†Warning: NEVER mention this list (or any part thereof) in any public or non-secure transmission. Specifically this includes non-elite BBS's and the internet (all areas no matter how private you think it is - it isn't), CompuServe, Genie, AppleLink, and the other commercial/public networks. NEVER leave this list on a storage medium in a non-secure/non-elite environment. Never use this list in public.
The C&N list and/or portions thereof has been mentioned/posted to/transferred over the internet (and probably other non-elite systems) more than a few times in the last year or two!!! This has resulted in some developers taking action by re-engineering their copy protection - some even going so far as to trash files on your system if you try to use our information (Realmz trashes its own files). This is extremely annoying to those of use who actually produce or gather this info. If this continues to happen this list will become useless - we will not allow this to happen as we will simply not distribute it to as wide a channel (by using serialization, encryption and key distribution if necessary) and you (especially the assholes causing the problems) will never see another list again.
BTW: This list is a tool not a solution - so if you really need/use a ware and can afford it - buy it - especially if its a utility or a 'deep' ware.
(one exception - never buy anything from microsoft if you can avoid it)
-
*** Using the Cracks ***
vAll
†Most of these cracks can be installed either by using the Sector Editor option of Norton Utilities, or by using Resorcerer, or ResEdit...
Norton Utilities:
Run Norton Utilities and go to the Sector Editor option in the pull down menus. Select this. Open the drive the file is on. Open the file to be modified. Search for the string requiring modification using the find option. Select the bytes to be modified. Type in the changes.
ResEdit/Resorcerer
Run ResEdit and select the file to be modified. Click on the resource indicated (ie - Code 1) If there is more than one entry under that heading select the entry indicated in the crack. Go to the address indicated (Offset - this is usually shown as +0000 and is in the leftmost column) At this location you should see the code you have to change. Select the code to be changed. Type in the changes.
-
1st Base
vAll
†Move to block 0232, position 006F, and change to 01
Move to block 0005, position 008C, and change to 01
Move to block 0233, position 019F, and change to 60
Move to block 0233, position 01B3, and change to 01
Move to block 0233, position 01C7, and change to 01
Move to block 0005, position 0082, and change to 80
-
4D Boxing
v1.0
†CODE 12 +0CFA 6604->6004
-
4D Compiler
v2.3
v2.0.4
20996169922891
20996169923881
20996169924871
20996169925861
20996169926851
20996169927841
20996169928831
20996169929821
v1.0.4
†For SN# generation info see the '4D Serial Number Scheme' entry.
The first time 4D Compiler is run it will ask you for a serial number and then to insert it's key disk - it will then create a hidden file 'xx' at the root level of the volume that 4D Compiler is on - this file is used instead of you having to insert the key disk from then on.
Procedure for making 4D Compiler 2.3 68K create a valid xx file using MacsBug:
#1) Make a physical disk image of the installer disk 1 or have any formatted HD Disk handy
then follow this procedure EXACTLY (note <cr> indicates you press return)
#2) Delete any/all old xx (hidden) file(s) and Compiler prefs
#3) Quit all other running applications.
#4) Run 4D Compiler 2.3 68K.
#5) Personalize and enter any valid serial number such as: '20996169929821'
#6) Dialog will come up asking for the key disk
#7) Break into debugger and type:
ATB FreeDialog;G<CR>
#8) physically insert the disk mentioned in step #1.
#9) Debugger will now pop up. Type(Note: S0 stands for step-over ie O in SO is a letter not zero):
ATC;SO D;BR :+40F2;G<CR>
#A) Debugger will now pop up at CODE #2 +40F2, type
BRC;PC=PC+4;G<CR>
#B) Quit and Run again - will not ask for key disk again unless you made an error. If so start over
••• Version: "1.0.4" •••
CODE #1
+31F6 6724->4E71
+3214 6006->4E71
-
4D Dev/Runtime Key Disk
v3.2 (68K) Bypass
v3.2 File Format
†Install the 68K version of 4D 3.2 from the images.
The first time 4D is run it will ask you to insert it's key disk - it will then create a hidden file 'xb' (Developer) or 'xc' (Runtime) at the root level of the volume that 4D is on - this file is used instead of you having to insert the key disk from then on.
Procedure for making 4D 3.2 Dev/Runtime 68K create a valid 'xb'/'xc' file using MacsBug:
#1) Make a physical disk image of the installer disk 1
then follow this procedure EXACTLY (note <cr> indicates you press return)
#2) Delete any/all old xb (hidden) file and ACI prefs files/folders if present
#3) Quit all other running applications
#4) Break into debugger and put A-Trap break on _Eject by typing:
ATB EJECT;G<CR>
#5) Run 4D, the debugger will pop up, then type:
ATC;SO 6;BR :+5D2;G<CR>
#6) Dialog will come up asking for key disk - physically insert disk 1 into the drive now
••• in step #7 it is critical to include the 'BRC' as runtime code checksumming is done •••
#7) Debugger will come up now at main4+5D2. Type:
BRC;PC=PC+4;G<CR>
#8) Dialog will come up asking for name/owner/sn# - Click cancel - program will quit
#9) Run again - will not ask for key disk again unless you made an error - if so start over
#A) Personalize and enter a valid serial number and your done.
••• Version: "3.2 File Format" •••
4D 3.2 Developer Key Disk/SN# Info
The first time 4D is run it will ask you to insert it's key disk - it will then create a hidden file 'xb' at the root level of the volume that 4D is on - this file is used instead of you having to insert the key disk from then on - interestingly this files contents are independent of the key disk. The #948 byte 'xb' file format is:
[+#00,#39] #40=$28 byte header (20 words of generated data - see below)
[+#40,#43] $00000388 - longword containing the size of the 'FON#' #12 resource
[+#44,#948] the data from the 'FON#' #12 resource
The first #40 bytes are generated with the following code - it is unclear what their use is -- as although Random is predictable starting from a given seed, TickCount is not as the timings would vary with hardware and other software that is running and so should not be reliably reproducable (perhaps this is a red herring?):
short i,rand;
unsigned long temp,ticks;
for (i=0;i<20;i++)
{
rand=Random();
ticks=TickCount() % 1000;
xbData[i*2]=ticks+rand;
}
Format of the ACI prefs 'ICN*' resource (the only resource/data present)
These three resource contain (in increasing numerical order) the pascal strings you entered in the personalization dialog exclusive-or'd (cyclically if >9 bytes) against the (mungered from seperate pieces so as not to be spotable in the code) fixed string 'DOminiQUE', with the expeception of the length byte which is left alone.
†For key disk info see the entry: '4D Dev/Runtime Key Disk'
For SN# generation info see the entry: '4D Serial Number Scheme'
••• Version: "3.0.1" •••
Partial Crack to get around the key disk:
1. Install the program
2. Make a copy of the program
3. Make the following changes in the copy:
CODE 31+$22E From 66 to 60
CODE 31+$290 From 6700 FE82 to 4E71 4E71
CODE 31+$44C From 6600 10FE to 4E71 4E71
4. Run the copy and enter a serial number
This will create a preferences file on the hard drive
5. Delete the copy and run the original because the changes
cause crashes in the program. You will however no longer be asked for
a key disk at startup.
-
4D Insider
v2.0.1
11305970911491
v1.0.1
17385570911091
AAAAAAB3F0H150
AAAAAAB3ZARBZ0
AAAAAABDZUR1F0
-
4D Online Help
v3.0.5
123456400
654321301
v2.0.6
†The SN# algorithm is as follows:
num1=First six digits of the serial number
num2=((num1%7)*100)+((num1%3)*10)+(num1%2)
SN#=<num1><num2>
Thus if num1=654321, num2=(3*100)+(0*10)+(1)=301 so SN#='654321301'
Note: only the numerical value of <num2> is significant, so we could also use '654321000000301'
••• Version: "2.0.6" •••
CODE #3 +422E 6718->4E71
-
4D Runtime
v3.2
†For key disk info see the entry: '4D Dev/Runtime Key Disk'
For SN# generation info see the entry: '4D Serial Number Scheme'
-
4D SanityCheck
vAlias
Please see the entry SanityCheck
-
4D Serial Number Scheme
vVarious
†4D SN# Scheme Info
==================
The following is C (or in the later cases pseudo) code to generate and/or check 4th Dimension serial numbers. This information applies to the following products, whose minLength and mult paramaters are listed:
Product minLength mult
================ ========= ====
4D Insider 1.0.1 4 5
4D Insider 2.0.1 4 59 which is equivalent to 9 since (a+b)%c=(a+(b%c))%c
I will present two entirely different methods for generating serial numbers. The simplest, most direct method of attack is to restrict the problem domain to that of entirely numeric serial numbers. This approach removes the difficulty imposed by the "(SNStr[k]>='A')" test - but imposes the lesser restriction that SNStr[Len] is '0' or '1' in general (specific counterexamples exist). Thus we can arbitrarily choose digits for the first (mid-1) odd index characters, the 2nd to last (len-1) character (actually this character can even be an alpha), while the last character is choosen as '0' or '1'. Once those choices have been made it is a fairly straight forward procedure to calculate the remaining first (mid-1) even index numeric characters. The procedure is as follows
Step
====
#1 Choose len such that len>=minLength and len%2=0
#2 Set mid=len/2
#3 Choose numeric characters to occupy the first (mid-1) odd index positions of SNStr
#4 Choose numeric or alpha character to occupy SNStr[len-1]
#5 Choose numeric character '0' or '1' to occupy SNStr[len]
#6 if len%2=1 (len is odd) then choose an arbitrary character for SNStr[len-3]
#7 Calculate the constant specialA= myVal(SNStr[len])
#8 Calculate the initial value of specialB=((myVal(SNStr[len-1])^specialA)+mid)%10
The next method I present gets around the no non-digit characters (but last character must be a '0' or '1') restriction at the cost that we must work the problem both forwards and backwards. This technique comes about by noting that the "(SNStr[k]>='A')" test is only dependent upon the first (mid-1) characters of SNStr. Thus if we arbitrarily select the last two and these characters within the restriction(s) this test imposes we can solve for the remaining (next mid-1) characters in a two part process.
First we must note that the test implies that: isAlpha(SNStr[k])=isAlpha(SNStr[2*k-1])
ie for Len=14
k 2*k-1
= =====
6 11
5 9
4 7
3 5
2 3
1 1
thus for Len=14
Char 000000000011111
Index 012345678901234
---------------
SNStr[]="\p?xxyxzy?x?z???"
where each character marked with and x,y, or z must be the same type (alpha or digit) as the other characters so marked. In this case, we are only choosing the first 6 characters, so we must be sure that the characters at indexes 2,3 and 5 are either all digits or all alpha's - and when we are solving for the next six characters we must restrict our solutions to those in which the characters at indexes 7,9, and 11 match those that we choose at 4,5 and 6 respectively. Now as far as solving for our 6 remaining unknowns at positions 7 thru 12 we note that we must work the indexes in the same order as our loop since specialB is an (modular) recurrence equation. Thus, since the index interdependencies between specialB and specialC are (respectively - in the order we must solve them):
step 2*k-1 2*i
==== ===== ===
1 11 2
2 9 4
3 7 6
4 5 8
5 3 10
6 1 12
and we have already specified the characters at indexes 1 thru 6 it is clear that we must first solve (backwards) for the characters at positions 11,9 and 7 by calculating specialB as a function of itself and specialC and specialA; then we must solve (forwards) for positions 8,10 and 12 by (direct) calculation of specialB from itself and specialA. Both of these calculations can lead to multiple solutions (which is fine) due to modular arithmetic and the increased degrees of freedom in the pseudo (since the first 6 characters are not independent of themselves) independent variables (characters).
We must also note that in general we must have specialA=myVal(SnStr[len]) in a small enough range 0..n that will allow us to solve equations of the form:
u + (v^specialA)=w mod 10 for the variable v=0..9 or 10..35 or 0..35 where both u,w=0..9
u + x =w mod 10 ,where x=v^specialA
(u + x)%10 =w ,which implies u+x=w+10*j, integer j>=0 (and j<=4 in our case)
thus we have x=w-u+10*j, 0<=j<=4 or simply
v=(w-u+10*j)^specialA , j=0..4 such that v=0..9 or 10..35 or 0..35
but being able to generally satisfy the first range v=0..9 requires that specialA be constrained to 0..1 This range is also sufficient to guarantee that the other ranges of v are satisfied by some value of j in 0..4
Step
====
#1 Choose a len such that len>=minLength, if len%2=1 then SNStr[len-3] can be any character.
#2 Choose the last two characters - the last character must be '0'..'9','A'..'V'
(note you can do this in many ways and still get the value for myVal(SNStr[len-1]))
#3 Choose the each of the first six character from '0'..'9','A'..'Z' with the constraint that the
characters at indexes 2,3 and 5 are either all digits or all alpha's.
#4 Calculate the constant specialA= myVal(SNStr[len])
#5 Calculate the initial value of specialB=((myVal(SNStr[len-1])^specialA)+mid)%10
v=(specialB+10*j)^specialA such that j in 0..4 and v in 0..35
ie (in pseudo code):
j=0
repeat
calculate v=(specialB+10*j)^specialA
increment j
until (j=5)
pick a valid value of v from the values just calculated
#J if (i<(mid-1)) goto step#G
EX: For 4D insider 1.0.1 choosing the initial values SNStr[]='AAAAAA??????50' leads
to the following (3*4*3*4*2*4*4) 4608 valid serial numbers. (for any given SN# you may choose for each index any one of the characters in that indexes column)
SNStr[]='\pAAAAAAB3F0H150'
LDPARBF
VNZK LP
X U VZ
thus some serial numbers would be:
'AAAAAABDZUR1F0'
'AAAAAAB3F0H150'
'AAAAAAB3ZARBZ0'
In fact if we made the SN# 15 characters long we could arbitrarily choose the 13th character and get at least 4608*36=165888 valid serial numbers that all began with 'AAAAAA' and ended with '0' !!! (actually more since any character would work not just '0'..'9' 'A'-'Z')
-
4D Write
v2.1
SN#522691 Card#P.040029220455
-
4th Dimension
vAll
†See '4D <product name>'
-
4th Right
vAll
Butterball (case sensitive)
-
5PM Term
vAll
AICDBP-HHIJLD-FPTAJF-IBHBIM
-
8 Ball Deluxe
v1.0.1
6267EM11002
†Place the contents from all three disks into a folder and run the application. Let it uncompress all three files, when it gets to the Registration Dialog, CANCEL it and exit to Finder. Change:
CODE 4+$1B8E From: 660E To: 600E
CODE 4+$1BAC From: 670E To: 600E
or try
After you first take it off the disks, run it once so that it will decompress itself, then cancel and change:
To use anything as a registration number:
This part changes the application tampering check:
CODE 4+$1BAC From: 670E To: 600E
This part changes the dialog handling procedure:
CODE 4+$2E47 From: 670E To: 600E
Also
To really crack 8-Ball Deluxe, after you’ve done the crack, change:
CODE 2+$2EB2 From: 67 To: 60
Then you can copy the files all over the place.
OK, now to spice up your game:
To get infinite lives:
{How do you end the game? I dunno… Try it for practice!!!}
CODE 5+$3EEA From: 661C To: 601C
To set your number of lives:
CODE 5+$371E From: 0004 To: Whatever! Ex.
1 = $0001
2 = $0002
4 = $0004
9 = $0009
10 = $000A
11 = $000B
16 = $0010
17 = $0011
Get the idea? Remember to make sure it's 4 characters long when you type it in! Also, when you play, you’ll only see a '-' for your ball, because it thinks that because you've got n balls left, and it ends at 4 (5?), you’ve got
4 (5?) - n (Probably a negative number) left!
-
ABCBase
vAll
†Search for: A9F4 42A7
Change to: 4E71 " "
Search for: A9F4 4246
Change to: 4E71 " "
-
AboutFace
v1.3
1022446
-
Accelerator
vAll
A300-11114-CP4U
A300-12935-CP4U
A300-31239-CP4U
-
Access PC
v3.0
0120 0000 0253 0278
0120 0000 4589 1115
v2.0.2
500056261
-
Accountant Inc. Pro
vAll
18225
-
Accutext
v2.0
10900016
-
AD (After Dark)
v3.0
ADM-00670-6681
ADM-21289-8489
ADM-30306-9708
ADM-75689-8965
ADM-90213-6771
ADM-90213-6772
†If you need more serial numbers, you can change the last digit of any of the ones above.
-
AD Disney Screen Saver
vAll
DIS-00670-6681
DSM-75689-8965
-
AD Loony Tunes
v1.0
xxx-00670-6681
-
AD Marvel Comics Saver
vAll
EAM-30306-9708
MAR-00670-6681
-
AD Scream Saver
vAny
SSM-75689-8965
-
AD Simpsons
vAll
ZQM-65187-4617
-
AD Star Trek Next Generation
v1.0
NGM-00670-6681
ZQM-35600-2587
-
AD Star Trek Posters Saver
vAll
SPM-90213-6771
-
AD Star Trek Screen Saver
vAll
EAM-30306-9708
KAM-21289-8489
STM-00670-6681
†ADga 1+$864 From: 6706 To: 6006
ADga 1+$882 From: 6604 To: 6004
ADga 1+$896 From: 6704 To: 6004
ADga 1+$8F4 From: 57C0 To: 4E71
Anything will work as a serial number when running the Installer program - you cannot just drag the control panel into your System Folder. The Name, Organization, and Serial Number are stored in the 'InaP' resources in the After Dark control panel. They are encrypted - didn't bother to figure the method that out.
or try:
The crack is in the script file, resource ADga #1
Offset Original Cracked
2AC 67 60
362 6700FEE4 4E714E71
7A4 66 60
864 67 60
88E 6FE0 4E71
896 67 60
8B6 6DE8 4E71
8E6 6DD4 4E71
-
AD Totally Twisted Screen Saver
vAny
TTT-00670-6681
-
AD X-Men
v1.0
ZQM-65187-4617
-
AddDepth
v1.0.2
AD-102-8-1634-17056
v1.0
AD-100-2-1272-46699
-
Adobe Acrobat
v2.0 Mac
ANW200U3010000-353
ANW200U3010001-986
ANW200U3010002-619
ANW200U3010003-252
ANW200U3010004-885
ANW200U3010005-518
ANW200U3010006-151
ANW200U3010007-784
ANW200U3010008-417
ANW200U3010009-334
ANW200U3010010-952
ANW200U3010011-585
ANW200U3010012-218
ANW200U3010013-851
ANW200U3010014-484
ANW200U3010015-117
ANW200U3010016-750
ANW200U3010017-383
ANW200U3010018-300
ANW200U3010019-649
ANW200U3010020-551
ANW200U3010021-184
ANW200U3010022-817
ANW200U3010023-450
ANW200U3010024-367
ANW200U3010025-716
ANW200U3010026-349
ANW200U3010027-982
ANW200U3010028-615
ANW200U3010029-248
ANW200U3010030-150
ANW200U3010031-783
ANW200U3010032-416
ANW200U3010033-333
ANW200U3010034-682
ANW200U3010035-315
ANW200U3010036-948
ANW200U3010037-581
ANW200U3010038-214
ANW200U3010039-847
ANW200U3010040-749
ANW200U3010041-382
ANW200U3010042-299
ANW200U3010043-648
ANW200U3010044-281
ANW200U3010045-914
ANW200U3010046-547
ANW200U3010047-180
ANW200U3010048-813
ANW200U3010049-446
ANW200U3010050-348
v2.0 WorkGroup
DEW200U3100000-010-974
DEW200U3100001-010-607
DEW200U3100002-010-240
DEW200U3100003-010-873
DEW200U3100004-010-506
DEW200U3100005-010-139
DEW200U3100006-010-772
DEW200U3100007-010-405
DEW200U3100008-010-322
DEW200U3100009-010-671
DEW200U3100010-010-573
DEW200U3100011-010-206
DEW200U3100012-010-839
DEW200U3100013-010-472
DEW200U3100014-010-105
DEW200U3100015-010-738
DEW200U3100016-010-371
DEW200U3100017-010-288
DEW200U3100018-010-637
DEW200U3100019-010-270
DEW200U3100020-010-172
v2.0 PC
WVW200U3100000-340
WVW200U3100001-689
WVW200U3100002-322
WVW200U3100003-955
WVW200U3100004-588
WVW200U3100005-221
WVW200U3100006-854
WVW200U3100007-487
WVW200U3100008-120
WVW200U3100009-753
WVW200U3100010-655
v1.0
DEW100R3100564-885
MVW100R3100000-050-208 (50 User)
-
Adobe Acrobat Exchange
v2.0
MVW200R3100411-609
-
Adobe After Effects
v2.0.1
XH9-SVJ1-B5K
-
Adobe Illustrator
v5.5
AAW500U3105408-140
-
Adobe Serial Number Assignments (Foreign)
vAny
†Serial Number Assignment
The serial number format is PPLVVVZxxxxxx-ccc
PP = product identifier
L = language identifier W=US, ROW
E=Eng. Int'l
F=French
G=German
I=Italian
P=Spanish
J=Japanese
VVV = version T=Chinese
Z = Media Type /Package ID K=Korean
Rtl 3", Rtl5.25", RtlCD
X=NFR, U=Upg, B=Bndl
xxxxxx = sequence number, 6 digits
ccc = Checksum
DESCRIPTION CURRENT FORMAT ITEM ID
Japanese Language Products
ATM-J Roman 0199 2083
ATM-J v2.06 ATJ206---- 0199 5572
ATM-J v2.05 ATJ205---- 0199 4732
ATM-J v3.51 ATJ351---ccc 0199 6458
ATM-J v3.51, NFR ATJ351X--ccc 0199 6457
ATM-J v3.5.2 ATJ352---ccc 0199 6735
ATM-J v3.5.3 ATJ353(6)-ccc 0199 7535
ATM-J v3.8 ATJ380(6)-ccc 0197 0285
ATM-J v3.5.2, NFR ATJ352X--ccc 0199 6734
ATM-J v3.8, NFR ATJ380X(6)ccc 0197 0313
ATM-J v3.5.3, NFR ATJ353X(6)-ccc 0199 7534
ATM-J Kanji 2.0.6 ATJ206X 0199 5581
ATM-J Kanji 2.0.4 ATJ204X 0199 4185
ATM Japanese Version ATJ2031--- 0199 3469
ATM Japanese Version ATJ2041--- 0199 3683
ATM JPL Plus Pack Version 2.0.6 PPJ206---- 0199 5573
ATM JPL Plus Pack Version 2.0.5 PPJ205---- 0199 4731
ATM JPL Plus Pack Version 2.0.4 PPJ204---- 0199 3878
ATM JPL Plus Pack Version 3.5.3 PPJ353(6)-ccc 0199 7537
ATM JPL Plus Pack Version 3.8.1 PPJ381(6)-ccc 0197 0509
†The "Type on Call bundle version" serial number would be: AAB QWY SAHI MSRV
those are 12 letters however to add more fonts, you need to enter the 14 character. that would be CDW200B1753407
-
After Dark
vAlias
Please see the entry AD (After Dark)
-
After Dark Modules
vAll
See 'AD <module Name>'
-
AgentDA
v2.1.3
179105018
v2.0
101208510
v1.x
102800455
-
Airborne
vAll
†Search for: 6712 4267 3F3C 01F4 42A7
Change to: 6012 " " " " " " " "
-
Aladdin Desktop Tools
v1.0
ADTB-778-010000
-
Alarming Events
vAll
03478
-
Aldus Fetch
v1.0
51-1000-201176607
51-1003-102157313
51-1007-201194631
-
Aldus FreeHand
v3.0x
02-1235-002302134
02-3008-000036469
02-4008-200010087
02-6023-000345263
12-1234-123456789
-
Aldus Hitchcock
v1.0
NPW-2TYG-L92
-
Aldus IntelliDraw
v1.0
Try any of the other
serial numbers for Aldus
-
Aldus Persuasion
vAll
08-2009-000379488
08-2001-200201529
02-3008-000036469
-
Aldus PrePrint
v1.x
02-0001-100000000
11-1009-200021734
11-1000-200027072
-
Aldus TextureMaker
v1.0
56-1000-202888264
-
Alias Sketch
v2.0
SMFRZ9CQG7ZWQ86
v1.5
SMDFQHB3THRH4LJ
v1.x
SMKB8MMKZ6SM8EV
-
ALLright Utilities
v1.0
1026439
-
Alsoft Power Pack
vAll
PS001604(001)
-
Alter Ego
vMale
†Search for: 24D0 5DE0 3584
Change to : 23D0 5DE0 3584
Search for: B07A 09B0 05A5
Change to : D1BC 0DA4 3EC8
-
AMAP
v2.0
†The Dongle specs are DIAQUEST FCC ID 1V2 EVE II 1090 - Needs a Dongle crack
-
American Heritage Dictionary
v3.0
A9-L0010M3
A9-D0010M3
-
Ancient Art of War
vAll
†Search for: 4EAD 02DA B07C 0022 6700 0100 42A7
Change to : 246D E8BC 2B6A 0002 E9F2 6000 0102
-
Animal Kingdom
vAll
†Search for: 3CBA 000C 4EBA
Change to: 4E71 4E71 " "
-
Animation Stand
v2.0.2
201063
202012
-
Animation Toolkit
vAll
†Search for:6608 45FA 0020 3012 9041
Change to :600A " " " " " " " "
-
Animation Works
vAll
45482
-
Anubus
v2.52s
9611181
-
App-Doc Linker
vAll
817GrGn5jkfh78h
-
Apple Easy Open
vAll
0120 0000 0253 0278
-
AppleShare
v4.1
B-341-UFD-170-QEC-309-IBZ-461-QYV-340
v4.0.2
B-341-VFD-170-QEC-381-ICV-075-GSN-340
v4.0
B-341UFD-170-QEC-357-HZM-484-XDG-340
v3.0
B-341UFD-170-QEC-357-HZM-484-XDG-340
-
Arkanoid
vAll
† If you don't like relying on chance for the right power capsule to drop down, there is a way to make yourself a winner. First, boot the program and begin to play as you normally would. Then, type: dsimagic. Then, resume your play. You'll see a capsule called DS drifting down the screen. Catch it an press A to regain sound, then press the following keys to obtain the type of power capsule and feature you want:
A= Sound on/off
B or W= break to next round*
C= catch;
D= extra balls (3 total)
F= go to last round (33)
L= laser;
M= get three balls
P= player (extra life)
S= slow;
X= let the computer play
0= pause
9= resume.
*On some versions, when you press B, you see a screen called Boss Comming instead of the next level.
ARKANOID (to run on most Mac's)
EFFECT: ??? (I guess it patches the game)
HOW TO: LOCATE CODE resource ID #4
Change byte 42 (hex) from hex 66 to hex 6D
Good luck, the only problems I have heard are from powerbooks, (a 140 crashed)
Oh, and it really likes it if you switch to B/W FIRST.
-
Armor Alley
v1.1
EXC2H3Y
EXC53RH
EXC5F33
EXCA992
EXCE8AT
EXCEDJM
EXCJMBF
EXCLBL6
EXCMTCN
EXCNCEP
EXCQRF5
EXCRR6X
EXCSDLL
EXCY2PP
EXD3XPA
EXD89FT
EXDB85R
EXDFPA5
EXDGPPG
EXDH8NL
EXDLAB2
EXDMWHM
EXDREBM
EXDS2QL
EXDTCHB
EXDTY9M
EXDYGQX
EXE3NMF
EXE669P
EXE9583
EXE9QQ3
EXEALLY
EXEDA9C
EXEEXRF
EXEFRMC
EXEHR25
EXEMPJL
EXEQR3E
EXESPMC
EXESXH2
EXEW6T5
EXEXSS3
EXF26LF
EXF3NWH
EXF58G6
EXF5HF6
EXFCBTG
EXFCJXJ
EXFFBFB
EXFFEHW
EXFLMYX
EXFNQ82
EXFR2NC
EXFSNBN
EXFWLQX
EXFWRHR
EXFX6NQ
EXG2A96
EXG563R
EXG8YW2
EXG9G9F
EXG9T2H
EXGBDS5
It appears that
any variation of the
C9X53TA serial
number works fine:
C9X53TA
C9X53TB
C9X53TC
etc.
also:
A3A56T3
A3A56T5
A3A56T8
A3A56D8
v1.0.1
PWPWD92
PWPX939
PWX2QHX
PWX8TX3
PWX963Y
PWX99W6
PWXCAF9
PWXDEB2
PWXFL8Q
PWXL55F
PWXL98N
PWXN59J
PWXQHGF
PWXQNAH
PWXQNDN
PWX56SM
PWXT8BA
PWXWNQ9
PX29LNM
PX2B5N8
PX2BAHW
PX2D8E9
PX2DTES
PX2E9T8
PX2EQSG
PX2ES8L
PX2F9T6
PX2HF8Q
PX2J9YE
PX2JN98
PX2LFLM
PX2LLT5
PX2MD9A
PX2MW6X
PX2NPX5
PX2PY2R
PX2QAE8
PX2QP3X
PX2T3B6
PX2TJL9
PX2W6DW
PX2W6HY
PXC6FHX
PXC8A59
PXC8DWS
PXCBG5J
PXCEJJ9
PXCETED
PXCF5SS
PXCGRFQ
PXCHWSM
PXCJ3Q2
PXCJD35
PXCMN6B
PXCP3CA
PXCT52Y
vAll
3P6GXEH
8CW659X
H3PJ69D
HQQCDHA
JMNR9SC
DE5A8R3
† To play a multiplayer game of Armor Alley, each copy needs to be registerred with a different serial number. These serial numbers are for Armor Alley™ 1.0.1. Some may have typos. Just make sure there is no Armor Alley prefs file in the system folder so you can register Armor Alley with a new serial number.
EFFECT: Disables network serial number checking.
HOW TO: Open CODE resource 6
at offset 03CE, change words to $4E71 4E71
-
Arrange-It
v1.0.2
ARM9300533
-
Art Mixer
v1.6
9208001
-
ArtWORKS
v1.0
†This is a two step crack:
Step #1: To get bogus personalization info into the program, and have the program init itself, change:
CODE 148+$00DC From: 6728 To: 6028
+$0116 From: 6670 To: 4E71
+$011E From: 6D66 To: 4E71
+$018A From: 6714 To: 6014
+$07E2 From: 670A To: 4E71
Run the program and personalize it, then quit and:
STEP #2: To make it believe the personalization is valid and skip repersonalizing, change:
CODE 14+$09B2 From: 6400 0224 To: 6000 0224
+$0BDE From: 6E00 0094 To: 4E71 4E71
Now you should have a personalized artWORKS that works perfectly!
Note this may or may not remove the network copy protection, but I think it probably does.
-
Ascend
vAll
†Change code #80 offset 05f0 from 66 to 67.
and just enter a name in the licensed to
and leave the rest blank under registration.
-
Ashlar Vellum
vAll
01399
-
Astound
vAll
3006005109
3004400378
-
Atlas
v1.2
†Search for: 4EBA F9AA
Change to: 4E71 4E71
Search for: 6704 4EAD 02E2 42AD
Change to: 6004 " " " " " "
-
Atticus Vista
v1.0
126100023
-
Authorware Pro
v2.2.0
3028-7078-3072
v2.0.1
A-O-00378-00-1963
-
Autoboot
v1.1.1
† Crack for Autoboot 1.1.1:
------------------------
1) Open up the CDEV Resource
2) Open up ID -4064
3) Find Offset 075C
4) Change 672E to 4E71
5) Quit and save changes!
6) Open up the Control Panel and click Register.
7) Enter in whatever the phuck you want.
-
AutoCAD
v1.2
110-10638231
-
AutoDoubler
vb12
tioga
-
AutoMenus
vAll
†Search for: 4A00 6600 00B0
Change to: " " 6000 " "
This will allow unlimited boots past the demo period.
-
Axis Game Cheater
v1.0.1
GC100/30728/02381QI
-
AXS OnLine Reader
v1.0.3
TNJFDC
†The serial number generating algorithm is as follows:
DesiredNum=0;
for (i=0;i<6;i++) DesiredNum|=CharMapIndexValue(SNStr[i+1])*Mult[i];
Where:
DesiredNum=10007*k, for some k>0.
Mult[]={33554432,32768,32,1024,1,1048576} // note these are integral powers of 32
CharMap | 00000000001111111111222222222233
Index Val | 01234567890123456789012345678901
---------+---------------------------------
SNStr Char| thequickbrwnfxjmpsvazydg23456789
Example: if we let k=666 then Desired Num=6664662, now 6664662 = {0,6,11,12,14,22} in base 32 which is transformed into {0,11,14,12,22,6} by the mapping {a,b,c,d,e,f}->{a,c,e,d,f,b} thus the corresponding serial number is "TNJFDC"
-
Aztec C
vAll
†Aztec C (1.00c)
Change block 71 (decimal) byte $1A9 from 01 to 00
==========
v68K-C (commercial ver)
Apply this to sys:
Copy both disks with Diskutil or any program that will copy both disks. There are no bad blocks on the disk. Apply the following block patches:
Block 214 Byte 107 From: 01 To: 00
Block 212 Byte E0 From: xx xx xx xx xx xx To: 30 30 30 30 00 00
Where xx is the value of the serial # on your disk.
Apply to sys2:
Block 63 Byte 97 From: 01 To: 00
Block 61 Byte 6F From: xx xx xx xx To: 30 30 30 30
There’s a hidden serial number on the disk. It’s on Block 212 Byte E5-E6. Just zap it to 00 00. No need to do this on the second disk as the serial number (visible) is just junk, and the invisible one is gone.
==========
v1.06D,F
Search for: 5245 6000 FF2E 7001
Change to: " " " " " " 7000
==========
v1.7
In the file: SHELL.
Search for: 6700 00E4 3D7C 0001 FFAC
Change to: 6000 " " " " " " " "
-
BackBurner
vAll
03-1489-0280
03-1418-1779
03-1422-2788
03-1448-9871
03-1448-9429
03-1448-8313
03-1448-4655
03-1422-6446
03-1337-9988
03-1422-1672
03-1420-5036
03-1422-7905
03-1420-1721
03-1448-3196
03-1418-4321
03-1418-6995
03-1418-9194
03-1418-5437
03-1400-2150
03-1400-4725
03-1400-3266
03-1416-4027
03-1400-8482
03-1400-9598
03-1400-9941
03-1416-1828
03-1416-5585
03-1416-9243
† To fool BackBurner's personalization dialog into thinking any SN you enter is good, make the following changes to the BackBurner APP..
Search for: 4FEF 0022 6712 4EBA 005C
Change to: " " " " 6012 " " " "
-
Balance of Power
vAll
†Search for: 72A1 D3C1
Change to: 5AD0 60CA
Search for: 1B09 9629
Change to: 1C09 " "
Search for: 8BAF E645 DE98
Change to: EA69 7BA9 0AB5
-
Bane of the Cosmic Forge
vAll
†To eliminate the codes, use ResEdit, open Bane (on disk A) change:
CODE 1+$8406
From: 0C6D 0001 C268 6606
To: 3B7C " " " " 4E71
or try
Bypass the journal entry codes by changing:
CODE 14+$4020
From 4267 3F3C
To: 6000 01DA.
Bypass the rule book codes by changing:
CODE 2+$39E
From: 4EAD 037A
To: 6000 01F8.
or
BANE OF THE COSMIC FORGE
EFFECT: This will remove the "match the codes" box.
HOW TO: LOCATE 'CODE' ID 1 FIND Offset $83FE From: 0C6D 0001 C268 6606
To: 3B7C 0001 C268 4E71
The following is a BANE patch that appears to work correctly (the previously
posted one works fine until you get into combat --- then you always miss!) - BANE OF THE COSMIC FORGE (Apr 24, 1991 version)
EFFECT: While you will still be prompted for a password the first time you restore a game, any old word works.
HOW TO: CODE ID = 1
Offset was change to
86D0 6C 60
8702 67 60
(just killing off the JSR to the password grabbing routine didn't work, so this will have to do unless someone makes a little more effort)
-
Bar Code Pro UPC
v1.0
230,780,677,334,210
†When Bar Code Pro first launches after installation it will ask for the number
of bar codes used in the US last year (from the manual on page).
-
Batch It!
v1.0
53060XXXXX ,where each X=Any Char
-
BetterWriter
v1.0.1
BW9112131832
-
Big Thesaurus
vAll
AxxxxBC
(A+B=C; x=any #)
-
Black Night
v1.0
0000000D1FF113F
-
Blood Bath
v1.5
†sgtrock - invincible
badass - all weapsons
-
BluePrint
v4.0
240*-00080642
-
Body Works
v3.0
Q24474
-
Bola 32
vAll
†v1.1
Search: FFEC 0C40 000A 661A
Change: " " " " " " 4E71
Search: FFEE B0AE FFE0 6610
Change: " " " " " " 4E71
Search: FF16 B0AE FFF2 6606
Change: " " " " " " 4E71
-
Borrowed Time
vAll
†Search for: 2F10 4217 205F 4E90
Change to: 203C 99C4 5501 4E71
or try
Search for: A552 F6C8 44B0 3DC0 1564
Change to: CF40 9035 1857 73BB 1995
-
Brataccas
vAll
†Search for: 2F10 4217 205F 4E90
Change to: 203C 99C4 5501 4E71
-
Breach
vAll
†Search for: 6604 70FF 6088 0C6E
Change to: 4E71 " " " " " "
-
Brock Keystroke
vAll
†Search for: 6708 2F0E 4EBA FEAE
Change to: 4E71 " " " " " "
-
Bulk Mailer
vAll
†Search for: 675A 42A7 3F3C 01
Change to: 605A " " " " "
-
Business Filevision
vAll
†Search for: 6700 023C 4217 23B8
Change to: 6000 " " " " " "
Search for: 3E81 3B5F F2EE 4A6D
Change to: 4257 " " " " " "
Search for: 6C06 4EF9 0040
Change to: 6006 " " " "
-
Butler
vAll
1560216811
-
C.A.T. IV
v1.0 (Evaluation Copy
SeRvIcEs
-
Cachet
vAll
CM0000045VPM
CM0000567VOM
-
CadMover
v3.4
†Here is a crack for the date check to eliminate the need
to re-insert the install disk.
Search for : 4EAD 137A 4EAD 136A 4A40
Change to : 4E71 4E71
-
Calculator Construction Set
vAll
†Search for: 0C40 0000 6700 0006 4EED
Change to: " " " " 4EFA " " " "
or try
Search for: 4EAD 00A2 0C40
Change to: 4E71 4E71 " "
-
CalcWorks
v1.4.x
0000000416 'Anonymous'
†To register: bring up the about box, then hold down the option key and click the 'Register…' button.
Note: This program used to be called ProCalc.
-
Calendar Maker
v4.1
2000000
v4.0
300870
300876
-
CameraMan
v2.0
CMSV0336
-
Canvas
v3.5.2
3001700735
3860817489
v3.0
3001700735
4753234241
2090414360
v2.0
2005355
1234567
(1st+6th digit=7th)
†To kill the ser# protection:
Search for: 6D00 FE94 0C6E
Change to: 600C " " " "
-
Capitalist Pig
vAll
†v1.02
CODE 4+$1F0E From: 6706 To: 6006
Also: to cheat break in at the inital setup dialog and set a breakpoint at SetUpDia +200 which is a MOVE.L #$F4240,-13A(A6) The $F4240 = 1,000,000 Decimal, which is the initial funds you start with simply change this value to say 100,000,000 or whatever you want.
or
CAPITALIST PIG
EFFECT: When password dialog appears, press enter to bypass protection. HOW TO: LOCATE CODE 4...FIND THE OFFSET 1F08
AND CHANGE THE NUMBER 6706 TO 6006
CAPITALIST PIG V1.0.2
EFFECT: Enter any number you wish into the password dialog box HOW TO: LOCATE CODE RESOURCE 4
CHANGE THE WORD AT OFFSET 1F10 FROM 4EAD TO 4E71
CHANGE THE WORD AT OFFSET 1F12 FROM 013A TO 4E71
CHANGE THE WORD AT OFFSET 1F14 FROM A9F4 TO 4E71
if you don't want to see the dialog at all you can change all the words between (and including) offsets 1D0C and 1F1C to 4E71.
-
Carbon Copy Mac
vAll
100003660
100003661
† No Checksum, etc. on the number; the serial number is REAL EASY to find with ResEdit, etc. Just change it and save changes, and presto — a “New Copy.”
†So that the password dialog will never show up, change:
CODE 1+$0088 To: 60
AMPC 42+$1D6EA To: 6060
$1D754 To: 4E71
-
Checkminder
vAll
†Search for: 3B5F F6C8 4A6D F6C8 6707
Change to: " " " " " " " " 6007
Search for: 101F 0A00 0001 670A
Change to: " " " " " " 600A
or try
Search for: 3B5F F6C8 4A6D F6C8 6706
Change to: " " " " " " " " 6006
Search for: 101F 0A00 0001 670A
Change to: " " " " " " 600A
-
Chem3D Plus
vAll
60086
KYAKRP
†If you’re using MS Word 5 and System 7, place the "EGO for Word" plug-in module in the Word Commands folder that is found in the folder containing the Word 5.0 application.
Keep the ChemDraw folder in the same folder as the CSC ChemDraw application
-
ChemDraw Plus
v3.0
Serial Number: 40770
Registration Code: CQXWPQ
-
Chequebook
vAll
†Search for: 6718 4267 3F3C 040B
Change to: 6018 " " " " " "
-
Chessmaster 2000
vAll
†Search for: A851 4EBA 30A8 42A7
Change to: " " " " " " 602E
Search for: 584F 4A40 6724 362E 0008
Change to: " " " " 4E71 " " " "
CHESSMASTER 2000
[Ed: This looks different from previous patches, it might be one that requires a disk editor]
EFFECT: Disable copy protection
HOW TO:
Search for:A8514EBA30A842A7
Change to:A8514EBA30A8602E
Search for:584F4A406724362E0008
Change to:584F4A404E71362E0008
-
Chuck Yeager's Air Combat
v1.0
†To prevent the copy protection dialog from appearing:
'CODE' #9
+44C4 4E56->4E75
-
Chuck Yeager's Air Combat Demo
vAll
†Here’s how to remove the two-minute limit in the demonstration version of Chuck Yeager's Air Combat:
CODE 04+$02A4 From: 6400 1110 To: 4E71 4E71.
+$145E From: 650C To: 600C
The first part removes the actual limit; the second part stops the game from telling you your time was up when you stop any time after two minutes.
-
Civilization
v1.0.8
v1.0.7
vQ&A List
vCheats
†TO completely bypass the protection dialog.
CODE 9
+2D4E from $4EBA to $4E71
+2D50 from $0014 to $4E71
+2D56 from $6x08 to $6008
(I forget the actual value that x represents above, but it doesn't really matter.)
••• Version: "1.0.7" •••
EFFECT: Select any item in the password dialog box.
HOW TO: LOCATE CODE RESOURCE 9
CHANGE THE WORD AT OFFSET 31C6 FROM 6662 TO 4E71
CHANGE THE WORD AT OFFSET 2D58 FROM 4267 TO 4E71
CHANGE THE WORD AT OFFSET 2D5A FROM 4EBA TO 4E71
CHANGE THE WORD AT OFFSET 2D5C FROM 0008 TO 4E71
CHANGE THE WORD AT OFFSET 2D5E FROM 548F TO 4E71
if you don't want to see the dialog at all you can change all the words between (and including) offsets 1D0C and 1F1C to 4E71.
••• Version: "Q&A List" •••
The following list is all the questions you may be asked after playing for 1000 years after starting the program. They are very simple and you will be given an approximate page number. Every 5 or 6 items here I have given page numbers, so that should make the choice of what I am talking about fairly easy. If you answer wrong, you might as well quit. Wrong answers will tell you that you were wrong.
Picture of B2 Bomber Flight and Electricity
Scroll in Star Map Mysticism and Mathematics
Atom Theory of Gravity and Physics
Old Car Combustion and Steel
Piggy Bank Trade and the Republic
Bridge Construction and Iron Working
Black Pot on tripod(17) University and Medicine
Sword with Scarf Horseback riding & Feudalism
Statue of man with sword and scale Alphabet
Combustion engine Refining and Explosives
Soviet hammer cross Philosophy and Industrialization
IBM PC Computer Mathematics & Computers
Plain soldiers(35) Republic and Explosives
Hand holding hammer over inc. house Masonry and Currency
Coins and Dollars Bronze Working
Three hands over flag Philosophy and Literacy
Kite in lightning Metallurgy & Magnetism
Circuit board Enginerring and Electricity
Circuit design under ruler Wheel and Construction
Explosives Gunpowder and Chemistry
Castle on Hill Masonry and Monarchy
Man with Wings Combustion and Physics
Two Atoms splitting Nuclear Power and Superconductor
Molecular Splicing(47) Medicine and the Corporation
Old gun with Gunpowder Bag Invention and Iron Working
Factory emitting Smoke Railroad and Banking
Old Phonograph Engineering and Literacy
Shield and Spears Bronze Working
Shaking Hands with Shovel and Axe Mass Production and Communism
Open book with 3 closed in back Writing and Code of Laws
Magnet(64) Navigation and Physics
Map Alphabet
3 Cars Automobile and the Corporation
Abacus adding machine Alphabet and masonry
Red Cross with Snaking lines Philosophy and Trade
Smelting Ore cup pouring(78) Gunpowder and University
Crown Ceremonial Burial and Code of Laws
Suppliant Meditating Ceremonial Burial
Ship Wheel Map Making
Nuclear Explosion Atomic Theory & Mass Production
Nuclear Sign Electronics and Nuclear Fission
Pensive Sitting Statue(86) Mysticism and Literacy
Wheel Scale with two arrows Mathematics and Navigation
Plastic Engine Refining and Space Flight
Train(92) Steam Engine and Bridge Building
Recycle Sign Mass Production and Democracy
Robotic Implements(112) Plastics and Computers
Rocket Advanced Flight and Electronics
View of Earth Computers and Rocketry
Steam Engine Physics and Invention
Pouring Steel Metallurgy and Industrialization
Two Meters Plugged into Wall Plastics and Mass Production
4 Men in front of Graph(118) Banking and Industrialization
Eagle on Globe Code of Laws and Literacy
Balls falling with arrows on sides Astronomy and University
Hands Exchanging coins(122) Currency and Code of Laws
Scholar's Cap Mathematics and Philosophy
Writing Quill(124) Alphabet
••• Version: "Cheats" •••
I couldn’t find the location of the $ in the game before, so finally I
said to hell with it, I’ll just find somewhere where it accesses it and hack
there. (It seems to only decipher the $ when it needs to and the encrypt/hide it as I had searched the entire range of program memory for it at various interupt points.) ... Anyways to make buying a unit/improvementt give you $32,000 (!!!) just do this:
Civilization CODE #14
+4E48 6E00B6FA->363C7D00
+4E6E 9750->3083
To make it give you $32000 whenever you sell anything (unecessary if you do
the first one, but the first one may be to much of a cheat for some people)
+5340 700AC1D0->303C7D00
+5352 D150->3080
of course these ruin the game, but hey so what you now know that you can
dominate the game and thus do not have to waste the rest of '93 playing it.
Nemo’s cheat for Civilization! Sure the challenge of Civilization is the entertaining part of the game, but there's something to be said about nuking the shit out of the other guys. So, here's a cheat so that you can buy anything that’s being produced in your city without losing any money. Also it stops you from losing any money each turn by low taxes or whatever:
Change CODE 14 This patches the buying
Offset:$4E00 From: $6E12 To: $4E71
Offset:$4E48 From: $6E00 B6FA To: $4E71 4E71
Offset:$4E6E From: $9750 To: $4E71
Offset:$62F6 From: $9150 To: $4E71
Change CODE 13 This patches losing money each turn
Offset:$18B8 From: $6E00 0088 To: $4E71 4E71
Offset:$18DA From: $9150 To: $4E71
Nemo’s cheats for Civilization!
AKA - ‘Civilization Championship Edition’
Fifth Revision
Sure the challenge of Civilization is the entertaining part of the game, but there’s something to be said about nuking the shit out of the other guys. So, here’s a bunch of cheats that I made for ‘stress relief.’
i) Allows you to buy anything for your city without losing any money
ii) Stops you from losing any money each turn, for low taxes, or whatever.
iii) Allows you to see what’s under the black (where you haven’t been) on the map.
Unfortunately, you can't see other cities unless you’ve been there.
iv) Prevents Global Warming
v) Prevents you from losing any offensive battles.
Doesn't work for other people attacking you.
vi) Prevents losing troops and settlers from food shortages
Side effect - your cities don't grow.
vii) All items can walk on water!
viii) All boats can swim on land!
You can attack cities, but you can't take them over (yet).
ix) SuperTechnology - all technology takes one turn.
Enemy technology also takes one turn.
x) Airplanes can't run out of fuel.
xi) Build cities on water
xii) Troops can attack from boats or the water without landing
Change CODE 14 This patches the buying
Offset: $4E00
From: $6E12
To: $4E71
Offset: $4E48
From: $6E00 B6FA
To: $4E71 4E71
Offset: $4E6E
From: $9750
To: $4E71
Offset: $62F6
From: $9150
To: $4E71
Offset: $6316
From: $5350
To: $4E71
Offset: $6330
From: $5350
To: $4E71
Offset: $6354
From: $5350
To: $4E71
Change CODE 13 This patches losing money each turn
Offset: $18B8
From: $6E00 0088
To: $4E71 4E71
Offset: $18DA
From: $9150
To: $4E71
Change CODE 3 This patches the map
Offset: $3B28
From: $6712
To: $4E71
Change CODE 7 This patches the global warming
Offset: $5544
From: $6624
To: $6024
Change CODE 7 This patches the battles
Offset: $3DA
From: $672A
To: $602A
Offset: $40C
From: $662C
To: $4E71
Offset: $456
From: $6C06
To: $4E71
Offset: $590
From: $6E18
To: $4E71
Change CODE 14 This patches the food shortages
Offset: $37E8
From: $6600 0080
To: $6000 04AE
Offset: $6FE
From: $6600
To: $6000
Change CODE 11 This patches walking on water
Offset: $2118
From: $6600
To: $6000
Change CODE 11 This patches boats on land
Offset: $271E
From: $664A
To: $604A
Change CODE 14 This patches the SuperTechnology
Offset: $602C
From: $6C28
To: $4E71
Offset: $6046
From: $670E
To: $4E71
Change CODE 11 This patches the airplane fuel.
Offset: $3F74
From: $6C14
To: $6014
Change CODE 11 This allows you to build cities on water.
Offset: $1978
From: $6700 00DE
To: $6000 0096
Change CODE 11 This allows troops to attack from water.
Offset: $21FE
From: $662A
To: $602A
The two most useful cheats I know are:
1: Save the game before the last piece moves, then quit and start your saved
game. All your pieces will be able to move again.
2: Engineers can accomplish any one task in one turn if after you assign them
a task, you repeatedly click on them, wake them up, and reassign the task.
-
Claris Emailer
v1.0
f804977886.3295
-
Claris Impact
v1.0.x
0003116155
0003119496
-
Claris Organizer
v1.0v2
Enter any number with 6 or more digits
-
Claris Works
vAll
1120000
-
ClockWerx
vAll
†Complete documentation to play ClockWerx can be found in its help file which can be accessed by depressing both the control key and the "H" key together.
The first time you run ClockWerx, the computer will ask you a question before you can continue. Once you have answered the question correctly, you will only be asked again if you reinstall ClockWerx. The questions and their associated answers are:
1. What is the name of the wooden board to which the movement of a longcase clock is attached? ANSWER - Seat Board
2. What is a mechanism used to minimize escapement error as a mainspring unwinds? ANSWER - Fusee
3. What was the first form of clock controller used in verge-escapement clocks? ANSWER - Foliot
4. What is the name of the mechanism that electrically maintains a pendulum in oscillation? ANSWER - Hipp-toggle
5. What steel alloy used for pendulum rods has a near-zero coefficient of expansion? Answer - Invar
6. What is the name of a form of pendulum in which the rod is a diamond-shaped frame? ANSWER - Rhomboid
7. What is the name of the knurled nut supporting the pendulum bob? ANSWER - Rating nut
8. What is the name of the device that is used to equalize the force of the mainspring over its period of run? ANSWER - Stackfreed
9. What is another name for a watch capable of sounding out the time at will? ANSWER - Repeating work
10. What is the name of the cylindrical brass box containing the mainspring of a clock? ANSWER - Barrel
11. What is the name of the cam that is used to determine the number of blows struck in a rack-striking work at the hour? ANSWER - Snail
12. What is the name of the arm acting as a click for the rack in rack-striking clocks? ANSWER - Rack hook
13. What is the name of the nib at the end of the anchor or lever arms acted upon by the escapement wheel? ANSWER - Pallet
14. What is the name of the depression surrounding a pivot hole? ANSWER - Oil sink
15. What is the name of the teeth on a smaller driven members in clock gear trains? ANSWER - Pinion leaves
16. What is the name of the type of wheel found in platform-escapement carriage clocks which drives the escape pinion? ANSWER - Contrate
17. What is the sound of a clock striking the quarters on two differently pitched bells or gongs? ANSWER - Ting-tang
18. What is the name of the bearing in which a pivot runs? ANSWER - Pivot hole
19. What is the name of the train of wheels in a clock that provides a 12 to 1 reduction between the minute and hour hands? ANSWER - Motion work
20. What is the name of the cam in an equation clock used for indicating solar time? ANSWER - Kidney piece
-
Coach & Coach Pro
vAll
1000001
1234567
(1st+6th digit=7th)
-
Collage
vAll
06-1405-6209
-
Color Minder
v1.1
188877
-
Color Studio
vAll
CS27968
CS11305
-
Color Switch
v2.3.0
†To patch ColorSwitch 2.3.0 so you can register without a License Code,
If you want to reregister, erase the ColorSwitch License file (514 bytes) from the Preferences Folder.
-
ColorIt
v2.0
CI20A-xxxxx
(Notice that it is
CI and not C1)
^-L one-^
-
Comet/CG
v2.3
0022001175
-
Command HQ
vAll
†GetPassW +314 6?->60
or
COMMAND HQ V1.0
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 7
CHANGE THE WORD AT OFFSET 0F0C TO 4E71
CHANGE THE WORD AT OFFSET 0F0E TO 4E71
-
Comment
vAll
1234567
(1st+6th digit=7th)
†v2.0
Search for: B02E FFFE 6604
Change to: " " " " 4E71
Search for: 4A28 0068 6600
Change to: " " " " 6000
Search for: 670C 206E 0008
Change to: 600C " " " "
This will cause it not to ever ask for name and serial number. if you really want a name and company name, type them in along with any serial number then use MacsBug to exit to shell (type ES at the prompt).
-
Communicate Lite
v1.0.1
802864192400
-
Compactor Pro
vAll
16225913
†v1.33
To register Compact Pro 1.33 and enable encryption, change:
CODE 4+$2EA4 From: 67 To: 60
When it asks you for the registration code, type any 8 characters. If you want to reregister your copy (to change the name), change any number of bytes in the CLOC resource (don’t change the size).
If you have a copy of Compact Pro 1.33 that won't enable encryption (if there’s an ‘*’ after your name in the about dialogbox and no ‘Set password…’ item in the Misc menu), make sure CODE 4+$2F44 is $66 (not $60) and reregister.)
Version 1.34
1) Open up the application with ResEdit
2) Open up the CODE resource
3) Open up CODE ID 3
4) Search for Offset 4856
5) Change 6718 to 6018
6) Quit ResEdit and save all changes
7) Open up Compactor Pro
8) Click Register
9) Type in a name and any serial number you wish
0) Now hit the return key!
Compact Pro 1.34 Krak
CODE 3
+47B8
6600 009E->4E71 4E71
+4856
6718 ->6018
or
For Version 1.34
Actually, here's a slightly better version of the crack. This one leaves the
Eliminates updating of the free trials left number, Get unlimited tries.
-
Conflict Catcher
v3.0.x
CC3-001-849-809
-
Copy II Mac
vAll
†To get rid of that stupid startup message in versions 4.3 to 5.2 change:
Search for:486E FECE 3F3C 0032 3F3C 003C
Change to: 6000 0204 " " " " " " " "
-
CopyPaste
v2.3.1
†'INIT' #0
+004A 7200->7201
-
Crash Barrier
v2.0
1982487924
v1.1.2
893482255
v1.1
1852328092
v1.0.3
1982487924
†••• Version: "1.1" •••
'cdev' -4064
+$4724 6606->4E71
••• Version: "1.0.3" •••
'cdev' #-4064
+$14D4 2F0E 4EBA FDFA -> 4E71 4E71 4E71
-
Create-It
vAll
CRM9301513
-
Creative Partner
v1.0
2AE90-5270-6B95A
2B044-D29F-25567
-
Creepy Castle
vAll
†V1.0 (ATTENTION: Patch also disables internal virus check!)
So that the password dialog will never show up change:
In file ‘Data A’
CODE 4+$3D4E From: 4E56 To: 4E75
CODE 3+$7176 From: 4EBA To: 7000
+$7178 From: E582 To: 7000
or try,
In file ‘Data A’
CODE 3+$57B6 From: 6704 7000 6050 To: 6054 7000 6700
This patch will disable the game's automatic virus checker for the mods and it’s shorter somewhat. This will also make it so the trivia dialog will never show up:
In file ‘Data A’
search for: 4EBA E582 3B40 A7C0
change to: 7000 4E71 " " " "
search for: 0C85 60EB 6953 670E
change to: " " " " " " 600E
or try,
To bypass the Trivia dialog in Creepy Castle, change:
In file ‘Data A’
CODE 3+$56FE From: 2F07 3F3C To: 6000 00B8
So that the built in virus checker doesn’t detect the change the code
checksum:
In file ‘Data A’
CODE 4+$3DA6 From: 60EB 6953 To: 2267 9A4C
-
Cribbage
vAll
†Search for: FA75 C74C 511
Change to: FB74 " " "
Search for: 6851 8EDF 775C
Change to: 6950 " " " "
-
Crimson Crown
vAll
†Search for: 2F10 4217 205F 4E90
Change to: 203C 99C4 5501 4E71
-
Crush Beta
vAll
tioga
(case sensitive)
†Search for:6704 7001 6002 7000
Change to: " " 7000 " " " "
Only search the resource fork. There are 5 or 6 places where this string can be found. You must replace all of them. When entering the “0” for the “1” in 7001, make sure to enter just one “0” and write each sector. That's it, happy crushing…
-
Cryptomatic
v1.01
346190
-
Crystal Caliburn
vAll
†CRYSTAL CALIBURN 1.0.2
EFFECT: Gets rid of the 'Your data file as been installed improperly dialog box.
HOW TO:
LOCATE CODE RESOURCE 2
CHANGE THE WORD AT 3510 FROM 6710 TO 6010
a hack that lets you play crystal calibourn on a 12" screen
(by doing this you can see most of your flippers instead of none.)
use resourcerer and open the 13" WIND template change to:
top 0 bottom 612 left 0 right 512.
it's not perfect but it is playable this way - it also lets you see the left
part of the game.
-
Crystal TOPAS
v1.5
RB20-0110-0730
-
Curse of the Azure Bonds
vAll
†v1.0 (bw)
So that the password dialog will never show up, change:
CODE 7+$6772 To: 4E75
==========
v1.1 (color) (2/1/91)
So that the password dialog will never show up, change:
HOW TO: CHANGE THE WORD AT OFFSEA IN CODE RESOURCE 14 TO 4E75
[EH?!?!? Does some one have the offset?]
-
Cutthroats
vAll
†Search for: 6FDA 1006 6706 3B7C
Change to: 6004 " " " " " "
2nd Crack
Use Block Edit on block 44 and change byte 15D from 67 to 60 or try:
Move to block 002C, position 015D, change 67 to 60
-
Dabbler
vAll
0013058-6239
-
Daisy Quest
v1.0
DQ 1255
-
Dark Queen of Krynn
vAll
† - DARK QUEEN OF KRYNN (ATTENTION: Patch also disables internal viruscheck!)
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 11
CHANGE THE WORD AT OFFSET 655A TO 4E71
CHANGE THE WORD AT OFFSET 655C TO 4E71 CHANGE THE WORD AT OFFSET 65B4 TO 4E71
or
DARK QUEEN OF KRYNN V 1.0
EFFECT: Defeats password protection.
Works for b&w version, not tested for color. Patch 1.0
This keeps the password dialog, but it doesn’t matter what password you
use.
After the 3th try the program starts.
HOW TO: Locate code resource 15, change the word at offset $1DB6 from $4EBA to $4E71 and offset $1DB8 from $5586 to $4E71
Example: k=8 gives cs0=236113, cs1=2232,cs2=24,cs3=56,cs4=16 thus the SN# is '-2616-312361-234225'
Doom
-
Deja Vu
vAll
†Before making these changes, you must do the following:
(1) Sector copy with format, tracks 1 to 58 from the original.
(2) Then sector copy tracks 60 to 79. Track 59 hangs up on all copiers.
then change:
Search for: 56C0 671E 7200
Change to: 51C0 601E " "
Search for: 56C0 6722 223C
Change to: 51C0 6022 " "
Search for: 6708 41F8 00EC
Change to: 6008 " " " "
Search for: 6748 486E FDEA
Change to: 6048 " " " "
Search for: 56C0 6720 322D
Change to: 51C0 6020 " "
Search for: 57C0 670C 41FA
Change to: 50C0 600C " "
Search for: 57C0 6716 41FA
Change to: 50C0 6016 " "
-
Deja Vu (Rubicon)
vAll
†Search for: 6708 4EAD 019A
Change to: 6008 " " " "
Search for: 6706 1B7C 0002 F58B
Change to: 6006 " " " " " "
-
Deliverance
v1.0
51244-442657-100016
-
Delta Graph Pro
v3.5.x
MUU35-0827-3837184026
vUnknown
2000002464
v3.0
DGM3000900
-
Desk Toppers
vAll
†Search for: OC40 FFAF
Change to: " " 0000
-
Desktop Tools
vAlias
Please see the entry Aladdin Desktop Tools
-
DiagnoSYS
v1.0
B102131444366
-
DietMac
vAll
†v1.0
Search for: 4267 42A7 3F3C 0
Change to: 60FA " " " " "
-
DigiTrax
v1.0
ALS4312135
-
Dilbert Screen Saver
vAll
5180-6344-1654
-
Dimensions
v2.0
DAW100R3100720-191
DAW200U3200000-109
DAW200U3200001-742
DAW200U3200002-375
DAW200U3200003-292
DAW200U3200004-641
DAW200U3200005-274
DAW200U3200006-907
DAW200U3200007-540
DAW200U3200008-173
DAW200U3200009-806
DAW200U3200010-708
DAW200U3200011-341
DAW200U3200012-974
DAW200U3200013-607
DAW200U3200014-240
DAW200U3200015-873
DAW200U3200016-506
DAW200U3200017-139
DAW200U3200018-772
DAW200U3200019-405
DAW200U3200020-307
DAW200U3200021-940
DAW200U3200022-573
DAW200U3200023-206
DAW200U3200024-839
DAW200U3200025-472
DAW200U3200026-105
DAW200U3200027-738
DAW200U3200028-371
DAW200U3200029-288
DAW200U3200030-906
DAW200U3200031-539
DAW200U3200032-172
DAW200U3200033-805
DAW200U3200034-438
DAW200U3200035-355
DAW200U3200036-704
DAW200U3200037-337
DAW200U3200038-970
DAW200U3200039-603
DAW200U3200040-505
DAW200U3200041-138
DAW200U3200042-771
DAW200U3200043-404
DAW200U3200044-321
DAW200U3200045-670
DAW200U3200046-303
DAW200U3200047-936
DAW200U3200048-569
DAW200U3200049-202
DAW200U3200050-104
DAW200U3200051-737
DAW200U3200052-370
DAW200U3200053-287
DAW200U3200054-636
DAW200U3200055-269
DAW200U3200056-902
DAW200U3200057-535
DAW200U3200058-168
DAW200U3200059-801
DAW200U3200060-703
DAW200U3200061-336
DAW200U3200062-969
DAW200U3200063-602
DAW200U3200064-235
DAW200U3200065-868
DAW200U3200066-501
DAW200U3200067-134
DAW200U3200068-767
DAW200U3200069-400
DAW200U3200070-302
DAW200U3200071-935
DAW200U3200072-568
DAW200U3200073-201
DAW200U3200074-834
v1.0
DAW100R3104865-875
DAW100R3100720-191
PCA100000100953
-
Director
v4.0+++
See MacroMind Director
v3.0
D300-31239-CP4U
D300-11114-CP4U
D300-12935-CP4U
-
Disk Cafe
vAll
DC000444B52
DC000796A32
-
Disk Express II
vAll
JV103761
JE103744
JI103774
JV103735
JX103737
JX103763
JY103738
JZ103739
-
DiskCopy
vAll
†v4.2
To get rid of the dialog box, change:
CODE 1+$150C From: 67 To: 60
-
DiskDup
v2.6a
3 Spaces to Register, as before
v2.x Commercial
00310456
†v2.3 & older
All you need is when at the “number of Copies” dialog field - just arrow key to the right of the number “1” and type 3 (three) blank spaces. This should register the application.
-
DiskTop
v4.5.1
0065279
v4.5
0065449
v4.0x
(any 5 #s)
v4.0
06412
(any 5 #s)
-
Ditto
v1.0
XXXXXXXX-XXXXXXXX (any numbers in this format)
-
DMS
vAll
†DMS+
Search for: 0C6D 0034 8990 6700 0618
Change to: " " " " " " 6000 " "
==========
DMS 4.0a (messy crack, but effective)
Search for: 4A5F 671A 4267
Change to: " " 601A " "
Search for: B06D 82B0 671A 4267
Change to: " " " " 601A " "
Search for: 101F 6602 A9F4
Change to: " " 6002 " " (3 times)
Search for: C001 6766 102E 0008
Change to: " " 6066 " " " "
Search for: B240 662E 486E
Change to: " " 602E " "
Search for: 4A6D CF12 6766 102E
Change to: " " " " 6066 " "
-
Dollars & Sense
vAll
† Block (Hex) Byte From To
--------------------------------
425 146 6704 4E71
0FC 6700 6600
468 1E0 487A 6606
If you do not find these bytes on these blocks, you may have to search the disk.
Dollars and Sense A
Move to block 00B8, position 017C, change 56C0 to 4E71
Dollars and Sense B
Move to block 01A9, position 0146, change 6704 to 4E71
Move to block 01A9, position 00FC, change 6700 to 6600
Move to block 01D4, position 01E0, change 487A to 6606
Dollars and Sense C
Move to block 019E, position 01EF, change to 4E71
Move to block 019E, position 01F1, change to 4E71
==========
v1.3
Search for: 0A00 0001 6768 3F3C 0102
Change to: " " " " 6068 " " " "
-
DOS Mounter
v4.0
DS111247
-
Double Helix
vAll
DHMC180800011V30R1
-
Double Talk
vAll
† Change serial number in DATA resourse near the line 3D0. The serial
number is not exactly the same, it’s swapped to avoid detection.
-
Douglas CAD AutoRouter
v7.30
†guaranteed - Just hit cancel when asked for key disk
Code #5 +25F8 670C->4E71
OR
unguaranteed - but high degree of certainty - no key disk request at all
Code #5 +25E8 4267->6010
-
Douglas CAD Professional Layout
v7.30
†guaranteed - Just hit cancel when asked for key disk
Code #2 +2832 670C->4E71
OR
unguaranteed - but high degree of certainty - no key disk request at all
Code #2 +2822 4267->6010
-
Down to Business
vAll
SSN719
-
Dragon's Lair 2
vAll
†Search for: 426D 027A 0C6D
Change to: 4E71 4E71 " "
Be sure the folder format is EXACT! Put all files in a folder called DL2. The code is a 5 digit code, and this patch allows for any 5 digit combo. Even if you type a wrong serial code it will run the game anyway. Don’t forget to remove 32bit QuickDraw when running the game.
P.S. it hates MultiFinder. [and therefore probably bombs under S7?]
When your game is over. Just hit "0" to start over.
Another patch that will get rid of the jump to the serial code dialog box
Search for: 6100 04C2
Change to: 4E71 4E71
The patch seems to work just fine and without the code dialog you do not have to insert a code.
-
Dragon's Lair 3
vAll
†Unlike DL2, the DL3 app is buggy under certain circumstances. Even though the data files are installed on the hard disk, DL3 will try to look in the floppy drive, anyway!
Here's wathca do:
Copy file "disk1" to disk named “EscDisk1”
Copy file "disk2" to disk named “EscDisk2”
.
.
.
etc...
You might as well run it off floppies so copy “Escape” app to "EscDisk1" as well. DRAGON’S LAIR WILL NOW RUN FINE!
-
DragonWave
vAll
†v2.0
Open up the DragonWave 2.0 application and change:
CODE 18+$F5A From: 6720 To: 6020
-
Dragonworld
vAll
†Search for: 4EBA 0052 4A40 6748
Change to: 604E " " " " " "
-
DragStrip
v1.0
AB7-2X5-SHVE
-
Dreams of the Phoenix Fix
vAll
† Many DOTP programs DAs and FKEYS have trouble on the Mac II. In particular DA Installer + Q&D Terminal, Q&D Dialer, AVailable key, super note pad. The problems vary from minor inconvenience to crashing. This patch will fix them all. It won’t hurt them in any way :-)
Search for: 3082 2040 0000 4E75
Change to: " " " " A000 " "
has to do with self modifying code. Change all occurrences.
-
DX-7 Patch Editor
vAll
†v1.15
Search for: 8438 3F3C 0001 A
Change to: 76BE " " " " "
-
Earl Weaver Baseball
v1.5
†
-
eDisk
v2.0
E109716
-
Edit One
vAll
427-123-00040749
-
EG Word
vAll
51122400002818
-
Elastic Reality
vAll
80862801118
-
Elastic Reality Transjammer
v1.0b7
82-34075-22609-02307
v1.0b2
82-34075-22609-02307
-
Electric Checkbook
vAll
†v1.0?
Search for: 3E1F 206E FCF0
Change to: 4E71 " " " "
v1.1
Search for: 67DE 4A46 6728 487A
Change to: 4E71 " " 6028 " "
-
Elements of Style
vAll
ESM 113904 T
-
Empower
vI & II
Name:Administrator
PW:Admin
vAll
Name:Administrator
PW:Admin
-
Encore
v4.0
EV40-0-01034-4939
v3.0.7
EV30-0-01032-8582
v3.0.5
EV30-0-01032-3224
-
Enforcer
v2.9 (Old)
876855327801
-
Ensemble
vAll
†v1.0
Read block 338 ($152) change bytes as follows
byte
1A from 67 to 4E
1B from 92 to 71
7E from 67 to 60
If the original bytes are not correct then perform the following searches:
Search for: 6756 4267 3F3C 0001
Change to: 6056 " " " " " "
Search for: 6792 2F0B A983
Change to: 4E71 " " " "
-
Eric's Ultimate Solitaire
vAll
†try using "Weasel" as your name
-
Evelyn Wood
v0.5-1.0
†Search for: 3444 3F3C 0001 A9
Change to: 256E " " " " "
-
Exile
v1.1
v1.0.1
†The Key is derived from the registration code (rc) as follows:
Key=(((((rc*23)%990004)+52176)*7)%900000)+100000
eg: if rc=796608 then Key=378616
••• Version: "1.0.1" •••
The Key is derived from the registration code (rc) as follows:
key=((((rc*3+50)%3000)*81)%5000)+5000, where % is the MOD operator
eg: if rc=710 then Key=6580
-
Exile Editor
v1.0
†The Key is derived from the registration code (rc) as follows:
Key=((((rc*3+51)%3000)*82)%5000)+5000, where % is the MOD operator
***
eg: if rc=1088 then Key=5830
-
EXodus
v5.1
SE99001700022101
-
ExperLisp
vAll
†v1.4
Search for: 670E 2FFE 0008 486E
Change to: 600E " " " " " "
Search for: 6738 486D F1DC A851
Change to: 6038 " " " " " "
v1.02
Search for: 6738 4860 F200 A851
Change to: 6038 " " " " " "
Search for: 670E 2F2E 0008 486E
Change to: 600E " " " " " "
-
Expresso
v1.0
EXM-51679-5594
-
F/A 18 Hornet
vAll
100-98-4298
100-64-5896
Unlock code is 032-244
†Here are some of the cracks available for F/A-18 which may or may not work
with 1.1.2. Everything here except for the first one was taken from Patchlist
v2.4.
CODE 4 OFFSET 08E8: 6704 7000 -> 4E71 7001
(This one works for me with versions 1.1.2 and 1.1.3b1)
F/A-18 HORNET 1.1.1
EFFECT: Removes serial#, lookup and unlock code requirement
HOW TO: CODE 4 OFFSET 275A: 4EAD 0CAD -> 4E71 4E71
EFFECT: Removes network serial conflicts (ARA network not checked)
HOW TO: CODE 12 OFFSET 7AAE: 6704 -> 6004
CODE 12 OFFSET 7ABC: 49C0 -> 7001
F/A-18 HORNET
- To remove both serial number and password check.
- CODE 4, offset 08DA
- change 7000 1014
to 7001 6046
- CODE 4, offset 0944
- change 7000 1013 1239
to 7001 6000 00AC
(Definitely works for version 1.0 all the way up to 1.1.1)
F/A-18 Hornet 1.1.0
EFFECT: Makes it possible to enter any word in the password dialog
HOW TO: LOCATE 'CODE' ID 4 FIND Offset $000B40
~From: 6598 7000
To: 6598 7001
F/A -18 HORNET v1.1.0fc
EFFECT: Prevents the "Enter nth Word on Page p" dialog from appearing.
HOW TO: LOCATE 'CODE' RESOURCE 6 OFFSET $178C
CHANGE WORD
FROM $6600
TO $6000
FA/18 HORNET 1.0.1
EFFECT: The program will never ask you the question. HOW TO: Locate CODE 6, Find offset $189E,
Change the word $6700 to $6600.
or
F/A-18 HORNET 1.0.0
EFFECT: Makes it possible to enter any word in the password dialog
HOW TO: LOCATE 'CODE' ID 4 FIND Offset $000C30
~From: 0006 6604 7000 600C
To: 0006 6604 7001 600C
F/A -18 HORNET v1.0.0
EFFECT: Prevents the "Enter nth Word on Page p" dialog from appearing. HOW TO: LOCATE 'CODE' RESOURCE 6, OFFSET $18EC
CHANGE WORD FROM $6600 TO $6000
F/A-18 HORNET v1.1.0
EFFECT: Prevents the "Enter nth Word on Page p" dialog from appearing.
HOW TO:
LOCATE 'CODE' RESOURCE 6 OFFSET $17A4
CHANGE WORD FROM $6600 TO $6000
F/A-18 HORNET v1.1.0
EFFECT: To remove both serial number and password check.
EFFECT: Removes serial#, lookup and unlock code requirement
HOW TO: 4 275A: 4EAD 0CAA -> 4E71 4E71
EFFECT: Removes network serial conflicts (I haven't checked ARA network)
HOW TO:
12 79C2: 6704 -> 6004
12 79D0: 49C0 -> 7001
[I _think_ the "4" and the "12" are for CODE 4 & 12]
F/A-18 HORNET 1.1.0
EFFECT: Makes it possible to enter any word in the password dialog
HOW TO:
LOCATE 'CODE' ID 4 FIND Offset $000B40
From: 6598 7000
To: 6598 7001
-
Faces
vAll
†Search for: 4240 4840 80FC 0030 4840 3D40
Change to: 4280 " " " " " " " " " "
It will ask you who beat Napoleon at Waterloo. The answer is Welling.
or try,
Here is the complete crack:
CRACK PATCH
Open Faces 1.0 with ResEdit and change:
CODE 3+$652 From: 486D 01CA To: 603A 4E71
+$694 From: FEED To: FED4
Open Color Faces 1.0 with ResEdit and change:
CODE 3+$7C2 From: 486D 017A To: 603A 4E71
+$804 From: FEED To: FED4
-
Fact Finder
vAll
†v1.0
Factfinder A
Search for: 6604 A002 6002 A003 3D40 0012
Change to: " " " " " " " " 4E71 4E71
Factfinder B
Search for: 670A 206E FEF6 2D50
Change to: 600A " " " " " "
Factfinder ?
Move to block 015E, position 016C, change to 4280
-
Fahrenheit 451
vAll
†Search for: 0C42 005A 6F00 0014
Change to: " " " " 4E71 4E71
The mod is (using FEdit) Sector 59 of the Fahrenheit 451 file - offset 39F (or if you like, Seg #2 of CODE) - change JSR (4EBA 00A0) to NOP's (4E71 4E71).
-
Falcon MC
vAll
†Game Controls:
Pause ------------------------------ P,Q,ESC
Return to Cockpit ------------------ Command R
Quit ------------------------------- Command Q
All Sound -------------------------- Command S
Music ------------------------------ Command M
Switch MouseSticks ----------------- Command T
Exiting the Simulation :
Abort Mission ---------------------- Command A
End Mission ------------------------ Command E
Eject ------------------------------ Command Option E
Jettison Keys :
Jettison tanks --------------------- Option T
Jettison all A-G stores ------------ Option K
Jettison ECM pod ------------------- Option C
General Controls :
Autopilot on/off ------------------- A
Chat ( head-to-head only ) --------- '
Ranging TWI on/off ----------------- H
View stores ------------------------ V
Waypoint increment ----------------- U
Waypoint decrement ----------------- Y
Detail Controls :
None ------------------------------- Command 1
Far Terrain ------------------------ Command 2
Gradient Horizon ------------------- Command 3
Mountains -------------------------- Command 4
Medium Terrain --------------------- Command 5
Complex Rivers --------------------- Command 6
Ground Detail ---------------------- Command 7
All -------------------------------- Command 8
Flight Controls :
Forward stick ---------------------- (UP ARROW), I, numeric keypad 8
Back stick ------------------------- (DOWN ARROW), M, numeric keypad 2
Left stick ------------------------- (LEFT ARROW), J, numeric keypad 4
Right stick ------------------------ (RIGHT ARROW), L, numeric keypad 6
Set narrow fisheye ----------------- F10, Option 0
FALCON MC (v1.0.1)
EFFECT: The first time Falcon launches, it will quit immediately after you click your mouse to select items, but a good Falcon Settings file will be created for your macintosh without dialog showing up asking for documented answers. The following launches of Falcon will be successful with the correctsettings file.
HOW TO: Open CODE resource 1,
at offset 0041A4, change word to $4E71
Open CODE resource 21,
at offset 0009DE, change words to $4E71 4E71
at offset 0009E8, change words to $4E71 4E71 4E71
or
FALCON MC 1.0.1
EFFECT: The program will never ask you the question.
HOW TO: Locate CODE 1, Find offset $3F48,
Change the word $6700 to $6000.
or
FALCON MC 1.0
EFFECT: The first time Falcon launches, it will quit immediately after you click your mouse to select items, but a good Falcon Settings file will be created for your macintosh without dialog showing up asking for documented answers. The following launches of Falcon will be successful with the correct
settings file.
HOW TO: Open CODE resource 1,
at offset 00430A, change word $6404 to $4E71
Open CODE resource 21,
at offset 000AA4, change words $4EAD 08BA to $4E71 4E71,
at offset 000AAE, change words $4EAD 015A A9F4 to $4E71 4E71 4E71
-
FastTrack Schedule
v3.0
724037
-
Fauve Xres
v1.0.3
12978
-
FaxSTF
v3.1
AA100187
v3.0
S200200
T100300
-
Feathers & Space
vAll
†Search for: 6706 38BC FFC2 600C
Change to: 6006 " " " " " " (6 times)
-
Ferrari Grand Prix
vAll
†v1.27
Search for: 0280 1234 FFFF 48E7 7FFE 41FA
Change to: 4240 21FC D9CD B903 0A80 4E75
-
Fetch
v2.1.2
51-1003-102157313
51-1000-201176607
51-1007-201194631
v1.0
51-1007-201194631
-
Field Assistant
vAll
8E06D026670F0550
-
File Buddy
v3.x
FB3-00000700003
FB3-09876043214
v2.x
BDK 689 JEM
v1.x
M526 E803 J1120
†Serial Numbers are of the form 'FB3-xxxxxRxxyzS' , where
x = any character
y,z = any digit '0'-'9'
R = y+z+7 MOD 10
S = z+3 MOD 10
ie: if we let each x=0 and y,z=0 then we have
R= 0+0+7 MOD 10 = 7 MOD 10 = 7
S= 0+3 MOD 10 = 3 MOD 10 = 3
Thus 'FB3-00000700003' is a valid serial number
-
File Force
vAll
†1.0
X-442540368699
-
File Maker
vPro
1120000
-
FileGuard
v2.7.4
21414-749204-236308
v2.7.3
04264-904468-226561
v2.7.2
67188-222480-206181
77151-111159-201238
v2.7.1
77151-111159-201238
00111-683277-201548
v2.0.2
Mike
†Change:
HIGH 5+$52 From: 4EBA 05E2 To: 4E71 4E71
This will block the whole routine ‘CheckLicence’ which checks if it is registered, and if another computer on the network has the same serial number.
-
Filevision
vAll
†On block CE of the file Filevision, at byte 1B0 change 6604 to 4E71
or try,
Filevision Alternate Crack:
Search for: 6700 FEC6 (should be on Block 227, Byte 118)
†If this expires you can get around it by changing:
CODE 24+$09D6 To: 4E71
+$09D7 To: 4E71
-
Foxbase
vAll
Serial #:FMD027877
Activate:emzxpyei
-
Fracas
v1.0.1
68530 'Anonymous'
23562 'Doom'
57288 'Cerberus'
-
FrameMaker
v4.0
00-0-01-01-4-89693-CFF7AE
v3.0
2-01320-27
2-01880-14
2-02071-17
2-150753-47
2-151967-07
v2.1
2-01320-27
2-01880-14
2-02071-17
-
FreeHand
v5.0
10250-0397-4374-13083
v4.0
xx-xxxx-xxxxxxxxx
02-1235-002302134
02-3008-000036469
11-1009-200021734
02-4008-200010087
12-1234-123456789
02-6023-000345263
v3.0
02-1235-002302134
02-3008-000036469
02-4008-200010087
02-6023-000345263
04-1000-000006699
11-1009-200021734
06-0001-100000000
02-0000-000000000
v1.x/2.x
08-1004-0268684
†To change or modify the name or serial number of a personalized copy of
Freehand 4 open it with Resedit and open the aldp resource.
Aldus employs this serialization scheme (xx-xxxx-xxxxxxxxx).
Any number from any Aldus product using this scheme will work.
-
French Assistant
v1.0
M2100906
-
Frogger
vAll
† They named the Frogger program “Finder” and made it invisible, locked, and Bozo bit set, so just use setfile and undo all three and copy it to your disk, and then set the original back to the way it was. Now you have Frogger as a single file!!! One note of interest: After each game it executes the file named “Finder” Since that was what it was called. So if you don’t want to have to reclick on it everytime you want to play, then make sure the Frogger program is named Finder.
[One thing of note, under System 7, the Bozo bit is now the stationary bit (like any one used the Bozo bit anymore…). Since you can’t execute stationary :-), I don’t know how this will affect the program. Of course, it probably doesn’t work on System 7 anyways…]
-
FrontDesk
vAll
†Search for: 4EAD 046A 101F 675C
Change to: 4E71 4E71 " " 4E71
-
Frontier
v1.0
ULF.10108.100
-
Full Contact
v2.0.2
9310401FBE0750A
5106F04E30033020
-
Full Impact
v1.1
0000000-00
(XXXXXXX-AA X=any #,
AA = sum of x's)
-
FullWrite Pro
v2.0x
10000000-88000000
v1.x
0000000-00
(XXXXXXX-AA X=any #,
AA = sum of x's)
PN=1013409103 SN= 8052167-29
-
Fun Pak
vAll
†Search for: 4A5F 6708 48
Change to: " " 6008 "
-
Futuria
vAll
†Finder copy all the Files on the Futuria disk and then take Fedit to the file
Futuria.
Search for: 4EBA FC18 205F 4EFA FE16
Change to: 4E71 4E71 " " " " " "
or try,
Search for: 3CBA 000C 4EBA
Change to: 4E71 4E71 " "
-
FWB CD ROM Toolkit
v1.5.5
C38292117
v1.1
C38292117
v1.0.9
M01713833
v1.0.3
C12348678
N90307999
v1.0/1.01
C34012798
†••• Version: "1.1" •••
FWB CD 1.0.5
The personalization information is stored in the resource 'Font' ID -4048, which must always have a size of 148. The first byte is the
length of the name, and the name is encrypted by XORing the bytes by $93.
The byte at offset $40 is the length of the organization and, the
subsequent bytes are the organization itself, encrypted by XORing the
bytes by $7C. The byte at offset $80 is the length of the Serial Number,
and the subsequent bytes are the serial number itself, encrypted by XORing the
bytes by $E9.
The crack so that the serial number always looks good is: Open it up in
ResEdit Open up the resource 'cdev' ID -4064 Change it at offset: $56DA
From: $59FF To: $5A00
FWB CD ROM Toolkit 1.0.3
The serial number for 1.0/1.0.1 doesn’t work in 1.0.3. Here’s how to crack it (or you can just use the 1.0.3 Serial Number):
The personalization information is stored in the resource 'Font' ID - 4048, which must always have a size of 148.
The first byte is the length of the name, and the name is encrypted by XORing the bytes by $93.
The byte at offset $40 is the length of the organization and, the subsequent bytes are the organization itself, encrypted by XORing the bytes by $7C.
The byte at offset $80 is the length of the Serial Number, and the subsequent bytes are the serial number itself, encrypted by XORing the bytes by $E9.
The crack so that the serial number always looks good is:
cdev -4064+$56DA From: 59FF To: 5A00
Now any serial number in the correct format except C34012798 will work!
The personalization information is stored in the resource 'Font' ID -4048,
which must always have a size of 148. The first byte is the length of the
name, and the name is encrypted by XORing the bytes by $93. The byte at offset $40 is the length of the organization and the subsequent bytes are the organization itself, encrypted by XORing the bytes at $7C. The byte at offset $80 is the length of the serial number and the subsequent bytes are the serial number itself, encrypted by XORing the bytes by $E9.
The crack so the serial number will always look good is:
Then using MacZap 3.0, read block E6 using Address marks of D5ADAD (I think).Change the Address marks to the normal marks and write the block back to the disk. Use Fedit to write the changes to the code and unprotect,unlock & make visible the file CTEX.
2nd Gato 1.2
Search for: 4A01 6700 0006 4EAD
Change to: " " 6000 " " " "
==========
v1.3:
Search for: 6B00 00F6 203C 0000 0258
Change to: 6000 " " " " " " " "
==========
Gato
Search for: 4A01 6700 0006 4EAD
Change to: " " 6000 " " " "
-
Generic Cad
v2.0b
72205-4725
-
Geometry
vAll
†Search for: 4E71 4E71 4E71 4E71 0280 ABCD
Change to: 4240 21FC 9FFB B503 0A80 4E75
-
German Assistant
v1.0
M4100441
M4102046
-
GIF Converter
v2.2 (& up)
162-37-77-f4-de-a8-8b-b2
862-37-77-f4-de-a8-8b-b2
-
Go
vAll
†1.02
Go Questions:
The first golden age in the history of Japanese Go occured in which century?
17
Traditionally, the stones used in the game of Go are kept in what kind of containers?
bowls
The high quality white stones in the game of Go are made from what substance?
clam shells
Traditionally, the black stones in the game of Go are made from what substance?
slate
What is the term for mutual life in the game of Go?
seki
The Go game board 19 x19 has 361 positions called what?
points
What does one player say to the other when making a play that threatens capture of opponent stones?
atari
In what month and year was the first international computer Go competition held in Taiwan?
November 1986
Where are the first four handicap stones placed at the beginning of a game of Go?
Make these changes to a sector copy and then bit copy track#4 with any bit copier.
-
Hayden SAT
vAll
†Search for: 6608 45FA 003A
Change to: 4E71 " " " "
Search for: 6610 3F3C 0000
Change to: 4E71 " " " "
-
Hayden Speller
vAll
†Search for: 225F 508F 4ED1 4E56 FFC0
Change to: " " " " " " 4E71 4EF9 0000 E888
or try,
Search for: 4E56 FFC0 41EE
Change to: 4E71 6000 0AA8
or try
Search for: 4EBA 02BA 2E1F 4E5E
Change to: 4E71 4E71 " " " "
or try
Search for: 2007 0A00 0001 6700
Change to: 4E71 7000 " " " "
-
Hearts
v2.2
†Using TeachText, create a file named 'RP' that contains the word ‘Hearts’. Put this together with the files from the Hearts disk on a HD.
Hearts will not work on a floppy. It must be on a hard drive to work because on a floppy, it thinks there is a disk input output error (-36) when it trys to read the RP file. The original copy protection wouldn’t let you copy the RP file from the floppy using the finder or other file copying programs. Hearts checks this file and its contents to see if you have a valid copy. You had to bit copy the whole disk to make a copy. Although a normal copier couldn’t read the file, the Hearts program could but only if it was on the protected disk. It can’t if it was on an unprotected disk because it uses a different driver meant for the protected disk. This limitation doesn’t apply to the hard drive though.
There is one major bug: you can’t insert a disk after you start Hearts until you restart the Mac because the Mac will crash.
If Hearts doesn’t work on your Macintosh because it crashes at MCOD 45+$42, try changing MCOD 45+$3E from 6A to 60. This will skip over the part:
+$42 MOVE.B #$D5,$00FCC0E1
+$4A MOVE.B #$AA,$00FCC0E3
The address $FCC0xx is probably hardware I/O addresses for the old Macs. I couldn’t figure out what the $FCC0xx was for the new ones. These addresses are not the same on all Macs and programs that use them are bound to crash on some Macs.
This program works only under System 6.07 or earlier, not under System 7.0.
-
Hearts Deluxe
v3.x
†There's just nothing like macnosy for unearthing nasty little secrets like...
Start of Hearts 3.0 and hold down the spacebar at the splashscreen until a
registration dialog appears, then use any name you want and type 'X1181' (case sensitive) for the password and your registered...
-
Heaven & Earth
vAll
†Search for: 671E 0C79 FFFF
Change to: 601E " " " "
Search for: 4EAD 0AEA 508F
Change to: 4E71 4E71 " "
The preceding patch was installed in the 13” color version after the install.
-
Helium
v2.1.1
2020-3000
v2.0.2
40859
† To register Helium 2.0.2, copy the cdev from the patched Helium cdev resource file (found elsewhere) into your Helium control panel replacing the old cdev. After quiting ResEdit, open Helium. If it wasn't registerred already, it will give an alert telling you what the registration code is. It will display the same alert if you type in the wrong code. To reregister under a new name or reset the 15 day limit on unregisterred copies, erase the preferences file in the preferences folder.
-
Helix Express
v3.0
FULL Mode:
SN#31327
Key#BZAG-9QXX-QFWL-CQX1-YAT7-5QL0-ST
SERVER (2 CLIENTS):
SN#31328
Key#BZ42-395F-T8R4-RSYH-CA84-H9BD-YT
-
Hellcats
vAll
† I hacked into Hellcats to get rid of that annoying cp box. Load up Symantic Tools or the like and open a COPY of Hellcats and change:
(if this doesn’t work, try leaving that last word at 5257)
-
Holiday Lemmings 1993
vAll
† - HOLIDAY LEMMINGS 1993
EFFECT: Gets rid of passwords for individual levels
HOW TO:In CODE 3, at offset 0xD80, replace exactly 88 bytes
(11 lines in ResEdit's general editor) with the following 88 bytes
(11 lines) of garble:
48E7 1F18 47ED CEAE
4245 101B 0C00 0030
6D14 0C00 0039 6E0E
4880 0440 0030 CAFC
000A DA40 60E4 0C45
0020 6E1A 4A45 6F16
5345 3B45 DC58 2005
48C0 81FC 0010 3B40
DC88 7001 600A 426D
DC58 426D DC88 7000
4CDF 18F8 4E75 4E75
You'll probably want to update the corresponding dialog to make the prompt more appropriate. I changed item 4 of DITL 2001 to read "Enter level number (1 = Flurry 1, 17 = Blizzard 1):" so that I won't forget this is a patched copy.
-
HoloGate
v1.1.6b2
Z8ZV3HZBVY3CL4
-
Home Accountant
vAll
†Search for: 4A6E FFFE 6D08 1D7C 0001 000C
Change to: 4E71 4E71 4E71 " " " " " "
Search for: 0240 0001 6700 FF74 3F3C 0FD2
Change to: 303C " " " " " " " " " "
==========
v1.02
Search for: 6D08 1D7C 0001 000C
Change to: 4E71 " " " " " "
Search for: 302D FE34 B06D
Change to: 302D FE32 " "
Search for: 662C 4267 2F0E 4EBA
Change to: 4E71 4267 2F0E 4EBA
-
Hoyle
vAll
117363101307525
-
Hybrid
v1.2
HYB2-120-0-553B2B16
-
HyperCard
vAll
†HyperCard 2.1
Remove password protection from HC stacks!
Just the IDEA that some bozo put in a password... ARGH! I have a problem with that. In your HyperCard 2.1 file:
Search for: 6704 6000 02A2 42A7 3F3C 008C 42A7
Change to: 60 " " " " " " " " " " " " "
for HC to accept any password you give it, and let you into the protection dialog (remember, to get pswd. dialog in a protected stack, hold CMD while choosing Protection from File menu).
You can still assign pswds to stacks you make, and the pswd protection will still work on other people’s HCs, unless they have also applied this Kpatch.
==========
2.0 Light (the copy that [used to] come with your mac)
To gain user level five do the following:
In the first card of the HomeStack: Hit [Command] + M
Type:go cd "User Preferences" [enter]
magic [enter]
Select Level Five (Scripting)
(They hid half the user levels with an opaque button over UserLevel 3,4,5)
NOTE: This does not work with Hypercard Player, which doesn’t allow Userlevels 3, 4, or 5 at ALL. Boo...
-
HyperStudio
v2.0.4
MAA001AZT126147
vAll
101M-101392
-
I know it's here someplace
vAll
†Search for: 6700 0106 4267 3F3C
Change to: 6000 " " " " " "
Search for: 6602 7C01 6000 FF62
Change to: 4E71 " " " " " "
-
Igor
v1.2.8
7506
-
Illustrator
v5.5Mac-5User
AAW550U1100000-005-609
AAW550U1100001-005-242
AAW550U1100002-005-875
AAW550U1100003-005-508
AAW550U1100004-005-141
AAW550U1100005-005-774
AAW550U1100006-005-407
AAW550U1100007-005-324
AAW550U1100008-005-673
AAW550U1100009-005-306
AAW550U1100010-005-208
AAW550U1100011-005-841
AAW550U1100012-005-474
AAW550U1100013-005-107
AAW550U1100014-005-740
AAW550U1100015-005-373
AAW550U1100016-005-290
AAW550U1100017-005-639
AAW550U1100018-005-272
AAW550U1100019-005-905
AAW550U1100020-005-807
AAW550U1100021-005-440
AAW550U1100022-005-357
AAW550U1100023-005-706
AAW550U1100024-005-339
AAW550U1100025-005-972
AAW550U1100026-005-605
AAW550U1100027-005-238
AAW550U1100028-005-871
AAW550U1100029-005-504
AAW550U1100030-005-406
AAW550U1100031-005-323
AAW550U1100032-005-672
AAW550U1100033-005-305
AAW550U1100034-005-938
AAW550U1100035-005-571
AAW550U1100036-005-204
AAW550U1100037-005-837
AAW550U1100038-005-470
AAW550U1100039-005-103
AAW550U1100040-005-289
AAW550U1100041-005-638
AAW550U1100042-005-271
AAW550U1100043-005-904
AAW550U1100044-005-537
AAW550U1100045-005-170
AAW550U1100046-005-803
AAW550U1100047-005-436
AAW550U1100048-005-353
AAW550U1100049-005-702
AAW550U1100050-005-604
v5.5
AAW550U1200000-637
AAW550U1200001-270
AAW550U1200002-903
AAW550U1200003-536
AAW550U1200004-169
AAW550U1200005-802
AAW550U1200006-435
AAW550U1200007-352
AAW550U1200008-701
AAW550U1200009-334
AAW550U1200010-236
AAW550U1200011-869
AAW550U1200012-502
AAW550U1200013-135
AAW550U1200014-768
AAW550U1200015-401
AAW550U1200016-318
AAW550U1200017-667
AAW550U1200018-300
AAW550U1200019-933
AAW550U1200020-835
AAW550U1200021-468
AAW550U1200022-101
AAW550U1200023-734
AAW550U1200024-367
AAW550U1200025-284
AAW550U1200026-633
AAW550U1200027-266
AAW550U1200028-899
AAW550U1200029-532
AAW550U1200030-434
AAW550U1200031-351
AAW550U1200032-700
AAW550U1200033-333
AAW550U1200034-966
AAW550U1200035-599
AAW550U1200036-232
AAW550U1200037-865
AAW550U1200038-498
AAW550U1200039-131
AAW550U1200040-317
AAW550U1200041-666
AAW550U1200042-299
AAW550U1200043-932
AAW550U1200044-565
AAW550U1200045-198
AAW550U1200046-831
AAW550U1200047-464
AAW550U1200048-381
AAW550U1200049-730
AAW550U1200050-632
AAW550U1200051-265
AAW550U1200052-898
AAW550U1200053-531
AAW550U1200054-164
AAW550U1200055-797
AAW550U1200056-430
AAW550U1200057-347
AAW550U1200058-696
AAW550U1200059-329
AAW550U1200060-231
AAW550U1200061-864
AAW550U1200062-497
AAW550U1200063-130
AAW550U1200064-763
AAW550U1200065-396
AAW550U1200066-313
AAW550U1200067-662
AAW550U1200068-295
AAW550U1200069-928
AAW550U1200070-830
AAW550U1200071-463
AAW550U1200072-380
AAW550U1200073-729
AAW550U1200074-362
AAW550U1200075-995
AAW550U3125503-380
v4.0PC
ABW4033200076-938
ABW4033200077-537
ABW4033200078-136
ABW4033200079-735
ABW4033200080-719
ABW4033200081-318
ABW4033200082-917
ABW4033200083-516
ABW4033200084-115
ABW4033200085-714
ABW4033200086-313
ABW4033200087-912
ABW4033200088-511
ABW4033200089-110
ABW4033200090-378
ABW4033200091-693
ABW4033200092-292
ABW4033200093-891
ABW4033200094-490
ABW4033200095-373
ABW4033200096-688
ABW4033200097-287
ABW4033200098-886
ABW4033200099-485
ABW4033200100-906
v4.0.3/W
ABW4033200000-719
ABW4033200001-318
ABW4033200002-917
ABW4033200003-516
ABW4033200004-115
ABW4033200005-714
ABW4033200006-313
ABW4033200007-912
ABW4033200008-511
ABW4033200009-110
ABW4033200010-378
ABW4033200011-693
ABW4033200012-292
ABW4033200013-891
ABW4033200014-490
ABW4033200015-373
ABW4033200016-688
ABW4033200017-287
ABW4033200018-886
ABW4033200019-485
ABW4033200020-469
ABW4033200021-352
ABW4033200022-667
ABW4033200023-266
ABW4033200024-865
ABW4033200025-464
ABW4033200026-347
ABW4033200027-662
ABW4033200028-261
ABW4033200029-860
ABW4033200030-844
ABW4033200031-443
ABW4033200032-326
ABW4033200033-641
ABW4033200034-240
ABW4033200035-839
ABW4033200036-438
ABW4033200037-321
ABW4033200038-636
ABW4033200039-235
ABW4033200040-219
ABW4033200041-818
ABW4033200042-417
ABW4033200043-300
ABW4033200044-615
ABW4033200045-214
ABW4033200046-813
ABW4033200047-412
ABW4033200048-295
ABW4033200049-610
ABW4033200050-594
ABW4033200051-193
ABW4033200052-792
ABW4033200053-391
ABW4033200054-990
ABW4033200055-589
ABW4033200056-188
ABW4033200057-787
ABW4033200058-386
ABW4033200059-985
ABW4033200060-969
ABW4033200061-568
ABW4033200062-167
ABW4033200063-766
ABW4033200064-365
ABW4033200065-964
ABW4033200066-563
ABW4033200067-162
ABW4033200068-761
ABW4033200069-360
ABW4033200070-344
ABW4033200071-943
ABW4033200072-542
ABW4033200073-141
ABW4033200074-740
v5.0
AAW30210197831-337
AAW500U3105408-140
AAW500U7106717-802
AAW500R3102631-456
AAW500R3102632-373
AAW500U3106069-338
AAW500U7104713-896
AAW500U3106121-969
AAW500U3118733
AAW500U3101332
AAW500U3126375
AAW500U3127582-773
v3.0
AAW3021019783
-
Image Express
vAll
†Search for: 3B5F F33A 4A6D F33A 6622
Change to: " " " " " " " " 4E71
Search for: 4EAD 0B62 4EAD 166A 4EAD 16DA
Change to: 4E71 4E71 4E71 4E71 4E71 4E71
Search for: 4EAD 257A A9F4 4E5E 4E75
Change to: " " " " 4E71 " " " "
Projector:
Search for: 4A6D FDCE 664C 4EAD 056A
Change to: " " " " 4E71
Transporter:
Search for: 3B5F FBB8 4A6D FBB8 6600 01E6
Change to: " " " " " " " " 4E71 4E71
Search for: 57C0 4A00 6700 010E
Change to: " " " " 4E71 4E71
-
ImageAXS
v1.1
RC23V7
-
Impact
v1.0
0003119496
-
In Control
v3.5 for Workgroups
3500-9800000-1
v3.0
3000-0001343-8
v2.0.7
0000-0000000-0
2000-0031184-1
2000-0031185-8
3000-0001231-8
-
Indiana Jones and the Last Crusade
vAll
† - INDIANA JONES AND THE LAST CRUSADE V5.1.6 (Mac 1.7 8/17/90)
EFFECT: This is a patch with which I can Save and Open File at any moment HOW TO: Find Resource CODE 6 :
Replace all the occurences of (there are 4 occurences)
EXT.W D1 | 4881 MULS.W D1,D0 | C1C1
with
EXT.W D1 | 4881 MOVEQ #$01,D0 | 7001
[this patch seems different from others so I would be interested in knowing what
the EXT.W AND THE D1 AND THE 4881 etc means.]
-
Infini-D
v2.6
01-1400-6350
v2.5
01-1400-6350
01-1820-0916
31-9326-1679
v2.0.1
01-1400-6350
v1.x.x
01-1400-6350
31-9326-1679
†v1.02
Hex Changes:
Search for: 4EBA 0796
(You should find this 2 times, at Sectors 392 & 3FE)
Talk about reusable code, these guys reused half the friggin program or more, including, hilariously enough the same copy protection routines down to the byte (ie they were compiled from the same source with the same version of the compiler) the only difference was at link time apparently. Thus these code changes are for CODE #72 for Informed Manager, and CODE #79 for Informed Designer 1.3.3
To simply run the program without personalization (from unpersonalized copy obviously) change
+D72 6600->6000 (believe it's personalized)
OR:
if you want it personalized then follow these steps:
1: change +F18 6642->6042 (allow anything for serial # when personalizing)
2: run the program and personalize (use anything you want for a serial #), Quit (duh).
†Well, I know it's not a crack per se, but if anyone has a copy of Kid Pix with some other kid's name on it (other than your own kid's name, not your name, that is… Kid Pix IS for kids =) ), you can remove/change it in the following trivial Resedit hack:
Open the kID resource, open the one resource inside it, and you should see a short chunk of hex. The first digit is the number of letters in the name, and the rest of the string is the name. To change it, hilite the ASCII on the right hand side and type in the name you want ENCRYPTED in this ultra-secure, defense-department standard code: shift each letter one to the right (i.e., JOE becomes KPF)
-
Kid Talk
vAll
†Search for:6730 3F3C 0002
Change to: 6030 " " " "
Search for: 67B4 426D F750
Change to: 4E71 " " " "
or try
Search for: 6602 5200 5901 6AF4
Change to: 6018 " " " " " "
-
Kid’s Desk
vAll
†To get to administrator mode type Command-Option-A
-
King’s Bounty
vAll
†v1.0
CODE 2+$47E4 To: 4E71 4E71
or try,
v1.01
Search for: 4EBA FB96
Change to: 4E71 4E71
or try,
v1.01
Search for: 4EBA FBA6
Change to: 4E71 4E71
Here's a little trick to get more gold, leadership, and commission…
Open one of your saved games.
with Norton, go to Sector 8 of your file.
On line 160: XXXX AAAA BBBB CCCC
the A’s and B’s are your leadership, put the same value in each, the C’s are
your commission/week. Yes, there is a 64K limit to your leadership and comm.
On line 448: AAAA AAAA
all the A's are your gold, just put 0F in the first AA and you'll have about
250 million.
-
Kiwi Envelopes
v3.x
KE301120RA
KE304244RC
KE311870RK
KE311120RA
-
Kiwi Power Windows
vAll
10KPW002996b
†with ResEdit, in the second "LDEF" (ID 27420(?)), change the first four bytes
from "FFFF FFFF" to "0000 0000". You will now be able to postpone registering
at startup. Each time you start-up you have to postpone again.
-
KiwiFinder
v1.0
VB1011672KF
KE304244RC
KE301120RA
KE311120RA
KE311870RK
-
KPT Gradient Filler
vAll
KPT273
(unlocks expert mode)
-
Kung-Fu Chivralry
vAll
†The continue password for Kung-Fu Chivralry is 90179240. This number is stored in hex format at CODE 5+$4EE2 and occupies 4 bytes. To make it so that you can continue no matter what you type, change:
CODE 5+$4EE8 From: 6600 0070 To: 4E71 4E71
If you do this and you don't want to continue, just type Command-Q and the current game will end and the program will go back to the main screen.
-
LabView
v2.2.1
SN 27645; PN 4224446-24
-
LapTrack
v1.0f
85502930
-
Launch Pad
v1.0
LPM-03061-3480
-
Le Correcteur 101
v2.0.1
0382752-0369610-0049402
-
Legacy
vAll
†Search for: 6702 604C 4EAD 0112
Change to: 6002 " " " " " "
Search for: 670C 487A 00CC 4EAD
Change to: 600C " " " " " "
-
Lemmings
vAll
†v1.4.2
CODE 2+$1DE0 From: 6DC4 To: 4E71
+$1DE6 From: 6610 To: 6010
Lemmings Codes
Rating: FUN Rating: TRICKY Rating: TAXING Rating: MAYHEM
EFFECT: The Copy-Protect dialog will still come up, but you can press return
to bypass it now. Don't enter anything in the box or it will give you the standard message that the code isn't correct.
HOW TO: LOCATE CODE ID=2 FOR 5A83
CHANGE 5A83 TO 0000
LEMMINGS
EFFECT: Omits the dialog box
HOW TO: LOCATE CODE 3
CHANGE WORDS AT OFFSET $2588 WITH $302D DB60.
LEMMINGS
EFFECT: The quiz dialog will show up but anything will be valid HOW TO: Locate code resource #2
Change the words at offset 1F58 from B06D DB60 670C to 3B40 DB60 4E75
-
Leprechaun
v3.0
68uwxw58
(case sensitive)
†v3.0
CODE 6+$292 From: 4EBA To: 6062
-
LetraStudio
vAll
†v1.5
rename font to "Stand Font (Corinthian Bold)"
-
LetterPerfect
v2.1.2
F2USMLP21D
-
Lexi-Cross
vAll
†CODE 5+$05AE From: 67 To: 60
or try,
CODE 5+$05AE From: 67 To: 60
+$0590 From: 4EBA 227C To: 4E71 4E71
Now you don't even have to hit <CR>
-
Liaison
v2.0
40026825185
40063496992
40063576094
v3.0
40026825185
40063496992
40063576094
-
Life and Death
vAll
†v1.01
CODE 2+$5842 From: 674A To: 604A
-
LightSpeed C
vAll
†Ser. # Removal
In case you might need it, the serial number is hidden in the Lightspeed C file sector offset 281, byte 320 in decimal ASCII, you can’t miss it.
-
Live Picture
v2.0
6-8 digits long, ending with a 4
-
Lock Finder
v5.0 & above
†Search for: 3C38 0210 BE6D FF16 6730
Change to: " " " " " " " " 6030
Search for: 3C38 0210 BE6D FF16 674E
Change to: " " " " " " " " 604E
-
Lode Runner
vAll
†Search for: 6058 4EBA 00EA
Change to: 4E71 " " " "
Search for: 7E01 602E 4FBC
Change to: 7E1C " " " "
Lode Runner (new)
Search for: 6100 EBE6 42A7
Change to: 4E71 4E71 " "
-
Logo Correcter
v2.1
210342-5733
-
Loony Labyrinth
v1.0.x
9269LLM106162-U1
-
Luscher Profile
vAll
†Search for: 3DF1 9C0F 2E
Change to: 5C37 0227 8B2C
-
LXR Test
v5.0.10
1500B
-
Mac a Mug
vAll
†Search for:4569 2487 18D6
Change to: 24AF BAA3 0A42
Search for: 31E3 70F7 C897
Change to: 36E3 " " " "
-
Mac Edge
vAll
†Search for: 4EAD 00E2 4A6D FA48 6624
Change to: 4E71 4E71 " " " " 4E71
Search for: 4EAD 00C2 4A6D FD14 662C
Change to: 4E71 4E71 " " FA48 4E71
Search for: 4EAD 00C2 4A6D FD9C 662C
Change to: 4E71 4E71 " " FA48 4E71
Search for: 4EAD 00D2 4A6D F534 6624
Change to: 4E71 4E71 " " FA48 4E71
Search for: 4EAD 00C2 4A6D F828 6624
Change to: 4E71 4E71 " " FA48 4E71
Search for: 4EAD 00E2 4A6D F81E 6624
Change to: 4E71 4E71 " " FA48 4E71
Search for: 4EAD 00DA 4A6D E652 6624
Change to: 4E71 4E71 " " FA48 4E71
Search for: 4EAD 00D2 4A6D EC06 661C
Change to: 4E71 4E71 " " FA48 4E71
==========
MacEdge II
Search for: 672E 4267 487A
Change to: 4E71 " " " "
Search for: 6752 4267 487A
(The rest is missing, pure speculation, but the next line might be:
Change to: 4E71 " " " "
But that’s a guess…)
-
Mac Fortran
vAll
†Search for: 6700 000A 43FA
Change to: 6000 " " " "
Search for: 6602 604C
Change to: 4E71 " "
==========
v2.0a
Search for: 361F 6616 487A 0C54
Change to: " " 4E71 " " " "
Search for: 6602 604C 3F3C
Change to: 4E71 " " " "
Search for: 0016 A017 4A39
Change to: " " 4E71 " "
==========
v2.0b
Search for: 6100 FF22 6600 0016 47A0 6B4
Change to: 4E71 4E71 4E71 4E71 " " 6B4
-
Mac Golf
vAll
†Search for:21C2 022E 4A40 6700 002E
Change to: " " " " " " 6000 " "
MacGolf (font Change for nonstandard System)
Search for: 487A 04EF 487A FFE4 A900
Change to: 4E71 4E71 4E71 4E71 4E71
Search for: 3F3A FFDE A887 3F3C 000E A88A
Change to: 3F3C 0189 " " " " 000C " "
-
Mac Jack II & Poker
vAll
†Works on both games.
Open ‘Finder’
Search for: 2007 4FBC 00FF
Change to: 6016 " " " "
Rename ‘Finder’ to whatever. You will have to use Fedit or Mactools to rename as the Finder does not allow itself to be renamed from the desktop.
(To Change the routine that ejects and make it exit to the Finder, useful on Hard Disks)
Search for: A017 3D40 000E 4E5E
Change to: A9F4 " " " " " "
-
Mac Pascal
vAll
†Move to block 0209, position 0039, Change 41EE to 6000
Move to block 0209, position 003B, Change FFB0 to 008A
Move to block 0229, position 0105, Change 41EE to 6000
Move to block 0229, position 0107, Change FFB0 to 008A
Move to block 024B, position 01FB, Change 41EE to 6000
Move to block 024B, position 01FD, Change FFB0 to 008A
(Disk vs. file level)
SECTOR COPY THE DISK, THEN PERFORM THE FOLLOWING PATCHES..
SEARCH DISK FOR 41EE FFB0 Change EACH TO 6000 008A
(I FOUND IT IN ABOUT 8 PLACES)
SEARCH FOR B26E 0008 6702 60
TO 60
(FOUND ON 2 BLOCKS)
MacPascal V2.0 'Beta Plus'
Search for: 61 00 00 62 66 00 00 0A 61 00 00 C2
Change to 40
-
Mac Racquetball
vAll
†For harddrives. Enable you to use MacRacquetball on it without the reset.
Search for: D8FF 6C00 007A 4267
Change to: " " 6000 " " " "
Search for: 4EBA 5E92 91C8 317C
Change to: 4E71 4E71 " " " "
-
Mac+ ][
vAll
†Search for:6700 0250 2C7C 0001 8000
Change to :4E71 4E71 " " " " " "
Mac+ ][ 3.0
Search for: 6700 0250 2C7C 00
Change to: 4E71 4E71 " " "
-
Mac320
vAll
SB23-0015-0057-1800
-
MacAttack
vAll
†1.0
Move to block 002F, position 0174. Change 67FA to 4E71
MacAttack 1.4
USE MACTOOLS, AND UNLOCK, UNPROTECT, AND MAKE VISIBLE ALL FILES. THEN, USE FEDIT, OPEN UP 'PLAYFIELD1'. Find 67FA 4EAD and change to 4E71 4E71 COPY THE FILES OVER USING MACTOOLS (LOCKED DISK) AND COPY PLAYFIELD1, SYSTEM & THE TWO FILES SCORES & STEMP,YOU NEED THEIR SYSTEM BECAUSE IT HAS TEN FONTS FOR THE GAME. YOU CAN, IF YOU WISH, TAKE THIS FILE AND USING RESEDIT, COPY THE FONT FILES FROM THE SYSTEM AND THEN PASTE THEM INTO PLAYFIELD ONE. THEN YOU MAY USE ANY SYSTEM FILE.
MacAttack 1.6
Search for: F49E 67FA 4EAD 023A 41ED
Change to: " " 4E71 " " " " " "
-
MacBackup
vAll
†v2.3
Search for: 6700 0026 317C 0001
Change to: 6000 " " " " " "
==========
v3.0
Search for:4EBA 0170 4A40 6700 0016 4EBA
Change to :4E71 4E71 " " " " " " " "
==========
v3.5
Search for: 4EBA 0170 4A40 6700
Change to: 4E71 4E71 " " " "
-
MacBZone
vAll
† - MACBZONE 1.3.1
EFFECT: Remove the serialziation dialog box
HOW TO: Locate code resource #3
Change the byte at offset 2A80 from 67 to 60
Run the program and hit return at the serialization dialog,
leaving zeros in both fields. You'll never be bothered again.
EFFECT: Free serial number from author
HOW TO: Use Serial: 5000
Access code:48406914
-
MacCommand
vAll
†Search for: 4EEA 0010 31FC 0001
Change to: 6000 E8F4 " " " "
Copy files MC, HIscore, and startup screen and MCScreen.
or try,
Search for: 41FA 007A 209F 203A
Change to: 4E75 " " " " " "
or try,
Search for: 6614 2A7A ECAA
Change to: 4E71 " " " "
Search for: 6700 0014 41FA 01BE
Change to: 4E71 4E71 " " " "
Search for: 6700 0008 41FA
Change to: 6000 " " " "
-
MacDos
v1.0.1
0000036568
4294930727
†The SN# must be 10 digits long and satisfy LoWord(SN#)=HiWord(SN#) xor 8ED8
***
Thus if we let HiWord(SN#)=$0000, Then LoWord(SN#)=0000 xor 8ED8 =$8ED8, so SN#=$00008ED8 =#0000036568
1. Using MacZap Tools, Change data marker to D5 FC AD, then read block 3A hex from original.
2. Change marker back to default (D5 AA AD), then write block to sector copied disk.
-
MacEKG
v2.0.7
12345Z9L2416
-
MacFATS
vAll
†v1.0
Search for: 6600 00E4 3F3C
Change to: 6000 " " " "
-
MacFerret
vAll
Marty
-
MacGammon/Cribbage
vAll
†Search for: FA75 C74C 511
Change to: FB74 " " 511
Search for: 6851 8EDF 775C
Change to: 6950 " " " "
-
MacIndexer
vAll
†v1.0
Search for: 6700 00EA 486D F9
Change to: 6000 00EA 486D F9
-
Macintercomm
v1.1.1 Lite
v1.1b21
ToasT (case sensitive)
†CODE #2 +0B7E 4EAD 1382->4E71 C080
-
MacLabeler
v1.0
Search for: 0002 2E4E 4D00
Change to: 4002 " " " "
-
MacLabelPro
v1.6.3
5117081730
-
MacLink
v7.5
603050-1601
204612-7000
v6.0
00678935
-
MacMatch
vAll
†Search for: 6616 4267 6016
Change to: 6716 " " " "
or try,
Search for: 4EBA 0690 101F 6702 A9F4
Change to: 4E71 4E71 " " 6002 " "
-
MacMod Pro
v3.2.2
013953150 'Ian Mouton'
070185726 'ANONYMOUS'
133209756 'Anonymous'
700182795 <Any Name>
v3.0.1
†••• Version: "3.0.1" •••
SN#=ID+(ID/7)^2 - 724
-
MacPassword
v4.0
v3.8.8/3.9.0
Nov301954May261951
v3.8.7
Nov301954May261951
†Krak for MacPassword Package 4.0.0:
****************************************
MacPassword™ Utility:
Locate CODE 2 offset 07C8
Change 663E to 4E71
Run MacPassword™ Utility and enter any text into the serial number field.
Quit the application and
Search for ALL instances of 4A2D FA3B 67
Change ALL instances to 4A2D FA3B 60
************************
MacPassword™ CDEV:
Search for ALL instances of 4A2C 6301 67
Change ALL instances to 4A2C 6301 60
****************************************
MacPassword™ INIT:
Search for ALL instances of 4A2C 6BB2 67
Change ALL instances to 4A2C 6BB2 60
****************************************
I suppose it does not matter, but just so you know for future reference should an update be released that does not work with this krak:
The routine to check if time has run out on the demo version calls the
following code: 7C3C 9C80. This loads up 60 (as in 60 days left to register)
and subtracts from it how many days have passed since it was first run. So change the 9C80 to 4E71 and you will forever have 60 days to register. You will probably have to do this to all three parts.
-
MacPlot
v1.6
Search for: 6738 4267 3F3C
Change to: 6038 " " " "
==========
MacPlots // 1.01
Search for: EBAF D364 2A7
Change to: 4E71 4E71 2A7
-
MacPublisher
vAll
†(mounted as 1st volume)
Search for: 316E 0014 0016 4268 001C A007
Change to: 317C FFFF " " " " " " " "
(mounted as 2nd volume)
Search for: 316E 0014 0016 4268 001C A007
Change to: 317C FFFE " " " " " " " "
==========
v1.25
Search for: 4EAD 0552 41ED 0552
Change to: 4E71 4E71 " " " "
==========
v1.3
Search for:6760 102D FF22
Change to: 6660 " " " "
Search for: 6626 102D FF22
Change to: 6726 " " " "
Search for: 6606 197C 0001
Change to: 6706 " " " "
==========
MacPublisher II 2.0
Search for: 8310 2DFF 0E67 24
Change to: " " " " 0E60 24
Search for: 1F0A 0100 01C0 0167 00
Change to: " " " " " " 0160 00
-
MacRenderman
v1.3
978862966
-
MacRISK
vAll
†Patch for Mac II, 1-bit mode ONLY:
Search for: C1E8 000C 48C0
Change to: " " " " 4E71
I don’t know what the programmer was trying to do, but the above patch will allow MacRISK to work on the Mac II without ExitToShell happening all the time. All it does is replace an EXT.L D0 with a NOP. D0 was already in long form from the result of a MULS and on the Mac II the EXT.L was making D0 go negative. Not too good for a handle size… (Try running it in 1 bit mode if you have problems)
The above patch will _ONLY_ work in 1 bit mode. To make MacRISK work in all modes on all Macs do the following long patch:
Search for:
4E56 FFFC
486D FBCC A910 XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX 4E5E 4E75 5341
Change to:
4E56 FFFC
486D FBCC A910 203C 0000 5080 A122 4A40
6702 A9F4 2B48 FBC8 A029 206D FBC8 2050
2B48 FBBA 3B7C 0040 FBBE 2B7C 0014 0000
FBC0 2B7C 0156 0200 FBC4 206D FBCC 4868
0002 486D FBBA 486D FBC0 486D FBC0 4267
42A7 A8EC 4E71 4E71 4E71 4E71 4E71 4E71
4E71 4E71 4E71 4E71 4E71 4E71 4E71 4E71
4E71 4E71 4E71 4E5E 4E75 5341
This patch completely rewrites the “save the bits” routine. If you really want all the details disassemble from "SAVESCRE"+0 to see the new code.
-
MacRobots
vAll
†Search for: 3CBA 000C 4EBA
Change to: 4E71 4E71 4EBA
-
MacroMedia
vAll
†All you need for a MacroMedia serial number is D310-12345-CP4U. The first set of numbers stands for the “D” in Director. The “310” is the version 3.1. “CP4U” is for all Mac programs. Therefore, using this formula you can get the serial number for any Macromedia program.
For example;
Macromedia Three-D would be T110-12345-CP4U for the 1.1 version,
and MM Accelerator would be A300-12345-CP4U for the 3.0 version.
The “12345” is any five numbers you want.
-
MacroMedia 3D
v1.2
T120-12345-CP4U
-
MacroMind 3D
vAll
T100-12407-CPU4
D300-31239-CP4U
-
MacroMind Accelerator
vAll
A300-12935-CP4U
A300-31239-CP4U
-
MacroMind Director
v4.0
DM400-1799-3074-2073
DM400-3702-6075-3064
DM400-3745-9071-4064
DM400-5713-8178-0037
DM400-5716-8070-7081
DM400-9762-3971-1056
v4.0.3
DM403-1799-3074-2073
DM403-3702-6075-3064
DM403-3745-9071-4064
DM403-5713-8178-0037
DM403-5716-8070-7081
DM403-5716-8070-7081
DM403-9762-3971-1056
v3.1
v3.0
D300-11114-CP4U
D300-12935-CP4U
D300-13580-CP4U
D300-31239-CP4U
†The installer for Director 4.0 requires that the installer file be named 'Director 4.0' and the other files are: Director 4.0.2, Director 4.0.3, etc to Director 4.0.10 - this will then install from any disks or hard drive.
••• Version: "3.1" •••
I think all you need for a MacroMedia serial number is D310-12345-CP4U. The first set of numbers stands for the “D” in Director. The “310” is the version 3.1. “CP4U” is for all mac programs. Therefore, using this formula you can get the serial number for any Macromedia program. For example Macromedia Three-D would be T110-12345-CP4U for the 1.1 version, and A300-12345-CP4U would be for the Accelerator version 3.0.
The “12345” is any five numbers you want.
••• Version: "3.0" •••
For a general serial # scheme try:
'D300-AxBxC-CP4U' where the x is anything you want and (A+B)/2=C.
For example d300-69696-CP4U works.
-
MacroModel
v1.5
MM150-GC-10997
mm150-AB-11618
v1.5 BETA
Password:AlexY
(Case sensitive)
-
MacSafe ][
v2.0
00686279
-
MacSki
vAll
† - MACSKI V1.0.1
EFFECT: This change allows the setup code to run and will present the (randomly occurring) question dialog. Hit the "OK" button to continue with the game, the password is now ignored.
HOW TO: Locate CODE resource #3
Change WORD at offset 5F00 from 660A -> 6054
To change dialog box:
Locate DLOG resource #1015
Open Item #1 -> Change name from "OK" -> "Ignore Question" Change Top -> 140 Bottom -> 164
Change Left -> 16 Right -> 133 - MACSKI V1.0.1
EFFECT:The program will never ask you the question. HOW TO: Locate CODE 3, Find offset $5E76
For all three of the Mac Zap series programs the serial number may be searched for and replaced. It is not converted to hex. For instance if your number is
'30' =$00003045 in ASCII, you may change those to $00000000 or anything else you wish. But first apply the patches below.
MAC ZAP COPY 4.1
Search for:B380 0C80 1122 3344 6600 025A
Change To :4E71 4E71 4E71 4E71 4E71 4E71
MAC ZAP PATCHER 4.1
Search for: B380 0C80 1122 3344 66ED
Change To : 4E71
and
Search for: 0010 A9C4 6600 E943
Change To : 4E71 4E71
MAC ZAP TOOLS 4.1
Search for: 11 2233 66ED
Change To : 4E71
Search for: 0010 A9C4 6600 E8E9
Change To : 4E71 4E71
-
Maelstrom
vAll
†1.02
I was plugging along through the Maelstrom code when I came upon a way to have the bonus timer count forward instead of backwards.
Search for: 700A 91AD FCB2 4AAD
Change to: 700A D1AD " " " "
This changes the SUB.L D0,-$034E(A5) to ADD.L D0,-$034E(A5)
or try,
1. Invincibility. When you should die because of a collision or a hit,
it says "Sweet!" instead and you live. Shields are no longer needed.
CODE Resource #2:
Location 06DE:
Old Data: 66 New Data: 60
Location 0752:
Old Data: 66 New Data: 60
Location 0B14:
Old Data: 67 1E New Data: 4E 71
Location 0B22:
Old Data: 66 10 New Data: 4E 71
2. Initial goodies (3x fire power, long shots, rapid fire, retro brakes).
Luck and shields are no longer important when you’re invincible, so
they’re not fooled with.
CODE Resource #3:
Location 0ECA:
Old Data: 42 6D FC EA 42 6D FC EC
New Data: 2B 7C 00 01 00 01 FC EA
Location 0ED6:
Old Data: 42 6D FC F0 42 6D FC F2
New Data: 2B 7C 00 01 00 01 FC F0
3. Initial bonus points in a new wave. Set it to whatever you want.
CODE Resource #3:
Location 1284: Old Data: 00 00 07 D0
or try,
Run Maelstrom, start a game, and then drop into MacsBug. type the
following commands:
sm (a5)-30e 1
sm (a5)-30c 1
sm (a5)-30a 1
sm (a5)-308 1
sm (a5)-306 1
then type:
g
When you return to the game, you’ll find you have quite a few goodies. You can selectively cheat by only executing a subset of those "sm" commands.
==========
v1.03
To eliminate the small rocks COMPLETELY, change CODE #2
+CB0 From 4EBA 21DE to 4E71 4E71
+C98 From 3F3C 0003 to 3F3C 0000
or
The Official Maelstrom 1.03 Cheat Guide
Here is a list of points.
Small asteroid -> 300 points
Medium asteroid -> 100 points
Big asteroid -> 50 points
Vortex -> 500 points
Autonominous mine -> 700 points
Super nova -> 1000 points
Hitting a steel asteroid -> 100 points
Blowing up a steel asteroid -> 5000 points
Big Enemy -> 1000 points
Little enemy -> 2000 points
Picking up a stranded pilot gives you and extra life.
Here is a list of cheats for Maelstrom 1.03:
The Official Maelstrom 1.03 Cheat Guide
To start playing on any level you like, hit the 'L' key while you are at the main screen. A dialog box will come up that lets you choose what level to start on. The 'Turbofunk' option makes the game run as fast as it can, instead of the constant 30fps it normally uses.
Here are some neat little cheats that make Maelstrom interesting. You’ll need Maelstrom 1.03 for all of these cheats, DO NOT try them with an earlier version (you might crash your machine).
You'll also need MacsBug; it is widely available on AOL and other information services. To install it, just drag 'MacsBug' and 'Debugger Prefs' into your System Folder and reboot.
Once you've installed MacsBug, load up Maelstrom 1.03 and hit 'P' to start playing the game. When you want to use a cheat, hit the interrupt switch on your Macintosh to drop it into MacsBug; take care to hit the right switch: one reboots the machine, the other will drop you into MacsBug. On Machines like the ][si (which doesn't have an interrupt switch), hold down the Command key and hit the Power On key to drop you into MacsBug.
Now for the cheats:
Type: SW (A5)-$338 1 <return> for ACME XQJ-37 Retro Thrusters
Type: SW (A5)-$336 1 <return> for Machine Guns
Type: SW (A5)-$334 1 <return> for Luck
Type: SW (A5)-$332 1 <return> for Long Shots
Type: SW (A5)-$330 1 <return> for Triple Shots
Type: SW (A5)-$384 #X <return> where X is the number of lives you want
Type: SW (A5)-$32C #300 <return> for Maximum sheilds
After you’ve finished cheating, Type: G <return> to continue playing.
I was plugging along through the Maelstrom code when I came upon a way to have the bonus timer count forward instead of backwards.
Search for: 700A 91AD FCB2 4AAD
Change to: 700A D1AD " " " "
This changes the SUB.L D0,-$034E(A5) to ADD.L D0,-$034E(A5)
Here's a little tip I came across that seems to be an "undocumented feature"
in Maelstrom 1.30 that will allow you to get huge scores that are eligible for the contest ($300 cash prize, I think?) Note that this will only work on
v1.30, not 1.3.1 or 1.3.2.
1) Launch Maelstrom 1.30.
2) Press "L" to display the TurboMode dialog.
3) Set the beginning level to 40 and number of ships to 40.
4) Check the "TurboMode" box. TurboMode is required for the feature to surface.
5) Play the TurboMode game! Try to stay alive as long as possible as this
determines how long you'll enjoy higher bonus scores.
6) When the TurboMode games ends, play the normal, contest mode of Maelstrom.
Notice that the timer does not count down!
What Happens:
Due to a bug in the Maelstrom 1.30 code, (Thanks Andrew!) playing a Turbo game before a normal game DISABLES the bonus point countdown. As a side-effect, the CAPS LOCK Pause feature is also disabled. Since the clock does not decrement, you will always receive at least 2000 points at the end of each round. All comets and multipliers add to the score as normal. Since you are no longer hindered by the timer, you can take the opportunity to plug away at those metal asteroids (100 points each time you hit one) and explore the sector (assmall as it is).
NOTE: The counter will eventually reset itself. I've found that the longer you survive in the TurboMode game, the longer the timer will be disabled. Roughly, the ratio is 1:8 (1 minute in Turbo game = 8 minutes of timerless normal play).
NOW, SEARCH FOR:A0023F00 (SHOULD BE ON SAME BLOCK ABOUT, 10-20 BYTES DOWN)
REPLACE WITH:A0026098
3rd Crack:
Move to block 0153, position 0149, Change 3F00 to 6098
Move to block 0153, position 01B0, Change 3F00 to 6098
-
Math Blaster
vAll
†Search for: 56C0 4400 1B40 FF40
Change to: 51C0 " " " " " "
-
Mathematica
v2.2
2804-76464-85066-4534
v2.03
Disk 1 PW:
1862-40876-83824-2660
†••• Version: "2.03" •••
Mathematica 2.102 Enhanced
CODE #2 "Main2"
Global Offset Routine Name Local Offset From Bytes -> To Bytes
+603E ParsePas +4C 6600 00BC 4E71 4E71
+6052 ParsePas +60 6700 00A8 4E71 4E71
+6156 CheckPas +3E 6F24 4E71
+615E CheckPas +46 6C1C 4E71
+6E0A DoSealDi +130 6700 00CA 4E71 4E71
+6E24 DoSealDi +14A 6700 00B0 4E71 4E71
This allowed me to register with a bogus serial. Now network checking is still enabled, I believe, though I'm sure I could circumvent this easily too, but I haven't got a network with 2 machines with fpu's so I cannot test it. Instead, for now, I suggest changing the two longwords listed below as I beleive they are the keys that are unique to each copy of Mathematica - these may or may not have to be certain values, if so simply find these routines (by their name) in another copy of Mathematica and try the numbers there - chances are you have a second (nth) valid Mathematica. (PS: I have a high degree of certainty that these two numbers are the serialization keys, thus we should develop a list of them if any two #'s do not work [I haven't had time to check yet])
+6B46 GetProdu +6 xxxx xxxx
+6B60 GetMagic +6 xxxx xxxx
if this doesn't work try
+6CBC CheckSea +86 6704 6604
this probably won’t work for very long as I believe it calls “AnnoyNet” and “CheckNet” periodically - that is where to look if you need a net crack.
-
MathType
v3.1
1-505
1-1405
666-452
666-5729
00000666-00005729
†Four conditions must be met:
1) 4≤ Length(NameStr) ≤60
2) 0≤ Length(OrganizationStr) ≤60
3) 4≤ Length(OrganizationStr) ≤30
4) SN#='<num1>-<num2>'
where num1 and num2 are whole numbers that can be stored in a LONG, such that:
num2=(num0% 899)+ 101 , or
num2=(num0%8999)+1001 , where num0=((num1%137)+1)*((num1%97)+1)*101
note: only the numerical values of num1 and num2 are significant, you could prepend zeros to either/both of these numbers if you like.
†Move to block 02A2, position 01C4, Change to 3EBC
Move to block 02A2, position 01C6, Change to 0100
Move to block 02A2, position 01C8, Change to 4E71
Move to block 02A2, position 01CA, Change to 4E71
-
MegaForm
vAll
†v2.0
Search for: 6700 00EE 4267
Change to: 6000 " " " "
==========
v2.1
Search for: 6700 00EE 4267
Change to: 6000 " " " "
-
MegaMerge
vAll
†v3.0
Search for: 6700 00EE 4267 3F3C
Change to: 6000 " " " " " "
-
MetaFlo
v1.2.6
14648
15028
19131
2106737
2113107
2119234
2120247
2120471
227512
228433
230918
234512
234711
235351
2387332
2393312
2393474
2393544
25783
26650
3550857
3552499
3553275
3558496
45812
45940
46676
48021
49377
4986
525911
526546
527306
527648
5361
5717803
5723288
5724474
5904
6228939
6236
6389921
6391226
6394654
6457118
6460828
6462384
749435
753853
760847
761431
762978
764200
832933
833624
834083
836077
837482
839379
-
MGM Cad
v2.5 II
220301
-
MGM Station
vAll
†v1.0
Search for: 671C 302E FFFE
Change to: 601C " " " "
Search for: 101F 0A00 0001 6704
Change to: " " " " " " 6004
==========
v1.01
Search for: 6728 302E FFFC
Change to: 6028 " " " "
Search for: 6704 4EAD 0262
Change to: 6004 " " " "
-
MicroLeague Baseball ][
vAll
†For the MLB Application:
Search for: 4EAD 0652 2000 6708
Change to: 4E71 4E71 " " 6008
For the General Manager Application:
Search for: 4EBA 11EA 4A80
Change to: 4E71 4E71 " "
-
Microphone II
v3.0
B 008617
†MicroPhone II 4.0
Contains a bug that prevents the program from downloading files to mounted volumes with more than 32768 blocks free. Here's a ResEdit patch you can apply to fix the problem. Use this only if you feel comfortable using ResEdit and ONLY with a copy of MicroPhone II 4.0. Do not modify your master disks.
Patch 1 fixes XMODEM and YMODEM. Patch 2 fixes Kermit.
Patch 1:
CODE 21+$192 From: 302E FFC4 48C0 To: 4280 302E FFC4
Patch 2:
CODE 31+$11A8 From: 302E FFEA 48C0 To: 4280 302E FFEA
-
Microplanner
vAll
†v4.4
Search for: 6722 487A 0052
Change to: 6022 " " " "
==========
Microplanner+ 5.2 - 5.7
Search for: 6700 00D4 2F0E
Change to: 6000 " " " "
-
MidiMac
vAll
†I had to dissassemble all of CODE 7. By following the code, I was able to
figure out how to decrypt code 7 (It's encrypted in three parts). To
dissassemble it I used Nosy by the way. I copied pieces of code 7 to decrypt
code 7 each time I came to a part that decrypts something. After I got all of
CODE 7, I had figured out all of the decrypting procs, trap and vector changes etc. When code 7 is done it's disk checks and copy protection, it uses code 6 to change the first jump table item to code 1+5744 and it decrypts the jump table (which is pointed to by A5+CurJtOffset and is the same info as in CODE 0). I copied the procedure that decrypted code 0 and used that to give my a copy of the CODE 0 resource, except decrypted now. CODE 7 jumps to either CODE 1+5744 or CODE 8+0. It changes the first jump table item to code 8+0 if you put in a copy (I guess) and then jumps to the first jump table item after
disposing itself. CODE 8 gives that big dialog that lets you install copies,
run the original, run the copy or return to the finder. If you put in the
original copy in the first place, it goes directly to CODE 1+$5744. The
_Loadseg instructions in the jump table call GetResource. GetResource was
patched by CODE 7 to decrypt CODE resources. I had the proc to decrypt the
other code resources, but I was missing a number, a creation date or longint
in the boot block I guess. By looking at the decrypted CODE 0 jump table, I
was able to figure out what the first bytes of each code resource were
supposed to be because they tell where in the jump table this code resource is used and how many items it has in the jump table. The decrypting proc uses
some calculation to get a byte each iteration to EOR with the CODE resource
byte. The procedure was complicated but it turned out (by tracing it) that it
was only adding $2D to the byte used to EOR with the CODE bytes each time.
Knowing this and what the eor byte should be for the first 4 bytes, I got the
number I was missing. (I only needed 8 bits of the 32 bit number). I replaced
all the resources with the decrypted resources and code 0 pointing to 1+5744
as the new start of the program and it worked! It seems none of the other
resources do any copy protection (except for probably code 8 which isn't used
any more because code 7 isn't used anymore). I made no patches, just decrypted the codes.
-
Might & Magic I
vAll
† - MIGHT AND MAGIC I V1.0.1
EFFECT: Removes the password dialog
HOW TO:
Code 4 offset 06a0 change 4eba to 4e71 Code 4 offset 06a2 change fb5a to 4e71
-
Might & Magic II
vAll
†COLOR V1.0.2 (with possible FREEZE, try out)
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 4
CHANGE THE TWO WORDS AT OFFSET 02F4 TO 4E71 2D49
-
Might & Magic III
vAll
†Type 'BLASTOFF' in a mirror portal to see the ned of the game
-
Mind Prober
vAll
†Search for: 6718 486D F314 A851
Change to: 6018 " " " " " "
-
MindShadow
vAll
†Search for: 2F10 4217 205F 4E90
Change to: 203C 99C4 5501 4E71
or try,
Search for: A552 F6C8 44B0 3DC0 1564
Change to: CF40 9035 1857 73BB 1995
-
Mindsight
vAll
†v1.1
Search for 2924 3F3C 0001
Change to: 21CE " " " "
-
MiniCAD
v5.0
1500-04059406
1500-02837048
v4.0+
1400-07710400
†v2.01
Search for: 5E2E 9F4E 7550 4154 204E 56FE EC
Change to: " " " " " " " " 2000 0000 00
Search for: FA3F 2EFF FE48 6EFE F14E AD02 02
Change to: " " " " " " " " F100 0000 00
==========
v2.43
Search for: BC6E 000C 6F00 00F4 42A7
Change to: " " " " 6000 " " " "
Search for: 200C 6700 00C6 4247
Change to: " " 6000 " " " "
-
MiniTAB
vAll
M8208005
-
Minotaur
vAll
†Network Crack:
CODE #6 +1D90 67->60
-
Mission Thunderbolt
vAll
†In the application:
$129 Change 1EF0-1FB0 to 0000-0000
Then just type RETURN when asked to enter the code
==========
v1.06
STRS #129, Change $1BF0-1CAF to 0000-0000
or
CODE 11+$280C From: 67F6 To: 60F6
or
MISSION THUNDERBOLT (version unknown)
EFFECT: allows any entry including return for password HOW TO: LOCATE CODE RESOURCE 11
CHANGE THE WORK AT offset $280C, FROM 67F6 to 60F6
(Thanks to Dean C)
MISSION THUNDERBOLT 1.0.1
EFFECT: Bypasses COPY PROTECTION:
HOW TO: CODE 000B+280C
find: 67F6
replace: 60F6
-
MitemView
vAll
11089
-
MobileMath for Newton
vAll
2100012050337131
-
Monopoly
v2.01
† MONOPOLY2.01 (COLOR) Virgin Games'
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 8
CHANGE THE WORD AT OFFSET 3BBC FROM 6600 TO 6000
MONOPOLY2.05 (COLOR) Virgin Games'
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 8
CHANGE THE WORD AT OFFSET 3D1A FROM 6600 TO 6000
MONOPOLY2.05 (B&W) Virgin Games'
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 8
CHANGE THE WORD AT OFFSET 3DA6 FROM 6600 TO 6000
-
MORE
vAll
†Name in STR 63. Organization in STR 64. Personalized information is encoded.
-
More Disk Space
vAll
1982487924
†v1.1
Key words for successful use of MDS
To install, make a diskcopy image, boot from that floppy (very important). Go into options under file. Select which disk to install on (or sets of disks). Install (File menu). 2nd most important thing: Don’t let it go automatic on you. The automatic is eating people although we've had NO NO NO NO NO NO NO problems with it here or our collective 750 meg of hard drives on 7 machines. You can still reap the benefits of MDS by just smashing programs and games etc MANUALLY. You’ll still get 30-40 meg of hard drive space, your programs will not launch any slower, sometimes even faster and you won't have to publish any more messages about how it ate your precious files that you didn’t have backed up properly.
To remove MDS:
Run program from HD,
Hold down Command key
File menu’s formerly dimmed “Install” item will appear undimmed as “Remove”
Just make sure you have your hard disk selected in the options dialog or it won’t know which machine to remove from.
-
More Lemmings
vAll
† W I C K E D
02 - NICMITUODP
03 - OCCLWUGPDL
04 - CKLVUFOQDS
05 - GAHPVMHBEF
06 - IHSTDNGCEM
07 - MQTDJGEDEI
08 - QVMHGMMEEK
09 - VMHGAHVFEP
10 - ELGIHTTGEQ
11 - NGCLTTDHEQ
12 - GKLWVLJIES
13 - GEHQUDLJEM
14 - OISWLHGKEQ
15 - MPUDLGCLEQ
16 - PUMHGIMMEM
17 - UMHGEITNEJ
18 - DNGIHTUOEK
19 - HGCMUWLPEP
20 - GKMUUELQED
21 - GGHPTFNBFJ
22 - MHQTFNGCFR
23 - LPTGNGCDFM
24 - STFNGILEFF
25 - TGLGAHWFFN
26 - GLGIHVTGFF
27 - LGCLWTFHFE
28 - GMLWTNJIFF
29 - GAHSUGLJFO
30 - KHSUGLGKFJ
31 - MQUOJFGLFO
32 - SUGNGKLMFR
33 - UGLGCHWNFI
34 - FLGOHTUOFR
-
Morph
v2.5
4606000800
v2.0
1406016346
v1.1
1300670063
-
Mouse Stampede
vAll
†Search for: 3F3C 0006 4EBA 03EC 6000 0096
Change to: 4E71 4E71 4E71 4E71 4E71 4E71
or try,
Search for: 3F3C 0006 4EBA 0CEC 6000 0096
Change to: 4E71 4E71 4E71 4E71 4E71 4E71
-
Mouse Write
vAll
†v1.1
Search for: 6760 2F0E 4EBA
Change to: 6060 " " " "
Search for: 6700 0088 206E
Change to: 6000 " " " "
Search for: 6606 2F0E 4E
Change to: 6006 " " "
v2.3
Search for: 6606 2F0E 4EBA FF18
Change to: 6006 " " " " " "
Search for: 6700 0088 206E 0008
Change to: 6000 " " " " " "
Search for: 6606 2F0E 4EBA FD00
Change to: 6006 " " " " " "
Search for: 6706 2F0E 4EBA FC62
Change to: 6006 " " " " " "
-
Movie Magic
vAll
†To break the copy protection of Movie Magic, here’s what ya do. Use ResEdit to find the place where the copy protected name is stored. Simply backspace over it, deleting it. The name is also stored in the footnotes. If you disable it, the machine will bomb if anyone tries to use a footnote. So place an invisible box over the footnote box so no one will even think of using it in the first place.
-
MS Chart
vAll
†Search for: 6081 BEDD 608B BEDD
Change to: 4E71 " " " " " "
-
MS Excel
v4.0
00-065-0400-46250964
v3.0
00-065-0300-92000809
†v1.0
Search for: 608E BEDD
Change to: B103 6ADD
or try,
Search for: 37CF 0267 DD79
Change to: 00CF " " " "
or try,
MS Excel crack 1.0
Search for: 0000 A5A5
Change to: 045B BAAB
2nd crack
Search for: 37CF 0267 DD79
Change to: 00CF " " " "
MS Excel Serial # Removal
To remove the hidden ser# on excel, search for 7A43 5856 425A.
Change the *next* 3 words to 0000 0000 0000. Some may be zeros already.
-
MS File
vAll
†Search for: 1260 82BE DD
Change to: 124E 71BE "
==========
v1.02
Search for: 608F BEDD 608E
Change to: 678F " " " "
==========
v1.04
Search for: 608E BEDD 608F
Change to: 678E " " " "
-
MS Multiplan
vAll
†v1.02
Search for: 1260 8007 BE
Change to: 4E71 " " "
-
MS Word
vAll
†v1.05
Search for: DD 6084 BEDD
Change to: " 4E71 " "
==========
v1.15
Search for: 608E BEDD
Change to: 4E71 " "
MS Word A
Search for: DD 608B BEDD
Change to: " 4E71 " "
MS Word B
Search for: DD 6084 BEDD
Change to: " 4E71 " "
-
Multi Ad Search
vAll
100063800
100066120
-
Multi-Ad Creator
v3.0.1
000437085
v3.0
000716055
v2.2
100911030
000002784
v2.0
000002784
100911030
vAll
100911030
100733861
100733861
100063800
100066120
†For the General Manager Application:
Search for: 4EBA 11EA 4A80
Change to: 4E71 4E71 " "
==========
v3.0
In the application:
CODE 14+$1C56 From: 6776 To: 4E71
+$1D28 From: 6700 007E To: 4E71 4E71
+$1D2E From: 6700 00F2 To: 4E71 4E71
+$1D4A From: 6708 To: 4E71
+$1E26 From: 662A To: 4E71
This both cracks the program and removes the network check.
==========
v3.5
Forget the install process... Copy the disk files to your hard drive and extract the files yourself & put into a folder (files from disk 1&2 have to be done this way, the other can be run on their own), now in the application change:
CODE 10+$000E From: 67 To: 60
this works and gives me and registered to blank, serial #.
-
Multi-Disk
vAll
PS001604(001)
-
MultiClip Pro
v3.1
ENV30307-002
-
MusicShop
v1.0
210.100.000115xx (x = any number)
-
MusicTime
vAll
MV20-0-1045-1830
-
Mutant Beach
vAll
000234
003557
-
My Office
vAll
†Search for: 6600 00A2 2813 6700
Change to: 6000 " " " " " "
-
My School
vAll
6580040
-
My Town
vAll
8620045
-
myDiskLabeller
vAll
†v1.0
Search for: 6600 05B0 41ED 0352
Change to: 4E71 4E71 " " " "
-
MyLabelDesigner
v1.0.1
2227-30259
-
MYOB
v5.0.4
JZ51726
-
Name Cleaner
v1.0.1
Note: name field is case sensitive
409639 '_Anonymous_'
1551782 'Public Domain'
-
Nascar Challenge
vAll
†Bill Elliots NASCAR Challenge:
CODE 3+$07E0 From: 6700 FF46 To: 4E71 4E71
+$07E8 From: 6604 To: 4E71
this totally removes the protection as you do not even have to press a key
or try,
Bill Elliot's Nascar Challenge!
As always, open it up with ResEdit (The Application 'benc').
CODE 3+$0B5E From: 6704 To: 4E71
This is quite a cool 'Turbo' feature.
CODE 12+$05D8 From: 006D To: whaver
The lower the number you change it to, the faster you go. For instance, if you want to double your speed (Doesn’t change the other cars’ speeds), change it to $0036 (Half of $006D). If you want to have fun, and just fly out of the stadium, set it to below $0010. If you for any reason, want to go really slow, set it to something like $0100.
-
Negotiation Edge
vAll
†Search for:FDD0 6718 486D
Change to: " " 6018 " "
-
Net-Cal
vAll
†v1.3
Search: FFDE B0AE FFDA 6F0C
Change: " " " " " " 600C
-
NetPhone
v1.2.1
NPQ356V8
-
Nightingale
v1.01
195121
-
Nightwatch
vAll
†Nightwatch is a slick new protection scheme for hard disks. It is supposed to prevent anyone from accessing your hard disk, but really doesn't do much good. Basically it alters the hard disk so it seems to be permantely write protected. If the disk is write protected, you can write out the Desktop file, and the mac won't mount it.
How to crack it!
1) Bring a disk with the System on it and Mactools from copy ii mac. MAKE SURE that Mactools is the “startup” application, so you won’t even get into the Finder and see this desktop shit.
2) Boot the disk on the nightwatched system and you'll be up into Mactools with the ‘nightwatched’ hard disk mounted, ready to be leached!
(For more fun, bring another HD and leach the whole fucking thing!)
Alternately, you can set startup to any application and use Disktools or Disktop to open up nightwatch.
-
Nisus Writer
v4.0.6
1923328854936
v4.0.3
8382135866940
v3.0.x
90040236
-
Nok Nok
vAll
9300 49591
9300 49799
9300 59593
-
Notify
vAll
0005940166
-
Now Bundle Installer
v3.5
BNA-350-0001-011873529747
-
Now Compress
v1.0x
NCA-100-0001-003575417719
-
Now Contact
v3.5
BNA-350-0001-011873529747
v3.0
CTA-300-0001-000666706778
CTA-300-0001-075642105493
vAll
NCT-100-0001-000000451264
NCT-100-0001-000001134944
NCT-100-0001-000002522128
NCT-100-0001-000003488392
NCT-100-0001-000004357860
NCT-100-0001-000005235762
NCT-100-0001-000006896297
NCT-100-0001-000007087356
NCT-100-0001-000008807586
NCT-100-0001-000009688595
NCT-100-0001-000010736698
NCT-100-0001-000011197968
NCT-100-0001-000012008297
NCT-100-0001-000013958804
NCT-100-0001-000014206730
NCT-100-0001-000015717029
NCT-100-0001-000016915346
NCT-100-0001-000017513305
NCT-100-0001-000018395860
NCT-100-0001-000019267534
NCT-100-0001-000020418569
NCT-100-0001-005022697310
Reserved: NCT-100-0001-099999820388
-
Now Up-to-Date
v3.5
BNA-350-0001-011873529747
v3.0
UDA-300-0001-000001885057
UDA-300-0001-000002547761
UDA-300-0001-000003794225
UDA-300-0001-000004298420
UDA-300-0001-000005349864
UDA-300-0001-000666515963
UDA-300-0001-015049716191
v2.0
UDU-200-0001-002377188121
v1.0
UDA-100-0001-011445453986
-
Now Utilities
v5.0.1
NUA-500-0001-005930092882
Any numbers from 5.0
v5.0
NUA-500-0001-005930092882
NUA-500-0001-000001153288
NUA-500-0001-000002637220
NUA-500-0001-000003098898
NUA-500-0001-000004048457
NUA-500-0001-000005219300
NUA-500-0001-000006457186
NUA-500-0001-000007152361
NUA-500-0001-000008038064
NUA-500-0001-000009597126
NUA-500-0001-000010539034
NUA-500-0001-000010539034
NUA-500-0001-000013109925
NUA-500-0001-000012227787
NUA-500-0001-000011213269
NUA-500-0001-000014335250
NUA-500-0001-000999531947
NUA-500-0001-000019201700
NUA-500-0001-000018479633
NUA-500-0001-000017111730
NUA-500-0001-000016973956
NUA-500-0001-000015557769
-
NUBase
v1.3
0000000-00
-
NuPaint
vAll
10111220
-
O.G.R.E.
vAll
†Search for: 6700 000E A017 21FC 0000
Change to: 6000 " " " " " " " "
Must use the system that comes with the game (lots of resources).
HFS disks: remove all files from folders.
-
Object Master
v2.0.2
L\002428392663
-
Oh, no! More Lemmings!
vAll
† - OH, NO! MORE LEMMINGS
EFFECT: Gets rid of passwords for individual levels in Oh No! More Lemmings HOW TO: In CODE 3, at offset 0xDB2, replace exactly 88 bytes (11 lines in ResEdit's general editor) with the following 88 bytes (11 lines) of garble:
48E7 1F18 47ED D02C
4245 101B 0C00 0030
6D14 0C00 0039 6E0E
4880 0440 0030 CAFC
000A DA40 60E4 0C45
0064 6E1A 4A45 6F16
5345 3B45 DC52 2005
48C0 81FC 0014 3B40
DC82 7001 600A 426D
DC52 426D DC82 7000
4CDF 18F8 4E75 4E75
You'll probably want to update the corresponding dialog to make the prompt more appropriate. I changed item 4 of DITL 2001 to read "Level? (1 = Tame 1, 21 = Crazy 1, 41 = Wild 1, 61 = Wicked 1, 81 = Havoc 1)" so that I won't forget this is a patched copy.
or
OH, NO! MORE LEMMINGS
EFFECT: This will remove the personalisation requirement
HOW TO: CODE 2 Offset $1410
From: 661C
To: 4E71
CODE 2 Offset $1E78
From: 6700
To: 6000
CODE 2 Offset $1F60
From: 6706
To: 6006
CODE 3 Offset $0506
From: 671E
To: 601E
-
Oids
vAll
†CODE 12+$1F58 From: 670C To: 4E71
+$1F5E From: EC70 To: EC72
+$1F62 From: EC72 To: EC70
v1.3
CODE 12+$1F7C From: 670C To: 4E71
+$1F82 From: EC2E To: EC30
+$1F86 From: EC30 To: EC2E
-
OmniPage
v5.0
0102E-%001705
v2.1
0102E-%001705
0132A-%002643
v2.0
2801G-%001327
v3.0
0102E-%001705
0132A-%002643
-
Omnis 3+
vAll
†Search for: 6612 2F2E 0008
Change to: 6012 " " " "
Search for: 6624 2006 0A00
Change to: 4E71 " " " "
-
Omnis 7
v2.0
7MDSI25119011700
7MIES 450M 000000 94312
v1.1 Windows
7WDI 108844 18592
v1.1 Mac
7MDI 102344 37554
7MDI 103039 37065
7MDI 103247 37782
v1.0.3 Win 3.x
7WDI 108844 18592
Name each disk D1, D2, D3, D4, D5
Unzip to FLOPPIES then install through Windows
v1.0.3 Mac
7MDI 102344 37554
7MDI 103039 37065
Name each disk D1, D2, D3
-
One on One
vAll
†Search for: 2CE0 075B 4274 01C5
Change to: 42BF D8BD 9A4B 3915
Search for: D8EF F320 B611
Change to: D8BD 96C6 C05D
-
Operation Combat
vAll
†It took me a few hours, but I finally figured out a crack for this program. The only problem is that you cannot quit except through the monitor… You know, press the interupt switch and type SM 0 A9F4, G 0 or in MacsBug type ‘es’...
Search for: 102D 9E0A 6700 FEE2 4EBA 1A2E
Change to: " " " " 6000 " " " " " "
This trades a BEQ for a BRA. Works great.
-
Operation Desert Storm
vAll
†(B&W & Color)
Search for: 6700 FF44 2F2C FFEC
Change to: 4E71 4E71 " " " "
-
Operation Tsunami
vAll
†Level Passwords (case sensitive):
Normal: Hard:
Level 1
Area 2 FrGdSL ThrfrG
Area 3 vdThWr ndMkDs
Area 4 ldThtH cplsfl
Level 2
Area 1 GvHsnl lNtnsB
Area 2 Bgttns tzngTh
Area 3 nThtTh mnThNm
Area 4 sWhBlv fThFth
Level 3
Area 1 thnHmM rndfTh
Area 2 ghtNtP SnndfT
Area 3 BtHvtr hHlySp
Area 4 nlLfJh rtMtth
Level 4
Area 1 ThrSxt wTwnty
Area 2 nKngJm ghtTwn
Area 3 sVrsnf tyNwnt
Area 4 ThHlBb nlVrsn
Level 5
Area 1 lPrsGd PrsJss
-
OptiMem
v1.5.6
AVFA-SHAA-LLAO-LBPUA
-
Out of This World
vAll
†CODE 5+$325C From: 67C0 To: 4E71
File 0146 is a GIF that has a secret message....
Codes:
1) LDKD 2) HTDC 3) CLLD 4) FXLC 5) KRFK
6) XDDJ 7) LBKG 8) KLFB 9) TTCT 10) DDRX
11) TBHK 12) BRTD 13) CKJL 14) LFCK 15) BFLX
16) XJRT 17) HRTB 18) HBHK 19) JCGB 20) HHFL
21) TFBB 22) TXHF
-
OverVUE
vAll
†Search for: 1842 8112 3C00 314E
Change to: 0242 " " " " " "
==========
v2.0?
Move to block 030B, position 019C, Change to 0000
Move to block 030B, position 01A0, Change to 0000
or
Search for: 1842 8112 3C00 314E
Change to: 0242 " " " " " "
-
Oxyd
vAll
†Here are the first 2nd to 11 level codes:
2) 218780766 3) 10232399 4) 32882199
5) 13794470 6) 28197802 7) 17887807
8) 51761122 9) 83882268 10) 6071220
11) 58037867
Oxyd Patch
Here's the patch I found for removing the Oxyd CP. Maybe it can be added to
the new Cracks and Numbers file?
OXYD 3.4
Depending on which version you want to run (B&W or Color) you need to
alter the appropriate Data A file. (Note: this only works with 3.4; I
have no idea if it works with 3.3)
**NOTE: you require a Disk/File editor such as Norton Disk Utilites
rather than Resedit because you are editing the Data fork not Resource
fork.
EFFECT: This patch allows you to enter in the level number you want to
play,
instead of the annoying 'secret code'.
Data A Color +$0001BC48 (#113736):
Data A Mono +$0001C18A (#115082):
change: 6F6E DEC8 FFFD D823 to 614A 0080 FFF7 CFFA
and
Data A Color +$0001BC5A (#113754):
Data A Mono +$0001C19C (#115100):
change: 4CFF FFF6 to CFFF FEFA
Now you can just enter in the level number you want to play (preceded by
the appropriate number of 0's, so level 12 would be 00000012).
EFFECT: This patch allows you to press any key to remove the 'magical
tokens'
which block your path.
Data A Color +$0002C9F6 (#182774):
Data A Mono +$0002CF36 (#184118):
change: 669F to DE43
Data A Color +$0002CA22 (#182818):
Data A Mono +$0002CF62 (#184162):
change: 669F to DE43
Data A Color +$0002CA4E (#182862):
Data A Mono +$0002CF8E (#184206):
change: 669F to DE43
or
OXYD 3.4
Depending on which version you want to run (B&W or Color) you need to alter the appropriate Data A file. (Note: this only works with 3.4; I have no idea if it works with 3.3)
**NOTE: you require a Disk/File editor such as Norton Disk Utilites rather than Resedit because you are editing the Data fork not Resource fork.
EFFECT: This patch allows you to enter in the level number you want to play,
instead of the annoying 'secret code'.
Data A Color +$0001BC48 (#113736):
Data A Mono +$0001C18A (#115082):
change: 6F6E DEC8 FFFD D823 to 614A 0080 FFF7 CFFA and
Data A Color +$0001BC5A (#113754):
Data A Mono +$0001C19C (#115100):
change: 4CFF FFF6 to CFFF FEFA
Now you can just enter in the level number you want to play (preceded by the appropriate number of 0's, so level 12 would be 00000012).
EFFECT: This patch allows you to press any key to remove the 'magical tokens'
which block your path.
Data A Color +$0002C9F6 (#182774):
Data A Mono +$0002CF36 (#184118):
change: 669F to DE43
Data A Color +$0002CA22 (#182818):
Data A Mono +$0002CF62 (#184162):
change: 669F to DE43
Data A Color +$0002CA4E (#182862):
Data A Mono +$0002CF8E (#184206):
change: 669F to DE43
-
PacerForum
vAll
License Key: 5
User Key: B-6MX00096002114
-
PacerTerm
v1.0
B-43C78920099091
-
Pagemaker
v5.0
11-1009-200021734
11-1516-200723741
v5.0b1
11-1009-200021734
v4.x
02-4008-200010087
02-6023-000345263
02-3013-000-196593
08-1003-000357503
02-0004-000094245
02-3008-000036469
02-0000-000000000
†v1.0
Search for: 4E56 FFFE 422E 0008 486E
Change to: 205F 301F 1F3C 0001 4ED0
==========
v5.0
Open up the PageMaker App itself with ResEdit (or your favorite Brand X resource editor) and find the 'KXRX' resource. The net ID number is located between offsets 0A and 1F inclusive. You will find all of the bytes at these offsets have already been zeroed. Change them to whatever makes you happy (as long as it's unique for each machine on the net).
==========
v1.1
Search for: 6B00 00F4 203C 0000
Change to: 6000 " " " " " "
Search for: 670E 4267 4EBA FCF0
Change to: 600E " " " " " "
Search for: 670C 4267 4EBA FCD4
Change to: 600C " " " " " "
==========
v1.2
Search for: 676E 4267 2F07 4EAD
Change to: 606E " " " " " "
==========
Pagemaker Ser. # Removal:
To erase the serial number of Page Maker:
- Start Fedit
- Open File Page Maker
- Read sector 0 of the file
- At location $158 you will find a string like “xxxx 69xx xxxx 69xx xxxx
xxxx” which is the serial number. They, of course, encoded it but with a
simple key. They used the creator string "ALDU" and pass each letter in
turn to encode each number of the serial number.
Ex.:
$71 XOR $41 (A) = $30 (0)
$7E XOR $4C (L) = $32 (2)
$69 XOR $44 (D) = $2D (-)
and so on...
- If you just change the numbers to put out a 00-000-00000, the program bombs
out of its skull.
- A little more digging uncovers the preceding two bytes. $156 is the address
where the serial number check begins. It is normally a $0D so the checking
doesn’t begin until the 6th number ($15D) in the serial number string
(which starts at $158).
- $157 is the number of digits to print in the serial number box when the
program starts. If the number is less then $0C (original number), the
string “Serial number” before the actual number doesn’t get printed.
- So, to turn the number to 00-000-00000:
* Read sector 0 of the Page Maker file
* Go to byte $156
* Hex modify: 0D0C XXXX 69XX XXXX 69XX XXXX XXXX
To: 140C 717C 6965 717C 6965 717C 7465
* Write the sector back
-
PageNow
v1.0
800427536402
-
Paint Alchemy
v2.0
100110824578
-
Painter (Fractal Painter)
v3.0
PM999RAZ9999999-GFLB-999
PM300NAZ0008665-RYKA-001
v2.0
0011187QBO
(The last 3 are letters)
0000000xxx
v1.x
OOOOOOOAAA
0013951HZY
0014731DJN
†Painter 1.2
To make it so you can use any serial number (7 digits, 3 letters), change:
GWIL 1+$322 From: 6600 FEF8 To: 4E71 4E71
Registerred copies will not have a GWIL 1 resource and can’t be registerred without one. After registerring, a CPHR 0 resource is added that holds your name and serial number.
†To patch it so you don't need the codes, change CODE 1+$3C70 from
2F3000004EAD078A to 4E714E714E714E71 and change CODE 1+$3C92 from 67 to 60.
or
PGA GOLF V1.0
EFFECT: The password dialog will never show up. (It doesn't get rid of the diaglog box, but as with the other patch you can safely enter any distance.)
HOW TO: LOCATE CODE RESOURCE 1
CHANGE THE WORD AT OFFSET 3C70 TO 4E71
CHANGE THE WORD AT OFFSET 3C72 TO 4E71
CHANGE THE WORD AT OFFSET 3C74 TO 4E71 CHANGE THE WORD AT OFFSET 3C76 TO 4E71
CHANGE THE WORD AT OFFSET 3C98 TO 4E71 CHANGE THE WORD AT OFFSET 3C9A TO 4E71
PGA TOUR GOLF 1.0.1 ONLY [this patch works but the "before" code is NOT 660A]
EFFECT: It doesn't disable the green length box, but it doesn't matter what length you enter.
CHANGE THE BYTES AT OFFSET 25 FROM AD 01 4A TO 71 4E 71
IN CODE RESOURCE 3, CHANGE THE BYTE AT OFFSET 16060 FROM 6F TO 60
or
Change CODE 3+$17EA (A few characters over from 17E8)
from:
025A
to: 0172
This simple crack just jumps over waiting for you to enter the password, and lands right at the part where it sets the memory that says you got the password right.
-
Pixel Putty
v1.2
PP-001-03689-A
-
Pixel Putty Solo
v1.0.1-1.2.4
PP-001-03689-A
-
Planet X
v1.2.2
yteyWZIwB5NPHeGF
-
Player Pro
v4.3
00003400248
v4.15x
12345678900
v4.10
12345678900
v4.09
12345678900
†Crack for Player PRO 4.4.2 Fat:
---------------------------
Register Code = 123****900 (Such as 1231111900 or 1232222900)
If it makes your mac system down after registering, then
restart your mac and :
Open Player PRO 4.4.2 Fat in ResEdit
CODE ID=7 :
find at offset 32BA
change from 670C to 671A
Crack for Player Pro 4.15
-------------------------
Code 7
Offset 18FE
Change to 6012
Offset 1930
Change to 6012
Offset 16FA
Change 4E90 -> 4E71
-
PlayMaker Football
vAll
†v2.0
Find CODE 90+$608 is $6700 FF18
change CODE 90+$59E to $4E71 and CODE 90+$5F2 to $6018
change the message in DLOG 800 to
"Press Command-G and hit OK until the game begins.
Then you will never see this dialog box again."
or
Code #90
+54A 66D6->4E71
+552 670A->600A
+464 6714->4E71
or
PLAYMAKER FOOTBALL 2.0
This patch takes several steps, since PMFB checks to see if its code has been modified while a game plays; if it has, the game will crash. This is why previous patches have failed. However, it doesn't ask for a password every time; instead, it asks after several games have been played since it last got a valid password. After a valid password has been entered, all you need to do is lock the application in the Finder. Then it will not be able to remember how many times you've played, and will not ask you for the password again.
If you haven't enetered a valid password (and no longer have the
user's manual) modify the program with ResEdit as follows:
Open CODE 90, find word at offset $100;
change the word from $A861 to $4E71.
(This replaces the random number generator, so you will
always be asked for the same password.)
Then run PMFB and ask to play a game. It will ask you for word 4 on page 13, paragraph 3. The word is "are". After it accepts this
password, DO NOT PLAY THE GAME! It will see it has been modified and crash.
Instead, open ResEdit and change the word in CODE 90 back
to its original value of $A861. Then lock PMFB in the Finder. It should never ask you for the password again.
I don't know for sure that this will always work; I've only had my
copy of Playmaker Football to test it on.
-
Playroom
vAll
† - THE PLAYROOM (COLOR) V 2.0.1
HOW TO: The password dialog entry box will never show up (used to show up every fifth invocation).
HOW TO: Locate CODE resource #11 (number eleven)
Change WORD at offset 0DC2 from 526D -> 426D
-
Pool of Darkness
vAll
†In the application:
Check
'CODE'
$B
$6d92
2
$4ead
$01d2
Modify
'CODE'
$B
4
$6d92
$4e71
$6d94
$4e71
$6dc8
$600c
$6dec
$4e71
or
POOLS OF DARKNESS (ATTENTION: Patch also disables internal viruscheck!)
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 11
CHANGE THE WORD AT OFFSET 6D92 TO 4E71
CHANGE THE WORD AT OFFSET 6D94 TO 4E71
CHANGE THE WORD AT OFFSET 6DEC TO 4E71
POOLS OF DARKNESS V1.0
EFFECT: Defeats password protection.
Works for b&w version, not tested for color.
This keeps the password dialog, but it doesn’t matter what password you use After the 3th try the program starts.
HOW TO: Locate code resource 15, change the word at
offset $1AB4 from $4EBA to $4E71
offset $1AB6 from $5442 to $4E71
-
Pool of Radiance
vAll
†V1.1
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 2
CHANGE THE TWO WORDS AT OFFSET 3E94 TO 4E71 4E71
-
PopUpFolders
v2.0.1
13504-649669-120706
v2.0
13504-649669-120706
v1.5
70837-015270-100569
v1.0.1
100569
-
Poser (Fractal Poser)
v1.0.1
FM100NAZ0001902-VAGA-001
v1.0
FM100NAZ0002026-DYVN-001
FM100NAZ0001902-VAGA-001
-
PosterWorks
vAll
1883-BKHMEAFGHI
-
Power Launcher
vAll
†V1.6
Search for : 6716 1B7C 0001 F643 4206 554F
Change to : 6016
That will eliminate the check-sum routine that detects that the code has been modified.
Search for : 6718 3F3C 0080 4EAD 019A 554F
Change to : 6018
That will allow anything for your registration dialog. If it doesn’t ask for the registration then trash the pref. file before you launch it and it will ask you to register. If you want it un-registered just click ok. This crack also removes the annoying dialog everytime you change sets.
-
Power Translator Spanish
v1.0
PTSMA004852
-
PowerMerge
v1.0
PM1-002897
-
PowerScan
v2.0.5
Reg Seed#6F312122 (see below to change)
Reg Code#4134551C205 (205 is optional)
†Run the program and write down the first 8 characters of the Registration Seed number, then quit the program. Open the 'Pref' #128 of the file "PowerScan 2.0 Prefs" which will now be in your "Preferences" folder with a resource editor (ie Resorcerer or ResEdit) at offset $170 (#368) you should see the 8 characters of the Registration Seed number that you wrote down in the raw hex dump - replace this longword with $6F312122 and save the changes. you can now use the Seed/Code number info given above.
*** Detailed Info for Programmers/Hackers ***
The protection scheme used is of suprisingly high quality. The first time you run the program it generates a random long value called the "Registration Seed" and stores it in the prefs. You then register with the author (by giving him both the seed and the version number of PowerScan that you have) and he sends you back a "Registration Code" which enables you to register that version of the program (so long as you have not deleted the prefs file that is…). Whenever a new release is issued you are simply asked to find your old registered copy of PowerScan and it will register the new version using the info from it.) The reason why this protection scheme is good is that a given code only works for a single version with a certain seed (which the user cannot enter) - by using this scheme the author can change his protection scheme every release if he so chooses while not affecting previous registered users unless they have lost their old registered powerscan or the version for which they have the code. The copy protection scheme implemented in version 2.0.5 is done in three distinct steps:
1) Checksum memory containing the registration code being executed as follows:
(assume CodePtr is a pointer to an array of bytes)
codePtr = address of CODE#3 'Initialization'
length = 7844; // the number of bytes to checksum: 7844=Size(CODE #3) for v2.0.5
cs = 0; // checksum is a unsigned longword initially set to zero
for (index=1;(index<=length);index++);
{
cs += codePtr[index]^index; //where ^ is the XOR/EOR operator.
cs = cs<<3;
}
// cs=0x877AA4BB1 for v2.0.5
/* one of the main difficulties of figuring out a SN# for this app is obtaining the correct value of this checksum, since any debugger breakpoint or code modification within the range being checksummed will completely throw off the number generated -- thus you have to _recognize and understand_ exactly what is being done and why, and then deduce that you can either write some code to do it yourself (too much work) or look to see if the author made any mistakes/oversights by calling any subroutines outside of the range being checksummed after this number was calculated… sure enough he did, so I just put a breakpoint in one of these subroutines and looked where I knew the checksum value was being stored.
the breakpoints I used were:
68K t 00EE9888 R 'CODE 0002 1A14 Utilities'+23E8
68K t 00EE98AA R 'CODE 0002 1A14 Utilities'+240A
68K t 00EE98FC R 'CODE 0002 1A14 Utilities'+245C
*/
2) Take the first 8 digits of the Registration Seed (which is a hexadecimal long - in my case $6F312122) combine it with the fixed/preset long value $A9204A57 to get the "target" value as follows:
target=Combine1(0x6F312122,0xA9204A57); //where Combine1 is the routine given below
// target=0xC6F4544A in this case;
3) Take the first 8 digits of the Registration Code (an unknown at this point) and combine this value (according to the function Combine2) with the checksum value ($877AA4BB1) to generate a value to compare with the target value - if they are equal then the Registration Code is valid.
if (0xC6F4544A==Combine2(regCode,0x877AA4BB1) then Registration Code is valid.
Thus to figure out the Registration Code we need to find an inverse function Combine2Inverse such that:
regCode=Combine2Inverse(target,checksum);
//0x4134551C =Combine2Inverse(0xC6F4544A,0x877AA4BB1); in this case.
Upon Registration a 'Reg ' #128 resource is created in the app it contains:
+$00 Registration Seed
+$04 Registration Code
+$08 ?
+$0C Length byte followed by mangled user name
The Registration Code is actually supposed to be 11 characters, the first 8 being significant and the last three not significant as of 2.0.5, would simply be the version number (205 in our case). The last three characters do not seem to be stored anywhere in the application, thus it leads me to believe that the author simply chooses the fixed magic ($A9204A57) number such that it exactly comphensates for any changes in the registration code (and thus the code checksum) introduced in future versions.
Furthermore the author mangles your name in the exact same way as Combine2 except that he does it against his copyright string.
The Combine2Inverse function and all those used above are listed below:
*** Listings/Snippets ***
Byte GetByte(unsigned long theNum,short whichByte) //whichByte=0..3 0=MSB,3=LSB
{
return (Byte)((theNum<<(whichByte*8))>>24);
}
unsigned long SetByte(unsigned long theNum,short whichByte,Byte theByte)
for (i=0;i<4;i++) result=SetByte(result,i,GetByte(theNum<<i,i));
return result; // ie result[i]=MSB(theNum<<i);
}
unsigned long Combine1(unsigned long regSeed,unsigned long fixedNum)
{
unsigned long mangled,result=0x00000000;
Byte tempByte,lastByte=0x00;
short i;
mangled=Mangle(fixedNum); //$A9204A57 mangles to $A952A449
for (i=0;i<4;i++)
{
tempByte=GetByte(regSeed^mangled,i);
result =SetByte(result,i,tempByte-lastByte);
lastByte=GetByte(regSeed,i);
}
return result;
}
unsigned long Combine2(unsigned long regCode,unsigned long cs)
{
unsigned long mangled,result=0x00000000;
Byte tempByte,lastByte=0x00;
short i;
for (i=0;i<4;i++)
{
mangled=Mangle(cs);
tempByte=lastByte + GetByte(regCode,i);
lastByte=tempByte ^ GetByte(mangled,i);
result=SetByte(result,i,lastByte);
}
return result;
}
unsigned long Combine2Inverse(unsigned long target,unsigned long checksum)
{
unsigned long mangled,result=0x00000000;
Byte tempByte,lastByte=0x00;
short i;
for (i=0;i<4;i++)
{
mangled=mangle(checksum); //$877AA4BB1 mangles to $870E1D3A
tempByte=GetByte(target^mangled,i);
result=SetByte(result,i,tempByte-lastByte);
}
return result;
}
-
PowerTrax
v1.2
267048
SSI-92-2031
E-34502439249
Password "PowerTrax"
-
PowerView
vAll
1-38620-KVEASRD
-
Practica Musica
v2.295
226835
v1.x
00215052
PM220569
692878
-
Premiere
v4.0
PRX200100002-025-609
PRW400U3100000-290
PRW400U3100001-923
PRW400U3100002-556
PRW400U3100003-189
PRW400U3100004-822
PRW400U3100005-455
PRW400U3100006-372
PRW400U3100007-721
PRW400U3100008-354
PRW400U3100009-987
PRW400U3100010-889
PRW400U3100011-522
PRW400U3100012-155
PRW400U3100013-788
PRW400U3100014-421
PRW400U3100015-338
PRW400U3100016-687
PRW400U3100017-320
PRW400U3100018-953
PRW400U3100019-586
PRW400U3100020-488
PRW400U3100021-121
PRW400U3100022-754
PRW400U3100023-387
PRW400U3100024-304
PRW400U3100025-653
PRW400U3100026-286
PRW400U3100027-919
PRW400U3100028-552
PRW400U3100029-185
PRW400U3100030-371
PRW400U3100031-720
PRW400U3100032-353
PRW400U3100033-986
PRW400U3100034-619
PRW400U3100035-252
PRW400U3100036-885
PRW400U3100037-518
PRW400U3100038-151
PRW400U3100039-784
PRW400U3100040-686
PRW400U3100041-319
PRW400U3100042-952
PRW400U3100043-585
PRW400U3100044-218
PRW400U3100045-851
PRW400U3100046-484
PRW400U3100047-117
PRW400U3100048-750
PRW400U3100049-383
PRW400U3100050-285
PRW400U3100051-918
PRW400U3100052-551
PRW400U3100053-184
PRW400U3100054-817
PRW400U3100055-450
PRW400U3100056-367
PRW400U3100057-716
PRW400U3100058-349
PRW400U3100059-982
PRW400U3100060-884
PRW400U3100061-517
PRW400U3100062-150
PRW400U3100063-783
PRW400U3100064-416
PRW400U3100065-333
PRW400U3100066-682
PRW400U3100067-315
PRW400U3100068-948
PRW400U3100069-581
PRW400U3100070-483
PRW400U3100071-116
PRW400U3100072-749
PRW400U3100073-382
PRW400U3100074-299
PRW400U3100075-648
PRW400U3100076-281
PRW400U3100077-914
PRW400U3100078-547
PRW400U3100079-180
PRW400U3100080-366
PRW400U3100081-715
PRW400U3100082-348
PRW400U3100083-981
PRW400U3100084-614
PRW400U3100085-247
PRW400U3100086-880
PRW400U3100087-513
PRW400U3100088-146
PRW400U3100089-779
PRW400U3100090-681
PRW400U3100091-314
PRW400U3100092-947
PRW400U3100093-580
PRW400U3100094-213
PRW400U3100095-846
PRW400U3100096-479
PRW400U3100097-112
PRW400U3100098-745
PRW400U3100099-378
PRW400U3100100-665
MBW400R100000-581
MBW400R100001-180
MBW400R100002-779
v4.0.2PC
MBW400U3100050-439
MBW400U3100051-356
MBW400U3100052-705
MBW400U3100053-338
MBW400U3100054-971
MBW400U3100055-604
MBW400U3100056-237
MBW400U3100057-870
MBW400U3100058-503
MBW400U3100059-136
MBW400U3100060-322
MBW400U3100061-671
MBW400U3100062-304
MBW400U3100063-937
MBW400U3100064-570
MBW400U3100065-203
MBW400U3100066-836
MBW400U3100067-469
MBW400U3100068-102
MBW400U3100069-735
MBW400U3100070-637
MBW400U3100071-270
MBW400U3100072-903
MBW400U3100073-536
MBW400U3100074-169
MBW400U3100075-802
MBW400U3100076-435
MBW400U3100077-352
MBW400U3100078-701
MBW400U3100079-334
MBW400U3100080-236
MBW400U3100081-869
MBW400U3100082-502
MBW400U3100083-135
MBW400U3100084-768
MBW400U3100085-401
MBW400U3100086-318
MBW400U3100087-667
MBW400U3100088-300
MBW400U3100089-933
MBW400U3100090-835
MBW400U3100091-468
MBW400U3100092-101
MBW400U3100093-734
MBW400U3100094-367
MBW400U3100095-284
MBW400U3100096-633
MBW400U3100097-266
MBW400U3100098-899
MBW400U3100099-532
v4.0PC
MBW400U3100000-444
MBW400U3100001-361
MBW400U3100002-710
MBW400U3100003-343
MBW400U3100004-976
MBW400U3100005-609
MBW400U3100006-242
MBW400U3100007-875
MBW400U3100008-508
MBW400U3100009-141
MBW400U3100010-327
MBW400U3100011-676
MBW400U3100012-309
MBW400U3100013-942
MBW400U3100014-575
MBW400U3100015-208
MBW400U3100016-841
MBW400U3100017-474
MBW400U3100018-107
MBW400U3100019-740
MBW400U3100020-642
MBW400U3100021-275
MBW400U3100022-908
MBW400U3100023-541
MBW400U3100024-174
MBW400U3100025-807
MBW400U3100026-440
MBW400U3100027-357
MBW400U3100028-706
MBW400U3100029-339
MBW400U3100030-241
MBW400U3100031-874
MBW400U3100032-507
MBW400U3100033-140
MBW400U3100034-773
MBW400U3100035-406
MBW400U3100036-323
MBW400U3100037-672
MBW400U3100038-305
MBW400U3100039-938
MBW400U3100040-840
MBW400U3100041-473
MBW400U3100042-106
MBW400U3100043-739
MBW400U3100044-372
MBW400U3100045-289
MBW400U3100046-638
MBW400U3100047-271
MBW400U3100048-904
MBW400U3100049-537
MBW400U3100050-439
v3.0
PRW200100586-763
PRW200101810-587
PRW200101890-129
v2.0
PRW200100586-763
v1.0
PRB100101253-785
-
Preprint
v1.0/1.5
11-1009-200021734
02-0001-100000000
11-1000-200027072
-
Presenter
vAll
†1.5 Demo!
This will make Presenter 1.5 Demo act as though it is not a demo. There are three global variables which say in what way it is limited - such as Demo (INIT), Demo (ADB), and all that. From looking at the resources - there's one called 'EvE ', it seems that this uses the EvE protection scheme... So, the crack just changes the variables that says whether or not it has found the EvE.
Open CODE 12 in ResEdit
Change it at offset $5EC0
From: $6F3E
To: $603E
Change it at offset $6B7C
From: $6708
To: $4E71
Change it at offset $6BC4
From: $6708
To: $4E71
Change it at offset $7268
From: $6728
To: $6028
-
PressWise
vAll
02-000-00000
11-1009-200027072
-
Prince of Destruction
v1.0.4
†Name SN# (16 Chars)
Andrew Barry 2FD5AA782FF6A5G4
Tonio Loewald 8BG61E538A80C206
Pamina Loewald 817AF07061279C5A
Doom 6DA2F55B46162G65
Name is CaSe sensitive
the protection scheme is smart in that many different real time checks are
performed discreetly and many things don't work entirely/quite right/or at all
(no indication is given however) if you simply use a SN# that will get by the
registration dialog, all together there are about 30 relations that must hold
between your name and the sn#'s and single/multiuserness
-
Prince of Persia
vAll
†EFFECT: The Potion Level never appears
HOW TO: LOCATE CODE RESOURCE 2
CHANGE THE WORD AT OFFSET 1F70 FROM 660A TO 600A
or
To Patch Prince of Persia 1.0 so there are unlimited chances to get the right potion in the potion level, change CODE 3+$55A6 from $5240 to $7000. Note: The potion level has to be done again only if you quit Prince of Persia and run it again later.
To get rid of the potion level altogether, change CODE 2+$1DF2 from $0002 to $FFFF. This is for new games and opening from the file menu. Change CODE 2+$1DD6 from $3B6D BA64 BA62 to $3B7C FFFF BA62 for opening from the desktop.
Prince of Persia saved games:
The format of the save files for version 1.0 is 2 bytes each for:
minutes left; fraction of a minute out of $2D0 (max is $2CF); level ($F is potion level, $E is last level or princess level, $C and $D are level 12 part 1 and part 2: Jaffer level, $1-$B is level 1 to 11 and $0 is the demo level); potions; unknown; prizes (people killed, items obtained, big potions etc); how many times prince died; checksum (which=$1B39 - min*$B - frac - level*$11 - potions*$25 - unknown*$C1 - prize*$17 - died*$D. To eliminate the need to calculate the checksum, change CODE 2+ $15AC from $663A to $4E71.
(POP 0.15B saved files do not have prizes or died and are therfore, only 12 bytes instead of 16. The checksum does not include prizes or died. To eliminate the need to calculate the checksum for 0.15B, change CODE 2+$181C from $662E to $4E71.)
Prince of Persia speed up:
The 'Turbo POP' updater program changes CODE 2+$102 from $90 to $D0 to speed up the animation.
Prince of Persia Editor 2.01
Change CODE 3+$05FA (A few characters over from $05F8)
from:
4EBA FE84
to:
4E71 4E71
AND
Change CODE 3+$0990
from:
670E
to:
600E
-
Print Central
v3.0.5
65-3054-000915595
-
Print Shop
vAll
†1.0 - 1.2
Search for: 21FC D9BE B403 0A80 4E75
Change to: 4E71 4E71 4E71 4E71 0280
(They took out the CP in v1.3)
-
Pro Calc
v1.3.1
0000000416 'Anonymous'
† To register: bring up the about box, then hold down the
EFFECT: This game is NOT copy protected at all, but it does not run under Systems 7.0 or 7.0.1. This may be a good forum to publish this fix to allow the program run under these systems.
N.B. Do not EVER run copies of this modified program under Systems pre 6.0.2 (i.e. System 6.0, 4.2 etc.) As Egon said in GhostBusters, "it would be very bad".
Locate CODE resource #1 (number one)
Change WORD at offset 24C8 from 0002 -> 0000
The program will now run correctly (Systems 6.0.2 and greater)
-
Quark Xpress
v3.x.x
XG50002863
XR22000765
XR22246199
XU23262295
XU23326276
XU30435247
XU30435782
XU43158960
XU43914334
XU43950295
XU44134121
XU44267530
XU44317350
XU50002863
XU51210588
XU51636790
XU51785218
XU51849192
XU52404768
XU52443418
XU52628863
XU52911967
XU52928917
XU53277674
XU55081085
XU55082842
XU55082949
XU55404875
XU56693459
XU57046139
XU57046246
XU58494583
XU60541345
XX51123585
†** TIP **
Use a number that you know works and add 107 to it.
If you replace XU with XM the installer accepts the SN and I believe installs
a multi-user version.
QuarkXpress Network Bypass:
(as of 6/29/91)
For each additional copy you need to run on the network do the following:
- Make a copy of the original program.
- Open the copy with ResEdit and open the DATA resources.
- Now open the DATA ID 0 resource.
- Search for the string QuarkXPress (check spelling and case).
- The next character after the string is a "<" symbol.
- Change the "<" character to the character "1" for the second copy you want
to run on the net and to "2" for the third copy and so on.
- Now close ResEdit and save your changes.
NOTE: For each additional copy you want you MUST make a copy of the original
to modify. That should get you on your way to lots of copies on the net.
also any serial numbers from the gamma should work just change the first two
letters to XU instead of XG
serial numbers from 3.0 should work fine also if you use the updater it will
ask if you want to change the current SN to another SN (great for getting an
The personalization data is stored in 'Qky2' ID 1. When you register it, with
this crack, it will use the serial number 19628, which is presumably the
default one. To see the personalization, go to 'About QuicKeys™...' in the
option menu when editing keysets.
Quick Keys 2.1.3
For those who can't find a serial number this work around worked for me.
1 Install Quickeys with extensions, etc you desire
2 Install Quickeys 2.1 (no serial number needed) cdev only and reboot, should
open
3 Re-install Quickeys 2.1.3 cdev only and reboot, should now open without
asking for serial number
-
QuickFlix!Q
vAll
F1009383-0045
-
QuickFormat
v6.3/7.0
QF!DD45FPDACC16LS
†QuickFormat 7.0
Byte Changes (You should find the SEARCH string only ONE TIME!)
Search:
4EBA FE14 4EAD 02E2 4EBA FEBE 4EBA FF22 4EBA F82A
Change:
4E71 4E71
QuickFormat 7.1
CODE 3 +$3B6 From $6606 to $4E71
-
QuickMail
v2.2
40866
†Crack for 2.0 serial numbers patch:
Open up the QUICKINIT file with ResEdit:
Look in INIT 25 "QuickInit", offset $24, for an ASCII sequence of digits (they directly follow a string that looks like QuickMai, e.g., QuickMai00000). ASCII modify them to any serial # you want, preferably something far away from what other people are using. You see, that serial # is a BASE serial number, from which the Quickmail software will increment x # of times, where x is the # of users allowed by that particular pack. There is one more spot where it's stored, and that's in the DATA -14144 resource, offset $5C, again, it's five ASCII digits. Change them to the same # you installed into the INIT 25
resource. Once you've made your changes, be sure to save them, and then reboot with the new files installed in your System Folder to see them take effect. I know it's not a patch to remove the serial number check process altogether, but since I do not know how the scheme is intrinsically tied to the actual workings of the client/server mechanism, I'd rather not play around with that and possibly create reliability problems. If you want to invest loads of time looking into it, feel free and please post the results; but I think if all you want to do is get your office up and running with Quickmail for everyone, then this should meet your needs.
Change to :4E75FFC041EEFFC0316E00080016216E000A0012A017
Ragtime 3.0
Serial Number:6601120 Production Number:8739401
Ragtime 3.1
Serial Number:6601120 Production Number:8739401
-
Railroad Tychoon
vAll
†Krak Patch
Hex search for:
28 00 02 B0 69 06 84 66 08 08 AD
Hex change the bold values to 4E 71
This should appear on sector 301, byte 25848 of the file.
or
Find Hex string
0684 6646 486E
Replace it with
0684 4E71 486E
When you hit the choose the locomotive screen, any choice you make will be
valid The krak listed above allows the game to continue to limit your play to
two trains at a time.
or
RAILROAD TYCOON 1.0
EFFECT:The program will never ask you the question.
HOW TO: Locate CODE 24,
Find Offset $1F0A, Change the word $6646 to $4E71
Find Offset $207E, Change the word $6608 to $4E71
RAILROAD TYCOON
RRT has the PICTs and STR#s all in the application,
where they can be copied into a WORD document that you can have
on your hard disk.
There's an easier way to avoid needing the Railroad Tycoon manual (suggested, I believe, by some previous poster in this group): Just spend a few minutes with ResEdit and add the names of the engines to the PICTs. Then the answer is right in front of you every time.
-
RAM Disk Saver
v2.0
158100157
-
RAM Doubler
vAll
†Ramdoubler 1.0.1b1 krak
Code #2 +11A0 630E->600E
Ramdoubler 1.0
the correct SINGLE BYTE crack is
CODE #2 +114A 6620->6020
RAM Doubler 1.0 fix
While playing around with RAM Doubler 1.0 you may have noticed that if you
replace your System File from a backup or even just move it out of your
System Folder and immediately back in again, upon the next restart RAM
Doubler gives you an error message saying that RAM Doubler did not load
because it has been moved. Here is why: During installation the RAM
Doubler installer places two invisible files into your System Folder,
"MacsBug Mgr" and "Load RAMDblr." If you look at your HD's boot blocks
with Norton Disk Editor you will see that the RAM Doubler installer also
changed the boot blocks' Debugger Name from the normal "MacsBug" to
"MacsBug Mgr." Obviously the installer does this to ensure that RAM
Doubler resources get loaded absolutely first thing during bootup.
Presumably it also changes the boot blocks' Debugger Name from the normal
"MacsBug" to "MacsBug Mgr" so that it can load your MacsBug debugger (if
you use it) secondly, after the RAM Doubler code during bootup. The only
problem is that if you swap out your System File or even merely move it out
of your System Folder and immediately back in again, your boot blocks get
re-written by the Mac's ROM routines such that the Debugger Name gets
changed back to "MacsBug" and presto, RAM Doubler won't load, forcing a
re-installation from the RAM Doubler floppy. (Anything you do that causes
the miniature Mac on the face of your System Folder icon to disappear and
reappear reflects this automatic rewriting of your boot blocks.) What a
hassle! Solution: if you're NOT using a debugger (or anything else you've
named MacsBug, e.g., there was once a screen saver that needed to be called
MacsBug) simply use DiskTop, ResEdit or any other disk editor that can see
invisible files to go into your System Folder and change the name of
"MacsBug Mgr" to "MacsBug" and then move your System File out & back into
your System Folder to force the boot blocks rewrite. Then you'll never
need to reinstall RAM Doubler whenever you mess with your System File. Voila!
-
Rambo
vAll
†Search for:DB49D669B2FD Change to:DC49D669B2FD
Search for:4B6F26851ED8 Change to:2AA9BB036063
-
RAMdisk
vAll
†v3.16
Leave three blank spaces after your name to register
-
RapidTrak
vAll
600001201
-
RayDream Designer
v3.1.1
RD-301-1-2116-14832
v2.0.3
RDD5-1230-48398
RDD5-1550-52358
-
ReadySetGrow!
v1.0
20475
-
Real Poker
vAll
†Search for:43FA FE80 32BC FFDC
Change to:4E71 4E71 4E71 4E71
Make the files "Saloon File" & "Poker Data" visible. Also, there is a poker
font in the fonts file you have to have on your system.
-
Realmz
v2.0
SN#11603111 RC#7252020 (Min for this SN#)
SN#11603111 RC#7252048 (Max for this SN#)
v1.6.4+
†Registration Code = any number within the range 104+INT(SN/24)*15 +/- 14 ,where SN is the serial number.
***
ie if SN=11603111 then RC=any number in the range 7252034 +/- 14
••• Version: "1.6.4+" •••
Register with 911.
Serial Number 13987296
Registration Number 8742164
Once you register your copy. Quit. Open Data Folder and copy Data D, using
finder (cmd-M). Take the 'Data D copy' and move it out of that folder. If your
Realmz copy should become unregistered, which happens if you use a bad code in
a scenario, this file is deleted thereby unregistering your copy. This is a
pain in the butt that makes you re-register every time you fuck up. Rename
Data D copy => Data D and replace in Data folder. Make sure to recopy this
again, after you do this.
If you try to register a bad copy with 2.0.3+ the Realmz Manual is deleted. This is a real bitch since the game will not run without it in the same folder.
To eliminate the need to keep the Realmz Manual around simply take any small text file and change its creator type to 'RMAN'.
-
Realmz Assault on Giant Mountain
v2.0
0000017663 Doom
0705389594 Anonymous
1717142171 Fantasoft
†Warning: The above SN# info has been comprimised as of version 2.0.3 or higher. Some asshole(s) posted the info on the internet and the author apparently took some countermeasures - so you'll just have to suffer until (if i decide to) get around to reverse engineering it again.
-
Red Ryder
vAll
†v11.0
Find:6630 42A7 4879 434F 4445 3F3C Replace 42A7 with 6030
†How to remove the copy protection from Maxis' game "RoboSport":
Search for 4EAD 066A 4FEF 000A 3E00 4A47, using a Utility such as ResEdit or
SUM Tools.(This sequence is in code resource 2 at offset 2A8C if you look with
ResEdit. Replace the first two words with 7001 7001, and everything should be
OK.
Or try:
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 2
CHANGE THE WORDS AT OFFSET 2A82-98 (2A82, 2A84, ..., 2A98) TO 4E71
CHANGE THE WORDS AT OFFSET 2AB2-C8 (2AB2, 2AB4, ..., 2AC8) TO 4E71
Or try:
COMPATIBILITY NOTES
If you play RoboSport on a MAC PLUS or MAC CLASSIC, turn OFF the Preview Movie Sound option in the Preferences Window otherwise the program may lock during Turn Generation due to a sound chip incompatability. You need MORE THAN 1MB RAM to play RoboSport under MultiFinder. If you only have 1 MB RAM, you must play RoboSport under the Finder. RoboSport is not compatible with the Apple CD-ROM init. RoboSport is not compatible with the Now Menus in the Now Utilities.
APPLETALK NOTES
To remove a SECONDARY machine from an AppleTalk network game, the person on the PRIMARY machine must:
(1) Select REMOVE SECONDARY from the EDIT MENU
(2) Click the radio button next to the player you want to remove, and
(3) Click on the REMOVE SECONDARY button.
AppleTalk Zones are not supported in this version of RoboSport—only direct machine to machine AppleTalk.
KRAK NOTES
Run the program. <IN PROGRAM> Marvel at the cool sounds. Go to the dialog box in which you're asked to input the three symbols appearing on some page in the manual. Pick any three symbols. Break into TMON. <IN TMON> Choose MAGIC RETURN from User window. <IN PROGRAM> Hit OK button. <IN TMON> GOSUB a few times; do not GOSUB over pascal case statement beginning (TRACE through it to avoid hanging TMON). Notice quite a few BRAs to Code0005+BCC. Decide too many IFs to handle, so hack logic at source, decision stage (Code0003+15A, Code0003+16E). A #$00 returned from decision routine in D0 means a faulty code, a #$01 returned in D0 means good code. Change all MOVE #$00,D0 to MOVE #$01,D0 so every code is good.
KRAK IT YOURSELF
Hex Search:
70 00 60 12 52 6E FF EC
Hex change:
…01…
Hex Search:
70 00 4E 5E 4E 75 4E 56
Hex change:
…01…
or
CODE 2+2A8C
from:
4EAD 066A 4FEF 000A
to:
4E71 4E71 4E71 7001
or
ROBOSPORT V1.0
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 2
CHANGE THE WORDS AT OFFSET 2A82-98 (2A82, 2A84, ..., 2A98) TO 4E71 CHANGE THE WORDS AT OFFSET 2AB2-C8 (2AB2, 2AB4, ..., 2AC8) TO 4E71
ROBOSPORT V1.11
EFFECT: The password dialog will never show up
HOW TO: Locate CODE resource 2
Change the words at offsets 2C30 through 2C46 to 4E71 Change the words at offsets 2C60 through 2C76 to 4E71
and you'll get $500,000 and all technologies enabled.
-
SimEarth
vAll
†This patch to SimEarth 1.0 eliminates the annoying quiz at the beginning. This patch appears to work on both the color and black & white versions. The first patch disables the quiz for new planets, the second for loading existing planets. They simulate a successful call to the quiz procedure.
CODE 11 offset $61C (newgame)
change 4EAD 008A (color version) or 4EAD 00EA (B&W) to 4E71 7001
CODE 14 offset $D8 (loadgame)
change 4EAD 008A (color version) or 4EAD 00EA (B&W) to 4E71 7001
or
EFFECT: The password dialog will never show up
HOW TO: CHANGE THE WORD AT OFFSET 127E IN CODE RESOURCE 2 TO 4E71
SIMEARTH V1.1
EFFECT: The password dialog will never show up
HOW TO: LOCATE CODE RESOURCE 2
CHANGE THE WORD AT OFFSET 47E4 TO 4E71
CHANGE THE WORD AT OFFSET 47E6 TO 4E71
Typing when the cursor is in the toolbox:
FUND :gets you an infusion of cash
JOKE :displays a joke
SMOO :smooths coastlines
ERAD :eradicates all plants & animals life.
SIMEARTH (v1.1)
EFFECT: It doesn't ask for a word at start-up any more.
HOW TO: Open CODE resource 2
at offset 0012DA, change word to $4E71
SIMEARTH (B&W) V1.0
EFFECT: The password dialog entry box and question never show up. HOW TO: Locate CODE resource #2 (number two)
EFFECT: Can load old games w/o looking up words in manual.
HOW TO: LOCATE CODE ID=3
FIND Offset Change to from
3D0A 6032 4EAD
3D3E 6064 6630
-
Spaceways 2000
vAll
†Beta
To play at higher levels:
At CODE 6 +1E78 Change: 000A to: 002F
Spaceway 2000
AKA - 'Spaceway 2000 Championship Edition'
Sure the challenge of Spaceway is really fun, but there's something to be said about kicking the shit out of the other computer. So, here's a bunch of cheats that I made for 'stress relief'.
i) *TURBO* patch
Hint: go in low-gear, unless you are really psycho
ii) Rapid Fire Fore and Aft Weapons
Hint: if Fore is on, Aft will not work, because the bullet
Offset: $270A This patches choosing your Rear weapon
From: $302D CE8E
To: $4E71 700?
NOTE: Replace the '?' with one of the following:
1 - Normal Gun
2 - Mines
3 - Smart Bombs
4 - Homing Mines
5 - Freeze the Enemies
6 - Super Speed
NOTE: You must first put ANY weapon other than the standard weapon into it, then it will use the weapon you choose with ResEdit. Cracked by Nemo
-
Spanish Assistant
v1.0
M1102424
M1104116
-
Spectre
vVR
MB7565LD
vSupreme (release)
LTS24QW
ENF2BB5
V6GHC5S
23XHC5N
ENF2BB5
CME2438
45fgt67
45lkj67
buu24m
flh242t
lnb24wb
wdp257n
acr25mm
xpw23z5
LV8252W
LV82HPQ
LV836AJ
LV83ADH
LV83G43
LV83KT5
LV866AC
LV86CYN
LV86RMG
LV87E8A
LV87JB9
LV87PZT
LV87TQV
LV8AE84
LV8ALWE
LV8AZK8
LV8BN62
LV8BS8Z
LV8BXXK
LV8C3NM
LV8EN5U
LV8EUU6
LV8F9GY
LV8FW3S
LV8G26R
LV8G7VB
LV8GBLD
LV8JW3L
LV8K4RW
LV8KHEQ
LV8L5ZJ
LV8LA4H
LV8LFT3
LV8LKJ5
LV8P5ZC
LV8PCPN
LV8PRCG
LV8QDXA
LV8QJ29
LV8QPQT
ZC224R6
DMT24BV
8FL224V
XME224W
C8E224X
Q7D224Y
GDD224Z
9ET2FG2
LTS24QW
23XHC5N
V6GHC5S
ENF2BB5
CME2438
45FGT67
45LKJ67
ACR25MM
FLH242T
LNB24WB
WDP257N
XPW23Z5
vSupreme (MacExpo)
DMT24BV
BVU247M
FLH242T
LNB24WB
VDP257N
ACR25MM
XPW23Z5
45FGT67
45LKJ67
v2.0
LV82VNN
LV83ABG
LV83WWA
LV842Z9
LV848PT
LV84CEV
LV86WW4
LV875LE
LV87J98
LV886U2
LV88AWZ
LV88GMK
LV88LCM
LV8B6TU
LV8BDJ6
LV8BS6Y
LV8CERS
LV8CJUR
LV8CQKB
LV8CUAD
LV8FERL
LV8FMFW
LV8G24Q
LV8GNPJ
LV8GSSH
LV8GYH3
LV8H485
LV8KNPC
LV8KVDN
LV8LA2G
LV8LWMA
LV8M2Q9
LV8M8ET
LV8MC5V
LV8PWM4
LV8Q5BE
LV8QHY8
LV8R6K2
LV8RAMZ
LV8RGCK
LV8RL3M
LV8U6JU
LV8UD96
LV8URVY
LV8VEGS
LV8VJKR
LV8VQAB
LV8VTZD
LV8YEGL
LV8YM6W
LV8YZTQ
LV8ZNEJ
LV8ZSHH
LV8ZY83
LV93YKU
LV947A6
LV94KWY
LV958HS
LV95CLR
LV95JBB
LV95N2D
LV988HL
LV98F7W
LV98TUQ
LV99GFJ
LV99LJH
LV99S93
LV99VY5
LV9CGFC
LV9CP5N
LV9D3SG
LV9DQDA
LV9DUG9
LV9E26T
LV9E5VV
LV9GQD4
LV9GX3E
LV9HBQ8
LV9HYB2
LV9J4DZ
LV9JA4K
LV9JDTM
LV9LYAU
LV9M6Z6
LV9MKMY
LV9N88S
LV9NCBR
LV9NJ2B
LV9NMRD
LV9R88L
LV9REWW
LV9RTKQ
LV9SG6J
LV9SL9H
LV9SRY3
LV9SVP5
LV9VG6C
LV9VNUN
LV9W3HG
LV9WQ4A
LV9WU79
LV9WZVT
LV9X5LV
LV9ZQ44
LV9ZWSE
LVA2A7J
LVA2EAH
LVA2KZ3
LVA2PQ5
LVA5A7C
LVA5GVN
LVA5VJG
LVA6J5A
LVA6N89
LVA6TWT
LVA6XMV
LVA9J54
LVA9QTE
LVAA5G8
LVAAS32
LVAAW5Z
LVAB3UK
LVAB7KM
LVADS2U
LVADYR6
LVAEDDY
LVAEZYS
LVAF63R
LVAFBSB
LVAFFHD
LVAHZYL
LVAJ8NW
LVAJMBQ
LVAK9WJ
LVAKDZH
LVAKKQ3
LVAKPF5
LVAN9WC
LVANGLN
LVANV9G
LVAPHUA
LVAPMX9
LVAPTMT
LVAPXCV
LVASHU4
LVASQJE
LVAT578
LVATRS2
LVATVUZ
LVAU3KK
LVAU7AM
LVAWRRU
LVAWYG6
LVAXD4Y
LVAXZPS
LVAY5SR
LVAYBHB
LVAYF8D
LVB2BV4
LVB2JKE
LVB2X88
LVB3KT2
LVB3PVZ
LVB3VLK
LVB3ZBM
LVB6KSU
LVB6SH6
LVB775Y
LVB7TQS
LVB7XTR
LVB85JB
LVB899D
LVBATQL
LVBB2EW
LVBBF3Q
LVBC3NJ
LVBC7RH
LVBCDG3
LVBCH75
LVBF3NC
LVBFACN
LVBFNZG
LVBGBLA
LVBGFP9
LVBGMDT
LVBGR4V
LVBKBL4
LVBKJAE
LVBKWX8
LVBLKJ2
LVBLPLZ
LVBLVBK
LVBLZ2M
LVBPKHU
LVBPS86
LVBQ6UY
LVBQTFS
LVBQXJR
LVBR59B
LVBR8YD
LVBTTFL
LVBU25W
LVBUESQ
LVBV3DJ
LVBV7GH
LVBVD73
LVBVGW5
LVBY3DC
LVBYA3N
LVBYNQG
LVBZBBA
LVBZFE9
LVBZM4T
LVBZQTV
LVC3MGL
LVC3U6W
LVC48TQ
LVC4VEJ
LVC4ZHH
LVC5783
LVC5AX5
LVC7VEC
LVC844N
LVC8GRG
LVC95CA
LVC99F9
LVC9F5T
LVC9JUV
LVCC5C4
LVCCC2E
LVCCQP8
LVCDDA2
LVCDHCZ
LVCDP3K
LVCDSSM
LVCGD9U
LVCGKY6
LVCGYLY
LVCHM7S
LVCHRAR
LVCHWZB
LVCJ2QD
LVCLM7L
LVCLTVW
LVCM8JQ
LVCMV5J
LVCMZ8H
LVCN6X3
LVCNAN5
LVCQV5C
LVCR3TN
LVCRGGG
LVCS53A
LVCS969
LVCSEUT
LVCSJKV
LVCV534
LVCVBRE
LVCVQE8
LVCWCZ2
LVCWH3Z
LVCWNSK
LVCWSHM
LVCZCYU
LVCZKP6
LVCZYBY
LVD2379
LVD28VT
LVD2CLV
LVD4X44
LVD55SE
LVD5JF8
LVD6722
LVD6B4Z
LVD6GTK
LVD6LJM
LVD96ZU
LVD9DQ6
LVD9SCY
LVDAEXS
LVDAK2R
LVDAQRB
LVDAUGD
LVDDEXL
LVDDMMW
LVDE2AQ
LVDENVJ
LVDESYH
LVDEYP3
LVDF4E5
LVDHNVC
LVDHVKN
LVDJA8G
LVDJWTA
LVDK2W9
LVDK8LT
LVDKCBV
v2.0d
AVN2227
XPW23Z5.
v1.0
LV8252W
LV82HPQ
LV836AJ
LV83ADH
LV83G43
LV83KT5
LV866AC
LV86CYN
LV86RMG
LV87E8A
LV87JB9
LV87PZT
LV87TQV
LV8AE84
LV8ALWE
LV8AZK8
LV8BN62
LV8BS8Z
LV8BXXK
LV8C3NM
LV8EN5U
LV8EUU6
LV8F9GY
LV8FW3S
LV8G26R
LV8G7VB
LV8GBLD
LV8JW3L
LV8K4RW
LV8KHEQ
LV8L5ZJ
LV8LA4H
LV8LFT3
LV8LKJ5
LV8P5ZC
LV8PCPN
LV8PRCG
LV8QDXA
LV8QJ29
LV8QPQT
ZC224R6
DMT24BV
8FL224V
XME224W
C8E224X
Q7D224Y
GDD224Z
9ET2FG2
vpre-1.0
XVL224U
8FL224V
XME224W
C8E224X
Q7D224Y
GDD224Z
†Spectre 1.0
These are serial numbers for Spectre 1.0. To play multi player games, you need to have each copy registerred under a different serial number. Just copy your
Spectre, delete the 'STR ' resource ID 997 in the copy using ResEdit (this
erases the old serial number so you can reregister using a new one), and run
the copy. When it asks you to register your copy, use one of these serial
numbers. Use a different serial number for each copy.
Extra Note: try typing GOD (or dog) when playing the game, at the option
selection screen or in the demo.
or
To make anything a serial number:
CODE 2+$19DE
From: 660C
To: 600C
AND
CODE 2+$19EE
From: 67A4
To: 4E71
To really spice up the customizable tank:
CODE 25+$2F8
From: 6744
To: 6044
This will allow you to have up to 127 for your 3 attributes. For a really fun
game, try putting things in negative!
==========
Spectre Supreme (MacWorld Special Edtn)
NOTE: There is a bug in the way the program searches for the matrix file, so
to launch the application, double click the matrix file. Perhaps this bug
might be because it passes $910 to FS<something> instead of the correct low-
memory global (maybe #920 (CurDirStore))? Your guess is as good as mine...
To allow anything as a serial number...
CODE 2+$2A26
From: 6614
To: 6014
AND
CODE 2+$2A3E
From: 6796
To: 4E71
The name and serial number are stored in the 'STR ' resource ID 997.
To spice up the customizable tank
Change CODE 23+$310
From: 6624
To: 4E71
AND
CODE 23+$334
From: 6708
To: 6008
or
Search the Spectre App for : 4eba fcf6 1e1f 1007 6614 1007
Change the Specter App to : 6014
Search the Spectre App for : 6797 42a7 4240 102e fefc 5840
Change the Spectre App to : 4e71
or try
Patch to Fix Spectre Supreme 2.0b3
Search for: 6614 3F3C 2AFA 4EAD 07EA
Change to: 6014 3F3C ....
Search for: 6796 42A7 4240 102E FEFC
Change to: 4E71 42A7 ....
After these patches, you can enter ANY number or string as a serial number.
To remove the serial number so that you can repersonalize it, just delete
'STR' 997, and run the program again.
or try
Copy the STR resource from the 1.1 developer version. Replace the STR in
2.0b3 with the one from 1.1. This will give you one serial number. For
another serial number, delete the STR resouce in 1.1d, load it up and enter
any serial number. Repeat the process to get a copy of 2.0b3 with a different
serial number.
or try
These are serial numbers for Spectre 2.0. To play multi player games, you need
to have each copy registerred under a different serial number. Just copy your
Spectre, delete the 'STR ' resource ID 997 in the copy useing ResEdit, and run
the copy. When it asks you to register your copy, use one of these serial
numbers. Use a different serial number for each copy.
Extra Note: try typing GOD (or dog) when playing the game, at the option
selection screen or in the demo.
==========
Spectre Supreme (release)
Sometimes, but not always, you can re-personalize a copy of Spectre or Spectre
Supreme without knowing a valid serial number.
If you open the personalization resource with ResEdit (#995 or #997), all the
personalization info will be there. Delete everything from inside the
resource, but not the resource itself. Then type in a random hexidecimal
number and save. Then for each copy you wish to make, type in another,
different random hex number.
What I think happens is this: Spectre first checks to see if there is the
personalization resource (#997). If there is no STR# 997 then it will bring up
the serial # dialog box. But since there is (you didn't delete it, 'member?)
it continues. Then it checks the net for copies with the same SN, and
supposedly all your copies will have different ones. For some reason, at
random times, a dialog has come up saying that the same SN is on the net when,
for the life of me, I can't find it. I'm still trying to figure out why this
be.
Spectre VR network
If you really, really, really want to play Spectre VR over a network but still
haven't found any more SNs floating around, do the following hex patch.
This will make Spectre take any Name and SN as valid. Only problem is that it
will ask you for this every time you load it up. So just make sure that the
random crap you type in is nothe same on different machines.
CODE 2 OFFSET 359A
6614 3F3C 2AFA 4EAD 096A 3F3C
to
6714
and
CODE 2 OFFSET 35B2
679C 102D 842D 4880 122D 842D
to
669C
These offsets should be right, but if not the target code is right next to it.
The "module" is that as named under the "Module" menu in ResEdit
2.1.1 using Code Editor 2.9 . They may differ on other versions. Both ResEdit and the Code Editor are available via anonymous ftp to ftp.apple.com in the directory /dts/mac/tools/resedit . I highly recommend both of them.
(IF YOU DO NOT HAVE CODE EDITOR THEN USE THE RESOURCE OFFSET RATHER THAN MODULE OFFSET .....AC)
First the original code is listed, including the assembly command just before and after the one(s) to be changed. The numbers to be changed are just above the character "|". The first number to be changed corresponds exactly to the offset number.
When installing patches, you should ALWAYS verify that the original code is exactly the same as what's listed as "original". If not, you might patch the wrong location, which would have an unknown effect on the patched application.
EFFECT: Bypass the initial password (a number of ways).
(i) and (ii) still allow for entry / display of a password and username.
(iii) COMPLETELY bypasses the initial password dialog: Spectre will always have a NULL password and username using (iii). If you want a personalized version, you MUST use (i) or (ii).
†The Serial Number follows this pattern: A**6241-----1. The "**" is representitive of one of the following sequences: 02,15,28,31,44,57,60,73,86,99. Plug one of these where the stars are.
In the "-----" space enter either of these sets of numbers: 37708 or 79824.
Using this method you can yield over twenty copies.
To do this edit the 'V4sn' resource. Be sure to make it the same length (14 bytes including the beginning length byte=$0D).
-
Strata Virtual 3D
vAll
V826243977191
-
Stratego
vAll
†v1.1.1
change CODE 10+$1628 from $4EAD 0672 to $4E71 7001 to get rid of the codes.
-
Streamline
v2.0
SAW200U3100000-471
SAW200U3100001-104
SAW200U3100002-737
SAW200U3100003-370
SAW200U3100004-287
SAW200U3100005-636
SAW200U3100006-269
SAW200U3100007-902
SAW200U3100008-535
SAW200U3100009-168
SAW200U3100010-354
SAW200U3100011-703
SAW200U3100012-336
SAW200U3100013-969
SAW200U3100014-602
SAW200U3100015-235
SAW200U3100016-868
SAW200U3100017-501
SAW200U3100018-134
SAW200U3100019-767
SAW200U3100020-669
SAW200U3100021-302
SAW200U3100022-935
SAW200U3100023-568
SAW200U3100024-201
SAW200U3100025-834
v3.0PC
SBW3003200000-234
SBW3003200001-833
SBW3003200002-432
SBW3003200003-315
SBW3003200004-630
SBW3003200005-229
SBW3003200006-828
SBW3003200007-427
SBW3003200008-310
SBW3003200009-625
SBW3003200010-609
SBW3003200011-208
SBW3003200012-807
SBW3003200013-406
SBW3003200014-289
SBW3003200015-604
SBW3003200016-203
SBW3003200017-802
SBW3003200018-401
SBW3003200019-284
SBW3003200020-984
SBW3003200021-583
SBW3003200022-182
SBW3003200023-781
SBW3003200024-380
SBW3003200025-979
SBW3003200026-578
SBW3003200027-177
SBW3003200028-776
SBW3003200029-375
SBW3003200030-359
SBW3003200031-958
SBW3003200032-557
SBW3003200033-156
SBW3003200034-755
SBW3003200035-354
SBW3003200036-953
SBW3003200037-552
SBW3003200038-151
SBW3003200039-750
SBW3003200040-734
SBW3003200041-333
SBW3003200042-932
SBW3003200043-531
SBW3003200044-130
SBW3003200045-729
SBW3003200046-328
SBW3003200047-927
SBW3003200048-526
SBW3003200049-125
SBW3003200050-109
v3.0
SAW300R3113443-487
SAW300R3100127-190
-
Studio 1
vAll
4682119240
-
Studio 32
v1.2
3006127841
vUnknown
3006003068
-
Studio 8
v2.0
9248372456
†Crack
In ResEdit open code ID 3. At offset $011A change $671A to $601A.
Any 10 digit password will now work
-
Studio Pro
vAlias
Please see the entry Strata Studio Pro
-
Studio Session
vAll
†This crack works for both the Player and the Editor.
As a matter afact I know a "sort-of way" to do it. This will work fine for
TEXT files, but if you are unstuffing an application this may not work(though
try it).
Oh, this also works fine for documents, just not applications(well not all the time).
1. Open the stuffit archive with ResEdit(or similiar utility)
2. Locate the Mkey resource and delete it(remember to keep SPARE COPY OF THE
FILE!!!!!)
3. Now open the file again(yes it will still say it is encrypted)
4. Now try to unstuff the file, it will give you a dialog box asking you to
enter a password. Put one in(make it simple, like 123, abc etc. it has to
be 3 characters), then remember it, click ok, it will give you another
dialog box asking you to verify your password. Simply type it in again and
voila!
5. It will unstuff, but 7 times out of ten, it will not unstuff the file
completely right, you can still read TEXT files, document files etc. But
applications might not work. The TEXT files have there errors though, but
most of em are obvious.
-
StuntCopter
vAll
MUHAHA
-
Super 7 Utilities
v2.0
129300096
-
Super ATM
v3.5-3.6
GHB100R3100136-472
GHW100R3106316-197
-
Super Maze Wars
vAll
† - SUPER MAZE WARS
EFFECT: When you start up, it will no longer ask for a registration number. In the About window, you can enter any registration number in the format: xxx-xxx-xxxx
This allows you to have unique identities on the network.
HOW TO:
CODE 5 + $472A : Change $3007 -> $7000
CODE 5 + $47D4 : Change $1E00 -> $7EFF
Crack for Maze Wars 1.0
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
1) Open up Maze Wars 1.0 with ResEdit
2) Open up the Code Resource
3) Open up Code 5
4) Search for Offset +4660
5) Change 6622 to 6022
6) Quit and save all changes
7) Run Maze Wars
8) Enter your made-up serial number in the correct format (123-456-7890)
9) Have fun!
Brief Overview for C&Ns:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Code 5
+4660
6622 -> 6022
-
Super Tetris
vAll
†SUPER TETRIS
EFFECT: You don't have to keep looking up the password each time to run it.
HOW TO:
1. Open ResEdit
2. Open CODE resource #6 "dialogs"
3. select "Anon 5"
4. at offset +0034 (addr 00025A) change D6A0 to D7A0
5. save & quit
Color:
Patch App by first verifiying that CODE 6+$2B0 is $D9A4.
If this is the case, it is changed to $D7A0.
-
SuperBridge
v2.0
S370302000
TextBridge 2.0.2
PN#31-07995-00, SN#9404TM01068
-
SuperDisk
vAll
†On message, open Control Panel, Touch: Alerts, Security, More Options, Memory
-
SuperLaserSpool
vAll
042401
-
SuperOffice
v2.0
For the release
102600776
102600768
For the Upgrade
1026001535
1026001527
1026001451
-
SuperPaint
vAll
†v3.0
Name, Organization, and Serial Number info for SuperPaint 3.0
When the Aldus Installer installs SuperPaint 3.0, it will install an
Application with only one 'PLoc' Resource, which is a location of the
preferences file (ID 0). It also creates an invisible file called 'SomeFile',
type 'rsrc'/creator 'RSED' containing only one resource - 'PLoc' ID 1. The
format of this resource is similar to that of an owner resource - 1 byte
indicating the length, then the data of that length. This would contain your
serial number (i.e 'US 30-300....'), not encrypted. When you run SuperPaint
for the first time, it expects that file to be in the same directory as the
application, otherwise it says 'Personalization Failed.....'. If that file is
there, is will ask you for your name and organization, and display your serial
number. Then, it will add resource PLoc ID 1 to the Application with your
Name, Organization, and Serial Number stored as consecutive encrypted strings.
Since strings are 256 bytes, 256 * 3 = 768 bytes = Size of the resource. The
application never checks this resource, so you can screw with it to your
hearts content, as long as it stays the same size. As for the format of the
resource, I played with it and came up with this:
The first and second bytes are intact (the length, and the first character of
the string). The rest of the string seems to conform to this format:
First Nibble of the byte:
0 1 2 3 4 5 6 7 8 9 A B C D E F
becomes (BitXor $2)
2 3 0 1 6 7 4 5 A B 8 9 E F C D
Second Nibble of the byte:
0 1 2 3 4 5 6 7 8 9 A B C D E F
becomes (BitXor $A)
A B 8 9 E F C D 2 3 0 1 6 7 4 5
E.G.
$41 (Hex)/'A' (Char)/65 (Dec.) would become (BitXor 2A)
$6B (Hex)/'k' (Char)/107 (Dec).
Look for an application to convert this for you!
Hint: To depersonalize SuperPaint just delete PLoc ID 1, Open ResEdit, Create
a New File, add resource type 'PLoc', create a new resource, type in anything
as a serial number, get the length, convert it to hex, then insert that as the
first character. Run SuperPaint, and it should ask you for you name/org with
†Password 'awe' - this password works for every level
Here is a little help for those of you currently playing "The Incredible
Machine". Of the total number of 160 puzzles, the following passwords
are for the first forty.
01. (NR) 11. BASEBALL 21. COUNTDOWN 31. COMPACT DISK
02. SIERRA 12. BEAR 22. PSALMS 32. SHAVER LAKE
03. DYNAMIX 13. FISH 23. TANK 33. RHEUMATISM
04. MACHINE 14. DALE 24. NIGHT 34. HARPSICHORD
05. DISK 15. CHESTERTON 25. GAMES 35. MARKET
06. SHUTTLE 16. SIZE 26. WESTERN 36. DEST
07. SATURN 17. IRELAND 27. LOG HOME 37. MYRTLE
08. KING 18. WORD 28. GRAPHICS 38. QUATERNION
09. DRAGON 19. BRIEF 29. KNUTH 39. SHOE
10. ANTS 20. HOT DOG 30. DONALD 40. FLOWER
-
The Mist
vAll
†Search for: F92C 443C 994E
Change to: D15D F737 " "
Search for: 6094 21A4 7948
Change to: 6794 " " " "
Search for: 101A 69D0 A505
Change to: 71DC F456 E3E0
-
Theorist
v1.51
010626
v1.11
T-111-003367
T-110-001351
v1.1x
T-100-001351
T-110-001351
†Version 1.51
Open CODE 4 in ResEdit
Change it at offset $2BEE
From: $670C
To: $600C
-
Think Ahead+
v3.0.1
RK#2103171921
†To register bring up the about box and option-click on the icon on the right.
My SN# was 180101 (I don't believe this is used) the Registration Key was 2103171921
which comes from the 'magic' number (a constant initialized by the DATA resource) $4D8EEEF5=#1301212917 which maps to 2103171921=RK under the transformation rules that the first 5 and last 5 decimal digits are reversed and concatenated.
Make these changes to a sector copy, then bit copy tracks #78 & 79 with copy
II Mac.
-
Wishbringer
vAll
†Search for 6FDA100667063B7C change to 6004100667063B7C
-
Wizardry
vAll
†Search for 0A00000167000090302EFFF2 change to 0A00000160000098302EFFF2
THAT REMOVES THE PROTECTION, BUT YOU STILL HAVE TO PUT SOME KIND OF DISK IN
THE INTERNAL DRIVE WHEN IT ASKS FOR THE MASTER(ANY DISK). TO REMOVE THE EJECTS
AND THE DISK REQUEST, DO THE FOLLOWING (AFTER YOU MAKE THESE MODS, IT WON'T
WORK ON A HARD DRIVE THO..) (SO IF YOU HAVE A H.D., JUST DO THE FIRST PATCH)
Search for 205FA0173E804ED14E56FFCE change to 205FA0173EBC00004E56FFCE
Search for 216E000A0012A0173D40000E4E change to 216E000A00124E713D40000E4E
Search for 2F2E00084EBAFF66A853 change to 2F2E00084E714E71A853
Search for FFF46620487A067E487A0632 change to FFF44E71487A067E487A0632
THAT'S, EITHER THE FIRST PATCH, OR ALL OF THEM, THE FILES ARE FINDER COPYABLE
AND NO MORE CHECKS.
or try
Wizardry 1.1
Search for 4EAD 059A 41ED 059A change to 4E714E7141ED059A
-
Wizardry II Knight of Diamonds
vAll
† - KNIGHT OF DIAMONDS (aka. WIZARDRY II)
EFFECT: By-passes copy protection.
HOW TO: Open CODE resource 73
at offset, change word to $4E75
-
Word Perfect
v3.0
V0000005961
-
Word Perfect Works
vAll
1WW12XM0000099
-
Wordtris
vAll
†(color version)
Search for: A915 3B7C 000C 962E 422D
Change to : 4E71
Search for: 6600 FF4C 2F0C A983 1006 4CEE 10E0
Change to : 4E71 4E71 2F0C 4E71
Search for: A991 486D 95F2 7003
Change to : 4E71
(B/W version)
Search for: A915 3B7C 000C 963C 422D
Change to : 4E71
Search for: 6600 FF4C 2F0C A983 1006 4CEE 10E0
Change to : 4E71 4E71 2F0C 4E71
Search for: A991 486D 9600 7003
Change to : 4E71
or
Open it with ResEdit and open CODE resource ID=1 with a hex editor. At
position 07A0 you will find: 4EAD 056A 4A00 6606 4EBA 0BC8 A9F4 598F
Change this to: 4E71 4E71 4E71 4E71 4E71 4E71 4E71 4E71
or
WORDTRIS v1.0 (B&W and Colour)
EFFECT: It doesn't ask for a word at start-up any more.
HOW TO: Open CODE resource 1
at offset 07A0, change word to $600C
or
WORDTRIS B/W
EFFECT: The password dislog will never show up
HOW TO: LOCATE CODE RESOURCE 1
CHANGE THE WORD AT OFFSET 07A0 TO 4E71
CHANGE THE WORD AT OFFSET 07A2 TO 4E71
CHANGE THE BYTE AT OFFSET 07A6 TO 60
WORDTRIS V1.00 (COLOUR)
2 Patches, each works independant of the other so you can use one, the
other or both.
A) EFFECT: This will still bring up the dialog, but you just hit return 3 times and it will start.
HOW TO: Code 1, "Main", anton 6
offset 0082-0086 replace with 4E71
B) EFFECT: This will stop the dialog from being brought up. If you want to be reall safe, do both, because the second just kills the dialog and under some ciramstances it might quit anyway.
HOW TO: Code1, "Main", anton 6
offset 007A replace these two bytes with two 4E71's
-
World Music
v2.0b
M20014-41003
†SN#='MXXXXX-XXXXX' , where X=any digit
-
X-FerIT
vAll
550035173-2 'anonymous'
-
X-Mas Lights
v1.0
125001751
-
Xerion
vAll
†the following commands to wired things:
Clear 5 - Next Level (Just like Dos Master said for Crazy Cars)
Clear 6 - Directly to the bounus stage
Clear 3 - Clears what ever is pulling you or making you wiggle
Clear 1 - Make the paddel larger
Clear 2 - Makes you catch the ball
-
XP PressMarks
v1.0.6
001139
-
XP Print Tools XT
v1.0.1
815715147
-
Xyphus
vAll
†Search for each string seperately and change the 67's to 60's.
4EBA 5F6C 101F 6708
4EBA 5E6A 101F 6708
4EAD 007A 101F 6708
or try
Search for 670002502C7C00 change to 4E714E712C7C00
-
ZephyrPalettes
v1.3
2-130-3186163
-
ZipIt
v1.2.6
v1.2
†CODE #2
+2292 OC39->13FC
••• Version: "1.2" •••
CODE #2
+2B3A 660E->600E
+2B4A 0C39->13FC
+2B52 6614->4E71
Note that this does not actually register the program, it just makes it behave like it was registered. Also, it enables encryption!
-
ZipQuest Pro
v1.0
SN#A 10392, Reg#B-143385261
-
Zone of Avoidance
v1.0.3av
†EFFECT: Remove Copy Protection
HOW TO: CODE 9 @1A0A : 4EB9 -> 6008
Another collection of modifications to make games more fun!
****************************************
This patch allows you to have unlimited missiles:
Open CODE 4 in ResEdit
Change it at offset $4392
From: $5379
To: $6004
****************************************
This patch gives you full abilites after you finish Level 1:
Open CODE 4 in ResEdit
Change it at offset $736E
From: $6252
To: $4E71
AND
Change it at offset $737A
From: $4ED1 0C39 0004
To: $23FC 0404 0404
-
][ in a Mac
v2.0
vAll
†Search for: 4EBA 02C2 42A7 3F3C
Change to: 4E71 4E71 42A7 3F3C
••• Version: "All" •••
Search for: 6100 B754 42AF 3F
Change to: 4E71 B754 42AF 3F
-
Δ Acknowledgements Δ
vAll
†Thanks to the many people from whose postings I have stolen KRAKs and Serial Numbers. Special thanks to those who have taken the trouble to EMail me to send me the KRAKs and Serial Numbers, and to the creator of this database to view the files!
-
Δ Cracking Tips Δ
vAll
†“Single Test Crack”
Refers to a crack that works in two halves (that have to applied seperately and in order) as the result of the program that is being cracked having a particularly simple and annoying personalization/registration scheme. Namely these programs test the same data (the serial number) (in one or more -usually 2 places) for two different reasons:
#1 do I have a valid serial#?
Yes -> Personalized.
No -> Personalize
#2 Is the serial # valid when Personalizing?
Yes -> Save personalization and enter program
No -> Quit or give alert saying try again.
Now assuming we can circumvent these two checks (ie. always make the answer yes) we are left with a small dilemma: If we just circumvent check#1 (or check#1 and check#2) we will never get to personalize, and if we just circumvent check#2 we get it personalized and can use it once, but it will ask us to personalize every time we run it - clearly an unacceptable state of affairs.
The two possible (CODE) solutions:
---------------------------------
Method A:
Just Patch Test#1 (simple but may cause crashes and/or not work - see below)
Method B:
Patch Test #2
Run Program and Personalize/Register
Quit the program (this is obvious but included for completeness)
Patch Test #1 (at this point the patch to test #2 is irrelevant)
Method B is by far the preferred course of action - although it is a somewhat tedious 3 step process it is guaranteed (by me {iff the crack is correct}) to ALWAYS work as it mimicks exactly the way the original code was meant to work (aside from reversing the checks results).
Method A is fraught with DANGER as it will definitely skip any special one time initialization/setup that is done by the personalization code, which at a minimum records your personalization info. Usually your personalization info is used for display in about boxes and such and if you go to one of these locations the program may or may not crash/screw up DEPENDING ENTIRELY on how it is programmed. Also you can never be absolutely sure that it won’t crash unless your capable of disassembling the whole program and analyzing it completely - go ahead make my day...(and you don’t need my help if you can - and the NSA has a job for you)
Copy Protected disks
Do you have one of those copy protected floppies that
neither Apple Disk Copy nor DART nor DiskDup+ will copy?
You know, the kind with the hole punched in the disk.
Give up? Wanna' copy it? Use Norton Utilities' "Floppier" -- any version should work. It's the only disk image utility
that will display "Copying around bad sectors" when it
encounters the hole in the floppy. Duh -- it works!
You can even make a floppy out of it and then in turn make a
DiskDup+ image from that so you have a mountable image file.
(Or use Delta Image to convert the Floppier image to DiskDup+.)
-
ΔΔΔ End Note ΔΔΔ
vAll
†Any cracking tips will be added here at the end of the file. The main file will contain only actual cracks. Cracking tips will remain in the file for a few months only.
