†For SN# generation info see the '4D Serial Number Scheme' entry.
The first time 4D Compiler is run it will ask you for a serial number and then to insert it's key disk - it will then create a hidden file 'xx' at the root level of the volume that 4D Compiler is on - this file is used instead of you having to insert the key disk from then on.
Procedure for making 4D Compiler 2.3 68K create a valid xx file using MacsBug:
#1) Make a physical disk image of the installer disk 1 or have any formatted HD Disk handy
then follow this procedure EXACTLY (note <cr> indicates you press return)
#2) Delete any/all old xx (hidden) file(s) and Compiler prefs
#3) Quit all other running applications.
#4) Run 4D Compiler 2.3 68K.
#5) Personalize and enter any valid serial number such as: '20996169929821'
#6) Dialog will come up asking for the key disk
#7) Break into debugger and type:
ATB FreeDialog;G<CR>
#8) physically insert the disk mentioned in step #1.
#9) Debugger will now pop up. Type(Note: S0 stands for step-over ie O in SO is a letter not zero):
ATC;SO D;BR :+40F2;G<CR>
#A) Debugger will now pop up at CODE #2 +40F2, type
BRC;PC=PC+4;G<CR>
#B) Quit and Run again - will not ask for key disk again unless you made an error. If so start over
-
4D Dev/Runtime Key Disk
v3.2 (68K) Bypass
v3.2 File Format
†Install the 68K version of 4D 3.2 from the images.
The first time 4D is run it will ask you to insert it's key disk - it will then create a hidden file 'xb' (Developer) or 'xc' (Runtime) at the root level of the volume that 4D is on - this file is used instead of you having to insert the key disk from then on.
Procedure for making 4D 3.2 Dev/Runtime 68K create a valid 'xb'/'xc' file using MacsBug:
#1) Make a physical disk image of the installer disk 1
then follow this procedure EXACTLY (note <cr> indicates you press return)
#2) Delete any/all old xb (hidden) file and ACI prefs files/folders if present
#3) Quit all other running applications
#4) Break into debugger and put A-Trap break on _Eject by typing:
ATB EJECT;G<CR>
#5) Run 4D, the debugger will pop up, then type:
ATC;SO 6;BR :+5D2;G<CR>
#6) Dialog will come up asking for key disk - physically insert disk 1 into the drive now
••• in step #7 it is critical to include the 'BRC' as runtime code checksumming is done •••
#7) Debugger will come up now at main4+5D2. Type:
BRC;PC=PC+4;G<CR>
#8) Dialog will come up asking for name/owner/sn# - Click cancel - program will quit
#9) Run again - will not ask for key disk again unless you made an error - if so start over
#A) Personalize and enter a valid serial number and your done.
••• Version: "3.2 File Format" •••
4D 3.2 Developer Key Disk/SN# Info
The first time 4D is run it will ask you to insert it's key disk - it will then create a hidden file 'xb' at the root level of the volume that 4D is on - this file is used instead of you having to insert the key disk from then on - interestingly this files contents are independent of the key disk. The #948 byte 'xb' file format is:
[+#00,#39] #40=$28 byte header (20 words of generated data - see below)
[+#40,#43] $00000388 - longword containing the size of the 'FON#' #12 resource
[+#44,#948] the data from the 'FON#' #12 resource
The first #40 bytes are generated with the following code - it is unclear what their use is -- as although Random is predictable starting from a given seed, TickCount is not as the timings would vary with hardware and other software that is running and so should not be reliably reproducable (perhaps this is a red herring?):
short i,rand;
unsigned long temp,ticks;
for (i=0;i<20;i++)
{
rand=Random();
ticks=TickCount() % 1000;
xbData[i*2]=ticks+rand;
}
Format of the ACI prefs 'ICN*' resource (the only resource/data present)
These three resource contain (in increasing numerical order) the pascal strings you entered in the personalization dialog exclusive-or'd (cyclically if >9 bytes) against the (mungered from seperate pieces so as not to be spotable in the code) fixed string 'DOminiQUE', with the expeception of the length byte which is left alone.
†For key disk info see the entry: '4D Dev/Runtime Key Disk'
For SN# generation info see the entry: '4D Serial Number Scheme'
••• Version: "3.0.1" •••
Partial Crack to get around the key disk:
1. Install the program
2. Make a copy of the program
3. Make the following changes in the copy:
CODE 31+$22E From 66 to 60
CODE 31+$290 From 6700 FE82 to 4E71 4E71
CODE 31+$44C From 6600 10FE to 4E71 4E71
4. Run the copy and enter a serial number
This will create a preferences file on the hard drive
5. Delete the copy and run the original because the changes
cause crashes in the program. You will however no longer be asked for
a key disk at startup.
-
4D Insider
v2.0.1
11305970911491
-
4D Online Help
v3.0.5
123456400
654321301
†The SN# algorithm is as follows:
num1=First six digits of the serial number
num2=((num1%7)*100)+((num1%3)*10)+(num1%2)
SN#=<num1><num2>
Thus if num1=654321, num2=(3*100)+(0*10)+(1)=301 so SN#='654321301'
Note: only the numerical value of <num2> is significant, so we could also use '654321000000301'
-
4D Runtime
v3.2
†For key disk info see the entry: '4D Dev/Runtime Key Disk'
For SN# generation info see the entry: '4D Serial Number Scheme'
-
4D Serial Number Scheme
vVarious
†4D SN# Scheme Info
==================
The following is C (or in the later cases pseudo) code to generate and/or check 4th Dimension serial numbers. This information applies to the following products, whose minLength and mult paramaters are listed:
Product minLength mult
================ ========= ====
4D Insider 1.0.1 4 5
4D Insider 2.0.1 4 59 which is equivalent to 9 since (a+b)%c=(a+(b%c))%c
I will present two entirely different methods for generating serial numbers. The simplest, most direct method of attack is to restrict the problem domain to that of entirely numeric serial numbers. This approach removes the difficulty imposed by the "(SNStr[k]>='A')" test - but imposes the lesser restriction that SNStr[Len] is '0' or '1' in general (specific counterexamples exist). Thus we can arbitrarily choose digits for the first (mid-1) odd index characters, the 2nd to last (len-1) character (actually this character can even be an alpha), while the last character is choosen as '0' or '1'. Once those choices have been made it is a fairly straight forward procedure to calculate the remaining first (mid-1) even index numeric characters. The procedure is as follows
Step
====
#1 Choose len such that len>=minLength and len%2=0
#2 Set mid=len/2
#3 Choose numeric characters to occupy the first (mid-1) odd index positions of SNStr
#4 Choose numeric or alpha character to occupy SNStr[len-1]
#5 Choose numeric character '0' or '1' to occupy SNStr[len]
#6 if len%2=1 (len is odd) then choose an arbitrary character for SNStr[len-3]
#7 Calculate the constant specialA= myVal(SNStr[len])
#8 Calculate the initial value of specialB=((myVal(SNStr[len-1])^specialA)+mid)%10
The next method I present gets around the no non-digit characters (but last character must be a '0' or '1') restriction at the cost that we must work the problem both forwards and backwards. This technique comes about by noting that the "(SNStr[k]>='A')" test is only dependent upon the first (mid-1) characters of SNStr. Thus if we arbitrarily select the last two and these characters within the restriction(s) this test imposes we can solve for the remaining (next mid-1) characters in a two part process.
First we must note that the test implies that: isAlpha(SNStr[k])=isAlpha(SNStr[2*k-1])
ie for Len=14
k 2*k-1
= =====
6 11
5 9
4 7
3 5
2 3
1 1
thus for Len=14
Char 000000000011111
Index 012345678901234
---------------
SNStr[]="\p?xxyxzy?x?z???"
where each character marked with and x,y, or z must be the same type (alpha or digit) as the other characters so marked. In this case, we are only choosing the first 6 characters, so we must be sure that the characters at indexes 2,3 and 5 are either all digits or all alpha's - and when we are solving for the next six characters we must restrict our solutions to those in which the characters at indexes 7,9, and 11 match those that we choose at 4,5 and 6 respectively. Now as far as solving for our 6 remaining unknowns at positions 7 thru 12 we note that we must work the indexes in the same order as our loop since specialB is an (modular) recurrence equation. Thus, since the index interdependencies between specialB and specialC are (respectively - in the order we must solve them):
step 2*k-1 2*i
==== ===== ===
1 11 2
2 9 4
3 7 6
4 5 8
5 3 10
6 1 12
and we have already specified the characters at indexes 1 thru 6 it is clear that we must first solve (backwards) for the characters at positions 11,9 and 7 by calculating specialB as a function of itself and specialC and specialA; then we must solve (forwards) for positions 8,10 and 12 by (direct) calculation of specialB from itself and specialA. Both of these calculations can lead to multiple solutions (which is fine) due to modular arithmetic and the increased degrees of freedom in the pseudo (since the first 6 characters are not independent of themselves) independent variables (characters).
We must also note that in general we must have specialA=myVal(SnStr[len]) in a small enough range 0..n that will allow us to solve equations of the form:
u + (v^specialA)=w mod 10 for the variable v=0..9 or 10..35 or 0..35 where both u,w=0..9
u + x =w mod 10 ,where x=v^specialA
(u + x)%10 =w ,which implies u+x=w+10*j, integer j>=0 (and j<=4 in our case)
thus we have x=w-u+10*j, 0<=j<=4 or simply
v=(w-u+10*j)^specialA , j=0..4 such that v=0..9 or 10..35 or 0..35
but being able to generally satisfy the first range v=0..9 requires that specialA be constrained to 0..1 This range is also sufficient to guarantee that the other ranges of v are satisfied by some value of j in 0..4
Step
====
#1 Choose a len such that len>=minLength, if len%2=1 then SNStr[len-3] can be any character.
#2 Choose the last two characters - the last character must be '0'..'9','A'..'V'
(note you can do this in many ways and still get the value for myVal(SNStr[len-1]))
#3 Choose the each of the first six character from '0'..'9','A'..'Z' with the constraint that the
characters at indexes 2,3 and 5 are either all digits or all alpha's.
#4 Calculate the constant specialA= myVal(SNStr[len])
#5 Calculate the initial value of specialB=((myVal(SNStr[len-1])^specialA)+mid)%10
v=(specialB+10*j)^specialA such that j in 0..4 and v in 0..35
ie (in pseudo code):
j=0
repeat
calculate v=(specialB+10*j)^specialA
increment j
until (j=5)
pick a valid value of v from the values just calculated
#J if (i<(mid-1)) goto step#G
EX: For 4D insider 1.0.1 choosing the initial values SNStr[]='AAAAAA??????50' leads
to the following (3*4*3*4*2*4*4) 4608 valid serial numbers. (for any given SN# you may choose for each index any one of the characters in that indexes column)
SNStr[]='\pAAAAAAB3F0H150'
LDPARBF
VNZK LP
X U VZ
thus some serial numbers would be:
'AAAAAABDZUR1F0'
'AAAAAAB3F0H150'
'AAAAAAB3ZARBZ0'
In fact if we made the SN# 15 characters long we could arbitrarily choose the 13th character and get at least 4608*36=165888 valid serial numbers that all began with 'AAAAAA' and ended with '0' !!! (actually more since any character would work not just '0'..'9' 'A'-'Z')
-
4D Write
v2.1
SN#522691 Card#P.040029220455
-
4th Dimension
vAll
†See '4D <product name>'
-
5PM Term
vAll
AICDBP-HHIJLD-FPTAJF-IBHBIM
-
8 Ball Deluxe
v1.0.1
6267EM11002
†Place the contents from all three disks into a folder and run the application. Let it uncompress all three files, when it gets to the Registration Dialog, CANCEL it and exit to Finder. Change:
CODE 4+$1B8E From: 660E To: 600E
CODE 4+$1BAC From: 670E To: 600E
or try
After you first take it off the disks, run it once so that it will decompress itself, then cancel and change:
To use anything as a registration number:
This part changes the application tampering check:
CODE 4+$1BAC From: 670E To: 600E
This part changes the dialog handling procedure:
CODE 4+$2E47 From: 670E To: 600E
Also
To really crack 8-Ball Deluxe, after you’ve done the crack, change:
CODE 2+$2EB2 From: 67 To: 60
Then you can copy the files all over the place.
OK, now to spice up your game:
To get infinite lives:
{How do you end the game? I dunno… Try it for practice!!!}
CODE 5+$3EEA From: 661C To: 601C
To set your number of lives:
CODE 5+$371E From: 0004 To: Whatever! Ex.
1 = $0001
2 = $0002
4 = $0004
9 = $0009
10 = $000A
11 = $000B
16 = $0010
17 = $0011
Get the idea? Remember to make sure it's 4 characters long when you type it in! Also, when you play, you’ll only see a '-' for your ball, because it thinks that because you've got n balls left, and it ends at 4 (5?), you’ve got
4 (5?) - n (Probably a negative number) left!
-
A-10 Attack
v1.0
1523995795
-
Aaron
v1.1.1
†To Register Aaron (any version):
Keep the Return key pressed during the computer boot up.
That will register Aaron.
-
AboutFace
v1.3
1022446
-
Access PC
v3.0
0120 0000 0253 0278
0120 0000 4589 1115
-
Accutext
v2.0
10900016
-
AD (After Dark)
v3.0
ADM-00670-6681
ADM-21289-8489
ADM-30306-9708
ADM-75689-8965
ADM-90213-6771
ADM-90213-6772
†If you need more serial numbers, you can change the last digit of any of the ones above.
-
AD Disney Screen Saver
vAll
DIS-00670-6681
DSM-75689-8965
-
AD Loony Tunes
v1.0
xxx-00670-6681
-
AD Marvel Comics Saver
vAll
EAM-30306-9708
MAR-00670-6681
-
AD Scream Saver
vAny
SSM-75689-8965
-
AD Simpsons
vAll
ZQM-65187-4617
-
AD Star Trek Next Generation
v1.0
NGM-00670-6681
ZQM-35600-2587
-
AD Star Trek Posters Saver
vAll
SPM-90213-6771
-
AD Star Trek Screen Saver
vAll
EAM-30306-9708
KAM-21289-8489
STM-00670-6681
†ADga 1+$864 From: 6706 To: 6006
ADga 1+$882 From: 6604 To: 6004
ADga 1+$896 From: 6704 To: 6004
ADga 1+$8F4 From: 57C0 To: 4E71
Anything will work as a serial number when running the Installer program - you cannot just drag the control panel into your System Folder. The Name, Organization, and Serial Number are stored in the 'InaP' resources in the After Dark control panel. They are encrypted - didn't bother to figure the method that out.
Open up the PageMaker App itself with ResEdit (or your favorite Brand X resource editor) and find the 'KXRX' resource. The net ID number is located between offsets 0A and 1F inclusive. You will find all of the bytes at these offsets have already been zeroed. Change them to whatever makes you happy (as long as it's unique for each machine on the net).
==========
v1.1
Search for: 6B00 00F4 203C 0000
Change to: 6000 " " " " " "
Search for: 670E 4267 4EBA FCF0
Change to: 600E " " " " " "
Search for: 670C 4267 4EBA FCD4
Change to: 600C " " " " " "
==========
v1.2
Search for: 676E 4267 2F07 4EAD
Change to: 606E " " " " " "
==========
Pagemaker Ser. # Removal:
To erase the serial number of Page Maker:
- Start Fedit
- Open File Page Maker
- Read sector 0 of the file
- At location $158 you will find a string like “xxxx 69xx xxxx 69xx xxxx
xxxx” which is the serial number. They, of course, encoded it but with a
simple key. They used the creator string "ALDU" and pass each letter in
turn to encode each number of the serial number.
Ex.:
$71 XOR $41 (A) = $30 (0)
$7E XOR $4C (L) = $32 (2)
$69 XOR $44 (D) = $2D (-)
and so on...
- If you just change the numbers to put out a 00-000-00000, the program bombs
out of its skull.
- A little more digging uncovers the preceding two bytes. $156 is the address
where the serial number check begins. It is normally a $0D so the checking
doesn’t begin until the 6th number ($15D) in the serial number string
(which starts at $158).
- $157 is the number of digits to print in the serial number box when the
program starts. If the number is less then $0C (original number), the
string “Serial number” before the actual number doesn’t get printed.
- So, to turn the number to 00-000-00000:
* Read sector 0 of the Page Maker file
* Go to byte $156
* Hex modify: 0D0C XXXX 69XX XXXX 69XX XXXX XXXX
To: 140C 717C 6965 717C 6965 717C 7465
* Write the sector back
-
Adobe PageMill
v1.0
Multiple User
APW100R3100001-010-555
APW100R3100002-010-184
APW100R3100003-010-817
APW100R3100004-010-450
APW100R3100005-010-367
APW100R3100006-010-716
APW100R3100007-010-349
APW100R3100008-010-982
APW100R3100009-010-615
APW100R3100010-010-517
Single User
APW100R3101471-534
-
Adobe Photoshop
v3.0.4
PSW303R3232323-005-448
v3.0Mac-5User
PSW300U3100051-005-113
PSW300U3100052-005-746
PSW300U3100053-005-379
PSW300U3100054-005-296
PSW300U3100055-005-645
PSW300U3100056-005-278
PSW300U3100057-005-911
PSW300U3100058-005-544
PSW300U3100059-005-177
PSW300U3100060-005-363
PSW300U3100061-005-712
PSW300U3100062-005-345
PSW300U3100063-005-978
PSW300U3100064-005-611
PSW300U3100065-005-244
PSW300U3100066-005-877
PSW300U3100067-005-510
PSW300U3100068-005-143
PSW300U3100069-005-776
PSW300U3100070-005-678
PSW300U3100071-005-311
PSW300U3100072-005-944
PSW300U3100073-005-577
PSW300U3100074-005-210
PSW300U3100075-005-843
PSW300U3100076-005-476
PSW300U3100077-005-109
PSW300U3100078-005-742
PSW300U3100079-005-375
PSW300U3100080-005-277
PSW300U3100081-005-910
PSW300U3100082-005-543
PSW300U3100083-005-176
PSW300U3100084-005-809
PSW300U3100085-005-442
PSW300U3100086-005-359
PSW300U3100087-005-708
PSW300U3100088-005-341
PSW300U3100089-005-974
PSW300U3100090-005-876
PSW300U3100091-005-509
PSW300U3100092-005-142
PSW300U3100093-005-775
PSW300U3100094-005-408
PSW300U3100095-005-325
PSW300U3100096-005-674
PSW300U3100097-005-307
PSW300U3100098-005-940
PSW300U3100099-005-573
PSW300U3100100-005-860
PSW301U3100000-005-226
PSW301U3100001-005-859
PSW301U3100002-005-492
PSW301U3100003-005-125
PSW301U3100004-005-758
PSW301U3100005-005-391
PSW301U3100006-005-308
PSW301U3100007-005-657
PSW301U3100008-005-290
PSW301U3100009-005-923
PSW301U3100010-005-825
PSW301U3100011-005-458
PSW301U3100012-005-375
PSW301U3100013-005-724
PSW301U3100014-005-357
PSW301U3100015-005-990
PSW301U3100016-005-623
PSW301U3100017-005-256
PSW301U3100018-005-889
PSW301U3100019-005-522
PSW301U3100020-005-424
PSW301U3100021-005-341
PSW301U3100022-005-690
PSW301U3100023-005-323
PSW301U3100024-005-956
PSW301U3100025-005-589
PSW301U3100026-005-222
PSW301U3100027-005-855
PSW301U3100028-005-488
PSW301U3100029-005-121
PSW301U3100030-005-307
PSW301U3100031-005-656
PSW301U3100032-005-289
PSW301U3100033-005-922
PSW301U3100034-005-555
PSW301U3100035-005-188
PSW301U3100036-005-821
PSW301U3100037-005-454
PSW301U3100038-005-371
PSW301U3100039-005-720
PSW301U3100040-005-622
PSW301U3100041-005-255
PSW301U3100042-005-888
PSW301U3100043-005-521
PSW301U3100044-005-154
PSW301U3100045-005-787
PSW301U3100046-005-420
PSW301U3100047-005-337
PSW301U3100048-005-686
PSW301U3100049-005-319
PSW301U3100050-005-221
v3.0.1
PDA200100141-356
PMW200100345-605
PCA100000100-953
PDA100000915-575
PCA200102249-484
PCA200110733-522
PDA100001185-501
PDA100001018-372
PCA200108975-448
PCA200102474-344
PCA107011754-639
PHW200100021-751
PCA100000915-575
PCA100002582-359
-
Adobe Premiere
v4.0
PRX200100002-025-609
PRW400U3100000-290
PRW400U3100001-923
PRW400U3100002-556
PRW400U3100003-189
PRW400U3100004-822
PRW400U3100005-455
PRW400U3100006-372
PRW400U3100007-721
PRW400U3100008-354
PRW400U3100009-987
PRW400U3100010-889
PRW400U3100011-522
PRW400U3100012-155
PRW400U3100013-788
PRW400U3100014-421
PRW400U3100015-338
PRW400U3100016-687
PRW400U3100017-320
PRW400U3100018-953
PRW400U3100019-586
PRW400U3100020-488
PRW400U3100021-121
PRW400U3100022-754
PRW400U3100023-387
PRW400U3100024-304
PRW400U3100025-653
PRW400U3100026-286
PRW400U3100027-919
PRW400U3100028-552
PRW400U3100029-185
PRW400U3100030-371
PRW400U3100031-720
PRW400U3100032-353
PRW400U3100033-986
PRW400U3100034-619
PRW400U3100035-252
PRW400U3100036-885
PRW400U3100037-518
PRW400U3100038-151
PRW400U3100039-784
PRW400U3100040-686
PRW400U3100041-319
PRW400U3100042-952
PRW400U3100043-585
PRW400U3100044-218
PRW400U3100045-851
PRW400U3100046-484
PRW400U3100047-117
PRW400U3100048-750
PRW400U3100049-383
PRW400U3100050-285
PRW400U3100051-918
PRW400U3100052-551
PRW400U3100053-184
PRW400U3100054-817
PRW400U3100055-450
PRW400U3100056-367
PRW400U3100057-716
PRW400U3100058-349
PRW400U3100059-982
PRW400U3100060-884
PRW400U3100061-517
PRW400U3100062-150
PRW400U3100063-783
PRW400U3100064-416
PRW400U3100065-333
PRW400U3100066-682
PRW400U3100067-315
PRW400U3100068-948
PRW400U3100069-581
PRW400U3100070-483
PRW400U3100071-116
PRW400U3100072-749
PRW400U3100073-382
PRW400U3100074-299
PRW400U3100075-648
PRW400U3100076-281
PRW400U3100077-914
PRW400U3100078-547
PRW400U3100079-180
PRW400U3100080-366
PRW400U3100081-715
PRW400U3100082-348
PRW400U3100083-981
PRW400U3100084-614
PRW400U3100085-247
PRW400U3100086-880
PRW400U3100087-513
PRW400U3100088-146
PRW400U3100089-779
PRW400U3100090-681
PRW400U3100091-314
PRW400U3100092-947
PRW400U3100093-580
PRW400U3100094-213
PRW400U3100095-846
PRW400U3100096-479
PRW400U3100097-112
PRW400U3100098-745
PRW400U3100099-378
PRW400U3100100-665
MBW400R100000-581
MBW400R100001-180
MBW400R100002-779
-
Adobe Screen Ready
v1.0
SRW100R7100738-841
-
Adobe Serial Number Assignments Mac
vAny
†Serial Number Assignment
The serial number format is PPLVVVZxxxxxx-ccc
PP = product identifier
L = language identifier W=US, ROW
E=Eng. Int'l
F=French
G=German
I=Italian
P=Spanish
J=Japanese
VVV = version T=Chinese
Z = Media Type /Package ID K=Korean
Rtl 3", Rtl5.25", RtlCD
X=NFR, U=Upg, B=Bndl
xxxxxx = sequence number, 6 digits
ccc = Checksum
DESCRIPTION CURRENT FORMAT ITEM ID
Macintosh version products
Fonts - MAC FAW500---- 0199 2986
Fonts - MAC FAW361R3(6)ccc 0199 7973
Fonts - MAC FAW381R3(6)ccc 0197 0102
MultiMaster Fonts MMW500--- 0199 3649
MultiMaster Fonts MMW361R3(6)ccc 0199 7978
MultiMaster Fonts MMW381R3(6)ccc 0197 0169
Mac Cyrillic FAK500---- 0199 6298
Mac Cyrillic FAK361R3(6)ccc 0199 7981
Mac Cyrillic FAK380R3(6)ccc 0197 0168
Mac Font Charleston Collection SMW361R3(6)ccc 0197 0181
Mac, Sample SMW380R3(6)ccc 0199 8455
Mac, Sample SMW381R3(6)ccc 0197 0593
Pub Pack #1 - MAC PAW40O---- 0199 1309
Pub Pack #2 - MAC PBW400---- 0199 1310
Pub Pack #3 - MAC PCW400---- 0199 1311
Initial Caps MAC AGW200R3(6)CCC 0197 0271
Smart Choice Mac FCW380R3(6)CCC 0197 0182
Font Folio rev. 1 - MAC FFP----.001 0399 1202
Font Folio rev. 2 - MAC FFP----.002 0399 1268
Font Folio rev. 3 - MAC FFP----.003 0199 2293
Font Folio R4 w/copyright FFO----.004 0199 3460
Font Folio Upgrade 1 S/N FFU1------- 0199 1570
Font Folio Upgrade 2 S/N FFU2------- 0199 1571
Font Folio Upgrade 3 S/N FFU3------- 0199 1572
Font Folio Upgrade 4 S/N FFU4------- 0199 1616
Font Folio Upgrade 5 S/N FFU5------- 0199 1639
Font Folio Upgrade 6 S/N FFU6------- 0199 1640
Font Folio Upgrade 7 S/N FFU7------- 0199 1727
Font Folio Upgrade 8 S/N FFU8------- 0199 1740
Font Folio Upgrade 9 S/N FFU9------- 0199 2032
Font Folio Upgrade 10 S/N FFU10------ 0199 2370
Font Folio Upgrade 11 S/N FFU11 0199 2643
Font Folio Upgrade 12 S/N FFU12 0199 2621
Font Folio Upgrade 13 S/N FFU13 0199 2622
Font Folio Upgrade 14 S/N FFU14 0199 3283
CD Rom Font Folio CDF100---- 0199 2427
CD Rom Font Folio 1-250 CDF250---- 0199 3960
CD Rom Font Folio 1-325 CDF3251(6) 0199 5030
CD Rom Font Folio 1-360 CDF360R7(6)ccc 0399 2184
CD Rom Font Folio/Type on Call CDW100---- 0199 2593
†The "Type on Call bundle version" serial number would be: AAB QWY SAHI MSRV
those are 12 letters however to add more fonts, you need to enter the 14 character. that would be CDW200B1753407
-
After Dark
vAlias
Please see the entry AD (After Dark)
-
After Dark Modules
vAll
See 'AD <module Name>'
-
AgentDA
v2.1.3
179105018
v2.0
101208510
-
Aladdin Desktop Tools
v1.0.1
ADTB-778-055000
v1.0
ADTB-778-010000
-
Alias Sketch
v2.0
SMFRZ9CQG7ZWQ86
-
ALLright Utilities
v1.0
1026439
-
Alsoft Power Pack
vAll
PS001604(001)
-
American Heritage Dictionary
v3.0
A9-L0010M3
A9-D0010M3
-
Andromeda 3D Series II
v2.0.1
0P20000000-0051
all 0's are zeros
-
Animation Stand
v2.0.2
201063
202012
-
Anubus
v2.52s
9611181
-
App-Doc Linker
vAll
817GrGn5jkfh78h
-
AppleShare
v4.1
B-341-UFD-170-QEC-309-IBZ-461-QYV-340
B-341-UFD-170-QEC-309-ICJ-348-VZJ-340
B-341-UFD-170-QEC-309-ICI-155-NEE-340
B-341-UFD-170-QEC-309-ICI-218-QVH-340
B-341-UFD-170-QEC-309-ICI-025-MNQ-340
v4.0.2
B-341-VFD-170-QEC-381-ICV-075-GSN-340
v4.0
B-341UFD-170-QEC-357-HZM-484-XDG-340
vWindows
U-341-UFD-170-QEC-381-HUJ-185-IOI-340
- put in the AppleShare Windows client software
-
Armor Alley
v1.1
EXC2H3Y
EXC53RH
EXC5F33
EXCA992
EXCE8AT
EXCEDJM
EXCJMBF
EXCLBL6
EXCMTCN
EXCNCEP
EXCQRF5
EXCRR6X
EXCSDLL
EXCY2PP
EXD3XPA
EXD89FT
EXDB85R
EXDFPA5
EXDGPPG
EXDH8NL
EXDLAB2
EXDMWHM
EXDREBM
EXDS2QL
EXDTCHB
EXDTY9M
EXDYGQX
EXE3NMF
EXE669P
EXE9583
EXE9QQ3
EXEALLY
EXEDA9C
EXEEXRF
EXEFRMC
EXEHR25
EXEMPJL
EXEQR3E
EXESPMC
EXESXH2
EXEW6T5
EXEXSS3
EXF26LF
EXF3NWH
EXF58G6
EXF5HF6
EXFCBTG
EXFCJXJ
EXFFBFB
EXFFEHW
EXFLMYX
EXFNQ82
EXFR2NC
EXFSNBN
EXFWLQX
EXFWRHR
EXFX6NQ
EXG2A96
EXG563R
EXG8YW2
EXG9G9F
EXG9T2H
EXGBDS5
It appears that
any variation of the
C9X53TA serial
number works fine:
C9X53TA
C9X53TB
C9X53TC
etc.
also:
A3A56T3
A3A56T5
A3A56T8
A3A56D8
v1.0.1
PWPWD92
PWPX939
PWX2QHX
PWX8TX3
PWX963Y
PWX99W6
PWXCAF9
PWXDEB2
PWXFL8Q
PWXL55F
PWXL98N
PWXN59J
PWXQHGF
PWXQNAH
PWXQNDN
PWX56SM
PWXT8BA
PWXWNQ9
PX29LNM
PX2B5N8
PX2BAHW
PX2D8E9
PX2DTES
PX2E9T8
PX2EQSG
PX2ES8L
PX2F9T6
PX2HF8Q
PX2J9YE
PX2JN98
PX2LFLM
PX2LLT5
PX2MD9A
PX2MW6X
PX2NPX5
PX2PY2R
PX2QAE8
PX2QP3X
PX2T3B6
PX2TJL9
PX2W6DW
PX2W6HY
PXC6FHX
PXC8A59
PXC8DWS
PXCBG5J
PXCEJJ9
PXCETED
PXCF5SS
PXCGRFQ
PXCHWSM
PXCJ3Q2
PXCJD35
PXCMN6B
PXCP3CA
PXCT52Y
vAll
3P6GXEH
8CW659X
H3PJ69D
HQQCDHA
JMNR9SC
DE5A8R3
† To play a multiplayer game of Armor Alley, each copy needs to be registerred with a different serial number. These serial numbers are for Armor Alley™ 1.0.1. Some may have typos. Just make sure there is no Armor Alley prefs file in the system folder so you can register Armor Alley with a new serial number.
EFFECT: Disables network serial number checking.
HOW TO: Open CODE resource 6
at offset 03CE, change words to $4E71 4E71
All patchs, open the Armor Alley suspended game file with a hex editor such as the Norton Disk Editor
# Change the number of helicopters you have - offset 3ECA - 3ECB - change the two bytes to the number of helicopters you want (ie. 0064 = 100 helicopters)
# Change the number of funds you have - offset 3ECC - 3ECD - change the two bytes to the number of funds you want (ie. 5000 = 20480 funds) - NOTE: Funds go up as forces go further in the field, if funds go over 7FFF they will become captured; I recommend 5000 as a safe figure (and a lot of funds)
# Change the number of machine gun bullets (or those silly non- tracking missiles) you have - offset 3F84 - 3F85 - change the two bytes to the number of bullets you want (ie. FFFF = 65535 bullets) - NOTE: FFFF will show up as -1 on the display in Armor Alley. The bullet count will continue counting -2,-3,-4 until it gets to 7FFF where it will start counting down from there (effectively 65535 bullets)
# Change the number of bombs you have - offset 3F86 - 3F87 - change the two bytes to the number of bombs you want (ie. FFFF = 65535 bombs) - NOTE: The rules for bombs are the same as for bullets
# Change the number of missiles you have - offset 3F88 - 3F89 - change the two bytes to the number of missiles you want (ie. FFFF = 65535 missiles) - NOTE: The rules for missiles are the same as for bullets
# Change the number of men in your helicopter - offset 3F8A - 3F8B - change the two bytes to the number of men you want in your helicopter (ie. FFFF = 65535 men in your helicopter) - NOTE: The rules for men are the same as for bullets - NOTE: When you drop men your funds increase rapidly because you get funds for equipment as it is further out in the field
-
Arrange-It
v1.0.2
ARM9300533
-
ArtWORKS
v1.0
†This is a two step crack:
Step #1: To get bogus personalization info into the program, and have the program init itself, change:
CODE 148+$00DC From: 6728 To: 6028
+$0116 From: 6670 To: 4E71
+$011E From: 6D66 To: 4E71
+$018A From: 6714 To: 6014
+$07E2 From: 670A To: 4E71
Run the program and personalize it, then quit and:
STEP #2: To make it believe the personalization is valid and skip repersonalizing, change:
CODE 14+$09B2 From: 6400 0224 To: 6000 0224
+$0BDE From: 6E00 0094 To: 4E71 4E71
Now you should have a personalized artWORKS that works perfectly!
Note this may or may not remove the network copy protection, but I think it probably does.
-
Ascend
vAll
†Change code #80 offset 05f0 from 66 to 67.
and just enter a name in the licensed to
and leave the rest blank under registration.
-
Ashlar Vellum
vAll
01399
-
Astound
vAll
3006005109
3004400378
-
Atticus Vista
v1.0
126100023
-
Authorware Pro
v3.0
20030-0979-1236-56383
v2.2.0
3028-7078-3072
-
Autoboot
v1.1.1
† Crack for Autoboot 1.1.1:
------------------------
1) Open up the CDEV Resource
2) Open up ID -4064
3) Find Offset 075C
4) Change 672E to 4E71
5) Quit and save changes!
6) Open up the Control Panel and click Register.
7) Enter in whatever the phuck you want.
-
AutoCAD
v1.2
110-10638231
-
AutoMenus
vAll
†Search for: 4A00 6600 00B0
Change to: " " 6000 " "
This will allow unlimited boots past the demo period.
-
Axis Game Cheater
v1.0.1
GC100/30728/02381QI
-
AXS OnLine Reader
v1.0.3
TNJFDC
†The serial number generating algorithm is as follows:
DesiredNum=0;
for (i=0;i<6;i++) DesiredNum|=CharMapIndexValue(SNStr[i+1])*Mult[i];
Where:
DesiredNum=10007*k, for some k>0.
Mult[]={33554432,32768,32,1024,1,1048576} // note these are integral powers of 32
CharMap | 00000000001111111111222222222233
Index Val | 01234567890123456789012345678901
---------+---------------------------------
SNStr Char| thequickbrwnfxjmpsvazydg23456789
Example: if we let k=666 then Desired Num=6664662, now 6664662 = {0,6,11,12,14,22} in base 32 which is transformed into {0,11,14,12,22,6} by the mapping {a,b,c,d,e,f}->{a,c,e,d,f,b} thus the corresponding serial number is "TNJFDC"
-
BackBurner
vAll
03-1489-0280
03-1418-1779
03-1422-2788
03-1448-9871
03-1448-9429
03-1448-8313
03-1448-4655
03-1422-6446
03-1337-9988
03-1422-1672
03-1420-5036
03-1422-7905
03-1420-1721
03-1448-3196
03-1418-4321
03-1418-6995
03-1418-9194
03-1418-5437
03-1400-2150
03-1400-4725
03-1400-3266
03-1416-4027
03-1400-8482
03-1400-9598
03-1400-9941
03-1416-1828
03-1416-5585
03-1416-9243
† To fool BackBurner's personalization dialog into thinking any SN you enter is good, make the following changes to the BackBurner APP..
Search for: 4FEF 0022 6712 4EBA 005C
Change to: " " " " 6012 " " " "
-
Bar Code Pro II
v2.0.8
9074-545 TN293 45501
-
Bar Code Pro UPC
v1.0
230,780,677,334,210
†When Bar Code Pro first launches after installation it will ask for the number
of bar codes used in the US last year (from the manual on page).
-
Batch It!
v1.0
53060XXXXX ,where each X=Any Char
-
Binuscan
v1.0
SN#: 16849
Password 1: QRBs2LBUeY4
Password 2: vUEpAVINq8C
-
Black Night
v1.0
0000000D1FF113F
-
Blood Bath
v1.6
†sgtrock - invincible
badass - all weapsons
-
Body Works
v3.0
Q24474
-
Bola 32
vAll
†v1.1
Search: FFEC 0C40 000A 661A
Change: " " " " " " 4E71
Search: FFEE B0AE FFE0 6610
Change: " " " " " " 4E71
Search: FF16 B0AE FFF2 6606
Change: " " " " " " 4E71
-
Boris Filters
v1.0
8F002G-03B8M09-123DL
-
Bulk Mailer
vAll
†Search for: 675A 42A7 3F3C 01
Change to: 605A " " " " "
-
Butler
vAll
1560216811
-
C.A.T. IV
v1.0 (Evaluation Copy
SeRvIcEs
-
Cachet
vAll
CM0000045VPM
CM0000567VOM
-
CadMover
v3.4
†Here is a crack for the date check to eliminate the need
to re-insert the install disk.
Search for : 4EAD 137A 4EAD 136A 4A40
Change to : 4E71 4E71
-
CalcWorks
v1.4.x
0000000416 'Anonymous'
†To register: bring up the about box, then hold down the option key and click the 'Register…' button.
Note: This program used to be called ProCalc.
or
To prevent the registration notice to appear every 3 days do the following:
• Open the CalcWorks application with a resource editor (ResEdit, Resorcerer, etc.)
• Open the CODE resource ID number 2 ("Main")
• Go to offset $0011B2
• Change 4EBA 3F72 to 4E71 4E71
• Save the changes…
-
Calendar Maker
v4.1
2000000
v4.0
300870
300876
-
CameraMan
v2.0
CMSV0336
-
Canvas
v3.5.2
3001700735
3860817489
†To kill the ser# protection:
Search for: 6D00 FE94 0C6E
Change to: 600C " " " "
-
Carbon Copy Mac
vAll
100003660
100003661
† No Checksum, etc. on the number; the serial number is REAL EASY to find with ResEdit, etc. Just change it and save changes, and presto — a “New Copy.”
-
CatFinder
v1.5.5
shadow fax
109176985
235642596
235983691
258605775
453029002
687233582
750013862
857605513
921358721
-
CC Mail
v1.11 (Windows)
19342 030390
v4.0 (DOS)
19340 030380
v2.01 (Mac)
19344 030400
-
CD Copy
v1.0
C.012169
-
CD Directory
v1.0.2
0400-0200-1345-9154
-
CE Tiles
v1.0
100369
-
Chem3D Plus
vAll
60086
KYAKRP
†If you’re using MS Word 5 and System 7, place the "EGO for Word" plug-in module in the Word Commands folder that is found in the folder containing the Word 5.0 application.
Keep the ChemDraw folder in the same folder as the CSC ChemDraw application
-
ChemDraw Plus
v3.0
Serial Number: 40770
Registration Code: CQXWPQ
-
ChemOffice Pro
v3.5
SERIAL: 99999
Reg CODE: VWHFAJWO
(might be a zero at the end)
-
Chromassage
v1.0
CH1-1500349
-
Chuck Yeager's Air Combat
v1.0
†To prevent the copy protection dialog from appearing:
'CODE' #9
+44C4 4E56->4E75
-
CinePack Toolkit
v1.0
1\15:90.99014:2756968448A45421:N/0
1\15:90.99014:2558263296987C21:N/0
1\15:90.99014:1481572352584F21:N/0
-
Civilization
v1.1.2
v1.0.8
v1.0.7
vQ&A List
vCheats
†Bypass the question dialog box - CODE 9, offset 2D4E - change 4EBA 0014 to 4E71 4E71 - CODE 9, offset 2D56 - change 6608 to 6008
Give yourself extra cash - Your available funds are stored in Intel notation (LSB MSB) *around* address 120 in hex format. Note down your current funds, convert it to hex, then reverse the byte-pairs from $xxxx yyyy to $yyyy xxxx. - open the Civ game file with a disk editor and search for the string you have just created ($yyyy xxxx) - replace the found bytes with a new value in the same LSB MSB format - save your work Make buying an improvement give you $32,000 - CODE 14, offset 4E48 - change 6E00 B6FA to 363C 7D00 - CODE 14, offset 4E6E - change 9750 to 3083
Get $32,000 whenever you sell anything - CODE 14, offset5340 - change 700A C1D0 to 303C 7D00 - CODE 14, offset 5352 - change D150 to 3080
Buy anything produced in your city without losing any money - CODE 14, offset 4E00 - change 6E12 to 4E71 - CODE 14, offset 4E48 - change 6E00 B6FA to 4E71 4E71 - CODE 14, offset 4E6E - change 9750 to 4E71 - CODE 14, offset 62F6 - change 9150 to 4E71
Stop losing money at each turn due to low taxes - CODE 13, offset 18B8 - change 6E00 0088 to 4E71 4E71 - CODE 13, offset 18DA - change 9150 to 4E71
Patch the map display so you can see what's under the black - CODE 3, offset 3B28 - change 6712 to 4E71
Prevent Global Warming - CODE 7, offset 5544 - change 6624 to 6024
Prevent you losing any offensive battles - CODE 7, offset 03DA - change 672A to 602A - CODE 7, offset 040C - change 662C to 4E71 - CODE 7, offset 0456 - change 6C06 to 4E71 - CODE 7, offset 0590 - change 6E18 to 4E71
Prevent loss of troops & settlers from food shortages - side effect of this patch is that your cities don't grow - CODE 14, offset 37E8 - change 6600 0080 to 6000 04AE - CODE 14, offset 06FE - change 6600 to 6000
Allow all items to travel on water - CODE 11, offset 2118 - change 6600 to 6000
Allow boats to travel on land - CODE 11, offset 271E - change 664A to 604A
All technology takes one turn - side effect: affects enemy technology as well! - CODE 14, offset 602C - change 6C28 to 4E71 - CODE 14, offset 6046 - change 670E to 4E71
Airplanes can't run out of fuel - CODE 11, offset 3F74 - change 6C14 to 6014
Allow you to build cities on water - CODE 11, offset 1978 - change 6700 00DE to 6000 0096
Allow your troops to attack from water - CODE 11, offset 21FE - change 662A to 602A # If you don't want to try all these hacks, there's a program to do it for you, called "Civ Crack Editor" and available from all good Info-Mac archives & mirrors
••• Version: "1.0.8" •••
TO completely bypass the protection dialog.
CODE 9
+2D4E from $4EBA to $4E71
+2D50 from $0014 to $4E71
+2D56 from $6x08 to $6008
(I forget the actual value that x represents above, but it doesn't really matter.)
••• Version: "1.0.7" •••
EFFECT: Select any item in the password dialog box.
HOW TO: LOCATE CODE RESOURCE 9
CHANGE THE WORD AT OFFSET 31C6 FROM 6662 TO 4E71
CHANGE THE WORD AT OFFSET 2D58 FROM 4267 TO 4E71
CHANGE THE WORD AT OFFSET 2D5A FROM 4EBA TO 4E71
CHANGE THE WORD AT OFFSET 2D5C FROM 0008 TO 4E71
CHANGE THE WORD AT OFFSET 2D5E FROM 548F TO 4E71
if you don't want to see the dialog at all you can change all the words between (and including) offsets 1D0C and 1F1C to 4E71.
••• Version: "Q&A List" •••
The following list is all the questions you may be asked after playing for 1000 years after starting the program. They are very simple and you will be given an approximate page number. Every 5 or 6 items here I have given page numbers, so that should make the choice of what I am talking about fairly easy. If you answer wrong, you might as well quit. Wrong answers will tell you that you were wrong.
Picture of B2 Bomber Flight and Electricity
Scroll in Star Map Mysticism and Mathematics
Atom Theory of Gravity and Physics
Old Car Combustion and Steel
Piggy Bank Trade and the Republic
Bridge Construction and Iron Working
Black Pot on tripod(17) University and Medicine
Sword with Scarf Horseback riding & Feudalism
Statue of man with sword and scale Alphabet
Combustion engine Refining and Explosives
Soviet hammer cross Philosophy and Industrialization
IBM PC Computer Mathematics & Computers
Plain soldiers(35) Republic and Explosives
Hand holding hammer over inc. house Masonry and Currency
Coins and Dollars Bronze Working
Three hands over flag Philosophy and Literacy
Kite in lightning Metallurgy & Magnetism
Circuit board Enginerring and Electricity
Circuit design under ruler Wheel and Construction
Explosives Gunpowder and Chemistry
Castle on Hill Masonry and Monarchy
Man with Wings Combustion and Physics
Two Atoms splitting Nuclear Power and Superconductor
Molecular Splicing(47) Medicine and the Corporation
Old gun with Gunpowder Bag Invention and Iron Working
Factory emitting Smoke Railroad and Banking
Old Phonograph Engineering and Literacy
Shield and Spears Bronze Working
Shaking Hands with Shovel and Axe Mass Production and Communism
Open book with 3 closed in back Writing and Code of Laws
Magnet(64) Navigation and Physics
Map Alphabet
3 Cars Automobile and the Corporation
Abacus adding machine Alphabet and masonry
Red Cross with Snaking lines Philosophy and Trade
Smelting Ore cup pouring(78) Gunpowder and University
Crown Ceremonial Burial and Code of Laws
Suppliant Meditating Ceremonial Burial
Ship Wheel Map Making
Nuclear Explosion Atomic Theory & Mass Production
Nuclear Sign Electronics and Nuclear Fission
Pensive Sitting Statue(86) Mysticism and Literacy
Wheel Scale with two arrows Mathematics and Navigation
Plastic Engine Refining and Space Flight
Train(92) Steam Engine and Bridge Building
Recycle Sign Mass Production and Democracy
Robotic Implements(112) Plastics and Computers
Rocket Advanced Flight and Electronics
View of Earth Computers and Rocketry
Steam Engine Physics and Invention
Pouring Steel Metallurgy and Industrialization
Two Meters Plugged into Wall Plastics and Mass Production
4 Men in front of Graph(118) Banking and Industrialization
Eagle on Globe Code of Laws and Literacy
Balls falling with arrows on sides Astronomy and University
Hands Exchanging coins(122) Currency and Code of Laws
Scholar's Cap Mathematics and Philosophy
Writing Quill(124) Alphabet
••• Version: "Cheats" •••
I couldn’t find the location of the $ in the game before, so finally I
said to hell with it, I’ll just find somewhere where it accesses it and hack
there. (It seems to only decipher the $ when it needs to and the encrypt/hide it as I had searched the entire range of program memory for it at various interupt points.) ... Anyways to make buying a unit/improvementt give you $32,000 (!!!) just do this:
Civilization CODE #14
+4E48 6E00B6FA->363C7D00
+4E6E 9750->3083
To make it give you $32000 whenever you sell anything (unecessary if you do
the first one, but the first one may be to much of a cheat for some people)
+5340 700AC1D0->303C7D00
+5352 D150->3080
of course these ruin the game, but hey so what you now know that you can
dominate the game and thus do not have to waste the rest of '93 playing it.
Nemo’s cheat for Civilization! Sure the challenge of Civilization is the entertaining part of the game, but there's something to be said about nuking the shit out of the other guys. So, here's a cheat so that you can buy anything that’s being produced in your city without losing any money. Also it stops you from losing any money each turn by low taxes or whatever:
Change CODE 14 This patches the buying
Offset:$4E00 From: $6E12 To: $4E71
Offset:$4E48 From: $6E00 B6FA To: $4E71 4E71
Offset:$4E6E From: $9750 To: $4E71
Offset:$62F6 From: $9150 To: $4E71
Change CODE 13 This patches losing money each turn
Offset:$18B8 From: $6E00 0088 To: $4E71 4E71
Offset:$18DA From: $9150 To: $4E71
Nemo’s cheats for Civilization!
AKA - ‘Civilization Championship Edition’
Fifth Revision
Sure the challenge of Civilization is the entertaining part of the game, but there’s something to be said about nuking the shit out of the other guys. So, here’s a bunch of cheats that I made for ‘stress relief.’
i) Allows you to buy anything for your city without losing any money
ii) Stops you from losing any money each turn, for low taxes, or whatever.
iii) Allows you to see what’s under the black (where you haven’t been) on the map.
Unfortunately, you can't see other cities unless you’ve been there.
iv) Prevents Global Warming
v) Prevents you from losing any offensive battles.
Doesn't work for other people attacking you.
vi) Prevents losing troops and settlers from food shortages
Side effect - your cities don't grow.
vii) All items can walk on water!
viii) All boats can swim on land!
You can attack cities, but you can't take them over (yet).
ix) SuperTechnology - all technology takes one turn.
Enemy technology also takes one turn.
x) Airplanes can't run out of fuel.
xi) Build cities on water
xii) Troops can attack from boats or the water without landing
Change CODE 14 This patches the buying
Offset: $4E00
From: $6E12
To: $4E71
Offset: $4E48
From: $6E00 B6FA
To: $4E71 4E71
Offset: $4E6E
From: $9750
To: $4E71
Offset: $62F6
From: $9150
To: $4E71
Offset: $6316
From: $5350
To: $4E71
Offset: $6330
From: $5350
To: $4E71
Offset: $6354
From: $5350
To: $4E71
Change CODE 13 This patches losing money each turn
Offset: $18B8
From: $6E00 0088
To: $4E71 4E71
Offset: $18DA
From: $9150
To: $4E71
Change CODE 3 This patches the map
Offset: $3B28
From: $6712
To: $4E71
Change CODE 7 This patches the global warming
Offset: $5544
From: $6624
To: $6024
Change CODE 7 This patches the battles
Offset: $3DA
From: $672A
To: $602A
Offset: $40C
From: $662C
To: $4E71
Offset: $456
From: $6C06
To: $4E71
Offset: $590
From: $6E18
To: $4E71
Change CODE 14 This patches the food shortages
Offset: $37E8
From: $6600 0080
To: $6000 04AE
Offset: $6FE
From: $6600
To: $6000
Change CODE 11 This patches walking on water
Offset: $2118
From: $6600
To: $6000
Change CODE 11 This patches boats on land
Offset: $271E
From: $664A
To: $604A
Change CODE 14 This patches the SuperTechnology
Offset: $602C
From: $6C28
To: $4E71
Offset: $6046
From: $670E
To: $4E71
Change CODE 11 This patches the airplane fuel.
Offset: $3F74
From: $6C14
To: $6014
Change CODE 11 This allows you to build cities on water.
Offset: $1978
From: $6700 00DE
To: $6000 0096
Change CODE 11 This allows troops to attack from water.
Offset: $21FE
From: $662A
To: $602A
The two most useful cheats I know are:
1: Save the game before the last piece moves, then quit and start your saved
game. All your pieces will be able to move again.
2: Engineers can accomplish any one task in one turn if after you assign them
a task, you repeatedly click on them, wake them up, and reassign the task.
-
Claris Emailer
v1.0
f804977886.3295
-
Claris Impact
v1.0.x
0003116155
0003119496
-
Claris Organizer
v1.0v2
Enter any number with 6 or more digits
-
Claris Works
vAll
1120000
-
Clipfolio
v1.2
1231120413450001
-
ClockWerx
vAll
†Complete documentation to play ClockWerx can be found in its help file which can be accessed by depressing both the control key and the "H" key together.
The first time you run ClockWerx, the computer will ask you a question before you can continue. Once you have answered the question correctly, you will only be asked again if you reinstall ClockWerx. The questions and their associated answers are:
1. What is the name of the wooden board to which the movement of a longcase clock is attached? ANSWER - Seat Board
2. What is a mechanism used to minimize escapement error as a mainspring unwinds? ANSWER - Fusee
3. What was the first form of clock controller used in verge-escapement clocks? ANSWER - Foliot
4. What is the name of the mechanism that electrically maintains a pendulum in oscillation? ANSWER - Hipp-toggle
5. What steel alloy used for pendulum rods has a near-zero coefficient of expansion? Answer - Invar
6. What is the name of a form of pendulum in which the rod is a diamond-shaped frame? ANSWER - Rhomboid
7. What is the name of the knurled nut supporting the pendulum bob? ANSWER - Rating nut
8. What is the name of the device that is used to equalize the force of the mainspring over its period of run? ANSWER - Stackfreed
9. What is another name for a watch capable of sounding out the time at will? ANSWER - Repeating work
10. What is the name of the cylindrical brass box containing the mainspring of a clock? ANSWER - Barrel
11. What is the name of the cam that is used to determine the number of blows struck in a rack-striking work at the hour? ANSWER - Snail
12. What is the name of the arm acting as a click for the rack in rack-striking clocks? ANSWER - Rack hook
13. What is the name of the nib at the end of the anchor or lever arms acted upon by the escapement wheel? ANSWER - Pallet
14. What is the name of the depression surrounding a pivot hole? ANSWER - Oil sink
15. What is the name of the teeth on a smaller driven members in clock gear trains? ANSWER - Pinion leaves
16. What is the name of the type of wheel found in platform-escapement carriage clocks which drives the escape pinion? ANSWER - Contrate
17. What is the sound of a clock striking the quarters on two differently pitched bells or gongs? ANSWER - Ting-tang
18. What is the name of the bearing in which a pivot runs? ANSWER - Pivot hole
19. What is the name of the train of wheels in a clock that provides a 12 to 1 reduction between the minute and hour hands? ANSWER - Motion work
20. What is the name of the cam in an equation clock used for indicating solar time? ANSWER - Kidney piece
-
Coach & Coach Pro
vAll
1000001
1234567
(1st+6th digit=7th)
-
Collage
vAll
06-1405-6209
-
Color Access
v1.4.5
SN# 25194
REG# 24F631715384202F
-
Color Studio
vAll
CS27968
CS11305
-
ColorIt
v2.0
CI20A-xxxxx
(Notice that it is
CI and not C1)
^-L one-^
-
Comet/CG
v2.3
0022001175
-
Communicate Lite
v1.0.1
802864192400
-
Compactor Pro
vAll
16225913
†v1.33
To register Compact Pro 1.33 and enable encryption, change:
CODE 4+$2EA4 From: 67 To: 60
When it asks you for the registration code, type any 8 characters. If you want to reregister your copy (to change the name), change any number of bytes in the CLOC resource (don’t change the size).
If you have a copy of Compact Pro 1.33 that won't enable encryption (if there’s an ‘*’ after your name in the about dialogbox and no ‘Set password…’ item in the Misc menu), make sure CODE 4+$2F44 is $66 (not $60) and reregister.)
Version 1.34
1) Open up the application with ResEdit
2) Open up the CODE resource
3) Open up CODE ID 3
4) Search for Offset 4856
5) Change 6718 to 6018
6) Quit ResEdit and save all changes
7) Open up Compactor Pro
8) Click Register
9) Type in a name and any serial number you wish
0) Now hit the return key!
Compact Pro 1.34 Krak
CODE 3
+47B8
6600 009E->4E71 4E71
+4856
6718 ->6018
or
For Version 1.34
Actually, here's a slightly better version of the crack. This one leaves the
registration intact:
Go to offset 47A8 in Code 3
Find 0C2E 001F
Change to 6000 00C6
======================
Compact Pro 1.3.4
CODE 0003 offset 47AE
Locate 6200 00A8
Change to 6000 00C0
Any registration code will now work.
======================
-
Conflict Catcher
v3.0.x
CC3-001-849-809
-
CopyPaste
v2.3.1
†'INIT' #0
+004A 7200->7201
-
Crash Barrier
v2.0
1982487924
-
Creative Partner
v1.0
2AE90-5270-6B95A
2B044-D29F-25567
-
Crystal Caliburn
vAll
†CRYSTAL CALIBURN 1.0.2
EFFECT: Gets rid of the 'Your data file as been installed improperly dialog box.
HOW TO:
LOCATE CODE RESOURCE 2
CHANGE THE WORD AT 3510 FROM 6710 TO 6010
a hack that lets you play crystal calibourn on a 12" screen
(by doing this you can see most of your flippers instead of none.)
use resourcerer and open the 13" WIND template change to:
top 0 bottom 612 left 0 right 512.
it's not perfect but it is playable this way - it also lets you see the left
part of the game.
# Give yourself any number of balls per game - open the 'DIPs' resource with ResEdit - change the two word-values as follows: - $251F $0003 for 3 balls - $2CCD $0005 for 5 balls - $2CAE $0007 for 7 balls - $2CCD $000A for 10 balls - $2CDC $0014 for 20 balls - $2900 $0063 for 99 balls
-
Crystal TOPAS
v1.5
RB20-0110-0730
-
CyberSound FX
v1.0
†How to crack CyberSound™ FX 1.0 (fat)
Open a filter with ResEdit and search "AFlt" resource for hex "4A0066" and replace the PREVIOUS 4 bytes with "103C0001".
(This will crack the 68k stuff)
Next, open "AFlT" resource and search for hex "B06100384800002C" and replace the NEXT 4 bytes with "38600001".
(This will crack the PPC stuff)
This must be done to ALL filters in the set except the "Normalize" one.
* If you're not concerned with the added speed of native code, you may also delete the "AFlT" resource and still run it on a PPC (only in 68k emulation mode though).
-
Dabbler
v2.0
DM200NAZ0006148-FKWW-001
v1.0
0013058-6239
-
Daisy Quest
v1.0
DQ 1255
-
Dark Forces
v1.1.1
†Dark Forces Mac<-->PC Data File Exchange
The way to change PC "*.GOB"
files into something that Mac Dark Forces likes is to:
Infinite energy - CODE 4, offset 270A - change 660C to 600C
-
Delta Graph Pro
v3.5.x
MUU35-0827-3837184026
v3.0
DGM3000900
-
Descent
v1.0
†Krak:
1- Open Descent with ResEdit.
2- Open the STR resource -- there is only one.
3- Change "Descent:Install Descent" to ":Install Descent"
4- Use SetItsType to change ANY file (text file if you want) to
APPL/STi0 <-- that's a zero, zip, zilch, nil from whatever is was, not an "oh". Make sure this file is IN the Descent folder IN the same directory as the Application.
5- Call your dummy file "Install Descent"
That's it! You can kill the imagemaster file now, I believe. Keep the archive around for fun's sake, if you want.
-
Desktop Tools
vAlias
Please see the entry Aladdin Desktop Tools
-
DiagnoSYS
v1.0
B102131444366
-
Digital Box Office
vAll
DR1DBO0812071NS-A
-
DigiTrax
v1.2
ALS4312536
-
Dilbert Screen Saver
vAll
5180-6344-1654
-
Dimensions
v2.0
DAW100R3100720-191
DAW200U3200000-109
DAW200U3200001-742
DAW200U3200002-375
DAW200U3200003-292
DAW200U3200004-641
DAW200U3200005-274
DAW200U3200006-907
DAW200U3200007-540
DAW200U3200008-173
DAW200U3200009-806
DAW200U3200010-708
DAW200U3200011-341
DAW200U3200012-974
DAW200U3200013-607
DAW200U3200014-240
DAW200U3200015-873
DAW200U3200016-506
DAW200U3200017-139
DAW200U3200018-772
DAW200U3200019-405
DAW200U3200020-307
DAW200U3200021-940
DAW200U3200022-573
DAW200U3200023-206
DAW200U3200024-839
DAW200U3200025-472
DAW200U3200026-105
DAW200U3200027-738
DAW200U3200028-371
DAW200U3200029-288
DAW200U3200030-906
DAW200U3200031-539
DAW200U3200032-172
DAW200U3200033-805
DAW200U3200034-438
DAW200U3200035-355
DAW200U3200036-704
DAW200U3200037-337
DAW200U3200038-970
DAW200U3200039-603
DAW200U3200040-505
DAW200U3200041-138
DAW200U3200042-771
DAW200U3200043-404
DAW200U3200044-321
DAW200U3200045-670
DAW200U3200046-303
DAW200U3200047-936
DAW200U3200048-569
DAW200U3200049-202
DAW200U3200050-104
DAW200U3200051-737
DAW200U3200052-370
DAW200U3200053-287
DAW200U3200054-636
DAW200U3200055-269
DAW200U3200056-902
DAW200U3200057-535
DAW200U3200058-168
DAW200U3200059-801
DAW200U3200060-703
DAW200U3200061-336
DAW200U3200062-969
DAW200U3200063-602
DAW200U3200064-235
DAW200U3200065-868
DAW200U3200066-501
DAW200U3200067-134
DAW200U3200068-767
DAW200U3200069-400
DAW200U3200070-302
DAW200U3200071-935
DAW200U3200072-568
DAW200U3200073-201
DAW200U3200074-834
-
Director
v4.0+++
See MacroMind Director
-
Disk Cafe
vAll
DC000444B52
DC000796A32
-
Disk Express II
vAll
JV103761
JE103744
JI103774
JV103735
JX103737
JX103763
JY103738
JZ103739
-
DiskDup
v2.6a
3 Spaces to Register, as before
v2.x Commercial
00310456
†v2.3 & older
All you need is when at the “number of Copies” dialog field - just arrow key to the right of the number “1” and type 3 (three) blank spaces. This should register the application.
-
DiskTools Collection
v3.3
DTC-0330-663775888
†DTC-0330 = version number, by changing the version number when new versions come out
we can likely make this serial number work right up to 4.0
†If this expires you can get around it by changing:
CODE 24+$09D6 To: 4E71
+$09D7 To: 4E71
-
Foxbase
vAll
Serial #:FMD027877
Activate:emzxpyei
-
Fracas
v1.0.1
68530 'Anonymous'
23562 'Doom'
57288 'Cerberus'
-
FrameMaker
v5.0
00-0-01-01-5-897D6-??????
00-0-01-01-5-89B59-??????
†Whoever posted the version 5 serial numbers left out the final group of characters/digits.
-
FreeHand
v5.5
10255-0397-4374-13083
v5.0
10250-0397-4374-13083
†Use a Freehand 5.0 serial number and add a 5 just before the first dash
e.g. xxx55-xxxx-xxxx-xxxxx
••• Version: "5.0" •••
To change or modify the name or serial number of a personalized copy of
Freehand 4 open it with Resedit and open the aldp resource.
Aldus employs this serialization scheme (xx-xxxx-xxxxxxxxx).
Any number from any Aldus product using this scheme will work.
-
French Assistant
v1.0
M2100906
-
FWB CD ROM Toolkit
v1.5.5
C38292117
v1.1
C38292117
†••• Version: "1.1" •••
FWB CD 1.0.5
The personalization information is stored in the resource 'Font' ID -4048, which must always have a size of 148. The first byte is the
length of the name, and the name is encrypted by XORing the bytes by $93.
The byte at offset $40 is the length of the organization and, the
subsequent bytes are the organization itself, encrypted by XORing the
bytes by $7C. The byte at offset $80 is the length of the Serial Number,
and the subsequent bytes are the serial number itself, encrypted by XORing the
bytes by $E9.
The crack so that the serial number always looks good is: Open it up in
ResEdit Open up the resource 'cdev' ID -4064 Change it at offset: $56DA
From: $59FF To: $5A00
FWB CD ROM Toolkit 1.0.3
The serial number for 1.0/1.0.1 doesn’t work in 1.0.3. Here’s how to crack it (or you can just use the 1.0.3 Serial Number):
The personalization information is stored in the resource 'Font' ID - 4048, which must always have a size of 148.
The first byte is the length of the name, and the name is encrypted by XORing the bytes by $93.
The byte at offset $40 is the length of the organization and, the subsequent bytes are the organization itself, encrypted by XORing the bytes by $7C.
The byte at offset $80 is the length of the Serial Number, and the subsequent bytes are the serial number itself, encrypted by XORing the bytes by $E9.
The crack so that the serial number always looks good is:
cdev -4064+$56DA From: 59FF To: 5A00
Now any serial number in the correct format except C34012798 will work!
The personalization information is stored in the resource 'Font' ID -4048,
which must always have a size of 148. The first byte is the length of the
name, and the name is encrypted by XORing the bytes by $93. The byte at offset $40 is the length of the organization and the subsequent bytes are the organization itself, encrypted by XORing the bytes at $7C. The byte at offset $80 is the length of the serial number and the subsequent bytes are the serial number itself, encrypted by XORing the bytes by $E9.
The crack so the serial number will always look good is:
Open it up in ResEdit
Open the resource 'CDEV' ID -4064
Change offset $56DA from $59FF to $5A00
-
FWB HD Toolkit
v1.8
00000B1Q
UA010466C3C
19064C71
21197c7i
53361C1E
v1.7.5
JA130420B3I
336363C5K
v1.6PE
JA072921C5K
†••• Version: "1.7.5" •••
HDT PRIMER
Search for: 6714 2F3C 0000 121F
Change to: 6014 " " " " " "
0r
HDT PRIMER Version 1.2.1
CODE 2+$1B82 From: 6714 To: 6014
HDT WORLD CONTROL
Search for: 6712 486D E46C 2F3C
Change to: 6012 " " " " " "
Or
HDT WORLD CONTROL Version 1.2.1
CODE 2+$107C From: 6720 To: 6020
+$134C From: ???? To: 6012
^^^^--(might be 6712?)
-
FWB RAID Toolkit
v1.8
00000B1Q
-
FWB SCSI JackHammer
v3.2
UA010466C3C
-
Gallery Effects
v1.5.1
56-1000-202888264
†This is how you krack Gallery Effects 1.5.1
The serial number is stored in an invisible file called "Somefile" which is created in the same folder as the Aldus Gallery Effects application on your Hard Disk. Open this file, with ResEdit and edit the PLoc resource as a string... enter your very own serial number!
You may need to copy the image of the first disk to 3.5" floppy to satisfy the installer's lame system calls.
-
Generic Cad
v2.0b
72205-4725
-
German Assistant
v1.0
M4100441
M4102046
-
GIF Converter
v2.2 (& up)
162-37-77-f4-de-a8-8b-b2
862-37-77-f4-de-a8-8b-b2
-
Gold Digger
v1.0
3024849 'Doom''
5854738 'Tad Woods'
6269400 'Anonymous'
-
Gopher Golf
v2.0
Name: Anonymous
Serial Number: MP-7757
-
GraceLAN
v2.0
014125527017
-
GraceLAN Update Manager
v1.1
794800000437
-
Gradient Designer
vAll
†Try "KPT273" to unlock the expert mode
-
GraphicConverter
v2.x.x
G13375221 ANONYMOUS
G69466831 Anonymous
G99222619 Doom
-
Graphsoft Blueprint
v5.0.2
2500-26951884
-
Great Plains Accounting
vAll
User:MANAGER
PW:ACCESS
-
Guaranteed Undelete
v2.0
211204515
211252619
-
Hearts Deluxe
v4.x
†With Hearts 4.1, I found that if I held down
the spacebar after I started a game I could
then enter the password... X1181
-
Helix Express
v3.0
FULL Mode:
SN#31327
Key#BZAG-9QXX-QFWL-CQX1-YAT7-5QL0-ST
SERVER (2 CLIENTS):
SN#31328
Key#BZ42-395F-T8R4-RSYH-CA84-H9BD-YT
-
Help
v2.0
5840344
6949477
-
Hitchcock
v1.0
NPW-2TYG-L92
-
HoloGate
v1.1.6b2
Z8ZV3HZBVY3CL4
Z8ZVCGHBVY3PXE
-
Hybrid
v1.2
HYB2-120-0-553B2B16
-
HyperCard
vAll
†HyperCard 2.1
Remove password protection from HC stacks!
Just the IDEA that some bozo put in a password... ARGH! I have a problem with that. In your HyperCard 2.1 file:
Search for: 6704 6000 02A2 42A7 3F3C 008C 42A7
Change to: 60 " " " " " " " " " " " " "
for HC to accept any password you give it, and let you into the protection dialog (remember, to get pswd. dialog in a protected stack, hold CMD while choosing Protection from File menu).
You can still assign pswds to stacks you make, and the pswd protection will still work on other people’s HCs, unless they have also applied this Kpatch.
==========
2.0 Light (the copy that [used to] come with your mac)
To gain user level five do the following:
In the first card of the HomeStack: Hit [Command] + M
Type:go cd "User Preferences" [enter]
magic [enter]
Select Level Five (Scripting)
(They hid half the user levels with an opaque button over UserLevel 3,4,5)
NOTE: This does not work with Hypercard Player, which doesn’t allow Userlevels 3, 4, or 5 at ALL. Boo...
-
HyperStudio
v3.0.4
MAA001AZT126147
-
Igor
v1.2.8
7506
-
Image Express
vAll
†Search for: 3B5F F33A 4A6D F33A 6622
Change to: " " " " " " " " 4E71
Search for: 4EAD 0B62 4EAD 166A 4EAD 16DA
Change to: 4E71 4E71 4E71 4E71 4E71 4E71
Search for: 4EAD 257A A9F4 4E5E 4E75
Change to: " " " " 4E71 " " " "
Projector:
Search for: 4A6D FDCE 664C 4EAD 056A
Change to: " " " " 4E71
Transporter:
Search for: 3B5F FBB8 4A6D FBB8 6600 01E6
Change to: " " " " " " " " 4E71 4E71
Search for: 57C0 4A00 6700 010E
Change to: " " " " 4E71 4E71
-
ImageAXS
v1.1
RC23V7
-
In Control
v3.5 for Workgroups
3500-9800000-1
v3.0
3000-0001343-8
-
Indiana Jones and the Fate of Atlantis
v1.1
†# The protection dialog will never show up - CODE 4, offset 138E - change 0240 000F 2870 to 4EBA 0230 6008
# There is a major bug in the program; on the Team Path, when you land the balloon on the "X" in the desert, the game hangs. A patch for this bug is available via anonymous ftp at umich in: ftp://mac.archive.umich.edu/misc/update/indy.foa.patch.cpt.hqx ... and at sumex in: ftp://sumex-aim.stanford.edu/info-mac/games/com/indy-foa-updt.hqx
-
Infini-D
v3.0
01-5029-7811
v2.6
01-1400-6350
†••• Version: "2.6" •••
v1.02
Hex Changes:
Search for: 4EBA 0796
(You should find this 2 times, at Sectors 392 & 3FE)
Talk about reusable code, these guys reused half the friggin program or more, including, hilariously enough the same copy protection routines down to the byte (ie they were compiled from the same source with the same version of the compiler) the only difference was at link time apparently. Thus these code changes are for CODE #72 for Informed Manager, and CODE #79 for Informed Designer 1.3.3
To simply run the program without personalization (from unpersonalized copy obviously) change
+D72 6600->6000 (believe it's personalized)
OR:
if you want it personalized then follow these steps:
1: change +F18 6642->6042 (allow anything for serial # when personalizing)
2: run the program and personalize (use anything you want for a serial #), Quit (duh).
†any sequence of 5 keys will be accepted by the ATM and you will get your boarding pass - CODE 20, offset 2D7C - change 3B40 to 426D
-
Less Talk
v1.0
801038
-
LetterPerfect
v2.1.2
F2USMLP21D
-
Live Picture
v2.0
HN001-01-90001
HN001-01-91437
†6-8 digits long, ending with a 4
or
This is what was in the "2.0 key fix" file.
To get rid of the hardware lock, make the following change:
CODE ID=1, Offset +6600, change 2711 to 2716.
-
Logo Correcter
v2.1
210342-5733
-
Loony Labyrinth
v1.0.x
9269LLM106162-U1
-
LXR Test
v5.1
1000B
v5.0.10
1500B
-
Mac320
vAll
SB23-0015-0057-1800
-
MacDos
v1.0.1
0000036568
4294930727
†The SN# must be 10 digits long and satisfy LoWord(SN#)=HiWord(SN#) xor 8ED8
***
Thus if we let HiWord(SN#)=$0000, Then LoWord(SN#)=0000 xor 8ED8 =$8ED8, so SN#=$00008ED8 =#0000036568
-
MacEKG
v2.0.7
12345Z9L2416
-
Macintercomm
v1.1.1 Lite
†CODE #2 +0B7E 4EAD 1382->4E71 C080
-
MacKennel
v2.1
MK20084
-
MacLabelPro
v1.6.3
5117081730
-
MacLink
v8.0.4
00823013-6398
-
MacMod Pro
v3.2.2
013953150 'Ian Mouton'
070185726 'ANONYMOUS'
133209756 'Anonymous'
700182795 <Any Name>
v3.0.1
†••• Version: "3.0.1" •••
SN#=ID+(ID/7)^2 - 724
-
MacroMedia 3D
v1.2
T120-12345-CP4U
-
MacroMind 3D
vAll
T100-12407-CPU4
D300-31239-CP4U
-
MacroMind Accelerator
vAll
A300-12935-CP4U
A300-31239-CP4U
-
MacroMind Director
v4.0.3
DM403-1799-3074-2073
DM403-3702-6075-3064
DM403-3745-9071-4064
DM403-5713-8178-0037
DM403-5716-8070-7081
DM403-5716-8070-7081
DM403-9762-3971-1056
v4.0
DM400-1799-3074-2073
DM400-3702-6075-3064
DM400-3745-9071-4064
DM400-5713-8178-0037
DM400-5716-8070-7081
DM400-9762-3971-1056
†••• Version: "4.0" •••
The installer for Director 4.0 requires that the installer file be named 'Director 4.0' and the other files are: Director 4.0.2, Director 4.0.3, etc to Director 4.0.10 - this will then install from any disks or hard drive.
EFFECT: This change allows the setup code to run and will present the (randomly occurring) question dialog. Hit the "OK" button to continue with the game, the password is now ignored.
HOW TO: Locate CODE resource #3
Change WORD at offset 5F00 from 660A -> 6054
To change dialog box:
Locate DLOG resource #1015
Open Item #1 -> Change name from "OK" -> "Ignore Question" Change Top -> 140 Bottom -> 164
Change Left -> 16 Right -> 133 - MACSKI V1.0.1
EFFECT:The program will never ask you the question. HOW TO: Locate CODE 3, Find offset $5E76
Change the word $661C to $600C
-
MacTEX
vAll
00229.002
-
Maelstrom
vAll
†1.02
I was plugging along through the Maelstrom code when I came upon a way to have the bonus timer count forward instead of backwards.
Search for: 700A 91AD FCB2 4AAD
Change to: 700A D1AD " " " "
This changes the SUB.L D0,-$034E(A5) to ADD.L D0,-$034E(A5)
or try,
1. Invincibility. When you should die because of a collision or a hit,
it says "Sweet!" instead and you live. Shields are no longer needed.
CODE Resource #2:
Location 06DE:
Old Data: 66 New Data: 60
Location 0752:
Old Data: 66 New Data: 60
Location 0B14:
Old Data: 67 1E New Data: 4E 71
Location 0B22:
Old Data: 66 10 New Data: 4E 71
2. Initial goodies (3x fire power, long shots, rapid fire, retro brakes).
Luck and shields are no longer important when you’re invincible, so
they’re not fooled with.
CODE Resource #3:
Location 0ECA:
Old Data: 42 6D FC EA 42 6D FC EC
New Data: 2B 7C 00 01 00 01 FC EA
Location 0ED6:
Old Data: 42 6D FC F0 42 6D FC F2
New Data: 2B 7C 00 01 00 01 FC F0
3. Initial bonus points in a new wave. Set it to whatever you want.
CODE Resource #3:
Location 1284: Old Data: 00 00 07 D0
or try,
Run Maelstrom, start a game, and then drop into MacsBug. type the
following commands:
sm (a5)-30e 1
sm (a5)-30c 1
sm (a5)-30a 1
sm (a5)-308 1
sm (a5)-306 1
then type:
g
When you return to the game, you’ll find you have quite a few goodies. You can selectively cheat by only executing a subset of those "sm" commands.
==========
v1.03
To eliminate the small rocks COMPLETELY, change CODE #2
+CB0 From 4EBA 21DE to 4E71 4E71
+C98 From 3F3C 0003 to 3F3C 0000
or
The Official Maelstrom 1.03 Cheat Guide
Here is a list of points.
Small asteroid -> 300 points
Medium asteroid -> 100 points
Big asteroid -> 50 points
Vortex -> 500 points
Autonominous mine -> 700 points
Super nova -> 1000 points
Hitting a steel asteroid -> 100 points
Blowing up a steel asteroid -> 5000 points
Big Enemy -> 1000 points
Little enemy -> 2000 points
Picking up a stranded pilot gives you and extra life.
Here is a list of cheats for Maelstrom 1.03:
The Official Maelstrom 1.03 Cheat Guide
To start playing on any level you like, hit the 'L' key while you are at the main screen. A dialog box will come up that lets you choose what level to start on. The 'Turbofunk' option makes the game run as fast as it can, instead of the constant 30fps it normally uses.
Here are some neat little cheats that make Maelstrom interesting. You’ll need Maelstrom 1.03 for all of these cheats, DO NOT try them with an earlier version (you might crash your machine).
You'll also need MacsBug; it is widely available on AOL and other information services. To install it, just drag 'MacsBug' and 'Debugger Prefs' into your System Folder and reboot.
Once you've installed MacsBug, load up Maelstrom 1.03 and hit 'P' to start playing the game. When you want to use a cheat, hit the interrupt switch on your Macintosh to drop it into MacsBug; take care to hit the right switch: one reboots the machine, the other will drop you into MacsBug. On Machines like the ][si (which doesn't have an interrupt switch), hold down the Command key and hit the Power On key to drop you into MacsBug.
Now for the cheats:
Type: SW (A5)-$338 1 <return> for ACME XQJ-37 Retro Thrusters
Type: SW (A5)-$336 1 <return> for Machine Guns
Type: SW (A5)-$334 1 <return> for Luck
Type: SW (A5)-$332 1 <return> for Long Shots
Type: SW (A5)-$330 1 <return> for Triple Shots
Type: SW (A5)-$384 #X <return> where X is the number of lives you want
Type: SW (A5)-$32C #300 <return> for Maximum sheilds
After you’ve finished cheating, Type: G <return> to continue playing.
I was plugging along through the Maelstrom code when I came upon a way to have the bonus timer count forward instead of backwards.
Search for: 700A 91AD FCB2 4AAD
Change to: 700A D1AD " " " "
This changes the SUB.L D0,-$034E(A5) to ADD.L D0,-$034E(A5)
Here's a little tip I came across that seems to be an "undocumented feature"
in Maelstrom 1.30 that will allow you to get huge scores that are eligible for the contest ($300 cash prize, I think?) Note that this will only work on
v1.30, not 1.3.1 or 1.3.2.
1) Launch Maelstrom 1.30.
2) Press "L" to display the TurboMode dialog.
3) Set the beginning level to 40 and number of ships to 40.
4) Check the "TurboMode" box. TurboMode is required for the feature to surface.
5) Play the TurboMode game! Try to stay alive as long as possible as this
determines how long you'll enjoy higher bonus scores.
6) When the TurboMode games ends, play the normal, contest mode of Maelstrom.
Notice that the timer does not count down!
What Happens:
Due to a bug in the Maelstrom 1.30 code, (Thanks Andrew!) playing a Turbo game before a normal game DISABLES the bonus point countdown. As a side-effect, the CAPS LOCK Pause feature is also disabled. Since the clock does not decrement, you will always receive at least 2000 points at the end of each round. All comets and multipliers add to the score as normal. Since you are no longer hindered by the timer, you can take the opportunity to plug away at those metal asteroids (100 points each time you hit one) and explore the sector (assmall as it is).
NOTE: The counter will eventually reset itself. I've found that the longer you survive in the TurboMode game, the longer the timer will be disabled. Roughly, the ratio is 1:8 (1 minute in Turbo game = 8 minutes of timerless normal play).
-
Maple V
v3.0
MAC-5303-951412-1
-
Marathon
v2.0
S11NUC7TJJ98M7F4
69T855MYZ59V1Y4Y
DQ2GMY456KTA9EA2_-_Net
v1.x
429715FNNZBCZEYX (net)
4EMUDZ528RDKGC1Y (net)
F8S6Q5KVEDCES4YD (net)
X61SGC4ANZB7881X (net)
8M2K4VGB7PALXX28 (full)
GVFHNPJ1S3NS4V2E (full)
MSK9TJSCVNVYKGEN (full)
RTQJKYJ1M6PKLXBR (full)
46D3FZCV6Z7NN889
8JC8CY7M7ZNLQDZV
EMNRMPVCMPLDDXX6
GDSA4325FSF53AQQ
GG6L2JMD7PAVPYE8
GTACPPMCGPP6KXC2
PES3S5CFZPBPTC3Q
RJNLNV7GM1A9LDRE
ZVKRKJVMJZAZQVRT
-
MarkzTools II+
v3.5
5068033
-
Master Juggler
vAll
G00161
G09123
G00000
G04294
GU013228
-
Mathematica
v2.2
2804-76464-85066-4534
-
MathType
v3.1
1-505
1-1405
666-452
666-5729
00000666-00005729
†Four conditions must be met:
1) 4≤ Length(NameStr) ≤60
2) 0≤ Length(OrganizationStr) ≤60
3) 4≤ Length(OrganizationStr) ≤30
4) SN#='<num1>-<num2>'
where num1 and num2 are whole numbers that can be stored in a LONG, such that:
num2=(num0% 899)+ 101 , or
num2=(num0%8999)+1001 , where num0=((num1%137)+1)*((num1%97)+1)*101
note: only the numerical values of num1 and num2 are significant, you could prepend zeros to either/both of these numbers if you like.
Replace the 0D ith the number of characters in your CD title (00 to 0D)
*** Remember it may not exceed 0D ***
At: Offset +6AE94
Find the string: 10031.aiff.0.
After the aiff add in the number of spaces you lost when changing to your
new CD name.
Example: 0DWorld of Xeen
Becomes: 08Fonts CD
10031.aiff.0.
Becomes: 10031.aiff .0.
To make up the lost spaces. Then the program will work if the CD: Fonts CD
is in the CD ROM
The other crack:
In the DATA FORK:
Find: 4082 000C 4806 0E75
Replace: 4800 000C 4806 0E75
But this one causes a crash on the quit
-
Might & Magic III
vAll
†Type 'BLASTOFF' in a mirror portal to see the ned of the game
-
MiniCAD
v6.0
1600-Z0LMWFGC-016019
Note: that is a zero between the Z and L
1601-A01V34XY-000000
Note: that is a zero between the A and 1
v6.0.0b2
16B1-ARLMDXAQ-000000
-
MitemView
vAll
11089
-
Morph
v2.5
4606000800
v2.0
1406016346
-
Movie Magic
vAll
†To break the copy protection of Movie Magic, here’s what ya do. Use ResEdit to find the place where the copy protected name is stored. Simply backspace over it, deleting it. The name is also stored in the footnotes. If you disable it, the machine will bomb if anyone tries to use a footnote. So place an invisible box over the footnote box so no one will even think of using it in the first place.
-
mPower
v2.0
MP201635
-
Multi Ad Search
vAll
100063800
100066120
-
Multi-Ad Creator
v3.6
117032
117051
117187
119784
v3.0.1
000437085
†••• Version: "3.0.1" •••
For the General Manager Application:
Search for: 4EBA 11EA 4A80
Change to: 4E71 4E71 " "
==========
v3.0
In the application:
CODE 14+$1C56 From: 6776 To: 4E71
+$1D28 From: 6700 007E To: 4E71 4E71
+$1D2E From: 6700 00F2 To: 4E71 4E71
+$1D4A From: 6708 To: 4E71
+$1E26 From: 662A To: 4E71
This both cracks the program and removes the network check.
==========
v3.5
Forget the install process... Copy the disk files to your hard drive and extract the files yourself & put into a folder (files from disk 1&2 have to be done this way, the other can be run on their own), now in the application change:
CODE 10+$000E From: 67 To: 60
this works and gives me and registered to blank, serial #.
-
MultiClip Pro
v3.1
ENV30307-002
-
MusicShop
v1.0
210.100.000115xx (x = any number)
-
MusicTime
vAll
MV20-0-1045-1830
-
My School
vAll
6580040
-
My Town
vAll
8620045
-
MyLabelDesigner
v1.0.1
2227-30259
-
MYOB
v5.0.4
JZ51726
-
Name Cleaner
v1.0.1
Note: name field is case sensitive
409639 '_Anonymous_'
1551782 'Public Domain'
User: Anonymous
Code: 77207
User: Registered
Code: 94104
User: <10 Option-Spaces>
Code: 209715
†Recipe: Any User (>8 Chars) & Breakpoint at CODE 2+5852 = Code in Register D6
-
NetPhone
v1.2.1
NPQ356V8
-
Nightingale
v1.01
195121
-
Nisus Writer
v4.1.2
8382135866940
v4.0.6
1923328854936
v4.0.3
8382135866940
-
Nok Nok
vAll
9300 49591
9300 49799
9300 59593
-
Norton DiskLock
v2.0
DLM$3004XAAINO0255IN
-
Notify Mail
v2.5.2a
†How to Create Notify Mail 2.5.2a Registration Codes
* Load Debugger
* Load "Configure NotifyMail"
* Choose "Registration:Registration Code..." from pull-down menu
* Type desired Username (followed by an asterisk "*") and press OK
* When error dialog appears, press interrupt switch
* Set breakpoint for CODE $1, offset $52DC of the "Configure NotifyMail"
Application
* Return from interrupt
* Press OK twice to make breakpoint activate
* Convert hex number in register D0 to decimal - This is your Registration Code
* Turn off breakpoint
* Return from interrupt
* Press OK and type in Registration Code
Samples:
Username :Registered*
Registration Code :10380
Username :*
Registration Code :0
Telefinder 4.0
Serial Number: TF00-00001 (or just "1")
Registration Number: M3B6A7 (case not important)
Nodes Licensed: 2 Nodes
or
Registration Number: A7G4F
Nodes Licensed: Unlimited Nodes
-
Now Bundle Installer
v3.5.1
100 users SNs
Now UpToDate 3.5 + BNA-350-0100-000017152800
Now Contact 3.5 + BNA-350-0100-000018976645
v3.5
BNA-350-0001-011873529747
Serial Numbers for Now Bundle 3.5.x, where (0≤x≤9)
BNA-35x-1000-000001715539
BNA-35x-0900-000001905555
BNA-35x-0800-000001095571
BNA-35x-0700-000001285587
BNA-35x-0600-000001475603
BNA-35x-0500-000001665619
BNA-35x-0450-000001260627
BNA-35x-0400-000001855635
BNA-35x-0350-000001450643
BNA-35x-0300-000001045651
BNA-35x-0250-000001640659
BNA-35x-0200-000001235667
BNA-35x-0150-000001701587
BNA-35x-0100-000001296595
BNA-35x-0075-000001158643
BNA-35x-0050-000001891603
BNA-35x-0045-000001767283
BNA-35x-0040-000001513875
BNA-35x-0035-000001260467
BNA-35x-0030-000001007059
BNA-35x-0025-000001753651
BNA-35x-0020-000001500243
BNA-35x-0015-000001246835
BNA-35x-0010-000001993427
BNA-35x-0009-000001968563
BNA-35x-0008-000001943699
BNA-35x-0007-000001918835
BNA-35x-0006-000001764883
BNA-35x-0005-000001740019
BNA-35x-0004-000001715155
BNA-35x-0003-000001690291
BNA-35x-0002-000001665427
BNA-35x-0001-000001640563
BNF-35x-1000-000001737231
BNF-35x-0900-000001372111
BNF-35x-0800-000001006991
BNF-35x-0700-000001641871
BNF-35x-0600-000001276751
BNF-35x-0500-000001911631
BNF-35x-0450-000001729071
BNF-35x-0400-000001546511
BNF-35x-0350-000001363951
BNF-35x-0300-000001181391
BNF-35x-0250-000001998831
BNF-35x-0200-000001816271
BNF-35x-0150-000001633711
BNF-35x-0100-000001451151
BNF-35x-0075-000001859871
BNF-35x-0050-000001268591
BNF-35x-0045-000001550335
BNF-35x-0040-000001832079
BNF-35x-0035-000001113823
BNF-35x-0030-000001395567
BNF-35x-0025-000001677311
BNF-35x-0020-000001959055
BNF-35x-0015-000001240799
BNF-35x-0010-000001522543
BNF-35x-0009-000001701439
BNF-35x-0008-000001009423
BNF-35x-0007-000001317407
BNF-35x-0006-000001496303
BNF-35x-0005-000001804287
BNF-35x-0004-000001983183
BNF-35x-0003-000001291167
BNF-35x-0002-000001599151
BNF-35x-0001-000001778047
BNG-35x-1000-000001741569
BNG-35x-0900-000001387969
BNG-35x-0800-000001163457
BNG-35x-0700-000001809857
BNG-35x-0600-000001585345
BNG-35x-0500-000001360833
BNG-35x-0450-000001119489
BNG-35x-0400-000001007233
BNG-35x-0350-000001894977
BNG-35x-0300-000001782721
BNG-35x-0250-000001670465
BNG-35x-0200-000001558209
BNG-35x-0150-000001316865
BNG-35x-0100-000001204609
BNG-35x-0075-000001148481
BNG-35x-0050-000001092353
BNG-35x-0045-000001706945
BNG-35x-0040-000001321537
BNG-35x-0035-000001807041
BNG-35x-0030-000001421633
BNG-35x-0025-000001036225
BNG-35x-0020-000001650817
BNG-35x-0015-000001136321
BNG-35x-0010-000001750913
BNG-35x-0009-000001899649
BNG-35x-0008-000001048385
BNG-35x-0007-000001197121
BNG-35x-0006-000001216769
BNG-35x-0005-000001365505
BNG-35x-0004-000001514241
BNG-35x-0003-000001662977
BNG-35x-0002-000001682625
BNG-35x-0001-000001831361
BNJ-35x-1000-000001625496
BNJ-35x-0900-000001693720
BNJ-35x-0800-000001632856
BNJ-35x-0700-000001701080
BNJ-35x-0600-000001640216
BNJ-35x-0500-000001708440
BNJ-35x-0450-000001678008
BNJ-35x-0400-000001647576
BNJ-35x-0350-000001617144
BNJ-35x-0300-000001715800
BNJ-35x-0250-000001685368
BNJ-35x-0200-000001654936
BNJ-35x-0150-000001624504
BNJ-35x-0100-000001723160
BNJ-35x-0075-000001143400
BNJ-35x-0050-000001692728
BNJ-35x-0045-000001176776
BNJ-35x-0040-000001660824
BNJ-35x-0035-000001144872
BNJ-35x-0030-000001628920
BNJ-35x-0025-000001112968
BNJ-35x-0020-000001726104
BNJ-35x-0015-000001210152
BNJ-35x-0010-000001694200
BNJ-35x-0009-000001365192
BNJ-35x-0008-000001036184
BNJ-35x-0007-000001707176
BNJ-35x-0006-000001507256
BNJ-35x-0005-000001178248
BNJ-35x-0004-000001849240
BNJ-35x-0003-000001520232
BNJ-35x-0002-000001320312
BNJ-35x-0001-000001991304
Serial Numbers for ??? Bundles 3.5.x, where (0≤x≤9)
C3Z-35x-1000-000001524524
C3Z-35x-0900-000001698188
C3Z-35x-0800-000001742764
C3Z-35x-0700-000001916428
C3Z-35x-0600-000001961004
C3Z-35x-0500-000001005580
C3Z-35x-0450-000001592412
C3Z-35x-0400-000001179244
C3Z-35x-0350-000001766076
C3Z-35x-0300-000001223820
C3Z-35x-0250-000001810652
C3Z-35x-0200-000001397484
C3Z-35x-0150-000001855228
C3Z-35x-0100-000001442060
C3Z-35x-0075-000001670932
C3Z-35x-0050-000001028892
C3Z-35x-0045-000001900484
C3Z-35x-0040-000001642988
C3Z-35x-0035-000001514580
C3Z-35x-0030-000001386172
C3Z-35x-0025-000001257764
C3Z-35x-0020-000001129356
C3Z-35x-0015-000001000948
C3Z-35x-0010-000001872540
C3Z-35x-0009-000001343588
C3Z-35x-0008-000001943724
C3Z-35x-0007-000001543860
C3Z-35x-0006-000001143996
C3Z-35x-0005-000001615044
C3Z-35x-0004-000001215180
C3Z-35x-0003-000001815316
C3Z-35x-0002-000001415452
C3Z-35x-0001-000001015588
JJB-35x-1000-000001921963
JJB-35x-0900-000001518187
JJB-35x-0800-000001985323
JJB-35x-0700-000001581547
JJB-35x-0600-000001048683
JJB-35x-0500-000001644907
JJB-35x-0450-000001443019
JJB-35x-0400-000001112043
JJB-35x-0350-000001910155
JJB-35x-0300-000001708267
JJB-35x-0250-000001506379
JJB-35x-0200-000001175403
JJB-35x-0150-000001973515
JJB-35x-0100-000001771627
JJB-35x-0075-000001170683
JJB-35x-0050-000001569739
JJB-35x-0045-000001997915
JJB-35x-0040-000001426091
JJB-35x-0035-000001983355
JJB-35x-0030-000001411531
JJB-35x-0025-000001839707
JJB-35x-0020-000001396971
JJB-35x-0015-000001825147
JJB-35x-0010-000001382411
JJB-35x-0009-000001416411
JJB-35x-0008-000001579499
JJB-35x-0007-000001613499
JJB-35x-0006-000001647499
JJB-35x-0005-000001810587
JJB-35x-0004-000001844587
JJB-35x-0003-000001007675
JJB-35x-0002-000001041675
JJB-35x-0001-000001204763
-
Now Compress
v1.0x
NCA-100-0001-003575417719
-
Now Contact
v3.5
BNA-350-0001-011873529747
Serial Numbers for Now Contact 3.5.x, where (0≤x≤9)
CTA-35x-1000-000001817407
CTA-35x-0900-000001599583
CTA-35x-0800-000001381759
CTA-35x-0700-000001163935
CTA-35x-0600-000001946111
CTA-35x-0500-000001728287
CTA-35x-0450-000001619375
CTA-35x-0400-000001510463
CTA-35x-0350-000001401551
CTA-35x-0300-000001421727
CTA-35x-0250-000001312815
CTA-35x-0200-000001203903
CTA-35x-0150-000001094991
CTA-35x-0100-000001986079
CTA-35x-0075-000001367079
CTA-35x-0050-000001877167
CTA-35x-0045-000001153367
CTA-35x-0040-000001429567
CTA-35x-0035-000001705767
CTA-35x-0030-000001981967
CTA-35x-0025-000001258167
CTA-35x-0020-000001663455
CTA-35x-0015-000001939655
CTA-35x-0010-000001215855
CTA-35x-0009-000001671095
CTA-35x-0008-000001126335
CTA-35x-0007-000001581575
CTA-35x-0006-000001036815
CTA-35x-0005-000001492055
CTA-35x-0004-000001947295
CTA-35x-0003-000001402535
CTA-35x-0002-000001857775
CTA-35x-0001-000001313015
CTF-35x-1000-000001839099
CTF-35x-0900-000001566139
CTF-35x-0800-000001422267
CTF-35x-0700-000001149307
CTF-35x-0600-000001876347
CTF-35x-0500-000001603387
CTF-35x-0450-000001466907
CTF-35x-0400-000001330427
CTF-35x-0350-000001193947
CTF-35x-0300-000001057467
CTF-35x-0250-000001920987
CTF-35x-0200-000001784507
CTF-35x-0150-000001648027
CTF-35x-0100-000001511547
CTF-35x-0075-000001943307
CTF-35x-0050-000001375067
CTF-35x-0045-000001061419
CTF-35x-0040-000001747771
CTF-35x-0035-000001434123
CTF-35x-0030-000001120475
CTF-35x-0025-000001806827
CTF-35x-0020-000001493179
CTF-35x-0015-000001179531
CTF-35x-0010-000001865883
CTF-35x-0009-000001028971
CTF-35x-0008-000001192059
CTF-35x-0007-000001355147
CTF-35x-0006-000001518235
CTF-35x-0005-000001552235
CTF-35x-0004-000001715323
CTF-35x-0003-000001878411
CTF-35x-0002-000001041499
CTF-35x-0001-000001204587
CTG-35x-1000-000001843437
CTG-35x-0900-000001211085
CTG-35x-0800-000001578733
CTG-35x-0700-000001946381
CTG-35x-0600-000001184941
CTG-35x-0500-000001552589
CTG-35x-0450-000001236413
CTG-35x-0400-000001920237
CTG-35x-0350-000001474973
CTG-35x-0300-000001158797
CTG-35x-0250-000001842621
CTG-35x-0200-000001526445
CTG-35x-0150-000001210269
CTG-35x-0100-000001894093
CTG-35x-0075-000001736005
CTG-35x-0050-000001577917
CTG-35x-0045-000001843029
CTG-35x-0040-000001237229
CTG-35x-0035-000001631429
CTG-35x-0030-000001025629
CTG-35x-0025-000001290741
CTG-35x-0020-000001684941
CTG-35x-0015-000001079141
CTG-35x-0010-000001473341
CTG-35x-0009-000001352181
CTG-35x-0008-000001231021
CTG-35x-0007-000001109861
CTG-35x-0006-000001988701
CTG-35x-0005-000001867541
CTG-35x-0004-000001746381
CTG-35x-0003-000001625221
CTG-35x-0002-000001374973
CTG-35x-0001-000001253813
CTJ-35x-1000-000001985540
CTJ-35x-0900-000001016836
CTJ-35x-0800-000001177220
CTJ-35x-0700-000001208516
CTJ-35x-0600-000001368900
CTJ-35x-0500-000001400196
CTJ-35x-0450-000001415844
CTJ-35x-0400-000001560580
CTJ-35x-0350-000001576228
CTJ-35x-0300-000001591876
CTJ-35x-0250-000001607524
CTJ-35x-0200-000001752260
CTJ-35x-0150-000001767908
CTJ-35x-0100-000001783556
CTJ-35x-0075-000001855924
CTJ-35x-0050-000001799204
CTJ-35x-0045-000001187860
CTJ-35x-0040-000001705604
CTJ-35x-0035-000001094260
CTJ-35x-0030-000001482916
CTJ-35x-0025-000001871572
CTJ-35x-0020-000001260228
CTJ-35x-0015-000001648884
CTJ-35x-0010-000001037540
CTJ-35x-0009-000001192724
CTJ-35x-0008-000001218820
CTJ-35x-0007-000001374004
CTJ-35x-0006-000001400100
CTJ-35x-0005-000001426196
CTJ-35x-0004-000001581380
CTJ-35x-0003-000001607476
CTJ-35x-0002-000001762660
CTJ-35x-0001-000001788756
v3.0
CTA-300-0001-000666706778
CTA-300-0001-075642105493
vAll
NCT-100-0001-000000451264
NCT-100-0001-000001134944
NCT-100-0001-000002522128
NCT-100-0001-000003488392
NCT-100-0001-000004357860
NCT-100-0001-000005235762
NCT-100-0001-000006896297
NCT-100-0001-000007087356
NCT-100-0001-000008807586
NCT-100-0001-000009688595
NCT-100-0001-000010736698
NCT-100-0001-000011197968
NCT-100-0001-000012008297
NCT-100-0001-000013958804
NCT-100-0001-000014206730
NCT-100-0001-000015717029
NCT-100-0001-000016915346
NCT-100-0001-000017513305
NCT-100-0001-000018395860
NCT-100-0001-000019267534
NCT-100-0001-000020418569
NCT-100-0001-005022697310
Reserved: NCT-100-0001-099999820388
-
Now Quick&Easy
v1.0.0
Serial Numbers for Now Quick&Easy 1.0.0
NLA-100-1000-000001410843
NLA-100-0900-000001845275
NLA-100-0800-000001150619
NLA-100-0700-000001585051
NLA-100-0600-000001019483
NLA-100-0500-000001324827
NLA-100-0450-000001106587
NLA-100-0400-000001759259
NLA-100-0350-000001411931
NLA-100-0300-000001064603
NLA-100-0250-000001846363
NLA-100-0200-000001499035
NLA-100-0150-000001151707
NLA-100-0100-000001933467
NLA-100-0075-000001195259
NLA-100-0050-000001586139
NLA-100-0045-000001264315
NLA-100-0040-000001942491
NLA-100-0035-000001620667
NLA-100-0030-000001298843
NLA-100-0025-000001977019
NLA-100-0020-000001655195
NLA-100-0015-000001333371
NLA-100-0010-000001882459
NLA-100-0009-000001295547
NLA-100-0008-000001579547
NLA-100-0007-000001992635
NLA-100-0006-000001276635
NLA-100-0005-000001560635
NLA-100-0004-000001973723
NLA-100-0003-000001257723
NLA-100-0002-000001670811
NLA-100-0001-000001954811
-
Now Up-to-Date
v3.5
BNA-350-0001-011873529747
Serial Numbers for Now UpToDate 3.5.x, where (0≤x≤9)
UDA-35x-1000-000001533052
UDA-35x-0900-000001122204
UDA-35x-0800-000001582268
UDA-35x-0700-000001171420
UDA-35x-0600-000001631484
UDA-35x-0500-000001220636
UDA-35x-0450-000001450668
UDA-35x-0400-000001680700
UDA-35x-0350-000001039820
UDA-35x-0300-000001269852
UDA-35x-0250-000001499884
UDA-35x-0200-000001729916
UDA-35x-0150-000001089036
UDA-35x-0100-000001319068
UDA-35x-0075-000001934084
UDA-35x-0050-000001549100
UDA-35x-0045-000001949556
UDA-35x-0040-000001220924
UDA-35x-0035-000001492292
UDA-35x-0030-000001892748
UDA-35x-0025-000001164116
UDA-35x-0020-000001564572
UDA-35x-0015-000001835940
UDA-35x-0010-000001236396
UDA-35x-0009-000001264852
UDA-35x-0008-000001293308
UDA-35x-0007-000001321764
UDA-35x-0006-000001479308
UDA-35x-0005-000001507764
UDA-35x-0004-000001536220
UDA-35x-0003-000001693764
UDA-35x-0002-000001722220
UDA-35x-0001-000001750676
UDF-35x-1000-000001394691
UDF-35x-0900-000001541443
UDF-35x-0800-000001817283
UDF-35x-0700-000001964035
UDF-35x-0600-000001239875
UDF-35x-0500-000001386627
UDF-35x-0450-000001960003
UDF-35x-0400-000001533379
UDF-35x-0350-000001106755
UDF-35x-0300-000001809219
UDF-35x-0250-000001382595
UDF-35x-0200-000001955971
UDF-35x-0150-000001529347
UDF-35x-0100-000001102723
UDF-35x-0075-000001389411
UDF-35x-0050-000001805187
UDF-35x-0045-000001236707
UDF-35x-0040-000001668227
UDF-35x-0035-000001099747
UDF-35x-0030-000001531267
UDF-35x-0025-000001091875
UDF-35x-0020-000001523395
UDF-35x-0015-000001954915
UDF-35x-0010-000001386435
UDF-35x-0009-000001872739
UDF-35x-0008-000001359043
UDF-35x-0007-000001845347
UDF-35x-0006-000001331651
UDF-35x-0005-000001947043
UDF-35x-0004-000001433347
UDF-35x-0003-000001919651
UDF-35x-0002-000001405955
UDF-35x-0001-000001892259
UDG-35x-1000-000001915383
UDG-35x-0900-000001702743
UDG-35x-0800-000001361015
UDG-35x-0700-000001148375
UDG-35x-0600-000001935735
UDG-35x-0500-000001594007
UDG-35x-0450-000001487687
UDG-35x-0400-000001381367
UDG-35x-0350-000001145959
UDG-35x-0300-000001039639
UDG-35x-0250-000001933319
UDG-35x-0200-000001826999
UDG-35x-0150-000001720679
UDG-35x-0100-000001485271
UDG-35x-0075-000001932111
UDG-35x-0050-000001378951
UDG-35x-0045-000001268319
UDG-35x-0040-000001157687
UDG-35x-0035-000001047055
UDG-35x-0030-000001936423
UDG-35x-0025-000001825791
UDG-35x-0020-000001715159
UDG-35x-0015-000001604527
UDG-35x-0010-000001493895
UDG-35x-0009-000001445951
UDG-35x-0008-000001398007
UDG-35x-0007-000001350063
UDG-35x-0006-000001431207
UDG-35x-0005-000001383263
UDG-35x-0004-000001335319
UDG-35x-0003-000001287375
UDG-35x-0002-000001239431
UDG-35x-0001-000001320575
UDJ-35x-1000-000001606549
UDJ-35x-0900-000001928469
UDJ-35x-0800-000001250389
UDJ-35x-0700-000001701397
UDJ-35x-0600-000001023317
UDJ-35x-0500-000001345237
UDJ-35x-0450-000001941653
UDJ-35x-0400-000001667157
UDJ-35x-0350-000001263573
UDJ-35x-0300-000001989077
UDJ-35x-0250-000001585493
UDJ-35x-0200-000001310997
UDJ-35x-0150-000001907413
UDJ-35x-0100-000001632917
UDJ-35x-0075-000001431125
UDJ-35x-0050-000001358421
UDJ-35x-0045-000001492245
UDJ-35x-0040-000001626069
UDJ-35x-0035-000001759893
UDJ-35x-0030-000001022805
UDJ-35x-0025-000001156629
UDJ-35x-0020-000001290453
UDJ-35x-0015-000001424277
UDJ-35x-0010-000001687189
UDJ-35x-0009-000001036501
UDJ-35x-0008-000001514901
UDJ-35x-0007-000001864213
UDJ-35x-0006-000001342613
UDJ-35x-0005-000001821013
UDJ-35x-0004-000001170325
UDJ-35x-0003-000001648725
UDJ-35x-0002-000001127125
UDJ-35x-0001-000001476437
-
Now Utilities
v5.0.1
NUA-500-0001-005930092882
Any numbers from 5.0
Serial Numbers for Now Utilities 5.0.x, where (0≤x≤1)
NUA-50x-1000-000001796096
NUA-50x-0900-000001802784
NUA-50x-0800-000001938560
NUA-50x-0700-000001945248
NUA-50x-0600-000001951936
NUA-50x-0500-000001958624
NUA-50x-0450-000001897424
NUA-50x-0400-000001965312
NUA-50x-0350-000001904112
NUA-50x-0300-000001972000
NUA-50x-0250-000001039888
NUA-50x-0200-000001978688
NUA-50x-0150-000001046576
NUA-50x-0100-000001985376
NUA-50x-0075-000001954776
NUA-50x-0050-000001053264
NUA-50x-0045-000001247144
NUA-50x-0040-000001441024
NUA-50x-0035-000001634904
NUA-50x-0030-000001828784
NUA-50x-0025-000001022664
NUA-50x-0020-000001216544
NUA-50x-0015-000001410424
NUA-50x-0010-000001604304
NUA-50x-0009-000001443080
NUA-50x-0008-000001281856
NUA-50x-0007-000001120632
NUA-50x-0006-000001959408
NUA-50x-0005-000001798184
NUA-50x-0004-000001636960
NUA-50x-0003-000001475736
NUA-50x-0002-000001314512
NUA-50x-0001-000001153288
v5.0
NUA-500-0001-005930092882
NUA-500-0001-000001153288
NUA-500-0001-000002637220
NUA-500-0001-000003098898
NUA-500-0001-000004048457
NUA-500-0001-000005219300
NUA-500-0001-000006457186
NUA-500-0001-000007152361
NUA-500-0001-000008038064
NUA-500-0001-000009597126
NUA-500-0001-000010539034
NUA-500-0001-000010539034
NUA-500-0001-000013109925
NUA-500-0001-000012227787
NUA-500-0001-000011213269
NUA-500-0001-000014335250
NUA-500-0001-000999531947
NUA-500-0001-000019201700
NUA-500-0001-000018479633
NUA-500-0001-000017111730
NUA-500-0001-000016973956
NUA-500-0001-000015557769
-
NUBase
v1.3
0000000-00
-
Object Master
v2.0.2
L\002428392663
-
OmniPage
v5.0
0102E-%001705
-
Omnis 7
v3.2
†How to Create Omnis 7 v3.2 Serial Numbers
Format:
XXXX NNNNNN ?????
---- ------ -----
^ ^ ^
| | |
| | |
| Any 6 |
| digits |
| |
| |
| Checksum
| (see below)
|
CMDS (Mac Developer)
CPDS (PowerMac Developer)
CMXQ (Mac Runtime)
CPXQ (PowerMac Runtime)
How to Find the Checksum:
1. Install Omnis, using a valid s/n like "CMDS 000000 60889"
2. Using ResEdit, Open STR# ID = 1040 from "Omnis 7" and
change offset $45-$48 to CMDS, CPDS, CMXQ, or CPXQ (see above).
3. Now change offset $4A-$4F to any desired 6 digit number and save it.
4. Load your favorite debugger and set a TRAP breakpoint for _InitGraf.
5. Execute "Omnis 7" and when the break occurs, set an additional
breakpoint for CODE $8, offset $C6 of "Omnis 7".
6. Continue execution and when the breakpoint activates,
the Checksum will be in register D1.
7. Convert the Checksum hex number to decimal and write it down.
8. Exit to the finder.
9. Using ResEdit, Open STR# ID = 1040 from "Omnis 7" and
change offset $51-$55 to the Checksum you wrote down and save it.
All Done!!!
Examples:
=========
CMDS 000000 60889 (Mac Developer)
CMDS 000001 49156 (Mac Developer)
CMDS 000002 51122 (Mac Developer)
CMDS 000003 25257 (Mac Developer)
CMDS 000004 06951 (Mac Developer)
CMDS 000005 43852 (Mac Developer)
CMDS 000006 92290 (Mac Developer)
CMDS 000007 11021 (Mac Developer)
CMDS 000008 63760 (Mac Developer)
CMDS 000009 54599 (Mac Developer)
CPDS 000000 96347 (PowerMac Developer)
CPDS 000001 30500 (PowerMac Developer)
CPDS 000002 51254 (PowerMac Developer)
CPDS 000003 31273 (PowerMac Developer)
CPDS 000004 15399 (PowerMac Developer)
CPDS 000005 61581 (PowerMac Developer)
CPDS 000006 32962 (PowerMac Developer)
CPDS 000007 11087 (PowerMac Developer)
CPDS 000008 66768 (PowerMac Developer)
CPDS 000009 58823 (PowerMac Developer)
CMXQ 000000 12741 (Mac Runtime)
CPXQ 000000 48397 (PowerMac Runtime)
-
On Guard
v1.5.2
†No sn is needed, but to log in as the startup user, enter "administrator" in the name field and "admin" in the paswd field. Then you can change what options you like. I'm using it now, seems pretty good, and much more compatible than, say, Fileguard...
-
OptiMem
v1.5.6
AVFA-SHAA-LLAO-LBPUA
-
Oxyd
vAll
†Here are the first 2nd to 11 level codes:
2) 218780766 3) 10232399 4) 32882199
5) 13794470 6) 28197802 7) 17887807
8) 51761122 9) 83882268 10) 6071220
11) 58037867
Oxyd Patch
Here's the patch I found for removing the Oxyd CP. Maybe it can be added to
the new Cracks and Numbers file?
OXYD 3.4
Depending on which version you want to run (B&W or Color) you need to
alter the appropriate Data A file. (Note: this only works with 3.4; I
have no idea if it works with 3.3)
**NOTE: you require a Disk/File editor such as Norton Disk Utilites
rather than Resedit because you are editing the Data fork not Resource
fork.
EFFECT: This patch allows you to enter in the level number you want to
play,
instead of the annoying 'secret code'.
Data A Color +$0001BC48 (#113736):
Data A Mono +$0001C18A (#115082):
change: 6F6E DEC8 FFFD D823 to 614A 0080 FFF7 CFFA
and
Data A Color +$0001BC5A (#113754):
Data A Mono +$0001C19C (#115100):
change: 4CFF FFF6 to CFFF FEFA
Now you can just enter in the level number you want to play (preceded by
the appropriate number of 0's, so level 12 would be 00000012).
EFFECT: This patch allows you to press any key to remove the 'magical
tokens'
which block your path.
Data A Color +$0002C9F6 (#182774):
Data A Mono +$0002CF36 (#184118):
change: 669F to DE43
Data A Color +$0002CA22 (#182818):
Data A Mono +$0002CF62 (#184162):
change: 669F to DE43
Data A Color +$0002CA4E (#182862):
Data A Mono +$0002CF8E (#184206):
change: 669F to DE43
or
OXYD 3.4
Depending on which version you want to run (B&W or Color) you need to alter the appropriate Data A file. (Note: this only works with 3.4; I have no idea if it works with 3.3)
**NOTE: you require a Disk/File editor such as Norton Disk Utilites rather than Resedit because you are editing the Data fork not Resource fork.
EFFECT: This patch allows you to enter in the level number you want to play,
instead of the annoying 'secret code'.
Data A Color +$0001BC48 (#113736):
Data A Mono +$0001C18A (#115082):
change: 6F6E DEC8 FFFD D823 to 614A 0080 FFF7 CFFA and
Data A Color +$0001BC5A (#113754):
Data A Mono +$0001C19C (#115100):
change: 4CFF FFF6 to CFFF FEFA
Now you can just enter in the level number you want to play (preceded by the appropriate number of 0's, so level 12 would be 00000012).
EFFECT: This patch allows you to press any key to remove the 'magical tokens'
which block your path.
Data A Color +$0002C9F6 (#182774):
Data A Mono +$0002CF36 (#184118):
change: 669F to DE43
Data A Color +$0002CA22 (#182818):
Data A Mono +$0002CF62 (#184162):
change: 669F to DE43
Data A Color +$0002CA4E (#182862):
Data A Mono +$0002CF8E (#184206):
change: 669F to DE43
OXYD Magnum! 3.5
# Allows you to enter the level number you want to play instead of the secret code (when entering level, pad with zeros to make 8-digit code (e.g. 00000012)) - open "Data A Color" or "Data A Mono" with Norton's Disk Editor - search for D855 80D4 ED58 DBD4 E9DA (offset $00016C8A or $000161CA) change to 68FF EF6E E49F EF70 D845
†EFFECT: This will remove the "match the monsters" box. HOW TO: LOCATE 'CODE' ID 2 FIND Offset $002E
From: 4EBA 1106
To: 4E71 4E71
PATHWAYS OF DARKNESS (v1.0 I think)
EFFECT: This will allow you to play even after you enter the wrong sequence of monsters three times.
HOW TO: LOCATE 'CODE' ID 2 FIND Offset $0036
From: A9F4
To: 4E71
PATHWAYS INTO DARKNESS (note - somepeople say this doesn't work)
EFFECT: You don't have to worry about the dialog any more.
HOW TO: Open the CODE resource with ID 2 and jump to offset $2E.
Change from $4EBA to $6008
Pathways Into Darkness 1.1
# disable modification checking code - CODE 1, offset 02CE - change 67 to 60 # bypass monster sequence dialog - CODE 2, offset 11EC - change 4EAD 04E2 to 6600 012C # fix "Divide By Zero" bug - CODE 5, offset 4BD4 - change 3228 0006 48C1 to 7200 3228 0006 - CODE 5, offset 4BFE - change 3228 0006 48C1 to 7200 3228 0006 - CODE 5, offset 4C28 - change 3228 0006 48C1 to 7200 3228 0006 # Allows save anywhere, not just at a save rune - CODE 2, offset 0706 - change 6716 to 6516 ? Gives whatever weapon you have unlimited ammo - CODE 6, offset 5952 - change 6774 to 6074 ? increase healing rate by a factor of six & adjust internal game time to compensate - CODE 7, offset 2404 - change 0006 to 0002 - CODE 7, offset 3410 - change 6270 to 20D0 - CODE 7, offset 2608 - change 6270 to 20D0 - CODE 7, offset 2618 - change 6270 to 20D0 - CODE 7, offset 262C - change 3138 to 1068 - CODE 7, offset 263A - change 6270 to 20D0 - CODE 7, offset 2C0A - change 0006 9780 to 0002 3280 - CODE 7, offset 2C16 - change 0009 E340 to 0003 4BC0 ? increase maximum health points accrued based on treasure picked up - CODE 6, offset 2210 - change E588 to E788 - CODE 6, offset 221C - change 003C to 0064 ? increase efficacy of Violet Potion by x4 - CODE 6, offset 230D - change 3C to 0F ? increase game speed by removing multiple key checking - CODE 1, offset 0352 - change C046 to 4240 # a special "Terminator" set of saved games (1500 hp, lots of weaponry, extra crystals, etc) is available from me by sending some mail to my address, geoff@tara.apana.org.au
Pathways Into Darkness 2.0 (PPC)
bypasses manual-look-up - open the data fork with a sector editor - offset $000184D4 (# 99540) - change 4182 02EC to 4800 02EC - offset $0001B55C (#111964) - change 4180 0030 to 4800 0030 ? activate hidden 'turbo' modes - during game play, hold down Control and type: - turbo (puts game into high speed) - carnage (shows 'score' screen) - reset (resets time-elapsed clock)
Pathways Into Darkness 2.0 (68k)
bypasses manual-look-up - CODE 1, offset 0396 - change 6D to 60 - CODE 2, offset 10C4 - change 67 to 60 ? activate hidden 'turbo' modes - during game play, hold down Control and type: - turbo (puts game into high speed) - carnage (extra monsters?) - reset (resets time-elapsed clock)
-
Pax Imperia
vAll
†v1.02
Open Pax Imperia with ResEdit: To have unlimited abilities for your race:
Change CODE 23 at $1208, $13B4, $1560, $170C
From: $6C22
To:
$4E71
To have unlimited abilities when you create your own drives (Click New in the
Tech window):
Change CODE 4 at $3162, $3242
From: $6F0E
To:
$600E
To have unlimited abilities when you create your own shields (Click New in the
Tech window):
Change CODE 4 at $2D96, $2E76, $2F56
From: $6F0E
To:
$600E
To have unlimited abilities when you create your own sensors (Click New in the
Tech window):
Change CODE 4 at $260A
From: $6F08
To:
$6008
Change CODE 4 at $2752, $289E, $29EA, $2B36
From: $6F0C
To:
$600C
To have unlimited abilities when you create your own weapons (Click New in the
Any answer will work in the length dialog box. - CODE 4, offset 45CC - change B26E FFFE to B241 4E71 ? Cheat to hit a driver 500 yards - at any time, type "abbacab"
-
PhotoMagic
v1.1
010000BA
-
PhotoMatic
v2.0
4K2M-2K4-K2TC
-
PhotoSpot
v2.0.2
PS15-2500257
-
Pixel Putty
v1.2
PP-001-03689-A
-
Pixel Putty Solo
v1.0.1-1.2.4
PP-001-03689-A
-
Planet X
v1.2.2
yteyWZIwB5NPHeGF
-
Player Pro
v4.3
00003400248
†Crack for Player PRO 4.4.2 Fat:
---------------------------
Register Code = 123****900 (Such as 1231111900 or 1232222900)
If it makes your mac system down after registering, then
restart your mac and :
Open Player PRO 4.4.2 Fat in ResEdit
CODE ID=7 :
find at offset 32BA
change from 670C to 671A
-
PlayMaker Football
vAll
†v2.0
Find CODE 90+$608 is $6700 FF18
change CODE 90+$59E to $4E71 and CODE 90+$5F2 to $6018
change the message in DLOG 800 to
"Press Command-G and hit OK until the game begins.
Then you will never see this dialog box again."
or
Code #90
+54A 66D6->4E71
+552 670A->600A
+464 6714->4E71
or
PLAYMAKER FOOTBALL 2.0
This patch takes several steps, since PMFB checks to see if its code has been modified while a game plays; if it has, the game will crash. This is why previous patches have failed. However, it doesn't ask for a password every time; instead, it asks after several games have been played since it last got a valid password. After a valid password has been entered, all you need to do is lock the application in the Finder. Then it will not be able to remember how many times you've played, and will not ask you for the password again.
If you haven't enetered a valid password (and no longer have the
user's manual) modify the program with ResEdit as follows:
Open CODE 90, find word at offset $100;
change the word from $A861 to $4E71.
(This replaces the random number generator, so you will
always be asked for the same password.)
Then run PMFB and ask to play a game. It will ask you for word 4 on page 13, paragraph 3. The word is "are". After it accepts this
password, DO NOT PLAY THE GAME! It will see it has been modified and crash.
Instead, open ResEdit and change the word in CODE 90 back
to its original value of $A861. Then lock PMFB in the Finder. It should never ask you for the password again.
I don't know for sure that this will always work; I've only had my
copy of Playmaker Football to test it on.
-
PopUpFolders
v2.0.1
13504-649669-120706
-
Poser (Fractal Poser)
v1.0.1
FM100NAZ0001902-VAGA-001
v1.0
FM100NAZ0002026-DYVN-001
FM100NAZ0001902-VAGA-001
-
PosterWorks
vAll
1883-BKHMEAFGHI
-
Power Launcher
vAll
†V1.6
Search for : 6716 1B7C 0001 F643 4206 554F
Change to : 6016
That will eliminate the check-sum routine that detects that the code has been modified.
Search for : 6718 3F3C 0080 4EAD 019A 554F
Change to : 6018
That will allow anything for your registration dialog. If it doesn’t ask for the registration then trash the pref. file before you launch it and it will ask you to register. If you want it un-registered just click ok. This crack also removes the annoying dialog everytime you change sets.
-
Power Translator Spanish
v1.0
PTSMA004852
-
PowerMerge
v1.0
PM1-002897
-
PowerScan
v2.0.5
Reg Seed#6F312122 (see below to change)
Reg Code#4134551C205 (205 is optional)
†Run the program and write down the first 8 characters of the Registration Seed number, then quit the program. Open the 'Pref' #128 of the file "PowerScan 2.0 Prefs" which will now be in your "Preferences" folder with a resource editor (ie Resorcerer or ResEdit) at offset $170 (#368) you should see the 8 characters of the Registration Seed number that you wrote down in the raw hex dump - replace this longword with $6F312122 and save the changes. you can now use the Seed/Code number info given above.
*** Detailed Info for Programmers/Hackers ***
The protection scheme used is of suprisingly high quality. The first time you run the program it generates a random long value called the "Registration Seed" and stores it in the prefs. You then register with the author (by giving him both the seed and the version number of PowerScan that you have) and he sends you back a "Registration Code" which enables you to register that version of the program (so long as you have not deleted the prefs file that is…). Whenever a new release is issued you are simply asked to find your old registered copy of PowerScan and it will register the new version using the info from it.) The reason why this protection scheme is good is that a given code only works for a single version with a certain seed (which the user cannot enter) - by using this scheme the author can change his protection scheme every release if he so chooses while not affecting previous registered users unless they have lost their old registered powerscan or the version for which they have the code. The copy protection scheme implemented in version 2.0.5 is done in three distinct steps:
1) Checksum memory containing the registration code being executed as follows:
(assume CodePtr is a pointer to an array of bytes)
codePtr = address of CODE#3 'Initialization'
length = 7844; // the number of bytes to checksum: 7844=Size(CODE #3) for v2.0.5
cs = 0; // checksum is a unsigned longword initially set to zero
for (index=1;(index<=length);index++);
{
cs += codePtr[index]^index; //where ^ is the XOR/EOR operator.
cs = cs<<3;
}
// cs=0x877AA4BB1 for v2.0.5
/* one of the main difficulties of figuring out a SN# for this app is obtaining the correct value of this checksum, since any debugger breakpoint or code modification within the range being checksummed will completely throw off the number generated -- thus you have to _recognize and understand_ exactly what is being done and why, and then deduce that you can either write some code to do it yourself (too much work) or look to see if the author made any mistakes/oversights by calling any subroutines outside of the range being checksummed after this number was calculated… sure enough he did, so I just put a breakpoint in one of these subroutines and looked where I knew the checksum value was being stored.
the breakpoints I used were:
68K t 00EE9888 R 'CODE 0002 1A14 Utilities'+23E8
68K t 00EE98AA R 'CODE 0002 1A14 Utilities'+240A
68K t 00EE98FC R 'CODE 0002 1A14 Utilities'+245C
*/
2) Take the first 8 digits of the Registration Seed (which is a hexadecimal long - in my case $6F312122) combine it with the fixed/preset long value $A9204A57 to get the "target" value as follows:
target=Combine1(0x6F312122,0xA9204A57); //where Combine1 is the routine given below
// target=0xC6F4544A in this case;
3) Take the first 8 digits of the Registration Code (an unknown at this point) and combine this value (according to the function Combine2) with the checksum value ($877AA4BB1) to generate a value to compare with the target value - if they are equal then the Registration Code is valid.
if (0xC6F4544A==Combine2(regCode,0x877AA4BB1) then Registration Code is valid.
Thus to figure out the Registration Code we need to find an inverse function Combine2Inverse such that:
regCode=Combine2Inverse(target,checksum);
//0x4134551C =Combine2Inverse(0xC6F4544A,0x877AA4BB1); in this case.
Upon Registration a 'Reg ' #128 resource is created in the app it contains:
+$00 Registration Seed
+$04 Registration Code
+$08 ?
+$0C Length byte followed by mangled user name
The Registration Code is actually supposed to be 11 characters, the first 8 being significant and the last three not significant as of 2.0.5, would simply be the version number (205 in our case). The last three characters do not seem to be stored anywhere in the application, thus it leads me to believe that the author simply chooses the fixed magic ($A9204A57) number such that it exactly comphensates for any changes in the registration code (and thus the code checksum) introduced in future versions.
Furthermore the author mangles your name in the exact same way as Combine2 except that he does it against his copyright string.
The Combine2Inverse function and all those used above are listed below:
*** Listings/Snippets ***
Byte GetByte(unsigned long theNum,short whichByte) //whichByte=0..3 0=MSB,3=LSB
{
return (Byte)((theNum<<(whichByte*8))>>24);
}
unsigned long SetByte(unsigned long theNum,short whichByte,Byte theByte)
The personalization data is stored in 'Qky2' ID 1. When you register it, with
this crack, it will use the serial number 19628, which is presumably the
default one. To see the personalization, go to 'About QuicKeys™...' in the
option menu when editing keysets.
Quick Keys 2.1.3
For those who can't find a serial number this work around worked for me.
1 Install Quickeys with extensions, etc you desire
2 Install Quickeys 2.1 (no serial number needed) cdev only and reboot, should
open
3 Re-install Quickeys 2.1.3 cdev only and reboot, should now open without
asking for serial number
-
QuickMail
v2.2
40866
†Crack for 2.0 serial numbers patch:
Open up the QUICKINIT file with ResEdit:
Look in INIT 25 "QuickInit", offset $24, for an ASCII sequence of digits (they directly follow a string that looks like QuickMai, e.g., QuickMai00000). ASCII modify them to any serial # you want, preferably something far away from what other people are using. You see, that serial # is a BASE serial number, from which the Quickmail software will increment x # of times, where x is the # of users allowed by that particular pack. There is one more spot where it's stored, and that's in the DATA -14144 resource, offset $5C, again, it's five ASCII digits. Change them to the same # you installed into the INIT 25
resource. Once you've made your changes, be sure to save them, and then reboot with the new files installed in your System Folder to see them take effect. I know it's not a patch to remove the serial number check process altogether, but since I do not know how the scheme is intrinsically tied to the actual workings of the client/server mechanism, I'd rather not play around with that and possibly create reliability problems. If you want to invest loads of time looking into it, feel free and please post the results; but I think if all you want to do is get your office up and running with Quickmail for everyone, then this should meet your needs.
-
QX Tools
v1.0
QMU-100-001-915-10796
-
RAM Disk Saver
v2.0
158100157
-
RapidTrak
vAll
600001201
-
RayDream Designer
v3.1.1
RD-301-1-2116-14832
-
ReadySetGrow!
v1.0
20475
-
Realmz
v2.0
SN#11603111 RC#7252020 (Min for this SN#)
SN#11603111 RC#7252048 (Max for this SN#)
†Registration Code = any number within the range 104+INT(SN/24)*15 +/- 14 ,where SN is the serial number.
***
ie if SN=11603111 then RC=any number in the range 7252034 +/- 14
Another:
Each Realmz application has a unique serial number which is displayed on the
title page (upper left corner I think). What you're looking for is the
registration code.
To obtain the registration code follow these steps:
1. Find & note the serial number (SN).
2. Divide the SN by 24.
3. Remove all numbers to the right of the decimal point.
4. Multiply by 15.
5. Add 104.
Enter this registration code on the title page, then enter any name. Realmz
is now registered.
Realmz Serial Number info
-------------------------
You may enter '911' as the registration code when registering realmz to change the serial number. Upon doing so you may enter any long value for a SN# such that (SN#>>23)&1=1 [ie: bit 23 must be set] and - although not strictly required - it is probably wise to assume that the SN# should be positive. The following algorithm is used to compute the serial numbers:
enum {Realmz,Assault,Prelude,Castle};
Str31 name[]="\p<Your Reg Name Here>"; //name<=26 characters
Str15 regCodeStr;
void GenerateSN(short product)
{
long nameNum,divisor,multiplier,regCodeNum;
short i;
nameNum=StringToNum(name);
// StringToNum() is well defined even for non-numeric strings and is equivalent to:
/*
nameNum=0;
if (name[0]!=0)
{
if ((name[1]=='+')||(name[1]=='-'))
{
for (i=2;i<=name[0];i++) nameNum=(nameNum*10)+(name[i]%16); //note %16 == &0xF
if ((name[1]=='-') nameNum*=-1;
}
else for (i=1;i<=name[0];i++) nameNum=(nameNum*10)+(name[i]%16);
DebugStr("\pValid serial numbers are the following number +/- 14;G");
DebugStr(regCodeStr);
}
-
Realmz Assault on Giant Mountain
v2.0
0000017663 Doom
0705389594 Anonymous
1717142171 Fantasoft
†Warning: The above SN# info has been comprimised as of version 2.0.3 or higher. Some asshole(s) posted the info on the internet and the author apparently took some countermeasures - so you'll just have to suffer until (if i decide to) get around to reverse engineering it again.
-
Rebel Assault
v1.0
†Rebel Assault 1.0
Level pass-codes EASY NORMAL HARD - Ch. 2 = bossk bothan bordok - Ch. 3 = engret herglic skynx - Ch. 4 = ralrra leeni defel - Ch. 5 = frija thrawn jedgar - Ch. 6 = lafra lwyll madine - Ch. 7 = derlin mazzic tarkin - Ch. 8 = motlok julpa mothma - Ch. 9 = morag morrt glayyd - Ch.10 = tantiss muftak ottega - Ch.11 = oswafl raskar rishii - Ch.12 = klaaty jhoff irzina - Ch.13 = irenez ithor karrde - Ch.14 = lianna umwak vonzel - Ch.15 = pakka orlok ossus - end = narval nkllon malani ? Activate "Yoda's Power Mode" - go to Game Options - hold down the shift, control, option and command keys - triple-click on the space *between* the Rapid Fire and Shut Down Apps check boxes - you'll see a "Yoda's Power Mode" check box. Check it! - skip to any level by pressing 1 through 9 for those chapters and A through F for the rest - pressing the + DECREASES damage and hitting - INCREASES your damage ? patch to allow use with FWB's "CD-ROM Toolkit" - copy the Rebel Assault application to your hard drive - open the STRS 0 resource with ResEdit - after the final 0A00, *add* the following: 5265 6265 6C20 4173 7361 756C 743A 5245 4245 4C3A 2573 3B31 00 - CODE 4, offset 39E8 - change 2F3C 0000 2064 to 2F3C 0000 2152
-
Red Baron
v1.0
†Red Baron 1.0
When playing on a recent-model Mac (in particular, any model since the LCIII), using mouse control sends you into non- survivable spin on any Mac. - FIXED by turning off mouse control and flying with the keyboard by using the *undocumented* keystroke Option-D.
and you'll get $500,000 and all technologies enabled.
SimCity 2000 1.0
Raise $1 million by issuing a bond and immediately repaying it - CODE 4, offset 3376 - change 04B9 0000 2700 to 06B9 000F 4240 ? Enable all technologies & get $500,000 - go into "full zoom" mode - type: porntipsguzzardo - after the first time, typing 'ardo' gives you another $500k # an updater to v1.1 is currently available at most mac archive sites
SimCity 2000 1.1
Enable all technologies & get $500,000 - drag the 'Maps' window out of the toolbar so that it is the front-most (active) window - type 'pirn' - click once on the status bar (its the small horizontal bar thats usually to the right of the toolbar, shows the active tool and also the current weather) - type 'topsguzzardo' - after the first time, typing 'ardo' gives you another
-
SitComm
vAll
SCxxxxx
SRxxxxx
†Go to CODE 6
at Offset +BD2 change 6628 to 6028
-
Sketch
v2.0
SMZMP22W2CD6CER
SMDFQHB3THRH4LJ
SMFRZ9CQG7ZWQ86
-
Sketcher
v1.0
0400102LUA
-
SnapMail
v2.0
' -8E6C6183 10'
-
Snatcher
v1.0
104321
-
SndConverter Pro
v2.2
065016413435 'Anonymous'
-
Snoopy's Yearn to Learn
vAll
304E1342E
†Serial Number info
~~~~~~~~~~~~~~~~~~
Before you run the program for the first time, make a copy of the virgin "YL
Pref" file (in the System Folder [not the Preferences folder]). Then whenever
you want to repersonalize, just drag a virgin copy into the System Folder. If
you lose your virgin "YL Pref" file, you can make one yourself by creating a
plain text file with a single ellipsis character (opt-;) [that's option
semicolon] and set the file type to TEXT and the creator to ????. BTW, if you
copy the YEARN 2 LEARN folder to another Mac and run it, it will say it caught
you pirating. What you forgot to do was put a copy of the "YL Pref" file into
the System Folder of the new Mac.
The two serial numbers posted (304E2180E & 304E1342E) work fine. It seems that
most any numbers plugged into the pattern ( ###E####E ) work. Example:
123E4567E doesn't work, but 444E4444E does.
-
SoftwareFPU
v3.0.2
SFPU-302-XXXXXXX
†XXXXXXX can be any number you like and the 302 part is obviously the version
number, so for any future versions, just place the appropriate number there.
-
SoftWindows
v2.0
2500-6666-2112-1492
2500-0004-1485-1139
2500-0003-4575-1095
-
Sony Hybrid CD_ROM
v1.2
HYB2-120-0-553B2B16
-
Spanish Assistant
v1.0
M1102424
M1104116
-
Spectre VR
v1.0.1
†To remove duplicate serial number checking on a network:
CODE 0003 +05E2: 660E -> 600C
CODE 0003 +05F0: 6772 -> 6072
CODE 0005 +0708: 6610 -> 6010
-
Speed Doubler
v1.0.1
v1.0
†SpeedDoubler 1.0.1
+1900
6632 - 6D32
••• Version: "1.0" •••
Removes the need for an inserted disk:
Code 2 +1618
6632 -> 6032
-
SpeedyCD
v1.2.4
02F614C99EB36FD8
†SpeedyCD 1.1.1 (Single Test Crack)
cdev #1 +3C66 6616->6016 (Think it’s Registered/use invalid serial #)
+2798 670C->600C To Register with anything for a serial number
+272B 6604->4E71
+27CC 6706->6006
-
Spin Doctor
v1.0
703-221-0616
†'CODE' #3 +591E 6702->4E71.
Allows you to enter anything (or nothing) for the "enter serial number" dialog.
-
Spreadbase
v1.01
OSI-1-F-002-00105-100
(That’s osi at start)
-
SPSS Base
v6.1
12345
-
Square One
v3.0
SQ3-00921-5991
-
Squizz
v1.0f
801652
801538
-
StarDate
v1.0
ESM-10379-8830
-
StatusMac
vAll
SMR25168 25 Users
-
Strata Instant Replay
v1.0
I286243253831
-
Strata Studio Pro
vAll
A156241377081
A466241527321
†The Serial Number follows this pattern: A**6241-----1. The "**" is representitive of one of the following sequences: 02,15,28,31,44,57,60,73,86,99. Plug one of these where the stars are.
In the "-----" space enter either of these sets of numbers: 37708 or 79824.
Using this method you can yield over twenty copies.
To do this edit the 'V4sn' resource. Be sure to make it the same length (14 bytes including the beginning length byte=$0D).
-
Strata Virtual 3D
vAll
V826243977191
-
Studio Pro
vAlias
Please see the entry Strata Studio Pro
-
StuffIt Deluxe
v3.5
DLXB-793-050000
†A StuffIt 3.5 serial number can be generated in the following manner:
DLX?-***-nnnnnn
Where:
? is an alphanumeric character (all alphabetic's are considered upper case)
*** is a three digit number calculated by adding the ASCII of the ?
(alphanumeric character) to 727
nnnnnn is any six digits.
Example: DLXZ-817-123456 or DLXA-792-123456.
v3.0 beta
Use any disk editor.
Search for: 1107 02FF D663 0ED4
Replace with: D660
Eliminates the expiration date.
v3.0x
To change the registration info, edit the data fork of StuffIt Deluxe. The
serial number is a 4 byte hex value at offset $144. If you want to find out
what serial number you used, take the negative if it was a 'B' serial number
and subtract 50000 from it. Your name follows the serial number with a
preceding length byte. You can just change the serial number bytes to 0, run
the program and reregister.
KRAK magic menu
Stuffit Engine Patch
Here's a nifty patch I made to "fix" the Stuffit Engine so that it no longer
asks "this archive is corrupted, do you wish to continue working with it?"
whenever I use the Magic Menu "Expand" command to expand old archives.
(Interstingly enough in this dialog, yes means yes and no also means yes.)
If you don't know what I'm talking about then you don't need this patch.
However, if you find yourself in situations unpacking multiple archives from
the MagicMenu, and have cursed Stuffit's stupidity in refusing to recognize its
CODE 3 @7BEC : .... .... 2F3C EF96 [] This is added to the END of
5EB1 6000 F076 3B7C [] CODE 3, do not modify any
0001 D0F0 4E75 [] existing data while adding this.
CODE 7 @1CB6 : 660A -> 600A
Show 'Master' Menu:
CODE 2 @0B3E : 6710 -> 4E71
-
TCP Connect II
v2.0
DRJLT 8500 SVHTC 9210
DRJLT 8500 KLCVV 2300
DRJLT 8500 JRWHD 7050
DRJLT 8500 DVLNS 4570
DRJLT 8500 QLSBX 4320
DRJLT 8500 ATGFM 9920
DRJLT 8500 IDXDB 4860
DRJLT 8500 PMLJZ 4410
DRJLT 8500 UQHNH 6040
DRJLT 8500 PTXYB 7810
DRJLT 8500 NMXCD 2300
DRJLT 8500 ENDWZ 6010
DRJLT 8500 PWTHL 2600
DRJLT 8500 ECPJP 0320
DRJLT 8500 XLHTK 4410
-
TeleFinder
v4.0
Serial Number: TF00-00001 (or just "1")
Registration Number: M3B6A7 (case not important)
Nodes Licensed: 2 Nodes
Registration Number: A7G4F
Nodes Licensed: Unlimited Nodes
†Why not let TeleFinder cook one up for you...
* Load Debugger
* Load TeleFinder
* When dialog appears, press interrupt switch
* Set breakpoint for CODE $39, offset $1762 of the TeleFinder Application
* Return from interrupt
* Type any number greater than zero into the Serial Number field
* Set Nodes Licensed to anything (why not unlimited?)
* Press OK
* When debugger comes up, display memory pointed to by register A2
* This ASCII pascal string (length byte first) is your Registration Number
-
Tempo EZ
v1.2a
TEZ0104104078
-
Terrazzo
vAll
600701841233
-
TextBridge
v2.0.2
PN#31-07995-00 SN#9404TM01068
-
TextureMaker
v1.0
56-1000-202888264
-
TextureScape
v1.5
27-9003-6624
27-9082-9628
-
The Incredible Machine
vAll
†Password 'awe' - this password works for every level
Here is a little help for those of you currently playing "The Incredible
Machine". Of the total number of 160 puzzles, the following passwords
are for the first forty.
01. (NR) 11. BASEBALL 21. COUNTDOWN 31. COMPACT DISK
02. SIERRA 12. BEAR 22. PSALMS 32. SHAVER LAKE
03. DYNAMIX 13. FISH 23. TANK 33. RHEUMATISM
04. MACHINE 14. DALE 24. NIGHT 34. HARPSICHORD
05. DISK 15. CHESTERTON 25. GAMES 35. MARKET
06. SHUTTLE 16. SIZE 26. WESTERN 36. DEST
07. SATURN 17. IRELAND 27. LOG HOME 37. MYRTLE
08. KING 18. WORD 28. GRAPHICS 38. QUATERNION
09. DRAGON 19. BRIEF 29. KNUTH 39. SHOE
10. ANTS 20. HOT DOG 30. DONALD 40. FLOWER
-
The Mist
vAll
†Search for: F92C 443C 994E
Change to: D15D F737 " "
Search for: 6094 21A4 7948
Change to: 6794 " " " "
Search for: 101A 69D0 A505
Change to: 71DC F456 E3E0
-
The Palace
v1.0.1
LV3M-GRTN-XNG7E
-
Theorist
v1.51
010626
†Version 1.51
Open CODE 4 in ResEdit
Change it at offset $2BEE
From: $670C
To: $600C
-
Think Ahead+
v3.0.1
RK#2103171921
†To register bring up the about box and option-click on the icon on the right.
My SN# was 180101 (I don't believe this is used) the Registration Key was 2103171921
which comes from the 'magic' number (a constant initialized by the DATA resource) $4D8EEEF5=#1301212917 which maps to 2103171921=RK under the transformation rules that the first 5 and last 5 decimal digits are reversed and concatenated.
-
Tiles
v1.0
100369
-
Timbuktu
v5.0.x
283-961-742-350
283-962-334-986
247-084-561-538
247-086-646-953
247-083-731-231
247-080-756-939
247-070-062-382
247-061-593-341
247-081-055-303
247-062-971-815
247-082-602-838
247-082-602-838
247-074-375-896
247-069-542-312
247-085-957-012
247-073-186-241
247-060-285-987
247-077-990-950
247-078-288-405
247-087-766-436
247-076-343-506
247-064-707-220
247-088-845-597
247-066-385-138
247-089-304-931
247-063-261-279
247-067-064-988
247-071-627-818
247-072-430-997
v4.0.x
051-068-845-152
051-097-722-701
052-894-620-727
067-086-572-435
067-288-614-997
067-295-045-299
067-393-760-509
067-488-972-118
067-586-461-043
067-598-447-877
191-560-555-335
191-561-674-837
228-610-931-242
228-611-484-200
228-612-364-808
228-613-166-253
228-614-408-908
228-615-466-223
228-616-330-503
228-617-131-139
228-618-474-703
228-619-662-715
228-620-096-279
228-621-706-815
228-622-895-726
228-623-240-291
228-624-950-827
228-625-903-106
228-626-093-017
228-627-335-582
228-629-767-845
228-631-150-533
228-632-583-288
228-633-083-420
228-634-534-479
228-635-346-015
228-636-966-551
228-637-769-196
228-638-231-146
228-639-931-501
229-000-127-282
229-001-457-825
229-002-438-242
229-003-880-907
229-004-582-342
229-005-753-126
229-006-534-533
229-007-067-298
229-008-777-743
229-009-866-745
229-010-221-210
229-011-921-846
229-012-365-310
229-013-454-211
229-014-307-500
229-015-108-136
229-016-320-296
229-017-420-107
229-018-121-552
229-019-564-207
229-020-752-128
229-021-085-792
229-022-207-942
229-023-769-507
229-024-859-418
229-026-993-519
229-027-973-127
229-028-425-186
229-029-137-531
229-090-452-045
229-091-903-922
229-092-704-458
229-093-925-518
229-094-996-125
229-095-448-093
229-096-161-529
229-097-593-193
229-098-094-416
229-099-903-355
229-100-256-920
229-101-237-428
229-102-789-001
229-103-491-931
229-104-932-597
229-105-922-105
229-106-266-759
229-107-785-232
229-108-666-840
229-109-867-999
229-110-581-425
229-111-142-303
229-112-022-911
229-113-465-556
229-114-266-011
229-115-407-846
229-116-208-201
229-117-929-837
229-118-363-302
229-119-452-213
229-210-120-551
229-211-911-197
229-212-264-751
229-213-055-297
229-214-895-227
229-215-497-762
229-216-200-208
229-217-308-447
229-218-020-903
229-219-463-548
229-220-264-003
229-221-095-033
229-222-785-579
229-223-150-225
229-224-030-742
229-225-440-396
229-226-892-960
229-227-584-496
229-228-226-033
229-229-026-982
229-230-478-527
229-231-460-135
229-232-770-113
229-233-092-857
229-234-892-212
229-235-325-930
229-236-116-476
229-237-776-343
229-238-657-951
229-239-001-506
229-300-745-547
229-301-956-807
229-302-578-333
229-303-271-979
229-304-841-938
229-305-822-446
229-306-414-991
229-307-966-546
229-308-866-495
229-309-876-240
229-310-470-876
229-311-931-341
229-312-022-252
229-313-364-907
229-314-165-352
229-315-856-998
229-316-696-928
229-317-300-363
229-318-262-743
229-319-243-251
229-320-893-219
229-321-495-845
229-322-947-320
229-323-827-928
229-324-739-876
229-325-282-083
229-325-950-926
229-326-441-148
229-327-883-722
229-328-793-561
229-329-147-217
229-330-027-825
229-331-461-389
229-332-381-228
229-333-261-836
229-334-703-310
229-335-924-561
229-336-477-519
229-337-457-127
229-338-809-700
229-339-502-227
229-340-931-700
229-341-902-207
229-342-603-752
229-343-567-022
229-344-655-943
229-345-088-598
229-346-800-043
229-347-143-799
229-348-243-510
229-349-774-275
229-350-386-710
229-351-476-521
229-352-338-901
229-353-141-437
229-354-583-001
229-355-441-407
229-356-973-081
229-357-585-507
229-358-207-143
229-359-117-093
288-628-147-118
288-630-570-593
†Timbuktu 4.01
This patch works by changing the "check serial number" routine, to always
accept the entered serial number as valid. Timbuktu checks the serial number
in two places: (1) at startup in the INIT, and (2) in the DA when it is
opened. Therefore, there are two patches:
Rsrc
ID
Patch
New Code
INIT -15999
4E56 FFE6 48E7 1100 206E
205F 584F 1EBC 0001 4ED0
oTB2
1000
"
"
The INIT resource is in the Timbuktu startup document (naturally), but the
oTB2 resource is in the Timbuktu Desk Accessory. In the version I had (4.0.1),
which is posted on this board, the offsets for the patches in the resources
were:
Rsrc
Offset to patch
INIT
$2E12
oTB2
$2BC0
Just make sure you don't enter the same serial number twice on the same
network. The format for the Timbuktu 4.0.1 serial numbers is:
Open the resource 'LOST' and inside resource #128, you will see your personalization information. The first two bytes are the checksum, the next byte is the length of the personalization information. The program verifies the checksum when it starts up, so if you change it (not reset it), it will quit. To reset the personalization, just change the checksum (first two bytes) to $FFFF and then delete the rest of the data. Save your handy work and run the program.
I have not tested to see if it checks for a certain serial #, but 0123456789 seems to work every time for me. It also seems to take '0123' as a valid serial number, so I don't think that is checking the serial number against anything.