The hook: In one of today's digests, a short passage flashed by about id Software's early digital distribution and a group called GNOMON, which 39 days after release put out QCRACK.EXE — a crack that unlocked all the "encrypted" games on the Quake compact disc. At first I thought it was just another tall tale about teenage reverse engineers from the '90s. But the deeper I dug, the clearer it became: this isn't a "hacker story," it's a technical autopsy of an entire business model that seems wildly familiar to us today — precisely because the same model, in its correct incarnation, led us to Steam, the Epic Games Store, and subscription services. A story about how security by obscurity killed the first honest experiment with digital monetization, and why Carmack never again tried to sell games through physical media with built-in encryption.
August 1996, on the shelves of CompUSA stores across America, the Quake Shareware CD-ROM appears. Price — $9.95. On the disc — the Quake shareware version (22 MB) and a catalog of early id Software games, encrypted using TestDrive Corp technology. The idea was beautiful and absolutely in the spirit of the times:
So id Software wanted to turn the shareware disc into a universal catalog: pay-one-price-for-CD, pay-one-phone-call-for-unlock-the-whole-thing. This was 11 years before Steam, 14 years before Xbox Live Arcade, 22 years before the Epic Games Store. And it worked on one of the most inconvenient infrastructures of the '90s — a landline phone. In 1996, this was technological hooliganism.
August 30, 1996 — release.
October 8, 1996 — the GNOMON group releases Quakecrk.zip, containing QCRACK.EXE, a crack that unlocks every game on the disc.
39 days. Not three months. Not "sometime later." Less than six weeks.
This is the most interesting part. The GNOMON group didn't break the encryption in any cryptographic sense. They broke the architecture of trust. And the break was so simple that Fabian Sanglard in 2026 reconstructed it single-handedly, armed with only the disc and a text editor.
Here's what was on the compact disc:
.MJ3 file (encrypted .EXE) and its corresponding piece of .ST3 (a table needed for restoration).FLOW.EXE — a graphical unlock interface. It could generate a SERIAL from a CHALLENGE locally.PAGEMKR folder — all the .ST3 pieces (i.e., all the tables for all the games).FLOWDIR folder — a plain-text version of SKU.TXT, which completely duplicated the contents of the encrypted SKU.17. Meaning the encryption of the game database was decorative — the unencrypted duplicate lay right next to it.GNOMON's main discovery, which killed the entire system:
The SERIAL given out over the phone contained no secret. It was just "proof of payment."
Meaning TestDrive Corp and id Software built the system so that the unlock code was generated by the same logic that lived on the disc. CHALLENGE → several transformation steps through the game's CODENAME, DOC file, XOR table, reverse 7-bit pass and two constants (0x18 and 0x83 + 0x1EA3/0x1700A1) → SERIAL. The call to the 800 number only added the fact of payment, while the actual cryptographic secret did not exist in nature.
The formula Sanglard reverse-engineered:
unlock = ((reverse7(GAME_ID) + MEM + 0x18) & 0x7F)
+ 0x83 * ((MEM ^ 0x1EA3) + 0x1700A1)
That's it. Anyone who knew this formula could generate a valid SERIAL in a millisecond, without calling anyone at all. And GNOMON figured it out.
Then more details emerged that turned the story from "hacker triumph" into "engineering mess":
.DIR extension of the library was neither encrypted nor scrambled — reversing the format took GNOMON a matter of hours..TMP files, .BAK backups, and the program ENCRYPT.EXE, which wasn't used in the final version at all.Sanglard himself writes about this with a killer formulation:
"Never attribute to malice that which can be explained by stupidity. And never attribute to stupidity that which can be explained by lack of time. Fab's Razor."
Numbers from Masters of Doom by David Kushner (the canonical biography):
"The retail shareware experiment with Quake turned out to be catastrophic. In theory, id was going to cut out the retail middlemen by letting gamers buy the shareware disc and then call an 800 number to get a password to unlock the rest of the game. But gamers wasted no time cracking the shareware to get the full version for free. What's worse, the routine of distribution and order processing got out of hand. In a desperate measure, id tried to slow down retail shareware, but it was too late. They were stuck with almost 150,000 discs in inventory."
150 thousand CD-ROMs at $9.95 — that's ~$1.5 million in procurement losses, plus warehousing costs, plus reputational catastrophe, plus loss of control over monetization.
The contrast with the parallel reality of that same year is striking:
So id Software simultaneously built a working model of free distribution via the internet and a non-working model of protected monetization via CD. The first won. The second died so quickly that almost no one remembers it — which is a shame, because it was the technical foundation on which all modern digital stores later grew.
And here's another number few people recall: in that same 1996, id Software brought in $15.6 million in revenue and made multimillionaires of all six co-founders. Carmack, Romero, Adrian Carmack, Jay Wilbur, Kevin Cloud, Michael Abrash. The loss from 150 thousand discs was a financial scratch for them. But they remembered it for a long time.
The TestDrive Corp system itself is a separate story, and it's much more interesting than the crack itself. TestDrive invented "denaturing" executable files:
.EXE..MJ3..ST3.Conceptually, this is an attempt to turn commercial software into physical shareware: you buy the disc, but only what isn't locked behind a key is playable. Want the full version — pay, get unlock.
TestDrive had two US patents on this mechanism:
TestDrive Corp itself was based in Princeton, New Jersey, and ideologically was an heir to the shareware model, but tried to make it corporately safe for publishers. Their clients in the early '90s were Lotus, Adobe, Borland. They were a real company with real clients.
But in 1996 their technology faced a real mass audience for the first time, which wasn't just "a home user with a floppy," but an internet audience that knew how to use a debugger. And here the architecture designed for a physical store with anonymous purchases instantly turned into a cardboard facade.
Later TestDrive tried to pivot toward corporate software and online activations, but their technology remained stuck in the '90s. They tried to reinvent Steam 20 years before the infrastructure allowed it to be done properly.
If you look at the chronology further, the story gets even more interesting:
Three things hooked me here, and each is its own layer.
First, this is a lesson about security by obscurity in its pure, distilled form. TestDrive Corp encrypted the SKU.17 database. Put the unencrypted SKU.TXT right next to it. Carmack and id Software didn't notice this — because in their mental model the disc is an artifact the buyer receives once and never touches again. They weren't thinking from an attacker's model, someone who would disassemble the disc byte by byte. In this sense, QCRACK.EXE isn't the reverse engineering of a clever hacker, but the discovery of an architectural error that a TestDrive Corp engineer left in haste. If we put it up for discussion, we'd say: "this is a bug, not a feature, it needs to be removed before release." But the .BAK, .TMP files, the unencrypted .TXT floated onto the master disc.
Second, this is a lesson about time allocation. Sanglard's quote — "never attribute to stupidity that which can be explained by lack of time" — perfectly describes not just TestDrive, but the entire Quake project as a whole. They were simultaneously finishing Quake, doing the shareware release via internet, preparing the retail CD, negotiating with TestDrive, coordinating box design, and there was no time to proofread the disc. They had one programmer (Jay Wilbur), one "biz guy," plus Carmack himself. They were building a business model that couldn't be built at that time. And they didn't have the resources to polish it to working condition.
Third — and this is the subtlest — this is a lesson about how new distribution models are born. id Software simultaneously created two models:
Carmack and id learned this lesson for free: the future of digital distribution is internet + server-side authorization, not encryption on media. It took Valve another 7 years to materialize this lesson in Steam. Modern studios spend millions on DRM protections that get cracked in a week, even though the 1996 story gives a simple recipe: don't put what you want to protect on the disc.
If you reduce the Quake shareware CD story to one paragraph — it goes like this: 30 years before Steam arrived, a group of hackers proved in 39 days that there's no universal way to protect digital content from reverse engineering on a user's device. And this knowledge has basically remained unshakeable — only the economics changed: before, enthusiasts paid for cracks with money and fame, today piracy markets pay for it. Same principle. Server-side validation is the only thing that actually works, because it doesn't try to hide the key on the user's device, but makes it so the user's device can't run anything without the server.
The Quake shareware CD isn't "the failure of 1996." It's a field experiment showing that any DRM scheme without a server-side component is doomed. Carmack later, in the 2000s, openly said the most successful PC games are those where DRM is either absent or minimal, because converting pirates to buyers depends not on protection, but on convenience. In 1996, id Software tried to make "convenient protection," and that attempt left them with 150 thousand dead discs and one good lesson for the next thirty years.
Today Valve, Epic, Apple, Google use exactly the architecture that didn't exist in 1996: no device encryption, cloud authorization, and every purchase tied to an account that's alive as long as the account is alive. In 1996, three things blocked this architecture: lack of broadband internet in most households, lack of cheap cloud storage, and lack of the habit of paying for digital content via subscription. All three barriers fell by 2003 — and Steam became possible.
QCRACK.EXE wasn't a crack of encryption. It was a crack of a business model that tried to get by without infrastructure, without server-side validation, and without constant connection. The lesson the industry learned in 7 years: don't try to sell what's sitting on the buyer's disc. Sell access to what's sitting on yours.