siddhartha @siddharthaHacks

A new tutorial is up on blog.os9.ca. I detail exploiting poorly implemented serial number algorithms in REALbasic applications. blog.os9.ca/2022/09/11/002…

Pirates! has a doc check that makes the first sword fight nearly impossible to win if answered wrong. In elementary school, I always that that was the way it was supposed to be. Not any more! macintoshgarden.org/games/pirates

My new blog will be going into much greater detail on specific cracks and algorithm reversals that I've done. It's like an updated howtocrack.txt. blog.os9.ca

The Ancient Art of War 3.0 (1985) is my first pre-System 7 crack. It was a simple doc check, but this early version of MacsBug made me appreciate future releases. When cracking this form of copy protection, the goal is to bypass the prompt entirely. macintoshgarden.org/games/the-anci…

A massive archive of Apple Developer Documentation circa 1997-2002 is now available (and searchable) at: dev.os9.ca

All the Buck's Serial Number Generator (BSNG) plugins I have written for Macintosh Garden are now open source and archived on GitHub. github.com/siddhartha77/b…

A keygen for the early Mac multiplayer game, WWII Skyfighters (1997) has finally arrived. The serial check was cleverly hidden during gameplay and the quite simple algorithm was drawn out to a few hundred instructions for further obfuscation. macintoshgarden.org/games/world-wa…

OIDS 2 (2002) had a robust algorithm with a 16-byte substitution key and a 256-byte encryption key: subCipher > cryptRnd1 > MD5 > cryptRnd2 > subCipher It was also a task to trace where and how the code was entered (at the main screen and press Enter). macintoshgarden.org/games/oids-2

Pocket Battles (1994) is the first time I have been able to bypass anti-debugger techniques. Protected by Uniloc, it rewrote MacsBug pointers in the low area of RAM then used the new values as decryption keys. Full analysis here: pastebin.com/K1CPgHMC macintoshgarden.org/games/pocket-b…

If we get really lucky, some reversing takes only seconds. In the MacsBug disassembly of Burbank Rummy, a subroutine named GenerateCode seems worth investigating. After stepping over it and examining the output, the serial number is quite obvious. macintoshgarden.org/games/burbank-…

keyboard_arrow_left Previous keyboard_arrow_right Next

A brief document on My Modern Cracking Workflow. It will likely be updated with additional tips as time goes on. MacsBug is still essential after all these years! pastebin.com/2q9DZJ1s

Staring in awe at a subroutine a few hundred lines long for Airburst only to realize it was an extremely complicated atoi(). 🤦‍♂️ Airburst is unique though -- registration codes must be entered within two years. Hopefully you haven't formatted since 2003. macintoshgarden.org/games/airburst…

Many serial number aglorithms use a hash function on the inputted name. The magic numbers I look for in memory are: MD5: 0x98badcfe SHA-1: 0xc3d2e1f0 CRC-16: 0xc0c1, 0xc181 CRC-32: 0x04c11db7 There is overlap with MD5 and SHA-1, but only SHA-1 has the magic number above.

Many Macintosh Sierra games crashed after 1993. A modulo of seconds since Jan 1, 1904 causes an overflow. Sierra released a patch, but that pushed the crash to mid 2007. My patch reduces the dividend by 2 billion, extending the life of the games to 2072. macintoshgarden.org/games/sierra-p…

boogaloopers (1997) was a particularly nasty algorithm. It required a LUT matrix of 22 x 16 chars, a salted hash, bitmasking, and one final LUT. My own serial number generation function took nearly 200 lines of C code. Disgusting! macintoshgarden.org/games/boogaloo…

The Hextris (1996) algorithm has three check chars for the name, then a 13 char string that must have a CRC-16 of 0xA5D2 (~1 in 100,000). The novel part is it writes even bad serials to a pref file then loads it, burying the check in the loading code. macintoshgarden.org/games/hextris-…

Zap'T'Balls from 1995 has fun copy protection. It uses a two round substitution cipher using a 198 byte cipher text with a rotate thrown in for good measure. The key has two checksum chars and two placeholders. A true algebraic 'reversing' for once! macintoshgarden.org/games/zap-t-ba…

Cracking HyperCard stacks in 2021? That's what I did to Thief of Hearts. macintoshgarden.org/games/thief-of… The cute part of the copy protection was that the relevant portion of the script was after many carriage returns. On an 80s display, you would have to scroll quite far down.