, not tested for color.
This keeps the password dialog, but it doesn’t matter what password you use After the 3th try the program starts.
HOW TO: Locate code resource 15, change the word at
offset $1AB4 from $4EBA to $4E71
offset $1AB6 from $5442 to $4E71
-
Pool of Radiance
†V1.1
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 2
CHANGE THE TWO WORDS AT OFFSET 3E94 TO 4E71 4E71
-
PosterWorks
1883-BKHMEAFGHI
-
Power Launcher
†V1.6
Search for : 6716 1B7C 0001 F643 4206 554F
Change to : 6016
That will eliminate the check-sum routine that detects that the code has been modified.
Search for : 6718 3F3C 0080 4EAD 019A 554F
Change to : 6018
That will allow anything for your registration dialog. If it doesn’t ask for the registration then trash the pref. file before you launch it and it will ask you to register. If you want it un-registered just click ok. This crack also removes the annoying dialog everytime you change sets.
-
PowerMerge
v1.0
PM1-002897
-
PowerView
1-38620-KVEASRD
-
Practica Musica
v1.x
00215052
PM220569
692878
v2.295
226835
-
Premiere
v1.0
PRB100101253-785
v2.0
PRW200100586-763
v3.0
PRW200100586-763
PRW200101810-587
PRW200101890-129
-
Preprint
v1.0/1.5
11-1009-200021734
02-0001-100000000
11-1000-200027072
-
Presenter
†1.5 Demo!
This will make Presenter 1.5 Demo act as though it is not a demo. There are three global variables which say in what way it is limited - such as Demo (INIT), Demo (ADB), and all that. From looking at the resources - there's one called 'EvE ', it seems that this uses the EvE protection scheme... So, the crack just changes the variables that says whether or not it has found the EvE.
Open CODE 12 in ResEdit
Change it at offset $5EC0
From: $6F3E
To: $603E
Change it at offset $6B7C
From: $6708
To: $4E71
Change it at offset $6BC4
From: $6708
To: $4E71
Change it at offset $7268
From: $6728
To: $6028
-
PressWise
02-000-00000
-
Prince of Persia
†EFFECT: The Potion Level never appears
HOW TO: LOCATE CODE RESOURCE 2
CHANGE THE WORD AT OFFSET 1F70 FROM 660A TO 600A
or
To Patch Prince of Persia 1.0 so there are unlimited chances to get the right potion in the potion level, change CODE 3+$55A6 from $5240 to $7000. Note: The potion level has to be done again only if you quit Prince of Persia and run it again later.
To get rid of the potion level altogether, change CODE 2+$1DF2 from $0002 to $FFFF. This is for new games and opening from the file menu. Change CODE 2+$1DD6 from $3B6D BA64 BA62 to $3B7C FFFF BA62 for opening from the desktop.
Prince of Persia saved games:
The format of the save files for version 1.0 is 2 bytes each for:
minutes left; fraction of a minute out of $2D0 (max is $2CF); level ($F is potion level, $E is last level or princess level, $C and $D are level 12 part 1 and part 2: Jaffer level, $1-$B is level 1 to 11 and $0 is the demo level); potions; unknown; prizes (people killed, items obtained, big potions etc); how many times prince died; checksum (which=$1B39 - min*$B - frac - level*$11 - potions*$25 - unknown*$C1 - prize*$17 - died*$D. To eliminate the need to calculate the checksum, change CODE 2+ $15AC from $663A to $4E71.
(POP 0.15B saved files do not have prizes or died and are therfore, only 12 bytes instead of 16. The checksum does not include prizes or died. To eliminate the need to calculate the checksum for 0.15B, change CODE 2+$181C from $662E to $4E71.)
Prince of Persia speed up:
The 'Turbo POP' updater program changes CODE 2+$102 from $90 to $D0 to speed up the animation.
Prince of Persia Editor 2.01
Change CODE 3+$05FA (A few characters over from $05F8)
EFFECT: This game is NOT copy protected at all, but it does not run under Systems 7.0 or 7.0.1. This may be a good forum to publish this fix to allow the program run under these systems.
N.B. Do not EVER run copies of this modified program under Systems pre 6.0.2 (i.e. System 6.0, 4.2 etc.) As Egon said in GhostBusters, "it would be very bad".
Locate CODE resource #1 (number one)
Change WORD at offset 24C8 from 0002 -> 0000
The program will now run correctly (Systems 6.0.2 and greater)
-
Quark Xpress
v3.0
XX51123585
v3.1
XU60541345
XU51210588
XU50002863
XU58494583
XU60541345
XX51123585
XU43914334
XU43950295
XU44134121
XU44317350
XU51785218
XU51849192
XU52404768
XU52443418
XU52628863
XU52911967
XU52928917
XU53277674
XU55081085
XU55082842
XU55082949
XU55404875
XU57046139
XU57046246
XG50002863
XR22000765
XR22246199
XU23262295
XU23326276
XU43158960
v3.2
XU30435782
XU30435247
XU50002863
XU60541345
XU44267530
XU56693459
XU51636790
†** TIP **
Use a number that you know works and add 107 to it.
If you replace XU with XM the installer accepts the SN and I believe installs
a multi-user version.
QuarkXpress Network Bypass:
(as of 6/29/91)
For each additional copy you need to run on the network do the following:
- Make a copy of the original program.
- Open the copy with ResEdit and open the DATA resources.
- Now open the DATA ID 0 resource.
- Search for the string QuarkXPress (check spelling and case).
- The next character after the string is a "<" symbol.
- Change the "<" character to the character "1" for the second copy you want
to run on the net and to "2" for the third copy and so on.
- Now close ResEdit and save your changes.
NOTE: For each additional copy you want you MUST make a copy of the original
to modify. That should get you on your way to lots of copies on the net.
also any serial numbers from the gamma should work just change the first two
letters to XU instead of XG
serial numbers from 3.0 should work fine also if you use the updater it will
ask if you want to change the current SN to another SN (great for getting an
additional SN)
my hunch: if you replace XU with XM the installer accepts the SN and I believe
(i havent had a chance to verify it) installs a multi-user version.
The personalization data is stored in 'Qky2' ID 1. When you register it, with
this crack, it will use the serial number 19628, which is presumably the
default one. To see the personalization, go to 'About QuicKeys™...' in the
option menu when editing keysets.
Quick Keys 2.1.3
For those who can't find a serial number this work around worked for me.
1 Install Quickeys with extensions, etc you desire
2 Install Quickeys 2.1 (no serial number needed) cdev only and reboot, should
open
3 Re-install Quickeys 2.1.3 cdev only and reboot, should now open without
asking for serial number
-
QuickFlix!Q
F1009383-0045
-
QuickMail
v2.2
40866
†Crack for 2.0 serial numbers patch:
Open up the QUICKINIT file with ResEdit:
Look in INIT 25 "QuickInit", offset $24, for an ASCII sequence of digits (they directly follow a string that looks like QuickMai, e.g., QuickMai00000). ASCII modify them to any serial # you want, preferably something far away from what other people are using. You see, that serial # is a BASE serial number, from which the Quickmail software will increment x # of times, where x is the # of users allowed by that particular pack. There is one more spot where it's stored, and that's in the DATA -14144 resource, offset $5C, again, it's five ASCII digits. Change them to the same # you installed into the INIT 25
resource. Once you've made your changes, be sure to save them, and then reboot with the new files installed in your System Folder to see them take effect. I know it's not a patch to remove the serial number check process altogether, but since I do not know how the scheme is intrinsically tied to the actual workings of the client/server mechanism, I'd rather not play around with that and possibly create reliability problems. If you want to invest loads of time looking into it, feel free and please post the results; but I think if all you want to do is get your office up and running with Quickmail for everyone, then this should meet your needs.
Change to :4E75FFC041EEFFC0316E00080016216E000A0012A017
Ragtime 3.0
Serial Number:6601120 Production Number:8739401
Ragtime 3.1
Serial Number:6601120 Production Number:8739401
-
Railroad Tychoon
†Krak Patch
Hex search for:
28 00 02 B0 69 06 84 66 08 08 AD
Hex change the bold values to 4E 71
This should appear on sector 301, byte 25848 of the file.
or
Find Hex string
0684 6646 486E
Replace it with
0684 4E71 486E
When you hit the choose the locomotive screen, any choice you make will be
valid The krak listed above allows the game to continue to limit your play to
two trains at a time.
or
- RAILROAD TYCOON 1.0
EFFECT:The program will never ask you the question.
HOW TO: Locate CODE 24,
Find Offset $1F0A, Change the word $6646 to $4E71
Find Offset $207E, Change the word $6608 to $4E71
- RAILROAD TYCOON
RRT has the PICTs and STR#s all in the application,
where they can be copied into a WORD document that you can have
on your hard disk.
There's an easier way to avoid needing the Railroad Tycoon manual (suggested, I believe, by some previous poster in this group): Just spend a few minutes with ResEdit and add the names of the engines to the PICTs. Then the answer is right in front of you every time.
-
Rambo
†Search for:DB49D669B2FD Change to:DC49D669B2FD
Search for:4B6F26851ED8 Change to:2AA9BB036063
-
RAMdisk
†v3.16
Leave three blank spaces after your name to register
-
RAM Doubler
†Ramdoubler 1.0.1b1 krak
Code #2 +11A0 630E->600E
Ramdoubler 1.0
the correct SINGLE BYTE crack is
CODE #2 +114A 6620->6020
RAM Doubler 1.0 fix
While playing around with RAM Doubler 1.0 you may have noticed that if you
replace your System File from a backup or even just move it out of your
System Folder and immediately back in again, upon the next restart RAM
Doubler gives you an error message saying that RAM Doubler did not load
because it has been moved. Here is why: During installation the RAM
Doubler installer places two invisible files into your System Folder,
"MacsBug Mgr" and "Load RAMDblr." If you look at your HD's boot blocks
with Norton Disk Editor you will see that the RAM Doubler installer also
changed the boot blocks' Debugger Name from the normal "MacsBug" to
"MacsBug Mgr." Obviously the installer does this to ensure that RAM
Doubler resources get loaded absolutely first thing during bootup.
Presumably it also changes the boot blocks' Debugger Name from the normal
"MacsBug" to "MacsBug Mgr" so that it can load your MacsBug debugger (if
you use it) secondly, after the RAM Doubler code during bootup. The only
problem is that if you swap out your System File or even merely move it out
of your System Folder and immediately back in again, your boot blocks get
re-written by the Mac's ROM routines such that the Debugger Name gets
changed back to "MacsBug" and presto, RAM Doubler won't load, forcing a
re-installation from the RAM Doubler floppy. (Anything you do that causes
the miniature Mac on the face of your System Folder icon to disappear and
reappear reflects this automatic rewriting of your boot blocks.) What a
hassle! Solution: if you're NOT using a debugger (or anything else you've
named MacsBug, e.g., there was once a screen saver that needed to be called
MacsBug) simply use DiskTop, ResEdit or any other disk editor that can see
invisible files to go into your System Folder and change the name of
"MacsBug Mgr" to "MacsBug" and then move your System File out & back into
your System Folder to force the boot blocks rewrite. Then you'll never
need to reinstall RAM Doubler whenever you mess with your System File. Voila!
-
RapidTrak
600001201
-
RayDream Designer
v2.0.3
RDD5-1230-48398
RDD5-1550-52358
-
Real Poker
†Search for:43FA FE80 32BC FFDC
Change to:4E71 4E71 4E71 4E71
Make the files "Saloon File" & "Poker Data" visible. Also, there is a poker
font in the fonts file you have to have on your system.
-
Red Ryder
†v11.0
Find:6630 42A7 4879 434F 4445 3F3C Replace 42A7 with 6030
-
Rendermania Beta
3273071853
4027723341
3574598582
2518174477
4011405915
-
Resolve (Claris)
†v1.0
Hex Changes:
Search : 486E FFFC 4EBA FCF6 4A00 588F 670E
Change : 4E71 4E71 600E
-
Retrospect Remote
Authorization Numbers:
650-729-7746
543-999-2682
647-741-1178
595-161-0202
577-533-0106
545-366-9586
602-708-6450
592-374-9842
577-330-3898
652-350-7410
Registration Number:
05030000180
-
Reversi
†Search for:6708487A01904EBAF69
Change to :66008487A01904EBAF696
Search for:6708487A01524EBAF988
Change to :6008487A01524EBAF988
Search for:4EBA08C23E1F4EF9
Change to :A9F408C23E1F4EF9
Search for:4EBA0BF03E1F4EF9
Change to :A9F408C23E1F4EF9
Search for:4EBA04D03E1F4EF9
Change to :A9F408C23E1F4EF9
-
RightWriter
TGMC 113695
-
Robosport
†How to remove the copy protection from Maxis' game "RoboSport":
Search for 4EAD 066A 4FEF 000A 3E00 4A47, using a Utility such as ResEdit or
SUM Tools.(This sequence is in code resource 2 at offset 2A8C if you look with
ResEdit. Replace the first two words with 7001 7001, and everything should be
OK.
Or try:
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 2
CHANGE THE WORDS AT OFFSET 2A82-98 (2A82, 2A84, ..., 2A98) TO 4E71
CHANGE THE WORDS AT OFFSET 2AB2-C8 (2AB2, 2AB4, ..., 2AC8) TO 4E71
Or try:
COMPATIBILITY NOTES
If you play RoboSport on a MAC PLUS or MAC CLASSIC, turn OFF the Preview Movie Sound option in the Preferences Window otherwise the program may lock during Turn Generation due to a sound chip incompatability. You need MORE THAN 1MB RAM to play RoboSport under MultiFinder. If you only have 1 MB RAM, you must play RoboSport under the Finder. RoboSport is not compatible with the Apple CD-ROM init. RoboSport is not compatible with the Now Menus in the Now Utilities.
APPLETALK NOTES
To remove a SECONDARY machine from an AppleTalk network game, the person on the PRIMARY machine must:
(1) Select REMOVE SECONDARY from the EDIT MENU
(2) Click the radio button next to the player you want to remove, and
(3) Click on the REMOVE SECONDARY button.
AppleTalk Zones are not supported in this version of RoboSport—only direct machine to machine AppleTalk.
KRAK NOTES
Run the program. <IN PROGRAM> Marvel at the cool sounds. Go to the dialog box in which you're asked to input the three symbols appearing on some page in the manual. Pick any three symbols. Break into TMON. <IN TMON> Choose MAGIC RETURN from User window. <IN PROGRAM> Hit OK button. <IN TMON> GOSUB a few times; do not GOSUB over pascal case statement beginning (TRACE through it to avoid hanging TMON). Notice quite a few BRAs to Code0005+BCC. Decide too many IFs to handle, so hack logic at source, decision stage (Code0003+15A, Code0003+16E). A #$00 returned from decision routine in D0 means a faulty code, a #$01 returned in D0 means good code. Change all MOVE #$00,D0 to MOVE #$01,D0 so every code is good.
KRAK IT YOURSELF
Hex Search:
70 00 60 12 52 6E FF EC
Hex change:
…01…
Hex Search:
70 00 4E 5E 4E 75 4E 56
Hex change:
…01…
or
CODE 2+2A8C
from:
4EAD 066A 4FEF 000A
to:
4E71 4E71 4E71 7001
or
- ROBOSPORT V1.0
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 2
CHANGE THE WORDS AT OFFSET 2A82-98 (2A82, 2A84, ..., 2A98) TO 4E71 CHANGE THE WORDS AT OFFSET 2AB2-C8 (2AB2, 2AB4, ..., 2AC8) TO 4E71
- ROBOSPORT V1.11
EFFECT: The password dialog will never show up
HOW TO: Locate CODE resource 2
Change the words at offsets 2C30 through 2C46 to 4E71 Change the words at offsets 2C60 through 2C76 to 4E71
and you'll get $500,000 and all technologies enabled.
-
SimEarth
†This patch to SimEarth 1.0 eliminates the annoying quiz at the beginning. This patch appears to work on both the color and black & white versions. The first patch disables the quiz for new planets, the second for loading existing planets. They simulate a successful call to the quiz procedure.
CODE 11 offset $61C (newgame)
change 4EAD 008A (color version) or 4EAD 00EA (B&W) to 4E71 7001
CODE 14 offset $D8 (loadgame)
change 4EAD 008A (color version) or 4EAD 00EA (B&W) to 4E71 7001
or
EFFECT: The password dialog will never show up
HOW TO: CHANGE THE WORD AT OFFSET 127E IN CODE RESOURCE 2 TO 4E71
SIMEARTH V1.1
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 2
CHANGE THE WORD AT OFFSET 47E4 TO 4E71
CHANGE THE WORD AT OFFSET 47E6 TO 4E71
Typing when the cursor is in the toolbox:
FUND :gets you an infusion of cash
JOKE :displays a joke
SMOO :smooths coastlines
ERAD :eradicates all plants & animals life.
SIMEARTH (v1.1)
EFFECT: It doesn't ask for a word at start-up any more.
HOW TO: Open CODE resource 2
at offset 0012DA, change word to $4E71
-•SIMEARTH (B&W) V1.0
EFFECT: The password dialog entry box and question never show up. HOW TO: Locate CODE resource #2 (number two)
EFFECT: Press enter when asked program asks for original disk to avoid inserting original
HOW TO: LOCATE CODE 8 FIND THE OFFSET 390
AND CHANGE THE NUMBER 66 TO 67
-
Space Quest II
112929060100656
-
Spaceways 2000
†Beta
To play at higher levels:
At CODE 6 +1E78 Change: 000A to: 002F
Spaceway 2000
AKA - 'Spaceway 2000 Championship Edition'
Sure the challenge of Spaceway is really fun, but there's something to be said about kicking the shit out of the other computer. So, here's a bunch of cheats that I made for 'stress relief'.
i) *TURBO* patch
Hint: go in low-gear, unless you are really psycho
ii) Rapid Fire Fore and Aft Weapons
Hint: if Fore is on, Aft will not work, because the bullet
EFFECT: Can load old games w/o looking up words in manual.
HOW TO: LOCATE CODE ID=3
FIND Offset Change to from
3D0A 6032 4EAD
3D3E 6064 6630
-
Spectre
vpre-1.0
XVL224U
8FL224V
XME224W
C8E224X
Q7D224Y
GDD224Z
v1.0
LV8252W
LV82HPQ
LV836AJ
LV83ADH
LV83G43
LV83KT5
LV866AC
LV86CYN
LV86RMG
LV87E8A
LV87JB9
LV87PZT
LV87TQV
LV8AE84
LV8ALWE
LV8AZK8
LV8BN62
LV8BS8Z
LV8BXXK
LV8C3NM
LV8EN5U
LV8EUU6
LV8F9GY
LV8FW3S
LV8G26R
LV8G7VB
LV8GBLD
LV8JW3L
LV8K4RW
LV8KHEQ
LV8L5ZJ
LV8LA4H
LV8LFT3
LV8LKJ5
LV8P5ZC
LV8PCPN
LV8PRCG
LV8QDXA
LV8QJ29
LV8QPQT
ZC224R6
DMT24BV
8FL224V
XME224W
C8E224X
Q7D224Y
GDD224Z
9ET2FG2
v2.0d
AVN2227
XPW23Z5.
v2.0
LV82VNN
LV83ABG
LV83WWA
LV842Z9
LV848PT
LV84CEV
LV86WW4
LV875LE
LV87J98
LV886U2
LV88AWZ
LV88GMK
LV88LCM
LV8B6TU
LV8BDJ6
LV8BS6Y
LV8CERS
LV8CJUR
LV8CQKB
LV8CUAD
LV8FERL
LV8FMFW
LV8G24Q
LV8GNPJ
LV8GSSH
LV8GYH3
LV8H485
LV8KNPC
LV8KVDN
LV8LA2G
LV8LWMA
LV8M2Q9
LV8M8ET
LV8MC5V
LV8PWM4
LV8Q5BE
LV8QHY8
LV8R6K2
LV8RAMZ
LV8RGCK
LV8RL3M
LV8U6JU
LV8UD96
LV8URVY
LV8VEGS
LV8VJKR
LV8VQAB
LV8VTZD
LV8YEGL
LV8YM6W
LV8YZTQ
LV8ZNEJ
LV8ZSHH
LV8ZY83
LV93YKU
LV947A6
LV94KWY
LV958HS
LV95CLR
LV95JBB
LV95N2D
LV988HL
LV98F7W
LV98TUQ
LV99GFJ
LV99LJH
LV99S93
LV99VY5
LV9CGFC
LV9CP5N
LV9D3SG
LV9DQDA
LV9DUG9
LV9E26T
LV9E5VV
LV9GQD4
LV9GX3E
LV9HBQ8
LV9HYB2
LV9J4DZ
LV9JA4K
LV9JDTM
LV9LYAU
LV9M6Z6
LV9MKMY
LV9N88S
LV9NCBR
LV9NJ2B
LV9NMRD
LV9R88L
LV9REWW
LV9RTKQ
LV9SG6J
LV9SL9H
LV9SRY3
LV9SVP5
LV9VG6C
LV9VNUN
LV9W3HG
LV9WQ4A
LV9WU79
LV9WZVT
LV9X5LV
LV9ZQ44
LV9ZWSE
LVA2A7J
LVA2EAH
LVA2KZ3
LVA2PQ5
LVA5A7C
LVA5GVN
LVA5VJG
LVA6J5A
LVA6N89
LVA6TWT
LVA6XMV
LVA9J54
LVA9QTE
LVAA5G8
LVAAS32
LVAAW5Z
LVAB3UK
LVAB7KM
LVADS2U
LVADYR6
LVAEDDY
LVAEZYS
LVAF63R
LVAFBSB
LVAFFHD
LVAHZYL
LVAJ8NW
LVAJMBQ
LVAK9WJ
LVAKDZH
LVAKKQ3
LVAKPF5
LVAN9WC
LVANGLN
LVANV9G
LVAPHUA
LVAPMX9
LVAPTMT
LVAPXCV
LVASHU4
LVASQJE
LVAT578
LVATRS2
LVATVUZ
LVAU3KK
LVAU7AM
LVAWRRU
LVAWYG6
LVAXD4Y
LVAXZPS
LVAY5SR
LVAYBHB
LVAYF8D
LVB2BV4
LVB2JKE
LVB2X88
LVB3KT2
LVB3PVZ
LVB3VLK
LVB3ZBM
LVB6KSU
LVB6SH6
LVB775Y
LVB7TQS
LVB7XTR
LVB85JB
LVB899D
LVBATQL
LVBB2EW
LVBBF3Q
LVBC3NJ
LVBC7RH
LVBCDG3
LVBCH75
LVBF3NC
LVBFACN
LVBFNZG
LVBGBLA
LVBGFP9
LVBGMDT
LVBGR4V
LVBKBL4
LVBKJAE
LVBKWX8
LVBLKJ2
LVBLPLZ
LVBLVBK
LVBLZ2M
LVBPKHU
LVBPS86
LVBQ6UY
LVBQTFS
LVBQXJR
LVBR59B
LVBR8YD
LVBTTFL
LVBU25W
LVBUESQ
LVBV3DJ
LVBV7GH
LVBVD73
LVBVGW5
LVBY3DC
LVBYA3N
LVBYNQG
LVBZBBA
LVBZFE9
LVBZM4T
LVBZQTV
LVC3MGL
LVC3U6W
LVC48TQ
LVC4VEJ
LVC4ZHH
LVC5783
LVC5AX5
LVC7VEC
LVC844N
LVC8GRG
LVC95CA
LVC99F9
LVC9F5T
LVC9JUV
LVCC5C4
LVCCC2E
LVCCQP8
LVCDDA2
LVCDHCZ
LVCDP3K
LVCDSSM
LVCGD9U
LVCGKY6
LVCGYLY
LVCHM7S
LVCHRAR
LVCHWZB
LVCJ2QD
LVCLM7L
LVCLTVW
LVCM8JQ
LVCMV5J
LVCMZ8H
LVCN6X3
LVCNAN5
LVCQV5C
LVCR3TN
LVCRGGG
LVCS53A
LVCS969
LVCSEUT
LVCSJKV
LVCV534
LVCVBRE
LVCVQE8
LVCWCZ2
LVCWH3Z
LVCWNSK
LVCWSHM
LVCZCYU
LVCZKP6
LVCZYBY
LVD2379
LVD28VT
LVD2CLV
LVD4X44
LVD55SE
LVD5JF8
LVD6722
LVD6B4Z
LVD6GTK
LVD6LJM
LVD96ZU
LVD9DQ6
LVD9SCY
LVDAEXS
LVDAK2R
LVDAQRB
LVDAUGD
LVDDEXL
LVDDMMW
LVDE2AQ
LVDENVJ
LVDESYH
LVDEYP3
LVDF4E5
LVDHNVC
LVDHVKN
LVDJA8G
LVDJWTA
LVDK2W9
LVDK8LT
LVDKCBV
vSupreme (MacExpo)
DMT24BV
BVU247M
FLH242T
LNB24WB
VDP257N
ACR25MM
XPW23Z5
45FGT67
45LKJ67
Supreme (release)
LTS24QW
ENF2BB5
V6GHC5S
23XHC5N
ENF2BB5
CME2438
45fgt67
45lkj67
buu24m
flh242t
lnb24wb
wdp257n
acr25mm
xpw23z5
LV8252W
LV82HPQ
LV836AJ
LV83ADH
LV83G43
LV83KT5
LV866AC
LV86CYN
LV86RMG
LV87E8A
LV87JB9
LV87PZT
LV87TQV
LV8AE84
LV8ALWE
LV8AZK8
LV8BN62
LV8BS8Z
LV8BXXK
LV8C3NM
LV8EN5U
LV8EUU6
LV8F9GY
LV8FW3S
LV8G26R
LV8G7VB
LV8GBLD
LV8JW3L
LV8K4RW
LV8KHEQ
LV8L5ZJ
LV8LA4H
LV8LFT3
LV8LKJ5
LV8P5ZC
LV8PCPN
LV8PRCG
LV8QDXA
LV8QJ29
LV8QPQT
ZC224R6
DMT24BV
8FL224V
XME224W
C8E224X
Q7D224Y
GDD224Z
9ET2FG2
LTS24QW
23XHC5N
V6GHC5S
ENF2BB5
CME2438
45FGT67
45LKJ67
ACR25MM
FLH242T
LNB24WB
WDP257N
XPW23Z5
vVR
MB7565LD
†Spectre 1.0
These are serial numbers for Spectre 1.0. To play multi player games, you need to have each copy registerred under a different serial number. Just copy your
Spectre, delete the 'STR ' resource ID 997 in the copy using ResEdit (this
erases the old serial number so you can reregister using a new one), and run
the copy. When it asks you to register your copy, use one of these serial
numbers. Use a different serial number for each copy.
Extra Note: try typing GOD (or dog) when playing the game, at the option
selection screen or in the demo.
or
To make anything a serial number:
CODE 2+$19DE
From: 660C
To: 600C
AND
CODE 2+$19EE
From: 67A4
To: 4E71
To really spice up the customizable tank:
CODE 25+$2F8
From: 6744
To: 6044
This will allow you to have up to 127 for your 3 attributes. For a really fun
game, try putting things in negative!
==========
Spectre Supreme (MacWorld Special Edtn)
NOTE: There is a bug in the way the program searches for the matrix file, so
to launch the application, double click the matrix file. Perhaps this bug
might be because it passes $910 to FS<something> instead of the correct low-
memory global (maybe #920 (CurDirStore))? Your guess is as good as mine...
To allow anything as a serial number...
CODE 2+$2A26
From: 6614
To: 6014
AND
CODE 2+$2A3E
From: 6796
To: 4E71
The name and serial number are stored in the 'STR ' resource ID 997.
To spice up the customizable tank
Change CODE 23+$310
From: 6624
To: 4E71
AND
CODE 23+$334
From: 6708
To: 6008
or
Search the Spectre App for : 4eba fcf6 1e1f 1007 6614 1007
Change the Specter App to : 6014
Search the Spectre App for : 6797 42a7 4240 102e fefc 5840
Change the Spectre App to : 4e71
or try
Patch to Fix Spectre Supreme 2.0b3
Search for: 6614 3F3C 2AFA 4EAD 07EA
Change to: 6014 3F3C ....
Search for: 6796 42A7 4240 102E FEFC
Change to: 4E71 42A7 ....
After these patches, you can enter ANY number or string as a serial number.
To remove the serial number so that you can repersonalize it, just delete
'STR' 997, and run the program again.
or try
Copy the STR resource from the 1.1 developer version. Replace the STR in
2.0b3 with the one from 1.1. This will give you one serial number. For
another serial number, delete the STR resouce in 1.1d, load it up and enter
any serial number. Repeat the process to get a copy of 2.0b3 with a different
serial number.
or try
These are serial numbers for Spectre 2.0. To play multi player games, you need
to have each copy registerred under a different serial number. Just copy your
Spectre, delete the 'STR ' resource ID 997 in the copy useing ResEdit, and run
the copy. When it asks you to register your copy, use one of these serial
numbers. Use a different serial number for each copy.
Extra Note: try typing GOD (or dog) when playing the game, at the option
selection screen or in the demo.
==========
Spectre Supreme (release)
Sometimes, but not always, you can re-personalize a copy of Spectre or Spectre
Supreme without knowing a valid serial number.
If you open the personalization resource with ResEdit (#995 or #997), all the
personalization info will be there. Delete everything from inside the
resource, but not the resource itself. Then type in a random hexidecimal
number and save. Then for each copy you wish to make, type in another,
different random hex number.
What I think happens is this: Spectre first checks to see if there is the
personalization resource (#997). If there is no STR# 997 then it will bring up
the serial # dialog box. But since there is (you didn't delete it, 'member?)
it continues. Then it checks the net for copies with the same SN, and
supposedly all your copies will have different ones. For some reason, at
random times, a dialog has come up saying that the same SN is on the net when,
for the life of me, I can't find it. I'm still trying to figure out why this
be.
Spectre VR network
If you really, really, really want to play Spectre VR over a network but still
haven't found any more SNs floating around, do the following hex patch.
This will make Spectre take any Name and SN as valid. Only problem is that it
will ask you for this every time you load it up. So just make sure that the
random crap you type in is nothe same on different machines.
CODE 2 OFFSET 359A
6614 3F3C 2AFA 4EAD 096A 3F3C
to
6714
and
CODE 2 OFFSET 35B2
679C 102D 842D 4880 122D 842D
to
669C
These offsets should be right, but if not the target code is right next to it.
The "module" is that as named under the "Module" menu in ResEdit
2.1.1 using Code Editor 2.9 . They may differ on other versions. Both ResEdit and the Code Editor are available via anonymous ftp to ftp.apple.com in the directory /dts/mac/tools/resedit . I highly recommend both of them.
(IF YOU DO NOT HAVE CODE EDITOR THEN USE THE RESOURCE OFFSET RATHER THAN MODULE OFFSET .....AC)
First the original code is listed, including the assembly command just before and after the one(s) to be changed. The numbers to be changed are just above the character "|". The first number to be changed corresponds exactly to the offset number.
When installing patches, you should ALWAYS verify that the original code is exactly the same as what's listed as "original". If not, you might patch the wrong location, which would have an unknown effect on the patched application.
EFFECT: Bypass the initial password (a number of ways).
(i) and (ii) still allow for entry / display of a password and username.
(iii) COMPLETELY bypasses the initial password dialog: Spectre will always have a NULL password and username using (iii). If you want a personalized version, you MUST use (i) or (ii).
Serial Number follows this pattern: A**6241-----1. The "**" is representitive of one of the following sequences: 02,15,28,31,44,57,60,73,86,99. Plug one of these where the stars are.
In the "-----" space enter either of these sets of numbers: 37708 or 79824.
Using this method you can yield over twenty copies.
To do this edit the V4sn resource in ResEdit. Be sure to make it the same length (14 Characters) including the beginning box.
-
Stratego
†v1.1.1
change CODE 10+$1628 from $4EAD 0672 to $4E71 7001 to get rid of the codes.
-
Streamline
v3.0
SAW300R3113443-487
SAW300R3100127-190
-
Studio 1
4682119240
-
Studio 8
v2.0
9248372456
†Crack
In ResEdit open code ID 3. At offset $011A change $671A to $601A.
Any 10 digit password will now work
-
Studio 32
3006003068
-
Studio Session
†This crack works for both the Player and the Editor.
As a matter afact I know a "sort-of way" to do it. This will work fine for
TEXT files, but if you are unstuffing an application this may not work(though
try it).
Oh, this also works fine for documents, just not applications(well not all the time).
1. Open the stuffit archive with ResEdit(or similiar utility)
2. Locate the Mkey resource and delete it(remember to keep SPARE COPY OF THE
FILE!!!!!)
3. Now open the file again(yes it will still say it is encrypted)
4. Now try to unstuff the file, it will give you a dialog box asking you to
enter a password. Put one in(make it simple, like 123, abc etc. it has to
be 3 characters), then remember it, click ok, it will give you another
dialog box asking you to verify your password. Simply type it in again and
voila!
5. It will unstuff, but 7 times out of ten, it will not unstuff the file
completely right, you can still read TEXT files, document files etc. But
applications might not work. The TEXT files have there errors though, but
most of em are obvious.
-
StuntCopter
MUHAHA
-
S.U.M. II
D952906J
-
SuperATM
v3.5-3.6
GHB100R3100136-472
GHW100R3106316-197
-
SuperDisk
†On message, open Control Panel, Touch: Alerts, Security, More Options, Memory
-
SuperLaserSpool
042401
-
Super Maze Wars
†- SUPER MAZE WARS
EFFECT: When you start up, it will no longer ask for a registration number. In the About window, you can enter any registration number in the format: xxx-xxx-xxxx
This allows you to have unique identities on the network.
HOW TO:
CODE 5 + $472A : Change $3007 -> $7000
CODE 5 + $47D4 : Change $1E00 -> $7EFF
Crack for Maze Wars 1.0
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
1) Open up Maze Wars 1.0 with ResEdit
2) Open up the Code Resource
3) Open up Code 5
4) Search for Offset +4660
5) Change 6622 to 6022
6) Quit and save all changes
7) Run Maze Wars
8) Enter your made-up serial number in the correct format (123-456-7890)
9) Have fun!
Brief Overview for C&Ns:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Code 5
+4660
6622 -> 6022
-
SuperOffice
v2.0
For the release
102600776
102600768
For the Upgrade
1026001535
1026001527
1026001451
-
SuperPaint
†v3.0
Name, Organization, and Serial Number info for SuperPaint 3.0
When the Aldus Installer installs SuperPaint 3.0, it will install an
Application with only one 'PLoc' Resource, which is a location of the
preferences file (ID 0). It also creates an invisible file called 'SomeFile',
type 'rsrc'/creator 'RSED' containing only one resource - 'PLoc' ID 1. The
format of this resource is similar to that of an owner resource - 1 byte
indicating the length, then the data of that length. This would contain your
serial number (i.e 'US 30-300....'), not encrypted. When you run SuperPaint
for the first time, it expects that file to be in the same directory as the
application, otherwise it says 'Personalization Failed.....'. If that file is
there, is will ask you for your name and organization, and display your serial
number. Then, it will add resource PLoc ID 1 to the Application with your
Name, Organization, and Serial Number stored as consecutive encrypted strings.
Since strings are 256 bytes, 256 * 3 = 768 bytes = Size of the resource. The
application never checks this resource, so you can screw with it to your
hearts content, as long as it stays the same size. As for the format of the
resource, I played with it and came up with this:
The first and second bytes are intact (the length, and the first character of
the string). The rest of the string seems to conform to this format:
First Nibble of the byte:
0 1 2 3 4 5 6 7 8 9 A B C D E F
becomes (BitXor $2)
2 3 0 1 6 7 4 5 A B 8 9 E F C D
Second Nibble of the byte:
0 1 2 3 4 5 6 7 8 9 A B C D E F
becomes (BitXor $A)
A B 8 9 E F C D 2 3 0 1 6 7 4 5
E.G.
$41 (Hex)/'A' (Char)/65 (Dec.) would become (BitXor 2A)
$6B (Hex)/'k' (Char)/107 (Dec).
Look for an application to convert this for you!
Hint: To depersonalize SuperPaint just delete PLoc ID 1, Open ResEdit, Create
a New File, add resource type 'PLoc', create a new resource, type in anything
as a serial number, get the length, convert it to hex, then insert that as the
first character. Run SuperPaint, and it should ask you for you name/org with
that serial number!
-
Super Tetris
†SUPER TETRIS
EFFECT: You don't have to keep looking up the password each time to run it.
HOW TO:
1. Open ResEdit
2. Open CODE resource #6 "dialogs"
3. select "Anon 5"
4. at offset +0034 (addr 00025A) change D6A0 to D7A0
5. save & quit
Color:
Patch App by first verifiying that CODE 6+$2B0 is $D9A4.
Make these changes to a sector copy, then bit copy tracks #78 & 79 with copy
II Mac.
-
Wishbringer
†Search for 6FDA100667063B7C change to 6004100667063B7C
-
Wizardry
†Search for 0A00000167000090302EFFF2 change to 0A00000160000098302EFFF2
THAT REMOVES THE PROTECTION, BUT YOU STILL HAVE TO PUT SOME KIND OF DISK IN
THE INTERNAL DRIVE WHEN IT ASKS FOR THE MASTER(ANY DISK). TO REMOVE THE EJECTS
AND THE DISK REQUEST, DO THE FOLLOWING (AFTER YOU MAKE THESE MODS, IT WON'T
WORK ON A HARD DRIVE THO..) (SO IF YOU HAVE A H.D., JUST DO THE FIRST PATCH)
Search for 205FA0173E804ED14E56FFCE change to 205FA0173EBC00004E56FFCE
Search for 216E000A0012A0173D40000E4E change to 216E000A00124E713D40000E4E
Search for 2F2E00084EBAFF66A853 change to 2F2E00084E714E71A853
Search for FFF46620487A067E487A0632 change to FFF44E71487A067E487A0632
THAT'S, EITHER THE FIRST PATCH, OR ALL OF THEM, THE FILES ARE FINDER COPYABLE
AND NO MORE CHECKS.
or try
Wizardry 1.1
Search for 4EAD 059A 41ED 059A change to 4E714E7141ED059A
-
Wizardry II Knight of Diamonds
†- KNIGHT OF DIAMONDS (aka. WIZARDRY II)
EFFECT: By-passes copy protection.
HOW TO: Open CODE resource 73
at offset, change word to $4E75
-
Wordtris
†(color version)
Search for: A915 3B7C 000C 962E 422D
Change to : 4E71
Search for: 6600 FF4C 2F0C A983 1006 4CEE 10E0
Change to : 4E71 4E71 2F0C 4E71
Search for: A991 486D 95F2 7003
Change to : 4E71
(B/W version)
Search for: A915 3B7C 000C 963C 422D
Change to : 4E71
Search for: 6600 FF4C 2F0C A983 1006 4CEE 10E0
Change to : 4E71 4E71 2F0C 4E71
Search for: A991 486D 9600 7003
Change to : 4E71
or
Open it with ResEdit and open CODE resource ID=1 with a hex editor. At
position 07A0 you will find: 4EAD 056A 4A00 6606 4EBA 0BC8 A9F4 598F
Change this to: 4E71 4E71 4E71 4E71 4E71 4E71 4E71 4E71
or
- WORDTRIS v1.0 (B&W and Colour)
EFFECT: It doesn't ask for a word at start-up any more.
HOW TO: Open CODE resource 1
at offset 07A0, change word to $600C
or
WORDTRIS B/W
EFFECT: The password dislog will never show up
HOW TO: LOCATE CODE RESOURCE 1
CHANGE THE WORD AT OFFSET 07A0 TO 4E71
CHANGE THE WORD AT OFFSET 07A2 TO 4E71
CHANGE THE BYTE AT OFFSET 07A6 TO 60
- WORDTRIS V1.00 (COLOUR)
2 Patches, each works independant of the other so you can use one, the
other or both.
A) EFFECT: This will still bring up the dialog, but you just hit return 3 times and it will start.
HOW TO: Code 1, "Main", anton 6
offset 0082-0086 replace with 4E71
B) EFFECT: This will stop the dialog from being brought up. If you want to be reall safe, do both, because the second just kills the dialog and under some ciramstances it might quit anyway.
HOW TO: Code1, "Main", anton 6
offset 007A replace these two bytes with two 4E71's
-
Word Perfect
v2.0x
V0000005961
v3.0
V0000005961
-
Word Perfect Works
1WW12XM0000099
-
X-FerIT
†name is "anonymous"
number is 550035173-2
-
Xerion
†the following commands to wired things:
Clear 5 - Next Level (Just like Dos Master said for Crazy Cars)
Clear 6 - Directly to the bounus stage
Clear 3 - Clears what ever is pulling you or making you wiggle
Clear 1 - Make the paddel larger
Clear 2 - Makes you catch the ball
-
Xyphus
†Search for each string seperately and change the 67's to 60's.
4EBA 5F6C 101F 6708
4EBA 5E6A 101F 6708
4EAD 007A 101F 6708
or try
Search for 670002502C7C00 change to 4E714E712C7C00
-
ZephyrPalettes
v1.3
2-130-3186163
-
ZipIt
v1.2
†Crack for ZipIt v1.2
Open up ZipIt in ResEdit
Open CODE 2 in the Hex Editor
Change it as follows:
Offset:$2B3A From: $660E To: $600E
Offset:$2B4A From: $0C39 To: $13FC
Offset:$2B52 From: $6614 To: $4E71
Note that this does not actually register the program, it just makes it behave like it was registered. Also, it enables encryption!
-
Zone of Avoidance
†ZOA 1.03av
EFFECT: Remove Copy Protection
HOW TO: CODE 9 @1A0A : 4EB9 -> 6008
Another collection of modifications to make games more fun!
****************************************
This patch allows you to have unlimited missiles:
Open CODE 4 in ResEdit
Change it at offset $4392
From: $5379
To: $6004
****************************************
This patch gives you full abilites after you finish Level 1:
Open CODE 4 in ResEdit
Change it at offset $736E
From: $6252
To: $4E71
AND
Change it at offset $737A
From: $4ED1 0C39 0004
To: $23FC 0404 0404
-
~~~~~ Cracking Tips ~~~~~
†“Single Test Crack”
- refers to a crack that works in two halves (that have to applied seperately and in order) as the result of the program that is being cracked having a particularly simple and annoying personalization/registration scheme. Namely these programs test the same data (the serial number) (in one or more -usually 2 places) for two different reasons:
#1 do I have a valid serial#?
Yes -> Personalized.
No -> Personalize
#2 Is the serial # valid when Personalizing?
Yes -> Save personalization and enter program
No -> Quit or give alert saying try again.
Now assuming we can circumvent these two checks (ie. always make the answer yes) we are left with a small dilemma: If we just circumvent check#1 (or check#1 and check#2) we will never get to personalize, and if we just circumvent check#2 we get it personalized and can use it once, but it will ask us to personalize every time we run it - clearly an unacceptable state of affairs.
The two possible (CODE) solutions:
---------------------------------
Method A:
Just Patch Test#1 (simple but may cause crashes and/or not work - see below)
Method B:
Patch Test #2
Run Program and Personalize/Register
Quit the program (this is obvious but included for completeness)
Patch Test #1 (at this point the patch to test #2 is irrelevant)
Method B is by far the preferred course of action - although it is a somewhat tedious 3 step process it is guaranteed (by me {iff the crack is correct}) to ALWAYS work as it mimicks exactly the way the original code was meant to work (aside from reversing the checks results).
Method A is fraught with DANGER as it will definitely skip any special one time initialization/setup that is done by the personalization code, which at a minimum records your personalization info. Usually your personalization info is used for display in about boxes and such and if you go to one of these locations the program may or may not crash/screw up DEPENDING ENTIRELY on how it is programmed. Also you can never be absolutely sure that it won’t crash unless your capable of disassembling the whole program and analyzing it completely - go ahead make my day...(and you don’t need my help if you can - and the NSA has a job for you)
-
End Note
†Any cracking tips will be added here at the end of the file. The main file will contain only actual cracks. Cracking tips will remain in the file for only a few months.
