In 1996 id Software finished Quake and had a distribution idea. The shareware version took only 22 MiB, leaving most of a 640 MiB CD-ROM empty. So id filled the disc with encrypted copies of its full catalogue, including DOOM variants, HEXEN and HERETIC. Gamers bought the CD for $9.95 at CompUSA or Computer City, then called 1-800-ID-GAMES, paid by credit card and received an unlock code. No retailer middlemen, instant delivery.

The CD shipped on August 30, 1996. The hacker group GNOMON released QCRACK.EXE 39 days later. It generated a valid serial for every game on the disc. id was left with roughly 150,000 unsold CDs in a warehouse, as David Kushner recounts in Masters of Doom.

The protection came from TestDrive Corp. Their encrypter replaced the first 32 KiB of an executable with a custom header, renamed it to .MJ3 and stored the encrypted original header in a .ST3 file. The missing piece was supposed to be a secret seed derived from the serial you got by phone.

The fatal flaw: the serial contained no secret. It was only proof of payment. The unlock program FLOW.EXE on the CD computed the expected serial from the challenge all by itself and compared it with the user's input. The entire scheme rested on security by obscurity. In 2016 rmolina published the full algorithm: the 11-digit challenge splits into a 4-digit game ID and a 7-digit value for offset and depth, the game ID indexes an encrypted database to get a codename like doom2, and a DOC file plus the string "Testdrive Corp." transform a 508-byte hardcoded table into 254 16-bit values, which are walked backwards with XOR to produce one value that yields the serial.

Sanglard found more sloppiness. Final DOOM could never be unlocked legitimately because a typo in the database made game ID 12 map to "Final" with a capital F instead of "final", so paying customers got a worse experience than pirates. The CD also contained an unencrypted plain-text copy of the supposedly encrypted database. It also held editor backup files and several unused tools. Sanglard's verdict, which he calls Fab's Razor: never attribute to stupidity what you can attribute to time pressure.

A footnote for nostalgics: the unlock hotline is still active today. CompUSA went out of business between 2007 and 2008, so the number now plays an automated sales pitch for senior products instead of connecting you to an operator.