Crack Sublime Text and Sublime Merge

Crack Sublime Text and Sublime Merge.md

Note

1. If you can, please purchase the genuine license through the official channel and support the software developer.
2. All crack methods here are implemented by @leogx9r.
3. All data is not guaranteed to be authoritative or correct, nor has it been tested across the platform, nor is it responsible for any errors, lost data, etc. in practice! Please assess yourself!!!
4. I am only within the ability to update the information based on the existing crack methods until the existing rules fail.

---

Sublime Patcher Script for personal use

The code implementation is very poor.
https://gist.github.com/maboloshi/5baecbddacf43855f13240b63be5673d

ToC

	Sublime Text	Sublime Merge
Stable channel	win / linux / mac / mac-arm64	win / linux / mac / mac-arm64
Dev channel	win / linux / mac / mac-arm64	win / linux / mac / mac-arm64

---

How to Crack Sublime Text, Stable Channel, Build 4152

Thanks to @leogx9r for providing cracking methods.

https://gist.github.com/JerryLokjianming/71dac05f27f8c96ad1c8941b88030451?permalink_comment_id=3762200#gistcomment-3762200 https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3802197#gistcomment-3802197 https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3803204#gistcomment-3803204

Win64

Desciption	Offset	Original	Patched
Initial License Check	0x000A8D78	55 41 57 41	48 31 C0 C3
Persistent License Check 1	0x000071D0	E8 17 FE 20 00	90 90 90 90 90
Persistent License Check 2	0x000071E9	E8 FE FD 20 00	90 90 90 90 90
Disable Server Validation Thread	0x000AAB3E	55 56 57 48 83 EC 30	48 31 C0 48 FF C0 C3
Disable License Notify Thread	0x000A8945	55	C3
Disable Crash Reporter	0x00000400	41	C3

for 4117, 4118: https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3927712#gistcomment-3927712

Bat Script

:: for Win64
cd /d "C:\Program Files\Sublime Text" || exit
certutil -hashfile sublime_text.exe md5 | find /i "15BB398D5663B89A44372EF15F70A46F" || exit
echo 000A8D78: 48 31 C0 C3          | xxd -r - sublime_text.exe
echo 000071D0: 90 90 90 90 90       | xxd -r - sublime_text.exe
echo 000071E9: 90 90 90 90 90       | xxd -r - sublime_text.exe
echo 000AAB3E: 48 31 C0 48 FF C0 C3 | xxd -r - sublime_text.exe
echo 000A8945: C3                   | xxd -r - sublime_text.exe
echo 00000400: C3                   | xxd -r - sublime_text.exe

PS：xxd.exe extracted from git for windows

The license can be any string.

Blocked by Microsoft Defender SmartScreen -> More Info -> Run Anyway

Screenshot

![Screenshot](https://i.imgur.com/t4QlRZ6.png)

![Screenshot](https://i.imgur.com/18372Rh.png)

Linux

Desciption	Offset	Original	Patched
Initial License Check	0x00415013	55 41 57 41	48 31 C0 C3
Persistent License Check 1	0x00409037	E8 C0 CC 12 00	90 90 90 90 90
Persistent License Check 2	0x0040904F	E8 A8 CC 12 00	90 90 90 90 90
Disable Server Validation Thread	0x00416CA4	55 41 56 53 41 89 F6	48 31 C0 48 FF C0 C3
Disable License Notify Thread	0x00414C82	41	C3
Disable Crash Reporter	0x003FA310	55	C3

Bash Script

# for Linux
cd /opt/sublime_text || exit
md5sum -c <<<"7038C3B1CC79504602DA70599D4CCCE9  sublime_text" || exit
echo 00415013: 48 31 C0 C3          | xxd -r - sublime_text
echo 00409037: 90 90 90 90 90       | xxd -r - sublime_text
echo 0040904F: 90 90 90 90 90       | xxd -r - sublime_text
echo 00416CA4: 48 31 C0 48 FF C0 C3 | xxd -r - sublime_text
echo 00414C82: C3                   | xxd -r - sublime_text
echo 003FA310: C3                   | xxd -r - sublime_text

macOS

Desciption	Offset	Original	Patched
Initial License Check	0x0009F313	55 48 89 E5	48 31 C0 C3
Persistent License Check 1	0x00009CEF	E8 3C 2D 13 00	90 90 90 90 90
Persistent License Check 2	0x00009D07	E8 24 2D 13 00	90 90 90 90 90
Disable Server Validation Thread	0x000A085D	55 48 89 E5 41 57 41	48 31 C0 48 FF C0 C3
Disable License Notify Thread	0x0009EF0E	55	C3
Disable Crash Reporter	0x00002A87	55	C3

Bash Script

# for MacOS
cd "/Applications/Sublime Text.app/Contents/MacOS/" || exit
md5 -q sublime_text | grep -i "B07FDB3A228A46DF1CC178FE60B64D3B" || exit
echo 0009F313: 48 31 C0 C3          | xxd -r - sublime_text
echo 00009CEF: 90 90 90 90 90       | xxd -r - sublime_text
echo 00009D07: 90 90 90 90 90       | xxd -r - sublime_text
echo 000A085D: 48 31 C0 48 FF C0 C3 | xxd -r - sublime_text
echo 0009EF0E: C3                   | xxd -r - sublime_text
echo 00002A87: C3                   | xxd -r - sublime_text

Re-Sign App

codesign --force --deep --sign - "/Applications/Sublime Text.app"

Requires Apple Command Line Tools to be installed

macOS (ARM64)

Based on: https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3929427#gistcomment-3929427

Desciption	Offset	Original	Patched
Initial License Check	0x01060C90	FC 6F BA A9 E6 03 1E AA	E0 03 1F AA C0 03 5F D6
Persistent License Check 1	0x00FEAD18	40 BB 03 94	1F 20 03 D5
Persistent License Check 2	0x00FEAD2C	3B BB 03 94	1F 20 03 D5
Disable Server Validation Thread	0x01061F28	F6 57 BD A9	C0 03 5F D6
Disable License Notify Thread	0x01060908	FC 6F BD A9	C0 03 5F D6
Disable Crash Reporter	0x00FE5780	FC 6F BC A9	C0 03 5F D6

Bash Script

# for macOS (ARM64)
cd "/Applications/Sublime Text.app/Contents/MacOS/" || exit
md5 -q sublime_text | grep -i "B07FDB3A228A46DF1CC178FE60B64D3B" || exit
echo 01060C90: E0 03 1F AA C0 03 5F D6 | xxd -r - sublime_text
echo 00FEAD18: 1F 20 03 D5             | xxd -r - sublime_text
echo 00FEAD2C: 1F 20 03 D5             | xxd -r - sublime_text
echo 01061F28: C0 03 5F D6             | xxd -r - sublime_text
echo 01060908: C0 03 5F D6             | xxd -r - sublime_text
echo 00FE5780: C0 03 5F D6             | xxd -r - sublime_text

Re-Sign App

codesign --force --deep --sign - "/Applications/Sublime Text.app"

Requires Apple Command Line Tools to be installed

---

How to Crack Sublime Text, Dev Channel, Build 4154

Thanks to @leogx9r for providing cracking methods.

https://gist.github.com/JerryLokjianming/71dac05f27f8c96ad1c8941b88030451?permalink_comment_id=3762200#gistcomment-3762200 https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3802197#gistcomment-3802197 https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3803204#gistcomment-3803204

Win64

Desciption	Offset	Original	Patched
Initial License Check	0x0009E47C	55 41 57 41	48 31 C0 C3
Persistent License Check 1	0x0000647C	E8 23 7C 20 00	90 90 90 90 90
Persistent License Check 2	0x00006495	E8 0A 7C 20 00	90 90 90 90 90
Disable Server Validation Thread	0x000A0222	55 56 57 48 83 EC 30	48 31 C0 48 FF C0 C3
Disable License Notify Thread	0x0009E043	55	C3

for 4117, 4118: https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3927712#gistcomment-3927712

Bat Script

:: for Win64
cd /d "C:\Program Files\Sublime Text" || exit
certutil -hashfile sublime_text.exe md5 | find /i "ADF277D39672D83637AB708FC45413C8" || exit
echo 0009E47C: 48 31 C0 C3          | xxd -r - sublime_text.exe
echo 0000647C: 90 90 90 90 90       | xxd -r - sublime_text.exe
echo 00006495: 90 90 90 90 90       | xxd -r - sublime_text.exe
echo 000A0222: 48 31 C0 48 FF C0 C3 | xxd -r - sublime_text.exe
echo 0009E043: C3                   | xxd -r - sublime_text.exe

PS：xxd.exe extracted from git for windows

The license can be any string.

Blocked by Microsoft Defender SmartScreen -> More Info -> Run Anyway

Screenshot

![Screenshot](https://i.imgur.com/t4QlRZ6.png)

![Screenshot](https://i.imgur.com/18372Rh.png)

Linux

Desciption	Offset	Original	Patched
Initial License Check	0x00443F94	55 41 57 41	48 31 C0 C3
Persistent License Check 1	0x0042B210	E8 37 44 14 00	90 90 90 90 90
Persistent License Check 2	0x0042B228	E8 1F 44 14 00	90 90 90 90 90
Disable Server Validation Thread	0x00445EB6	55 41 56 53 41 89 F6	48 31 C0 48 FF C0 C3
Disable License Notify Thread	0x00443BF8	41	C3

Bash Script

# for Linux
cd /opt/sublime_text || exit
md5sum -c <<<"8836FE092DBB7BC8D3D2375D34510CA9  sublime_text" || exit
echo 00443F94: 48 31 C0 C3          | xxd -r - sublime_text
echo 0042B210: 90 90 90 90 90       | xxd -r - sublime_text
echo 0042B228: 90 90 90 90 90       | xxd -r - sublime_text
echo 00445EB6: 48 31 C0 48 FF C0 C3 | xxd -r - sublime_text
echo 00443BF8: C3                   | xxd -r - sublime_text

macOS

Desciption	Offset	Original	Patched
Initial License Check	0x0009D527	55 48 89 E5	48 31 C0 C3
Persistent License Check 1	0x000097F5	E8 AE 12 13 00	90 90 90 90 90
Persistent License Check 2	0x0000980D	E8 96 12 13 00	90 90 90 90 90
Disable Server Validation Thread	0x0009EA9D	55 48 89 E5 41 57 41	48 31 C0 48 FF C0 C3
Disable License Notify Thread	0x0009D122	55	C3

Bash Script

# for MacOS
cd "/Applications/Sublime Text.app/Contents/MacOS/" || exit
md5 -q sublime_text | grep -i "E1A3347BECDA7CC1EF583ECACECACBDC" || exit
echo 0009D527: 48 31 C0 C3          | xxd -r - sublime_text
echo 000097F5: 90 90 90 90 90       | xxd -r - sublime_text
echo 0000980D: 90 90 90 90 90       | xxd -r - sublime_text
echo 0009EA9D: 48 31 C0 48 FF C0 C3 | xxd -r - sublime_text
echo 0009D122: C3                   | xxd -r - sublime_text

Re-Sign App

codesign --force --deep --sign - "/Applications/Sublime Text.app"

Requires Apple Command Line Tools to be installed

macOS (ARM64)

Based on: https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3929427#gistcomment-3929427

Desciption	Offset	Original	Patched
Initial License Check	0x010758B8	FC 6F BA A9 E6 03 1E AA	E0 03 1F AA C0 03 5F D6
Persistent License Check 1	0x01000360	33 A4 03 94	1F 20 03 D5
Persistent License Check 2	0x01000374	2E A4 03 94	1F 20 03 D5
Disable Server Validation Thread	0x01076B54	F6 57 BD A9	C0 03 5F D6
Disable License Notify Thread	0x01075534	FC 6F BD A9	C0 03 5F D6

Bash Script

# for macOS (ARM64)
cd "/Applications/Sublime Text.app/Contents/MacOS/" || exit
md5 -q sublime_text | grep -i "E1A3347BECDA7CC1EF583ECACECACBDC" || exit
echo 010758B8: E0 03 1F AA C0 03 5F D6 | xxd -r - sublime_text
echo 01000360: 1F 20 03 D5             | xxd -r - sublime_text
echo 01000374: 1F 20 03 D5             | xxd -r - sublime_text
echo 01076B54: C0 03 5F D6             | xxd -r - sublime_text
echo 01075534: C0 03 5F D6             | xxd -r - sublime_text

Re-Sign App

codesign --force --deep --sign - "/Applications/Sublime Text.app"

Requires Apple Command Line Tools to be installed

---

How to Crack Sublime Merge, Stable Channel, Build 2083

Thanks to @leogx9r for providing cracking methods.

https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3823090#gistcomment-3823090 https://gist.github.com/JerryLokjianming/71dac05f27f8c96ad1c8941b88030451?permalink_comment_id=3762883#gistcomment-3762883 https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3802197#gistcomment-3802197

Win64

Desciption	Offset	Original	Patched
Initial License Check	0x000251A8	55 41 57 41 56 41 55 41	48 C7 C0 19 01 00 00 C3
Persistent License Check 1	0x000286A3	E8 70 AA 26 00	90 90 90 90 90
Persistent License Check 2	0x000286BC	E8 57 AA 26 00	90 90 90 90 90
Disable Server Validation Thread	0x000269B8	55 56 57 48 83 EC 30	48 31 C0 48 FF C0 C3
Disable License Notify Thread	0x00024DCD	55	C3
Disable Crash Reporter	0x00023F18	41	C3

Bat Script

:: for Win64
cd /d "C:\Program Files\Sublime Merge" || exit
certutil -hashfile sublime_merge.exe md5 | find /i "E33B76ADA6E7E7577CD4E81A7A4580C7" || exit
echo 000251A8: 48 C7 C0 19 01 00 00 C3 | xxd -r - sublime_merge.exe
echo 000286A3: 90 90 90 90 90          | xxd -r - sublime_merge.exe
echo 000286BC: 90 90 90 90 90          | xxd -r - sublime_merge.exe
echo 000269B8: 48 31 C0 48 FF C0 C3    | xxd -r - sublime_merge.exe
echo 00024DCD: C3                      | xxd -r - sublime_merge.exe
echo 00023F18: C3                      | xxd -r - sublime_merge.exe

PS：xxd.exe extracted from git for windows

Linux

thinks @urxi here

Bash Script

# for Linux
cd /opt/sublime_merge || exit
md5sum -c <<<"86F61A82E7EE8DD9BDC4CF16A7C8E825  sublime_merge" || exit
echo 0045A360: 48 C7 C0 19 01 00 00 C3 | xxd -r - sublime_merge
echo 0045D21D: 90 90 90 90 90          | xxd -r - sublime_merge
echo 0045D23A: 90 90 90 90 90          | xxd -r - sublime_merge
echo 0045B990: C3                      | xxd -r - sublime_merge
echo 0045A05A: C3                      | xxd -r - sublime_merge
echo 00459ABA: C3                      | xxd -r - sublime_merge

macOS

Desciption	Offset	Original	Patched
Initial License Check	0x0002C2DF	55 48 89 E5 41 57 41 56	48 C7 C0 19 01 00 00 C3
Persistent License Check 1	0x0002E96C	E8 1F B9 18 00	90 90 90 90 90
Persistent License Check 2	0x0002E98B	E8 00 B9 18 00	90 90 90 90 90
Disable Server Validation Thread	0x0002D295	55 48 89 E5 41 57 41	48 31 C0 48 FF C0 C3
Disable License Notify Thread	0x0002BF6A	55	C3
Disable Crash Reporter	0x0002B7AB	55	C3

Bash Script

# for MacOS
cd "/Applications/Sublime Merge.app/Contents/MacOS/" || exit
md5 -q sublime_merge | grep -i "B1AADED4F196EEEEBF8D5A6F98B11288" || exit
echo 0002C2DF: 48 C7 C0 19 01 00 00 C3 | xxd -r - sublime_merge
echo 0002E96C: 90 90 90 90 90          | xxd -r - sublime_merge
echo 0002E98B: 90 90 90 90 90          | xxd -r - sublime_merge
echo 0002D295: 48 31 C0 48 FF C0 C3    | xxd -r - sublime_merge
echo 0002BF6A: C3                      | xxd -r - sublime_merge
echo 0002B7AB: C3                      | xxd -r - sublime_merge

Re-Sign App

codesign --force --deep --sign - "/Applications/Sublime Merge.app"

Requires Apple Command Line Tools to be installed

macOS (ARM64)

!!!! May have expired !!!!

Based on:

• https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3929427#gistcomment-3929427
• for ≥ 2075: https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=4311375#gistcomment-4311375

Desciption	Offset	Original	Patched
Initial License Check	0x014D9060	FC 6F BA A9 E6 03 1E AA	E0 03 1F AA C0 03 5F D6
Persistent License Check 1	0x014DAF68	AB B6 04 94	1F 20 03 D5
Persistent License Check 2	0x014DAF7C	A6 B6 04 94	1F 20 03 D5
Disable Server Validation Thread	0x014D9DBC	F6 57 BD A9	C0 03 5F D6
Disable License Notify Thread	0x014D8D9C	FC 6F BD A9	C0 03 5F D6
Disable Crash Reporter	0x014D86E4	FC 6F BC A9	C0 03 5F D6

Bash Script

# for macOS (ARM64)
cd "/Applications/Sublime Merge.app/Contents/MacOS/" || exit
md5 -q sublime_merge | grep -i "B1AADED4F196EEEEBF8D5A6F98B11288" || exit
echo 014D9060: E0 03 1F AA C0 03 5F D6 | xxd -r - sublime_merge
echo 014DAF68: 1F 20 03 D5             | xxd -r - sublime_merge
echo 014DAF7C: 1F 20 03 D5             | xxd -r - sublime_merge
echo 014D9DBC: C0 03 5F D6             | xxd -r - sublime_merge
echo 014D8D9C: C0 03 5F D6             | xxd -r - sublime_merge
echo 014D86E4: C0 03 5F D6             | xxd -r - sublime_merge

Re-Sign App

codesign --force --deep --sign - "/Applications/Sublime Merge.app"

Requires Apple Command Line Tools to be installed

---

How to Crack Sublime Merge, Dev Channel, Build 2085

Thanks to @leogx9r for providing cracking methods.

https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3823090#gistcomment-3823090 https://gist.github.com/JerryLokjianming/71dac05f27f8c96ad1c8941b88030451?permalink_comment_id=3762883#gistcomment-3762883 https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3802197#gistcomment-3802197

Win64

Desciption	Offset	Original	Patched
Initial License Check	0x00025300	55 41 57 41 56 41 55 41	48 C7 C0 19 01 00 00 C3
Persistent License Check 1	0x00028813	E8 B8 7F 27 00	90 90 90 90 90
Persistent License Check 2	0x0002882C	E8 9F 7F 27 00	90 90 90 90 90
Disable Server Validation Thread	0x00026B20	55 56 57 48 83 EC 30	48 31 C0 48 FF C0 C3
Disable License Notify Thread	0x00024F25	55	C3
Disable Crash Reporter	0x00024070	41	C3

Bat Script

:: for Win64
cd /d "C:\Program Files\Sublime Merge" || exit
certutil -hashfile sublime_merge.exe md5 | find /i "8B6590708E6AAE98AC3AE29135DB084F" || exit
echo 00025300: 48 C7 C0 19 01 00 00 C3 | xxd -r - sublime_merge.exe
echo 00028813: 90 90 90 90 90          | xxd -r - sublime_merge.exe
echo 0002882C: 90 90 90 90 90          | xxd -r - sublime_merge.exe
echo 00026B20: 48 31 C0 48 FF C0 C3    | xxd -r - sublime_merge.exe
echo 00024F25: C3                      | xxd -r - sublime_merge.exe
echo 00024070: C3                      | xxd -r - sublime_merge.exe

PS：xxd.exe extracted from git for windows

Linux

thinks @urxi here

Bash Script

# for Linux
cd /opt/sublime_merge || exit
md5sum -c <<<"958DA6B7EC687B25F55A16FF6A3D9BD0  sublime_merge" || exit
echo 0045F22C: 48 C7 C0 19 01 00 00 C3 | xxd -r - sublime_merge
echo 004620F9: 90 90 90 90 90          | xxd -r - sublime_merge
echo 00462116: 90 90 90 90 90          | xxd -r - sublime_merge
echo 0046086C: C3                      | xxd -r - sublime_merge
echo 0045EF26: C3                      | xxd -r - sublime_merge
echo 0045E986: C3                      | xxd -r - sublime_merge

macOS

Desciption	Offset	Original	Patched
Initial License Check	0x0002C4CB	55 48 89 E5 41 57 41 56	48 C7 C0 19 01 00 00 C3
Persistent License Check 1	0x0002EB48	E8 15 23 19 00	90 90 90 90 90
Persistent License Check 2	0x0002EB67	E8 F6 22 19 00	90 90 90 90 90
Disable Server Validation Thread	0x0002D471	55 48 89 E5 41 57 41	48 31 C0 48 FF C0 C3
Disable License Notify Thread	0x0002C156	55	C3
Disable Crash Reporter	0x0002B997	55	C3

Bash Script

# for MacOS
cd "/Applications/Sublime Merge.app/Contents/MacOS/" || exit
md5 -q sublime_merge | grep -i "D67510219FB14938A47BE39260C87215" || exit
echo 0002C4CB: 48 C7 C0 19 01 00 00 C3 | xxd -r - sublime_merge
echo 0002EB48: 90 90 90 90 90          | xxd -r - sublime_merge
echo 0002EB67: 90 90 90 90 90          | xxd -r - sublime_merge
echo 0002D471: 48 31 C0 48 FF C0 C3    | xxd -r - sublime_merge
echo 0002C156: C3                      | xxd -r - sublime_merge
echo 0002B997: C3                      | xxd -r - sublime_merge

Re-Sign App

codesign --force --deep --sign - "/Applications/Sublime Merge.app"

Requires Apple Command Line Tools to be installed

macOS (ARM64)

!!!! May have expired !!!!

Based on:

• https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3929427#gistcomment-3929427
• for ≥ 2075: https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=4311375#gistcomment-4311375

Desciption	Offset	Original	Patched
Initial License Check	0x015027EC	FC 6F BA A9 E6 03 1E AA	E0 03 1F AA C0 03 5F D6
Persistent License Check 1	0x015046D4	78 C9 04 94	1F 20 03 D5
Persistent License Check 2	0x015046E8	73 C9 04 94	1F 20 03 D5
Disable Server Validation Thread	0x0150352C	F6 57 BD A9	C0 03 5F D6
Disable License Notify Thread	0x01502528	FC 6F BD A9	C0 03 5F D6
Disable Crash Reporter	0x01501E70	FC 6F BC A9	C0 03 5F D6

Bash Script

# for macOS (ARM64)
cd "/Applications/Sublime Merge.app/Contents/MacOS/" || exit
md5 -q sublime_merge | grep -i "D67510219FB14938A47BE39260C87215" || exit
echo 015027EC: E0 03 1F AA C0 03 5F D6 | xxd -r - sublime_merge
echo 015046D4: 1F 20 03 D5             | xxd -r - sublime_merge
echo 015046E8: 1F 20 03 D5             | xxd -r - sublime_merge
echo 0150352C: C0 03 5F D6             | xxd -r - sublime_merge
echo 01502528: C0 03 5F D6             | xxd -r - sublime_merge
echo 01501E70: C0 03 5F D6             | xxd -r - sublime_merge

Re-Sign App

codesign --force --deep --sign - "/Applications/Sublime Merge.app"

Requires Apple Command Line Tools to be installed

Other cracking methods.md

ST's new version of hexadecimal editing method

From: https://gist.github.com/opastorello/4d494d627ec9012367028c89cb7a1945

Search : 80 78 05 00 0f 94 c1 first result , replace: c6 40 05 01 48 85 c9

This patch is applicable to all x86-64 CPU platforms of ST.

ST's old version hexadecimal editing method

From: https://gist.github.com/opastorello/4d494d627ec9012367028c89cb7a1945?permalink_comment_id=4495369#gistcomment-4495369

97 94 0D --> 00 00 00

License Key:

----- BEGIN LICENSE -----
TwitterInc
200 User License
EA7E-890007
1D77F72E 390CDD93 4DCBA022 FAF60790
61AA12C0 A37081C5 D0316412 4584D136
94D7F7D4 95BC8C1C 527DA828 560BB037
D1EDDD8C AE7B379F 50C9D69D B35179EF
2FE898C4 8E4277A8 555CE714 E1FB0E43
D5D52613 C3D12E98 BC49967F 7652EED2
9D2D2E61 67610860 6D338B72 5CF95C69
E36B85CC 84991F19 7575D828 470A92AB
------ END LICENSE ------

I put a regex pattern in my patcher that can detect new version (along with channel, os, arch) without any modification.
/updates/(?P<channel>\w+)_update_check\?version=\d+&platform=(?P<os>\w+)&arch=(?P<arch>\w+)

So is there a patcher that works on MacOS (ARM version) or just for Windows for now?

Current patterns still work on SM 2060. They use ret 281 again in license check. All releases since SM 2056 (except 2058) are like this. Maybe SM 2058 was just an anomaly.

Based on the work of @leogx9r and @maboloshi, I updated my patcher to support Mac M1. But I guess it's only suitable for version 4114 on Mac M1.

PS: the patterns of @maboloshi are mostly correct, except the license check. My pattern is:

Fix(name="license_check", reghex="E6 03 1E AA ED 65 0E 94", patch="E0 03 1F AA C0 03 5F D6")

@Destitute-Streetdwelling-Guttersnipe where exactly can I get that patcher?

Mac version of ST can run on both x64 and M1 CPUs, so I improved my patcher to patch for both platforms at once:

@bms8197 it's at https://github.com/Destitute-Streetdwelling-Guttersnipe/reghex_patcher
The patterns are similar to the ones in rainbowpigeon's patcher.

If you don't know any fix, you can use the famous patch for 97 94 0D (see https://gist.github.com/JerryLokjianming/71dac05f27f8c96ad1c8941b88030451)

@Destitute-Streetdwelling-Guttersnipe is that patcher going to work for 4115 MacOS on M1 cpu or just for 4114?

@bms8197 I don't include patterns since I want to make a generic patcher. You have to add patterns yourself.

There are patterns for 4114 on Mac M1 in this page, such as https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47#gistcomment-3908103.
I don't know if they work on 4115 or not.

@Destitute-Streetdwelling-Guttersnipe allright, thanks for the info. It beats me at the moment so I'll just stick with my 4114 fully registered version. There are no things that I actually need in 4115 at the moment so...

Sublime Text v4116

==========================================================================================
[*] Download: sublime_text_build_4116_x64.zip, from: https://download.sublimetext.com/sublime_text_build_4116_x64.zip ...
>>>: 29.1MB [00:12, 2.31MB/s]
[*] Extract: sublime_text.exe, from: sublime_text_build_4116_x64.zip ...
[>] Attempting to autodetect application type ...
[*] Detected input file as Sublime Text ...
[*] Windows PE Detected -> 9849248 Bytes
    MD5 Checksum -> 1E9700C9AE636755E674176196C6546D
[>] Found RVA pattern for "isValidLicense" at 0xA8730 -> 0xFFFFE29F -> 0xA69D4 ...
[*] Rewrite data '55 41 57 41' -> '48 31 C0 C3' ...

[>] Found pattern for "invalidationFunction" at 0x711A ...
[*] Rewrite data 'E8 A5 60 20 00' -> '90 90 90 90 90' ...

[!] No pattern found for "validationFunction" ...

[>] Found pattern for "validationFunction2" at 0x7133 ...
[*] Rewrite data 'E8 8C 60 20 00' -> '90 90 90 90 90' ...

[>] Found pattern for "serverThread" at 0xA847F ...
[*] Rewrite data '55 56 57 48 83 EC 30' -> '48 31 C0 48 FF C0 C3' ...

[>] Found pattern for "licenseNotifyThread" at 0xA65CF ...
[*] Rewrite data '55' -> 'C3' ...

[>] Found pattern for "crashReporter" at 0x400 ...
[*] Rewrite data '41' -> 'C3' ...

==========================================================================================
[*] Download: sublime_text_build_4116_x64.tar.xz, from: https://download.sublimetext.com/sublime_text_build_4116_x64.tar.xz ...
>>>: 17.2MB [00:04, 3.86MB/s]
[*] Extract: sublime_text/sublime_text, from: sublime_text_build_4116_x64.tar.xz ...
[>] Attempting to autodetect application type ...
[*] Detected input file as Sublime Text ...
[*] Linux ELF Detected -> 8739760 Bytes
    MD5 Checksum -> E825B21D7821A49D1DB6583D089CF0E9
[>] Found RVA pattern for "isValidLicense" at 0x3781CE -> 0xFFFFE96F -> 0x376B42 ...
[*] Rewrite data '55 41 57 41' -> '48 31 C0 C3' ...

[>] Found pattern for "invalidationFunction" at 0x36CC85 ...
[*] Rewrite data 'E8 A4 B4 11 00' -> '90 90 90 90 90' ...

[>] Found pattern for "validationFunction" at 0x36CCA0 ...
[*] Rewrite data 'E8 89 B4 11 00' -> '90 90 90 90 90' ...

[>] Found pattern for "serverThread" at 0x3785CD ...
[*] Rewrite data '55 41 56 53 41 89 F6' -> '48 31 C0 48 FF C0 C3' ...

[>] Found pattern for "licenseNotifyThread" at 0x376806 ...
[*] Rewrite data '41' -> 'C3' ...

[>] Found pattern for "crashReporter" at 0x360930 ...
[*] Rewrite data '55' -> 'C3' ...

==========================================================================================
[*] Download: sublime_text_build_4116_mac.zip, from: https://download.sublimetext.com/sublime_text_build_4116_mac.zip ...
>>>: 43.7MB [00:16, 2.59MB/s]
[*] Extract: Sublime Text.app/Contents/MacOS/sublime_text, from: sublime_text_build_4116_mac.zip ...
[>] Attempting to autodetect application type ...
[*] Detected input file as Sublime Text ...
[*] MacOS Mach-O Detected -> 33166448 Bytes
    MD5 Checksum -> DA00E096337A07B659B573CA7FC4D352
[>] Found RVA pattern for "isValidLicense" at 0x93D8A -> 0xFFFFF1A3 -> 0x92F32 ...
[*] Rewrite data '55 48 89 E5' -> '48 31 C0 C3' ...

[>] Found pattern for "invalidationFunction" at 0x8E7E ...
[*] Rewrite data 'E8 93 16 12 00' -> '90 90 90 90 90' ...

[>] Found pattern for "validationFunction" at 0x8E9D ...
[*] Rewrite data 'E8 74 16 12 00' -> '90 90 90 90 90' ...

[>] Found pattern for "serverThread" at 0x94297 ...
[*] Rewrite data '55 48 89 E5 41 57 41' -> '48 31 C0 48 FF C0 C3' ...

[>] Found pattern for "licenseNotifyThread" at 0x92B50 ...
[*] Rewrite data '55' -> 'C3' ...

[>] Found pattern for "crashReporter" at 0x2FE7 ...
[*] Rewrite data '55' -> 'C3' ...

↓ The following rules are not validated for ARM64 and are missing rule "license_check" ↓

[>] Found pattern for "invalidationFunction_arm64" at 0xF69744 ...
[*] Rewrite data '48 95 03 94' -> '1F 20 03 D5' ...

[>] Found pattern for "validationFunction_arm64" at 0xF69758 ...
[*] Rewrite data '43 95 03 94' -> '1F 20 03 D5' ...

[>] Found pattern for "serverThread_arm64" at 0xFD8F38 ...
[*] Rewrite data 'F6 57 BD A9' -> 'C0 03 5F D6' ...

[>] Found pattern for "licenseNotifyThread_arm64" at 0xFD7AAC ...
[*] Rewrite data 'FC 6F BD A9' -> 'C0 03 5F D6' ...

[>] Found pattern for "crashReporte_arm64" at 0xF64DB8 ...
[*] Rewrite data 'FC 6F BC A9' -> 'C0 03 5F D6' ...

@maboloshi can we get that patcher from somewhere or is it private?

@rainbowpigeon patch working for 4116 build

@maboloshi You can use my pattern for license_check (for ARM64 on Mac M1) at https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47#gistcomment-3908103

@Destitute-Streetdwelling-Guttersnipe I know, but this only applies to 4114.

It's Friday, so let's have some fun with binary 🚀
@maboloshi you can use this pattern for license_check with 4116:

        Fix(name="license_check", reghex=f"(?<= {0b0000000000001000:02x} {0b0000000000000000:02x} {0b0000000010000000:02x} {0b0000000001010010:02x} . . . {0b0000000000010100:02x} ) {0b0000000011100110:02x} {0b0000000000000011:02x} {0b0000000000011110:02x} {0b0000000010101010:02x} . . . {0b0000000010010100:02x} {0b0000000011111110:02x} {0b0000000000000011:02x} {0b0000000000000110:02x} {0b0000000010101010:02x}", patch=_ret0),

@bms8197 if you want to patch 4116, you can combine the patches of maboloshi at https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47#gistcomment-3911981 with my patch for license_check:

printf %02x  $((2#0000000011100000)) $((2#0000000000000011)) $((2#0000000000011111)) $((2#0000000010101010)) $((2#0000000011000000)) $((2#0000000000000011)) $((2#0000000001011111)) $((2#0000000011010110)) | xxd -r -p -s $((2#00000000111111010111111000011100)) sublime_text

I haven't tested it on Mac M1, but you can give it a try if you're not afraid of binary digits.

@Destitute-Streetdwelling-Guttersnipe Good job 😆 👍

[>] Found pattern for "isValidLicense_arm64" at 0xFD7E1C ...
[*] Rewrite data 'E6 03 1E AA E4 65 0E 94' -> 'E0 03 1F AA C0 03 5F D6' ...

@Destitute-Streetdwelling-Guttersnipe it beats me completely how to patch 4116. I tried several methods combining those patches but it's not working. I'm pretty sure I'm doing something wrong here. This hex stuff is not for me as it seems...

@rainbowpigeon patch working for 4116 build

@kepeto Thanks for testing. I have pushed the changes to support those new dev builds.

echo|set /p="7D6D201F6E924801C0B872398877C8A1 sublime_merge.exe" >nul 2>&1 | md5sum -c - || exit

getting an exit at this point in SM version 2060 🤔

@sharunkumar You need to download Command Line Tools for Windows 64 and extract the Command Line Tools.

I did download that and added the binaries to path. I am still getting the exit. I think the MD5 sum isn't matching

also, if I skip the md5sum check the rest of the commands doesn't seem to work

So in the end does anyone have a patcher that works for MacOS M1 cpu for dev 4116? I tried several times to make it work based on the informations and the patterns provided here but since my skills related to assembly stuff are pretty limit, I had no success so right now I'm using dev 4114 patched.

Nvm, it works when I run them in git bash, but strange that it doesn't work in command prompt.

Nvm, it works when I run them in git bash, but strange that it doesn't work in command prompt.

@sharunkumar Thank you very much for your feedback. I'll look into it then.

@sharunkumar
The command line is amended to:

echo|set /p="7D6D201F6E924801C0B872398877C8A1  sublime_merge.exe" | md5sum -c - >nul 2>&1 || exit

@maboloshi it's better to use PowerShell in Windows, instead of bash, like this:

$file = "C:\Program Files\Sublime Text\sublime_text.exe"
if ((Get-FileHash $file -Algorithm MD5).Hash -ne 'AACCDDFF') { echo 'wrong MD5 hash'; exit }

$bytes = Get-Content $file -Encoding Byte -Raw
$fix = @{
  0xA69D4 = @(0x48, 0x31, 0xC0, 0xC3) # Initial License Check
  0x711A  = @(0x90, 0x90, 0x90, 0x90, 0x90)
  0x7133  = @(0x90, 0x90, 0x90, 0x90, 0x90)
  0xA847F = @(0xC3) # Disable Server Validation Thread
  0xA65CF = @(0xC3)
  0x400   = @(0xC3)
  }
$fix.Keys | %{ $fix[($k=$_)] | %{ $bytes[$k++] = $_ } }
Set-Content $file -Encoding Byte -Value $bytes

in Linux, bash script can be simpler

(
  f=./sublime_text
  patchex() { printf %b ${*/#/\\x} | dd seek=$(($o)) of="$f" bs=1 conv=notrunc status=none; }
  while read o b; do [[ $o =~ ^#|^$ ]] || patchex $b; done <<<'
    # Initial License Check
    0xA69D4 48 31 C0 C3
    0x711A  90 90 90 90 90
    0x7133  90 90 90 90 90
    # Disable Server Validation Thread
    0xA847F C3
    0xA65CF C3
    0x400   C3
    '
)

@Destitute-Streetdwelling-Guttersnipe In fact, I never intended to write it as a nanny script in the first place. 😆

Sublime Text v4117 Crack

Windows (x64 Only)

Patterns have changed again for isValidLicense. Here's 5 different patterns you can use in case one stops working:

`direct reference sig: (+0x3) 45 31 C9 E8 ? ? ? ? 85 C0 75 15 `         // These two invalidation/validation function references
`direct reference sig: (+0x3) 45 31 C9 E8 ? ? ? ? 85 C0 75 0D`          // Same as above.
`direct reference sig: (+0x4) 48 8D 4D 40 E8 ? ? ? ? 48 8B 4E 10`
`direct reference sig: (+0x3) 48 89 F9 E8 ? ? ? ? 48 8B 4E 10 85 C0`
`direct reference sig: (+0x4) 4C 8D 4D 54 E8 ? ? ? ?`                   // Performed on license entering to check validity.

Linux (x64 Only)

MacOS (x64 Only)

Proof

Yes, I removed the "Registered to" line. You can do the same:

    def patch_registration_message(self):
        # 'Registered to \0'
        offset = PatternFinder(
            'registrationMessage',
            '52 65 67 69 73 74 65 72 65 64 20 74 6F 20 00',
            can_duplicate = True
        ).locate(self.binary, slow_method = True, log = False);

        if offset != -1:
            for i in range(0, 15):
                self.binary[offset + i] = 0x00;
            print('[+] Removed registration message.');

Here I quoted the first 3 posts of @leogx9r from
https://gist.github.com/JerryLokjianming/71dac05f27f8c96ad1c8941b88030451#gistcomment-3762200

They're historic game-changing contribution. Thank you, @leogx9r

---

leogx9r commented on May 30

Here's my method for breaking their license protection. I've specifically applied the below to v4107.

Quick note: This isn't meant for newbies, this shows you how to patch the current and (most likely) future versions of Sublime Text. I've been using this for a while now.

Here's a basic rundown of how license validation and invalidation works:

• Licenses have hardcoded (lol, remove blacklist and patch server thread, 10/10 protection) blacklists in the executable and are signed via an RSA public key (which is 'encrypted' in the binary, basically some xor stuff).
• Application tries to validate an invalid license every 5 seconds. It expects this to fail but if it succeeds, it will unregister you after 480 seconds. This is why simply patching the validity function isn't enough.
• Application tries to validate your current license every 15 seconds. It expects this to succeed but if it fails, it will unregister you after 360 seconds.
• The application creates a thread to validate the current license with the server at license.sublimehq.com whenever the application is started (config file read) or when modifying your current license. If this succeeds to connect and your license isn't correct it will unregister you.

So how can you bypass all this? Dare I say, efficiently?

• Patch the validation function (isLicenseValid as I call it) for anything to always return 0 (valid). Values from 1-4 specify either an invalid, blacklisted or unsupported/expired license.
• Prevent thread creation for the validation/invalidation routines to avoid the license being unregistered after X seconds due to patching isLicenseValid. Optionally simply remove the "unregister" function here. Doesn't matter how you go about it really.
• Disable server validation thread or patch the HTTP host so it always fails to connect. Most people resort to using hosts to redirect the license server to localhost or renaming the host in the binary. A far better way is simply to avoid a dead thread being created that does this check.

Disabling creation of these 3 threads is my preferred method since you obviously save resources as you don't need to constantly have new threads opened every X seconds.

Why I consider this better than other methods?

• No need to find a "working"/"nonblacklisted" license. You can literally enter "Hello World!" as a valid license.
• No useless thread creation eating up resources. A small performance improvement you'll absolutely never notice.
• You don't have to patch /etc/hosts or system32/drivers/etc/hosts.
• Relies on patterns so you can build your own script to auto-patch on updates, provided patterns don't break of course.
• Doesn't decide to randomly expire.

How tho?

Patch the following methods:

• License Validity Checking (Aka IsValidLicense

Make isLicenseValid return 0, pattern is a reference to call isLicenseValid. I personally just replaced the method with xor rax, rax; ret so 48 31 C0 C3.

    Linux/MacOS x64 Pattern: `direct reference sig: E8 ? ? ? ? 49 8B BF ? ? ? ? 85 C0`
    Windows x64 Pattern:     `direct reference sig: E8 ? ? ? ? 48 8B 8B ? ? ? ? 85 C0`

• Invalidation/Validation Functions

These cause delayed unregistration after 360/480 seconds so NOP out the calls to avoid them. Aka replace E8 XX XX XX XX with 90 90 90 90 90.

    Windows x64 Pattern 1: `direct reference sig: (+0x6) 41 B8 ? ? ? ? E8 ? ? ? ? 49 8B 96`
                Pattern 2: `raw sig: E8 ? ? ? ? E8 ? ? ? ? 4C 89 F1 E8`
    Linux x64   Pattern 1: `raw sig: E8 ? ? ? ? 48 89 5C 24 ? 48 8B B3`
                Pattern 2: `raw sig: E8 ? ? ? ? BF ? ? ? ? E8 ? ? ? ? 83 25`
    MacOS       Pattern 1: `raw sig: E8 ? ? ? ? 48 89 9D ? ? ? ? 48 8B B3`
                Pattern 2: `raw sig: E8 ? ? ? ? 48 8D 3D ? ? ? ? E8 ? ? ? ? 83 25`

• Server Validation Thread

Simply make this instantly return 1 to disable thread creation or patch the hostname to something invalid. I personally prefer to simply disable thread creation by making this return 1, aka 48 31 C0 48 FF C0 C3, xor rax, rax; inc rax; ret.

    Windows x64 Pattern: `raw sig: 55 56 57 48 83 EC 30 48 8D 6C 24 ? 48 C7 45 ? ? ? ? ? 89 D6 48 89 CF 6A 28`
    Linux x64   Pattern: `raw sig: 55 41 56 53 41 89 F6 48 89 FD 6A 28`
    MacOS       Pattern: `raw sig: 55 48 89 E5 41 57 41 56 53 50 41 89 F6 49 89 FF 6A 20`

Now what?

After patching simply register with anything you want. It can even be just a random letter, a space, a word, a sentence, a valid or invalid license -- whatever you want. Here's what I registered with:

Paying 80$ For A License Is Stupid

But I wanna download!

Linux

For Linux x64 on v4107, you can use this (replace /opt/sublime_text/sublime_text with the path to the binary):

# 554157415641554154534881EC68240000 -> 4831C0C390909090909090909090909090
sed -i 's/\x55\x41\x57\x41\x56\x41\x55\x41\x54\x53\x48\x81\xEC\x68\x24\x00\x00/\x48\x31\xC0\xC3\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90/g' /opt/sublime_text/sublime_text

# E8C2781800 -> 9090909090
sed -i 's/\xE8\xC2\x78\x18\x00/\x90\x90\x90\x90\x90/g' /opt/sublime_text/sublime_text
# E8A7781800 -> 9090909090
sed -i 's/\xE8\xA7\x78\x18\x00/\x90\x90\x90\x90\x90/g' /opt/sublime_text/sublime_text

# 554156534189F64889FD6A28 -> 4831C048FFC0C39090909090
sed -i 's/\x55\x41\x56\x53\x41\x89\xF6\x48\x89\xFD\x6A\x28/\x48\x31\xC0\x48\xFF\xC0\xC3\x90\x90\x90\x90\x90/g' /opt/sublime_text/sublime_text

Windows

I've uploaded a portable copy of the Windows x64 bit version, already patched, here. Simply replace the sublime_text.exe file from the portable download with the above. Here's the virus scan. Note: PE.Heur.InvalidSig is due to patching the executable to bypass the license checks. Don't trust it? Then patch it yourself :P

I've been using this on both Windows and Linux since the new version dropped without issues.

MacOS

No.

Proof

---

leogx9r commented on May 30

@CypherpunkSamurai You can probably try these:

Art of Assembly
Assembly Generic Wiki
Introduction to x64 Assembly
x86 and x64 Instruction Reference

There's many books as well. You could look around. I use IDA and Ghidra.

---

leogx9r commented on May 30

For the record, Sublime Merge can also be defeated the same way. Did the same on v2056.

License Validity Checking

For this, the only difference with Sublime Text is you need to return 281 instead of 0. I just did a simple mov rax, 281; ret.

    Windows x64 Pattern: `direct reference sig: E8 ? ? ? ? 3D ? ? ? ? 75 15`
    Linux x64 Pattern:   `direct reference sig: E8 ? ? ? ? 3D ? ? ? ? 75 12`
    MacOS x64 Pattern:   `direct reference sig: E8 ? ? ? ? 3D ? ? ? ? 75 14`

Invalidation/Validation Threads

    Windows x64 Pattern 1: `direct reference sig: (+0x6) 41 B8 ? ? ? ? E8 ? ? ? ? E8 ? ? ? ? B9`
                Pattern 2: `direct reference sig: (+0x6) 41 B8 ? ? ? ? E8 ? ? ? ? 48 8B 96 ? ? ? ? `
    Linux x64   Pattern 1: `raw sig: E8 ? ? ? ? 48 89 5C 24 ? 48 8B B3`
                Pattern 2: `raw sig: E8 ? ? ? ? BF ? ? ? ? E8 ? ? ? ? 83 25`
    MacOS       Pattern 1: `raw sig: E8 ? ? ? ? 48 89 9D ? ? ? ? 48 8B B3`
                Pattern 2: `raw sig: E8 ? ? ? ? 48 8D 3D ? ? ? ? E8 ? ? ? ? 83 25`

Server Validation Thread

    Windows x64 Pattern: `raw sig: 55 56 57 48 83 EC 30 48 8D 6C 24 ? 48 C7 45 ? ? ? ? ? 89 D6 48 89 CF 6A 28`
    Linux x64   Pattern: `raw sig: 55 41 56 53 41 89 F6 48 89 FD 6A 28`
    MacOS       Pattern: `raw sig: 55 48 89 E5 41 57 41 56 53 50 41 89 F6 49 89 FF 6A 20`

Proof

---