⏱️ Lectura: 11 min
In 1996, id Software printed 150,000 copies of a CD-ROM that nobody needed to pay to fully unlock: a free tool called QCRACK.EXE was enough.
📑 En este artículo
On August 17, 2026, researcher Fabien Sanglard published a technical reconstruction of how the Quake Shareware CD-ROM protection system worked, a phone-based unlock scheme that the hacking scene broke in just 39 days after its original release.
TL;DR
- id Software’s Quake Shareware CD sold for $9.95 at CompUSA and Computer City starting August 30, 1996.
- The hacking group GNOMON released Quakecrk.zip just 39 days later, on October 8, 1996, with the QCRACK.EXE tool.
- The unlock system used a CHALLENGE that rotated every 5 minutes and a SERIAL validated by phone at 1-800-ID-GAMES.
- The protection was provided by TestDrive Corp, an external company, not id Software.
- id Software ended up with nearly 150,000 unsold CDs in a warehouse after the scheme’s commercial failure.
- The number 1-800-669-9342 is still active in 2026, but it no longer connects to an unlock operator.
- The CD included encrypted access to id’s entire catalog: multiple versions of DOOM, Heretic, and Hexen.
- Fabien Sanglard documented the full case on August 17, 2026 on his technical blog.
Introduction
In the mid-1990s, the CD-ROM was the most coveted accessory for a PC, second only to the pricey Intel Pentium processor. With a capacity of 640 MiB, three times a typical hard drive of the era, the format opened the door to 640×480 photos with a 256-color palette, VOC-format audio tracks, and Video for Windows clips at 12 fps.
For game studios, that capacity was overkill. Titles like 7th Guest (1993), Wing Commander III: Heart of the Tiger (1994), and Phantasmagoria (1995) filled their discs with live-action video sequences, something unthinkable when only a portion of the screen could be animated. John Carmack, id Software’s technical lead, viewed that padding with suspicion:
“People expect CD games to have tons of digitized speech and video […] The joke here is that if we ever do a CD version of DOOM, you’re going to get the game and ‘The Making of DOOM,’ a one-hour feature film. I’d rather strip everything down to the essentials and fit on a cartridge than needlessly pad out a CD. I have a minimalist sense of aesthetics in game design.”
That quote, from a January 1994 interview with Atari Explorer Online, explains why Quake ended up taking up just 22 MiB in its shareware version. It also explains why id Software came up with a bold idea to make use of the disc’s leftover space.
What happened with the Quake Shareware CD-ROM
By June 1996, after three years of development, id Software had finished Quake. As with its previous games, the company planned to release a free shareware version and a paid full version. Since the shareware took up just 22 MiB of the 640 MiB available on a CD-ROM, someone at id had an idea: fill the leftover space with encrypted versions of the company’s entire catalog.
The business logic seemed solid. A player could buy the CD for $9.95 at stores like CompUSA or Computer City, try the shareware, and if they wanted the full game (or any other id title) all it took was a call to an 800 number with a credit card to get an unlock password instantly. No middlemen distributors, no waiting for mail delivery.
The CD was announced on July 3, 1996 and went on sale August 30 of that year. The experiment didn’t last long: the hacking group GNOMON released the file Quakecrk.zip just 39 days later, on October 8, 1996. Inside was QCRACK.EXE, a tool capable of decrypting any of the games included on the disc without going through the phone or a credit card.
Context and history
Journalist David Kushner documented the outcome in his book Masters of Doom: the Quake shareware retail experiment turned into a disaster. id’s idea was to cut out distributors by letting players buy the shareware and then call an 800 number to request a password unlocking the rest of the game. But players wasted no time hacking the shareware to unlock the full version for free. Worse, the logistics of distribution and order fulfillment spiraled out of control. In a desperate move, id tried to halt retail sales of the shareware, but it was too late. They ended up with nearly 150,000 CDs piled up in a warehouse.
The group’s name, GNOMON, doesn’t appear in the credits of any game: like much of the 1990s cracking scene, it operated anonymously and distributed its work through BBS systems and underground FTP sites, long before centralized forums or mass P2P networks existed. That a single group managed to break TestDrive Corp’s scheme in just over a month illustrates how quickly the scene could analyze an MS-DOS binary without modern debugging tools.
Thanks to Usenet archives from the rec.games.computer.quake.misc group, detailed discussions exist of how the system worked in practice. The packaging had surprisingly high quality for a shareware product: a sticker on the cover clarified it was the shareware version, with instructions to call 1-800-669-9342 (or 1-800-ID-GAMES) to unlock the full game.
That phone number is still active in 2026. But since the CompUSA chain closed between 2007 and 2008, it no longer connects to an unlock operator: today it answers with an automated message trying to sell products unrelated to Quake.
Technical details and performance
The unlock process was, on the surface, solid. The CD’s graphical interface let you jump straight into the Quake shareware, but it also included a QUAKE UNLOCK button. There was also a section called ID STUFF that let you browse id’s full catalog and unlock any of its games: multiple versions of DOOM, plus Heretic and Hexen.
When starting the unlock process, the program generated a number Sanglard calls the CHALLENGE, which the user had to relay over the phone to a service agent. After payment, the agent provided a number back, the SERIAL, which unlocked the game. Both numbers included checksums to mitigate transcription errors, an inherent risk of the most primitive communication channel possible for this kind of transaction: a phone call.
The key defense against reusing a stolen or shared SERIAL was time: the CHALLENGE changed every time the program ran and also rotated automatically every 5 minutes while the interface stayed open. Since the CHALLENGE included a random component, there was no way to reuse a previously issued SERIAL for another session.
The technology behind the lock and unlock wasn’t id Software’s own: it was provided by TestDrive Corp, an external company specializing in anti-piracy systems for retail distribution. That detail explains why the scheme relied on a third-party phone service rather than Quake’s own code.
sequenceDiagram
participant J as Player
participant G as "CD GUI"
participant O as "Phone Operator"
participant T as "TestDrive System"
J->>G: Runs QUAKE UNLOCK
G->>J: Shows the CHALLENGE
J->>O: Calls with the CHALLENGE
O->>T: Requests the SERIAL
T-->>O: Returns SERIAL with checksum
O-->>J: Reads out the SERIAL over the phone
J->>G: Enters the SERIAL
G-->>J: Unlocks id's catalogTo illustrate the general principle of a challenge-response system with a checksum, without reproducing TestDrive’s actual algorithm, which was never published, a simplified version looks like this:
import random
def generate_challenge():
number = random.randint(100000, 999999)
checksum = sum(int(d) for d in str(number)) % 10
return f"{number}-{checksum}"
def validate_serial(challenge, entered_serial, expected_serial):
number, checksum = challenge.split("-")
return entered_serial == expected_serial and int(checksum) == \
sum(int(d) for d in number) % 10
This snippet doesn’t reproduce TestDrive’s algorithm, but it shows the principle: a number that changes each session, a checksum to catch phone dictation errors, and validation that depends on both.
How to try it
The original 1996 CD is no longer sold, but the shareware that ran on it is still perfectly runnable today with a DOS emulator. The shareware, by design, was always freely distributable, so the simplest way to relive the experience is with DOSBox or its fork DOSBox-X, available on all three major platforms.
# Windows (with winget)
winget install --id DosBox.DosBox -e
# macOS (with Homebrew)
brew install dosbox
# Linux (Debian/Ubuntu)
sudo apt install dosbox
With DOSBox installed, the flow for running the original shareware is to mount the folder as a virtual drive and run the binary:
mount c /path/to/quake-shareware
c:
cd quake
QUAKE.EXE
This doesn’t unlock anything: it just runs the original 22 MiB shareware version, the same one 1996 players ran before deciding whether to call 1-800-ID-GAMES.
💡 Tip: If you want to see period technical documents, the Usenet archives from rec.games.computer.quake.misc are still accessible via Google Groups and are the primary source Sanglard used to reconstruct the protocol.
Impact and analysis
The commercial failure of the Quake Shareware CD-ROM had concrete consequences. id Software ended up with roughly 150,000 unsold CDs, a logistical problem Kushner documents as part of the company’s operational strain during that period. The cut-out-the-middleman model the CD promised ended up creating more friction than savings: between phone orders, credit card validation, and handling complaints, the operation became unmanageable even before piracy of the scheme itself finished it off.
The episode also serves as a case study on the limits of DRM based on a shared secret and a human communication channel. It only took one group understanding the relationship between CHALLENGE and SERIAL for the entire protection to fall, and once the tool was published, any user could repeat the process without limit.
The pattern later repeated with other protection schemes based on a single, static secret: whenever validation depends on one fixed algorithm, extracting it from the binary (with a debugger, or today with automated static analysis tools) is usually enough to break the entire protection, no matter how many layers of checksums are added on top.
| Distribution model | How it worked | Advantage | Limitation |
|---|---|---|---|
| Shareware CD with phone unlock (Quake, 1996) | CHALLENGE/SERIAL validated by a human operator via TestDrive Corp | Instant purchase, no distributor | A single crack exposes the entire catalog |
| Shareware with mail-in registration (DOOM, 1993) | Player mailed a form and payment to receive the full game by post | No real-time validation infrastructure needed | Delivery times of days or weeks |
| Digital distribution with account (current model) | Binary downloads encrypted and validates against an account on every online run | Automatic updates and patches | Requires a connection and platform dependency |
What’s next
The Quake Shareware CD-ROM case foreshadowed a problem the software industry kept solving over the following three decades: how to verify a purchase without relying on a human in the middle. Modern activation systems inherit the same challenge-response logic TestDrive Corp used, but automated end to end and without checksums designed for phone dictation.
The comparison to today’s digital distribution isn’t just nostalgic: it explains why practically no major studio returns to a phone-based validation model today. The cost of running call centers, printing physical CDs, and dealing with unsold inventory disappeared once internet access became the norm in homes.
💭 Key takeaway: John Carmack himself predicted the problem before it happened: his preference for games that fit on a cartridge reflected distrust of the multimedia padding the CD-ROM encouraged, not just in content but in the distribution complexity that came with it.
📖 Summary on Telegram: View summary
Try it yourself: install DOSBox with the command for your operating system and run the original Quake shareware in minutes.
Frequently Asked Questions
What was the Quake Shareware CD-ROM?
A $9.95 disc sold in 1996 at stores like CompUSA that included the Quake shareware version (22 MiB) plus encrypted versions of id Software’s entire catalog, unlockable by phone.
Who cracked the protection?
The hacking group GNOMON, which released the tool QCRACK.EXE inside the file Quakecrk.zip on October 8, 1996, 39 days after the CD’s release.
Who provided the protection technology?
TestDrive Corp, an external company specializing in unlock systems for retail distribution, not id Software.
Is the 1-800-ID-GAMES number still working?
The number is still active in 2026, but it no longer connects to an unlock operator because CompUSA closed between 2007 and 2008; today it answers with an automated message unrelated to Quake.
Can you still play the original shareware today?
Yes. The binary runs unmodified in DOSBox or DOSBox-X on Windows, macOS, and Linux, by mounting the game folder as a virtual drive.
How many CDs went unsold?
According to David Kushner in Masters of Doom, id Software ended up with nearly 150,000 CDs piled up in a warehouse after the scheme’s commercial failure.
References
- Quake Shareware, a CD-ROM just a little too full: Fabien Sanglard’s original research on the CD’s unlock system.
- Quake (video game) – Wikipedia: general context on the game’s development and 1996 release.
- Masters of Doom – Wikipedia: reference to David Kushner’s book documenting the scheme’s commercial outcome.
- DOSBox: official emulator used to run the original Quake shareware on modern systems.
📱 Enjoy this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day. @programacion
Imagen destacada: Foto de Fernando Lavin en Unsplash
0 Comments