Remember CD-ROMs? Those spinning discs required physical installation on a PC. In the case of the Quake shareware CD release, id Software packed the disc with a lot more than just the iconic shooter. According to a blog post by Fabien Sanglard, the game itself took up a mere 22 MB of the CD-ROM's 640 MB capacity.

Quick Facts

  • Original Release: 1996 (Quake launched June 22, 1996; Metacritic score 94).
  • Platforms: PC (along with many subsequent ports including PlayStation 5, Xbox Series S/X, Nintendo Switch, and more).
  • The Concept: A retail shareware CD priced around $10 containing locked versions of id Software's entire game back catalogue.
  • The Flaw: Players could bypass payment by using a cracked executable released 39 days after launch.

The Hidden id Software Back Catalogue

John Carmack famously joked that if there was ever a CD version of Doom, it would come with a "Making of Doom" feature film to use up the remaining disc capacity. Instead, id Software decided to use the empty space to store locked versions of the studio's entire back catalogue.

The distribution model allowed buyers to gain access to these locked games by calling a telephone hotline, paying over the phone, and receiving an unlock code. It operated on the same principle used to turn the shareware version of Quake into the full retail game.

How the Quake CD Security Was Cracked

Just 39 days after the CD-ROM hit stores, a file named Quakecrk.zip surfaced on the internet. Contained inside was Qcrack.exe, a utility that let users generate codes to decrypt every single game on the disc without paying.

The GUI on the CD-ROM provided a code number that users were meant to relay to a phone agent in exchange for a serial number. However, the software's local unlock program was actually capable of generating valid serial numbers on its own. It only checked whether the locally-generated serial matched the user-entered serial. The cracked program exploited this loop by creating valid serials using generated code numbers automatically.

Warehouse Surplus and a Typo

As detailed in David Kushner's book Masters of Doom, orders and distribution spun out of control as gamers quickly hacked the shareware disc. In a desperate measure, id Software attempted to halt retail shareware distribution, leaving roughly 150,000 CDs sitting in a warehouse.

To compound the disaster, Sanglard's analysis of the file structure revealed that the pirated experience was technically superior to the legitimate one. A small typo in the filename of SKU.17—where 'Final' was capitalized instead of lowercase ('final')—prevented Final Doom from being accessed legitimately over the phone. Consequently, paying customers hit a roadblock while illegitimate users enjoyed uninterrupted access.