Crack Sublime Text and Sublime Merge

Crack Sublime Text and Sublime Merge.md

Note

1. If you can, please purchase the genuine license through the official channel and support the software developer.
2. All crack methods here are implemented by @leogx9r.
3. All data is not guaranteed to be authoritative or correct, nor has it been tested across the platform, nor is it responsible for any errors, lost data, etc. in practice! Please assess yourself!!!
4. I am only within the ability to update the information based on the existing crack methods until the existing rules fail.

---

Sublime Patcher Script for personal use

The code implementation is very poor.
https://gist.github.com/maboloshi/5baecbddacf43855f13240b63be5673d

ToC

	Sublime Text	Sublime Merge
Stable channel	win / linux / mac / mac-arm64	win / linux / mac / mac-arm64
Dev channel	win / linux / mac / mac-arm64	win / linux / mac / mac-arm64

---

How to Crack Sublime Text, Stable Channel, Build 4152

Thanks to @leogx9r for providing cracking methods.

https://gist.github.com/JerryLokjianming/71dac05f27f8c96ad1c8941b88030451?permalink_comment_id=3762200#gistcomment-3762200 https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3802197#gistcomment-3802197 https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3803204#gistcomment-3803204

Win64

Desciption	Offset	Original	Patched
Initial License Check	0x000A8D78	55 41 57 41	48 31 C0 C3
Persistent License Check 1	0x000071D0	E8 17 FE 20 00	90 90 90 90 90
Persistent License Check 2	0x000071E9	E8 FE FD 20 00	90 90 90 90 90
Disable Server Validation Thread	0x000AAB3E	55 56 57 48 83 EC 30	48 31 C0 48 FF C0 C3
Disable License Notify Thread	0x000A8945	55	C3
Disable Crash Reporter	0x00000400	41	C3

for 4117, 4118: https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3927712#gistcomment-3927712

Bat Script

:: for Win64
cd /d "C:\Program Files\Sublime Text" || exit
certutil -hashfile sublime_text.exe md5 | find /i "15BB398D5663B89A44372EF15F70A46F" || exit
echo 000A8D78: 48 31 C0 C3          | xxd -r - sublime_text.exe
echo 000071D0: 90 90 90 90 90       | xxd -r - sublime_text.exe
echo 000071E9: 90 90 90 90 90       | xxd -r - sublime_text.exe
echo 000AAB3E: 48 31 C0 48 FF C0 C3 | xxd -r - sublime_text.exe
echo 000A8945: C3                   | xxd -r - sublime_text.exe
echo 00000400: C3                   | xxd -r - sublime_text.exe

PS：xxd.exe extracted from git for windows

The license can be any string.

Blocked by Microsoft Defender SmartScreen -> More Info -> Run Anyway

Screenshot

![Screenshot](https://i.imgur.com/t4QlRZ6.png)

![Screenshot](https://i.imgur.com/18372Rh.png)

Linux

Desciption	Offset	Original	Patched
Initial License Check	0x00415013	55 41 57 41	48 31 C0 C3
Persistent License Check 1	0x00409037	E8 C0 CC 12 00	90 90 90 90 90
Persistent License Check 2	0x0040904F	E8 A8 CC 12 00	90 90 90 90 90
Disable Server Validation Thread	0x00416CA4	55 41 56 53 41 89 F6	48 31 C0 48 FF C0 C3
Disable License Notify Thread	0x00414C82	41	C3
Disable Crash Reporter	0x003FA310	55	C3

Bash Script

# for Linux
cd /opt/sublime_text || exit
md5sum -c <<<"7038C3B1CC79504602DA70599D4CCCE9  sublime_text" || exit
echo 00415013: 48 31 C0 C3          | xxd -r - sublime_text
echo 00409037: 90 90 90 90 90       | xxd -r - sublime_text
echo 0040904F: 90 90 90 90 90       | xxd -r - sublime_text
echo 00416CA4: 48 31 C0 48 FF C0 C3 | xxd -r - sublime_text
echo 00414C82: C3                   | xxd -r - sublime_text
echo 003FA310: C3                   | xxd -r - sublime_text

macOS

Desciption	Offset	Original	Patched
Initial License Check	0x0009F313	55 48 89 E5	48 31 C0 C3
Persistent License Check 1	0x00009CEF	E8 3C 2D 13 00	90 90 90 90 90
Persistent License Check 2	0x00009D07	E8 24 2D 13 00	90 90 90 90 90
Disable Server Validation Thread	0x000A085D	55 48 89 E5 41 57 41	48 31 C0 48 FF C0 C3
Disable License Notify Thread	0x0009EF0E	55	C3
Disable Crash Reporter	0x00002A87	55	C3

Bash Script

# for MacOS
cd "/Applications/Sublime Text.app/Contents/MacOS/" || exit
md5 -q sublime_text | grep -i "B07FDB3A228A46DF1CC178FE60B64D3B" || exit
echo 0009F313: 48 31 C0 C3          | xxd -r - sublime_text
echo 00009CEF: 90 90 90 90 90       | xxd -r - sublime_text
echo 00009D07: 90 90 90 90 90       | xxd -r - sublime_text
echo 000A085D: 48 31 C0 48 FF C0 C3 | xxd -r - sublime_text
echo 0009EF0E: C3                   | xxd -r - sublime_text
echo 00002A87: C3                   | xxd -r - sublime_text

Re-Sign App

codesign --force --deep --sign - "/Applications/Sublime Text.app"

Requires Apple Command Line Tools to be installed

macOS (ARM64)

Based on: https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3929427#gistcomment-3929427

Desciption	Offset	Original	Patched
Initial License Check	0x01060C90	FC 6F BA A9 E6 03 1E AA	E0 03 1F AA C0 03 5F D6
Persistent License Check 1	0x00FEAD18	40 BB 03 94	1F 20 03 D5
Persistent License Check 2	0x00FEAD2C	3B BB 03 94	1F 20 03 D5
Disable Server Validation Thread	0x01061F28	F6 57 BD A9	C0 03 5F D6
Disable License Notify Thread	0x01060908	FC 6F BD A9	C0 03 5F D6
Disable Crash Reporter	0x00FE5780	FC 6F BC A9	C0 03 5F D6

Bash Script

# for macOS (ARM64)
cd "/Applications/Sublime Text.app/Contents/MacOS/" || exit
md5 -q sublime_text | grep -i "B07FDB3A228A46DF1CC178FE60B64D3B" || exit
echo 01060C90: E0 03 1F AA C0 03 5F D6 | xxd -r - sublime_text
echo 00FEAD18: 1F 20 03 D5             | xxd -r - sublime_text
echo 00FEAD2C: 1F 20 03 D5             | xxd -r - sublime_text
echo 01061F28: C0 03 5F D6             | xxd -r - sublime_text
echo 01060908: C0 03 5F D6             | xxd -r - sublime_text
echo 00FE5780: C0 03 5F D6             | xxd -r - sublime_text

Re-Sign App

codesign --force --deep --sign - "/Applications/Sublime Text.app"

Requires Apple Command Line Tools to be installed

---

How to Crack Sublime Text, Dev Channel, Build 4154

Thanks to @leogx9r for providing cracking methods.

https://gist.github.com/JerryLokjianming/71dac05f27f8c96ad1c8941b88030451?permalink_comment_id=3762200#gistcomment-3762200 https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3802197#gistcomment-3802197 https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3803204#gistcomment-3803204

Win64

Desciption	Offset	Original	Patched
Initial License Check	0x0009E47C	55 41 57 41	48 31 C0 C3
Persistent License Check 1	0x0000647C	E8 23 7C 20 00	90 90 90 90 90
Persistent License Check 2	0x00006495	E8 0A 7C 20 00	90 90 90 90 90
Disable Server Validation Thread	0x000A0222	55 56 57 48 83 EC 30	48 31 C0 48 FF C0 C3
Disable License Notify Thread	0x0009E043	55	C3

for 4117, 4118: https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3927712#gistcomment-3927712

Bat Script

:: for Win64
cd /d "C:\Program Files\Sublime Text" || exit
certutil -hashfile sublime_text.exe md5 | find /i "ADF277D39672D83637AB708FC45413C8" || exit
echo 0009E47C: 48 31 C0 C3          | xxd -r - sublime_text.exe
echo 0000647C: 90 90 90 90 90       | xxd -r - sublime_text.exe
echo 00006495: 90 90 90 90 90       | xxd -r - sublime_text.exe
echo 000A0222: 48 31 C0 48 FF C0 C3 | xxd -r - sublime_text.exe
echo 0009E043: C3                   | xxd -r - sublime_text.exe

PS：xxd.exe extracted from git for windows

The license can be any string.

Blocked by Microsoft Defender SmartScreen -> More Info -> Run Anyway

Screenshot

![Screenshot](https://i.imgur.com/t4QlRZ6.png)

![Screenshot](https://i.imgur.com/18372Rh.png)

Linux

Desciption	Offset	Original	Patched
Initial License Check	0x00443F94	55 41 57 41	48 31 C0 C3
Persistent License Check 1	0x0042B210	E8 37 44 14 00	90 90 90 90 90
Persistent License Check 2	0x0042B228	E8 1F 44 14 00	90 90 90 90 90
Disable Server Validation Thread	0x00445EB6	55 41 56 53 41 89 F6	48 31 C0 48 FF C0 C3
Disable License Notify Thread	0x00443BF8	41	C3

Bash Script

# for Linux
cd /opt/sublime_text || exit
md5sum -c <<<"8836FE092DBB7BC8D3D2375D34510CA9  sublime_text" || exit
echo 00443F94: 48 31 C0 C3          | xxd -r - sublime_text
echo 0042B210: 90 90 90 90 90       | xxd -r - sublime_text
echo 0042B228: 90 90 90 90 90       | xxd -r - sublime_text
echo 00445EB6: 48 31 C0 48 FF C0 C3 | xxd -r - sublime_text
echo 00443BF8: C3                   | xxd -r - sublime_text

macOS

Desciption	Offset	Original	Patched
Initial License Check	0x0009D527	55 48 89 E5	48 31 C0 C3
Persistent License Check 1	0x000097F5	E8 AE 12 13 00	90 90 90 90 90
Persistent License Check 2	0x0000980D	E8 96 12 13 00	90 90 90 90 90
Disable Server Validation Thread	0x0009EA9D	55 48 89 E5 41 57 41	48 31 C0 48 FF C0 C3
Disable License Notify Thread	0x0009D122	55	C3

Bash Script

# for MacOS
cd "/Applications/Sublime Text.app/Contents/MacOS/" || exit
md5 -q sublime_text | grep -i "E1A3347BECDA7CC1EF583ECACECACBDC" || exit
echo 0009D527: 48 31 C0 C3          | xxd -r - sublime_text
echo 000097F5: 90 90 90 90 90       | xxd -r - sublime_text
echo 0000980D: 90 90 90 90 90       | xxd -r - sublime_text
echo 0009EA9D: 48 31 C0 48 FF C0 C3 | xxd -r - sublime_text
echo 0009D122: C3                   | xxd -r - sublime_text

Re-Sign App

codesign --force --deep --sign - "/Applications/Sublime Text.app"

Requires Apple Command Line Tools to be installed

macOS (ARM64)

Based on: https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3929427#gistcomment-3929427

Desciption	Offset	Original	Patched
Initial License Check	0x010758B8	FC 6F BA A9 E6 03 1E AA	E0 03 1F AA C0 03 5F D6
Persistent License Check 1	0x01000360	33 A4 03 94	1F 20 03 D5
Persistent License Check 2	0x01000374	2E A4 03 94	1F 20 03 D5
Disable Server Validation Thread	0x01076B54	F6 57 BD A9	C0 03 5F D6
Disable License Notify Thread	0x01075534	FC 6F BD A9	C0 03 5F D6

Bash Script

# for macOS (ARM64)
cd "/Applications/Sublime Text.app/Contents/MacOS/" || exit
md5 -q sublime_text | grep -i "E1A3347BECDA7CC1EF583ECACECACBDC" || exit
echo 010758B8: E0 03 1F AA C0 03 5F D6 | xxd -r - sublime_text
echo 01000360: 1F 20 03 D5             | xxd -r - sublime_text
echo 01000374: 1F 20 03 D5             | xxd -r - sublime_text
echo 01076B54: C0 03 5F D6             | xxd -r - sublime_text
echo 01075534: C0 03 5F D6             | xxd -r - sublime_text

Re-Sign App

codesign --force --deep --sign - "/Applications/Sublime Text.app"

Requires Apple Command Line Tools to be installed

---

How to Crack Sublime Merge, Stable Channel, Build 2083

Thanks to @leogx9r for providing cracking methods.

https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3823090#gistcomment-3823090 https://gist.github.com/JerryLokjianming/71dac05f27f8c96ad1c8941b88030451?permalink_comment_id=3762883#gistcomment-3762883 https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3802197#gistcomment-3802197

Win64

Desciption	Offset	Original	Patched
Initial License Check	0x000251A8	55 41 57 41 56 41 55 41	48 C7 C0 19 01 00 00 C3
Persistent License Check 1	0x000286A3	E8 70 AA 26 00	90 90 90 90 90
Persistent License Check 2	0x000286BC	E8 57 AA 26 00	90 90 90 90 90
Disable Server Validation Thread	0x000269B8	55 56 57 48 83 EC 30	48 31 C0 48 FF C0 C3
Disable License Notify Thread	0x00024DCD	55	C3
Disable Crash Reporter	0x00023F18	41	C3

Bat Script

:: for Win64
cd /d "C:\Program Files\Sublime Merge" || exit
certutil -hashfile sublime_merge.exe md5 | find /i "E33B76ADA6E7E7577CD4E81A7A4580C7" || exit
echo 000251A8: 48 C7 C0 19 01 00 00 C3 | xxd -r - sublime_merge.exe
echo 000286A3: 90 90 90 90 90          | xxd -r - sublime_merge.exe
echo 000286BC: 90 90 90 90 90          | xxd -r - sublime_merge.exe
echo 000269B8: 48 31 C0 48 FF C0 C3    | xxd -r - sublime_merge.exe
echo 00024DCD: C3                      | xxd -r - sublime_merge.exe
echo 00023F18: C3                      | xxd -r - sublime_merge.exe

PS：xxd.exe extracted from git for windows

Linux

thinks @urxi here

Bash Script

# for Linux
cd /opt/sublime_merge || exit
md5sum -c <<<"86F61A82E7EE8DD9BDC4CF16A7C8E825  sublime_merge" || exit
echo 0045A360: 48 C7 C0 19 01 00 00 C3 | xxd -r - sublime_merge
echo 0045D21D: 90 90 90 90 90          | xxd -r - sublime_merge
echo 0045D23A: 90 90 90 90 90          | xxd -r - sublime_merge
echo 0045B990: C3                      | xxd -r - sublime_merge
echo 0045A05A: C3                      | xxd -r - sublime_merge
echo 00459ABA: C3                      | xxd -r - sublime_merge

macOS

Desciption	Offset	Original	Patched
Initial License Check	0x0002C2DF	55 48 89 E5 41 57 41 56	48 C7 C0 19 01 00 00 C3
Persistent License Check 1	0x0002E96C	E8 1F B9 18 00	90 90 90 90 90
Persistent License Check 2	0x0002E98B	E8 00 B9 18 00	90 90 90 90 90
Disable Server Validation Thread	0x0002D295	55 48 89 E5 41 57 41	48 31 C0 48 FF C0 C3
Disable License Notify Thread	0x0002BF6A	55	C3
Disable Crash Reporter	0x0002B7AB	55	C3

Bash Script

# for MacOS
cd "/Applications/Sublime Merge.app/Contents/MacOS/" || exit
md5 -q sublime_merge | grep -i "B1AADED4F196EEEEBF8D5A6F98B11288" || exit
echo 0002C2DF: 48 C7 C0 19 01 00 00 C3 | xxd -r - sublime_merge
echo 0002E96C: 90 90 90 90 90          | xxd -r - sublime_merge
echo 0002E98B: 90 90 90 90 90          | xxd -r - sublime_merge
echo 0002D295: 48 31 C0 48 FF C0 C3    | xxd -r - sublime_merge
echo 0002BF6A: C3                      | xxd -r - sublime_merge
echo 0002B7AB: C3                      | xxd -r - sublime_merge

Re-Sign App

codesign --force --deep --sign - "/Applications/Sublime Merge.app"

Requires Apple Command Line Tools to be installed

macOS (ARM64)

!!!! May have expired !!!!

Based on:

• https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3929427#gistcomment-3929427
• for ≥ 2075: https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=4311375#gistcomment-4311375

Desciption	Offset	Original	Patched
Initial License Check	0x014D9060	FC 6F BA A9 E6 03 1E AA	E0 03 1F AA C0 03 5F D6
Persistent License Check 1	0x014DAF68	AB B6 04 94	1F 20 03 D5
Persistent License Check 2	0x014DAF7C	A6 B6 04 94	1F 20 03 D5
Disable Server Validation Thread	0x014D9DBC	F6 57 BD A9	C0 03 5F D6
Disable License Notify Thread	0x014D8D9C	FC 6F BD A9	C0 03 5F D6
Disable Crash Reporter	0x014D86E4	FC 6F BC A9	C0 03 5F D6

Bash Script

# for macOS (ARM64)
cd "/Applications/Sublime Merge.app/Contents/MacOS/" || exit
md5 -q sublime_merge | grep -i "B1AADED4F196EEEEBF8D5A6F98B11288" || exit
echo 014D9060: E0 03 1F AA C0 03 5F D6 | xxd -r - sublime_merge
echo 014DAF68: 1F 20 03 D5             | xxd -r - sublime_merge
echo 014DAF7C: 1F 20 03 D5             | xxd -r - sublime_merge
echo 014D9DBC: C0 03 5F D6             | xxd -r - sublime_merge
echo 014D8D9C: C0 03 5F D6             | xxd -r - sublime_merge
echo 014D86E4: C0 03 5F D6             | xxd -r - sublime_merge

Re-Sign App

codesign --force --deep --sign - "/Applications/Sublime Merge.app"

Requires Apple Command Line Tools to be installed

---

How to Crack Sublime Merge, Dev Channel, Build 2085

Thanks to @leogx9r for providing cracking methods.

https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3823090#gistcomment-3823090 https://gist.github.com/JerryLokjianming/71dac05f27f8c96ad1c8941b88030451?permalink_comment_id=3762883#gistcomment-3762883 https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3802197#gistcomment-3802197

Win64

Desciption	Offset	Original	Patched
Initial License Check	0x00025300	55 41 57 41 56 41 55 41	48 C7 C0 19 01 00 00 C3
Persistent License Check 1	0x00028813	E8 B8 7F 27 00	90 90 90 90 90
Persistent License Check 2	0x0002882C	E8 9F 7F 27 00	90 90 90 90 90
Disable Server Validation Thread	0x00026B20	55 56 57 48 83 EC 30	48 31 C0 48 FF C0 C3
Disable License Notify Thread	0x00024F25	55	C3
Disable Crash Reporter	0x00024070	41	C3

Bat Script

:: for Win64
cd /d "C:\Program Files\Sublime Merge" || exit
certutil -hashfile sublime_merge.exe md5 | find /i "8B6590708E6AAE98AC3AE29135DB084F" || exit
echo 00025300: 48 C7 C0 19 01 00 00 C3 | xxd -r - sublime_merge.exe
echo 00028813: 90 90 90 90 90          | xxd -r - sublime_merge.exe
echo 0002882C: 90 90 90 90 90          | xxd -r - sublime_merge.exe
echo 00026B20: 48 31 C0 48 FF C0 C3    | xxd -r - sublime_merge.exe
echo 00024F25: C3                      | xxd -r - sublime_merge.exe
echo 00024070: C3                      | xxd -r - sublime_merge.exe

PS：xxd.exe extracted from git for windows

Linux

thinks @urxi here

Bash Script

# for Linux
cd /opt/sublime_merge || exit
md5sum -c <<<"958DA6B7EC687B25F55A16FF6A3D9BD0  sublime_merge" || exit
echo 0045F22C: 48 C7 C0 19 01 00 00 C3 | xxd -r - sublime_merge
echo 004620F9: 90 90 90 90 90          | xxd -r - sublime_merge
echo 00462116: 90 90 90 90 90          | xxd -r - sublime_merge
echo 0046086C: C3                      | xxd -r - sublime_merge
echo 0045EF26: C3                      | xxd -r - sublime_merge
echo 0045E986: C3                      | xxd -r - sublime_merge

macOS

Desciption	Offset	Original	Patched
Initial License Check	0x0002C4CB	55 48 89 E5 41 57 41 56	48 C7 C0 19 01 00 00 C3
Persistent License Check 1	0x0002EB48	E8 15 23 19 00	90 90 90 90 90
Persistent License Check 2	0x0002EB67	E8 F6 22 19 00	90 90 90 90 90
Disable Server Validation Thread	0x0002D471	55 48 89 E5 41 57 41	48 31 C0 48 FF C0 C3
Disable License Notify Thread	0x0002C156	55	C3
Disable Crash Reporter	0x0002B997	55	C3

Bash Script

# for MacOS
cd "/Applications/Sublime Merge.app/Contents/MacOS/" || exit
md5 -q sublime_merge | grep -i "D67510219FB14938A47BE39260C87215" || exit
echo 0002C4CB: 48 C7 C0 19 01 00 00 C3 | xxd -r - sublime_merge
echo 0002EB48: 90 90 90 90 90          | xxd -r - sublime_merge
echo 0002EB67: 90 90 90 90 90          | xxd -r - sublime_merge
echo 0002D471: 48 31 C0 48 FF C0 C3    | xxd -r - sublime_merge
echo 0002C156: C3                      | xxd -r - sublime_merge
echo 0002B997: C3                      | xxd -r - sublime_merge

Re-Sign App

codesign --force --deep --sign - "/Applications/Sublime Merge.app"

Requires Apple Command Line Tools to be installed

macOS (ARM64)

!!!! May have expired !!!!

Based on:

• https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=3929427#gistcomment-3929427
• for ≥ 2075: https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47?permalink_comment_id=4311375#gistcomment-4311375

Desciption	Offset	Original	Patched
Initial License Check	0x015027EC	FC 6F BA A9 E6 03 1E AA	E0 03 1F AA C0 03 5F D6
Persistent License Check 1	0x015046D4	78 C9 04 94	1F 20 03 D5
Persistent License Check 2	0x015046E8	73 C9 04 94	1F 20 03 D5
Disable Server Validation Thread	0x0150352C	F6 57 BD A9	C0 03 5F D6
Disable License Notify Thread	0x01502528	FC 6F BD A9	C0 03 5F D6
Disable Crash Reporter	0x01501E70	FC 6F BC A9	C0 03 5F D6

Bash Script

# for macOS (ARM64)
cd "/Applications/Sublime Merge.app/Contents/MacOS/" || exit
md5 -q sublime_merge | grep -i "D67510219FB14938A47BE39260C87215" || exit
echo 015027EC: E0 03 1F AA C0 03 5F D6 | xxd -r - sublime_merge
echo 015046D4: 1F 20 03 D5             | xxd -r - sublime_merge
echo 015046E8: 1F 20 03 D5             | xxd -r - sublime_merge
echo 0150352C: C0 03 5F D6             | xxd -r - sublime_merge
echo 01502528: C0 03 5F D6             | xxd -r - sublime_merge
echo 01501E70: C0 03 5F D6             | xxd -r - sublime_merge

Re-Sign App

codesign --force --deep --sign - "/Applications/Sublime Merge.app"

Requires Apple Command Line Tools to be installed

Other cracking methods.md

ST's new version of hexadecimal editing method

From: https://gist.github.com/opastorello/4d494d627ec9012367028c89cb7a1945

Search : 80 78 05 00 0f 94 c1 first result , replace: c6 40 05 01 48 85 c9

This patch is applicable to all x86-64 CPU platforms of ST.

ST's old version hexadecimal editing method

From: https://gist.github.com/opastorello/4d494d627ec9012367028c89cb7a1945?permalink_comment_id=4495369#gistcomment-4495369

97 94 0D --> 00 00 00

License Key:

----- BEGIN LICENSE -----
TwitterInc
200 User License
EA7E-890007
1D77F72E 390CDD93 4DCBA022 FAF60790
61AA12C0 A37081C5 D0316412 4584D136
94D7F7D4 95BC8C1C 527DA828 560BB037
D1EDDD8C AE7B379F 50C9D69D B35179EF
2FE898C4 8E4277A8 555CE714 E1FB0E43
D5D52613 C3D12E98 BC49967F 7652EED2
9D2D2E61 67610860 6D338B72 5CF95C69
E36B85CC 84991F19 7575D828 470A92AB
------ END LICENSE ------

@Destitute-Streetdwelling-Guttersnipe I know, but this only applies to 4114.

It's Friday, so let's have some fun with binary 🚀
@maboloshi you can use this pattern for license_check with 4116:

        Fix(name="license_check", reghex=f"(?<= {0b0000000000001000:02x} {0b0000000000000000:02x} {0b0000000010000000:02x} {0b0000000001010010:02x} . . . {0b0000000000010100:02x} ) {0b0000000011100110:02x} {0b0000000000000011:02x} {0b0000000000011110:02x} {0b0000000010101010:02x} . . . {0b0000000010010100:02x} {0b0000000011111110:02x} {0b0000000000000011:02x} {0b0000000000000110:02x} {0b0000000010101010:02x}", patch=_ret0),

@bms8197 if you want to patch 4116, you can combine the patches of maboloshi at https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47#gistcomment-3911981 with my patch for license_check:

printf %02x  $((2#0000000011100000)) $((2#0000000000000011)) $((2#0000000000011111)) $((2#0000000010101010)) $((2#0000000011000000)) $((2#0000000000000011)) $((2#0000000001011111)) $((2#0000000011010110)) | xxd -r -p -s $((2#00000000111111010111111000011100)) sublime_text

I haven't tested it on Mac M1, but you can give it a try if you're not afraid of binary digits.

@Destitute-Streetdwelling-Guttersnipe Good job 😆 👍

[>] Found pattern for "isValidLicense_arm64" at 0xFD7E1C ...
[*] Rewrite data 'E6 03 1E AA E4 65 0E 94' -> 'E0 03 1F AA C0 03 5F D6' ...

@Destitute-Streetdwelling-Guttersnipe it beats me completely how to patch 4116. I tried several methods combining those patches but it's not working. I'm pretty sure I'm doing something wrong here. This hex stuff is not for me as it seems...

@rainbowpigeon patch working for 4116 build

@kepeto Thanks for testing. I have pushed the changes to support those new dev builds.

echo|set /p="7D6D201F6E924801C0B872398877C8A1 sublime_merge.exe" >nul 2>&1 | md5sum -c - || exit

getting an exit at this point in SM version 2060 🤔

@sharunkumar You need to download Command Line Tools for Windows 64 and extract the Command Line Tools.

I did download that and added the binaries to path. I am still getting the exit. I think the MD5 sum isn't matching

also, if I skip the md5sum check the rest of the commands doesn't seem to work

So in the end does anyone have a patcher that works for MacOS M1 cpu for dev 4116? I tried several times to make it work based on the informations and the patterns provided here but since my skills related to assembly stuff are pretty limit, I had no success so right now I'm using dev 4114 patched.

Nvm, it works when I run them in git bash, but strange that it doesn't work in command prompt.

Nvm, it works when I run them in git bash, but strange that it doesn't work in command prompt.

@sharunkumar Thank you very much for your feedback. I'll look into it then.

@sharunkumar
The command line is amended to:

echo|set /p="7D6D201F6E924801C0B872398877C8A1  sublime_merge.exe" | md5sum -c - >nul 2>&1 || exit

@maboloshi it's better to use PowerShell in Windows, instead of bash, like this:

$file = "C:\Program Files\Sublime Text\sublime_text.exe"
if ((Get-FileHash $file -Algorithm MD5).Hash -ne 'AACCDDFF') { echo 'wrong MD5 hash'; exit }

$bytes = Get-Content $file -Encoding Byte -Raw
$fix = @{
  0xA69D4 = @(0x48, 0x31, 0xC0, 0xC3) # Initial License Check
  0x711A  = @(0x90, 0x90, 0x90, 0x90, 0x90)
  0x7133  = @(0x90, 0x90, 0x90, 0x90, 0x90)
  0xA847F = @(0xC3) # Disable Server Validation Thread
  0xA65CF = @(0xC3)
  0x400   = @(0xC3)
  }
$fix.Keys | %{ $fix[($k=$_)] | %{ $bytes[$k++] = $_ } }
Set-Content $file -Encoding Byte -Value $bytes

in Linux, bash script can be simpler

(
  f=./sublime_text
  patchex() { printf %b ${*/#/\\x} | dd seek=$(($o)) of="$f" bs=1 conv=notrunc status=none; }
  while read o b; do [[ $o =~ ^#|^$ ]] || patchex $b; done <<<'
    # Initial License Check
    0xA69D4 48 31 C0 C3
    0x711A  90 90 90 90 90
    0x7133  90 90 90 90 90
    # Disable Server Validation Thread
    0xA847F C3
    0xA65CF C3
    0x400   C3
    '
)

@Destitute-Streetdwelling-Guttersnipe In fact, I never intended to write it as a nanny script in the first place. 😆

Sublime Text v4117 Crack

Windows (x64 Only)

Patterns have changed again for isValidLicense. Here's 5 different patterns you can use in case one stops working:

`direct reference sig: (+0x3) 45 31 C9 E8 ? ? ? ? 85 C0 75 15 `         // These two invalidation/validation function references
`direct reference sig: (+0x3) 45 31 C9 E8 ? ? ? ? 85 C0 75 0D`          // Same as above.
`direct reference sig: (+0x4) 48 8D 4D 40 E8 ? ? ? ? 48 8B 4E 10`
`direct reference sig: (+0x3) 48 89 F9 E8 ? ? ? ? 48 8B 4E 10 85 C0`
`direct reference sig: (+0x4) 4C 8D 4D 54 E8 ? ? ? ?`                   // Performed on license entering to check validity.

Linux (x64 Only)

MacOS (x64 Only)

Proof

Yes, I removed the "Registered to" line. You can do the same:

    def patch_registration_message(self):
        # 'Registered to \0'
        offset = PatternFinder(
            'registrationMessage',
            '52 65 67 69 73 74 65 72 65 64 20 74 6F 20 00',
            can_duplicate = True
        ).locate(self.binary, slow_method = True, log = False);

        if offset != -1:
            for i in range(0, 15):
                self.binary[offset + i] = 0x00;
            print('[+] Removed registration message.');

Here I quoted the first 3 posts of @leogx9r from
https://gist.github.com/JerryLokjianming/71dac05f27f8c96ad1c8941b88030451#gistcomment-3762200

They're historic game-changing contribution. Thank you, @leogx9r

---

leogx9r commented on May 30

Here's my method for breaking their license protection. I've specifically applied the below to v4107.

Quick note: This isn't meant for newbies, this shows you how to patch the current and (most likely) future versions of Sublime Text. I've been using this for a while now.

Here's a basic rundown of how license validation and invalidation works:

• Licenses have hardcoded (lol, remove blacklist and patch server thread, 10/10 protection) blacklists in the executable and are signed via an RSA public key (which is 'encrypted' in the binary, basically some xor stuff).
• Application tries to validate an invalid license every 5 seconds. It expects this to fail but if it succeeds, it will unregister you after 480 seconds. This is why simply patching the validity function isn't enough.
• Application tries to validate your current license every 15 seconds. It expects this to succeed but if it fails, it will unregister you after 360 seconds.
• The application creates a thread to validate the current license with the server at license.sublimehq.com whenever the application is started (config file read) or when modifying your current license. If this succeeds to connect and your license isn't correct it will unregister you.

So how can you bypass all this? Dare I say, efficiently?

• Patch the validation function (isLicenseValid as I call it) for anything to always return 0 (valid). Values from 1-4 specify either an invalid, blacklisted or unsupported/expired license.
• Prevent thread creation for the validation/invalidation routines to avoid the license being unregistered after X seconds due to patching isLicenseValid. Optionally simply remove the "unregister" function here. Doesn't matter how you go about it really.
• Disable server validation thread or patch the HTTP host so it always fails to connect. Most people resort to using hosts to redirect the license server to localhost or renaming the host in the binary. A far better way is simply to avoid a dead thread being created that does this check.

Disabling creation of these 3 threads is my preferred method since you obviously save resources as you don't need to constantly have new threads opened every X seconds.

Why I consider this better than other methods?

• No need to find a "working"/"nonblacklisted" license. You can literally enter "Hello World!" as a valid license.
• No useless thread creation eating up resources. A small performance improvement you'll absolutely never notice.
• You don't have to patch /etc/hosts or system32/drivers/etc/hosts.
• Relies on patterns so you can build your own script to auto-patch on updates, provided patterns don't break of course.
• Doesn't decide to randomly expire.

How tho?

Patch the following methods:

• License Validity Checking (Aka IsValidLicense

Make isLicenseValid return 0, pattern is a reference to call isLicenseValid. I personally just replaced the method with xor rax, rax; ret so 48 31 C0 C3.

    Linux/MacOS x64 Pattern: `direct reference sig: E8 ? ? ? ? 49 8B BF ? ? ? ? 85 C0`
    Windows x64 Pattern:     `direct reference sig: E8 ? ? ? ? 48 8B 8B ? ? ? ? 85 C0`

• Invalidation/Validation Functions

These cause delayed unregistration after 360/480 seconds so NOP out the calls to avoid them. Aka replace E8 XX XX XX XX with 90 90 90 90 90.

    Windows x64 Pattern 1: `direct reference sig: (+0x6) 41 B8 ? ? ? ? E8 ? ? ? ? 49 8B 96`
                Pattern 2: `raw sig: E8 ? ? ? ? E8 ? ? ? ? 4C 89 F1 E8`
    Linux x64   Pattern 1: `raw sig: E8 ? ? ? ? 48 89 5C 24 ? 48 8B B3`
                Pattern 2: `raw sig: E8 ? ? ? ? BF ? ? ? ? E8 ? ? ? ? 83 25`
    MacOS       Pattern 1: `raw sig: E8 ? ? ? ? 48 89 9D ? ? ? ? 48 8B B3`
                Pattern 2: `raw sig: E8 ? ? ? ? 48 8D 3D ? ? ? ? E8 ? ? ? ? 83 25`

• Server Validation Thread

Simply make this instantly return 1 to disable thread creation or patch the hostname to something invalid. I personally prefer to simply disable thread creation by making this return 1, aka 48 31 C0 48 FF C0 C3, xor rax, rax; inc rax; ret.

    Windows x64 Pattern: `raw sig: 55 56 57 48 83 EC 30 48 8D 6C 24 ? 48 C7 45 ? ? ? ? ? 89 D6 48 89 CF 6A 28`
    Linux x64   Pattern: `raw sig: 55 41 56 53 41 89 F6 48 89 FD 6A 28`
    MacOS       Pattern: `raw sig: 55 48 89 E5 41 57 41 56 53 50 41 89 F6 49 89 FF 6A 20`

Now what?

After patching simply register with anything you want. It can even be just a random letter, a space, a word, a sentence, a valid or invalid license -- whatever you want. Here's what I registered with:

Paying 80$ For A License Is Stupid

But I wanna download!

Linux

For Linux x64 on v4107, you can use this (replace /opt/sublime_text/sublime_text with the path to the binary):

# 554157415641554154534881EC68240000 -> 4831C0C390909090909090909090909090
sed -i 's/\x55\x41\x57\x41\x56\x41\x55\x41\x54\x53\x48\x81\xEC\x68\x24\x00\x00/\x48\x31\xC0\xC3\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90/g' /opt/sublime_text/sublime_text

# E8C2781800 -> 9090909090
sed -i 's/\xE8\xC2\x78\x18\x00/\x90\x90\x90\x90\x90/g' /opt/sublime_text/sublime_text
# E8A7781800 -> 9090909090
sed -i 's/\xE8\xA7\x78\x18\x00/\x90\x90\x90\x90\x90/g' /opt/sublime_text/sublime_text

# 554156534189F64889FD6A28 -> 4831C048FFC0C39090909090
sed -i 's/\x55\x41\x56\x53\x41\x89\xF6\x48\x89\xFD\x6A\x28/\x48\x31\xC0\x48\xFF\xC0\xC3\x90\x90\x90\x90\x90/g' /opt/sublime_text/sublime_text

Windows

I've uploaded a portable copy of the Windows x64 bit version, already patched, here. Simply replace the sublime_text.exe file from the portable download with the above. Here's the virus scan. Note: PE.Heur.InvalidSig is due to patching the executable to bypass the license checks. Don't trust it? Then patch it yourself :P

I've been using this on both Windows and Linux since the new version dropped without issues.

MacOS

No.

Proof

---

leogx9r commented on May 30

@CypherpunkSamurai You can probably try these:

Art of Assembly
Assembly Generic Wiki
Introduction to x64 Assembly
x86 and x64 Instruction Reference

There's many books as well. You could look around. I use IDA and Ghidra.

---

leogx9r commented on May 30

For the record, Sublime Merge can also be defeated the same way. Did the same on v2056.

License Validity Checking

For this, the only difference with Sublime Text is you need to return 281 instead of 0. I just did a simple mov rax, 281; ret.

    Windows x64 Pattern: `direct reference sig: E8 ? ? ? ? 3D ? ? ? ? 75 15`
    Linux x64 Pattern:   `direct reference sig: E8 ? ? ? ? 3D ? ? ? ? 75 12`
    MacOS x64 Pattern:   `direct reference sig: E8 ? ? ? ? 3D ? ? ? ? 75 14`

Invalidation/Validation Threads

    Windows x64 Pattern 1: `direct reference sig: (+0x6) 41 B8 ? ? ? ? E8 ? ? ? ? E8 ? ? ? ? B9`
                Pattern 2: `direct reference sig: (+0x6) 41 B8 ? ? ? ? E8 ? ? ? ? 48 8B 96 ? ? ? ? `
    Linux x64   Pattern 1: `raw sig: E8 ? ? ? ? 48 89 5C 24 ? 48 8B B3`
                Pattern 2: `raw sig: E8 ? ? ? ? BF ? ? ? ? E8 ? ? ? ? 83 25`
    MacOS       Pattern 1: `raw sig: E8 ? ? ? ? 48 89 9D ? ? ? ? 48 8B B3`
                Pattern 2: `raw sig: E8 ? ? ? ? 48 8D 3D ? ? ? ? E8 ? ? ? ? 83 25`

Server Validation Thread

    Windows x64 Pattern: `raw sig: 55 56 57 48 83 EC 30 48 8D 6C 24 ? 48 C7 45 ? ? ? ? ? 89 D6 48 89 CF 6A 28`
    Linux x64   Pattern: `raw sig: 55 41 56 53 41 89 F6 48 89 FD 6A 28`
    MacOS       Pattern: `raw sig: 55 48 89 E5 41 57 41 56 53 50 41 89 F6 49 89 FF 6A 20`

Proof

---

@rainbowpigeon new pattern from @leogx9r
your patch not working for latest dev build (4117, 4118)

@Destitute-Streetdwelling-Guttersnipe 👍

---

Sublime Merge v2062 Crack

I finally managed to post the offsets before @maboloshi could provide them for once lol. 😄

Patterns remain the same thankfully.

Windows (x64 Only)

Linux (x64 Only)

MacOS (x64 Only)

Proof

Cheers.

@maboloshi: Tried with that bash script on a CentOS linux vm, using the patterns from v4116 and the sublime_text macos arm binary (I initially tried on MacOS terminal but it appears that I have bash 5 on Mac and the syntax is different). It resulted in a file of 4.2Gb. Needless to say that Sublime it's not working.

Inside the script I've used something like this:

    0x93D8A 48 31 C0 C3
    0xFFFFF1A3 48 31 C0 C3
    0x92F32 48 31 C0 C3
    0x8E7E 90 90 90 90 90
    0x8E9D 90 90 90 90 90
    0x94297 48 31 C0 48 FF C0 C3
    0x92B50 C3
    0x2FE7 C3

@maboloshi TIL that echo|set /p= in your bat script is used to print string without EOL (\n\r).
And I wonder why don't you use printf instead :D

BTW, I think it's better to remove >nul 2>&1 in order to show errors (wrong hash, file not found/readable ...)

@bms8197 You should remove the patch at 0x93D8A and 0xFFFFF1A3.
I guess you want to patch at 3 offsets when you saw this

[>] Found RVA pattern for "isValidLicense" at 0x93D8A -> 0xFFFFF1A3 -> 0x92F32 ...
[*] Rewrite data '55 48 89 E5' -> '48 31 C0 C3' ...

But only the last offset should be patched.

@Destitute-Streetdwelling-Guttersnipe Ok, thanks!

@Destitute-Streetdwelling-Guttersnipe Good idea. I've fixed it. 😆

@Destitute-Streetdwelling-Guttersnipe: Tried like that, for the macos arm binary, the bash command seems to work but nothing happens. I'm getting a Lincese Upgrade message (I initially had SublimeText v4113 license with some 10 user license I found on internet and it was still working. Currently I have a patched v4114 version that I'm using so I was trying to patch 4116 and run it in parallel until I manage to patch it following instructions from this thread. The patterns are from @maboloshi and according to him v4116 shold be patched with those or MacOS M1

      0x92F32 48 31 C0 C3
      0x8E7E 90 90 90 90 90
      0x8E9D 90 90 90 90 90
      0x94297 48 31 C0 48 FF C0 C3
      0x92B50 C3
      0x2FE7 C3

In order to test if the changes were actually applied to the sublime_text file I did a md5sum (before and after):

da00e096337a07b659b573ca7fc4d352  sublime_text
cf70460527ba9f1217307dae00c248db  sublime_text

So it appears the changes were applied. Maybe I'm missing something...

I've done some tests. So for v4114 binary which is correctly patched, if I remove the license, close the program, start it again, it asks for a license, I enter whatever, it's fully registered. For v4116 doing the same thing, when entering the license says "Invalid license" so I assume the patterns that I used above are not entirely correct

@bms8197 We took the 4114 binary provided by @leogx9r and tried to figure out the rules. We don't have a corresponding testbed to verify.

You can try:
for ST 4118 (MacOS M1):

# for ST 4118 (MacOS M1)
cd "/Applications/Sublime Text.app/Contents/MacOS/" || exit
[ $(md5 sublime_text) = B996ECD0CD2F60425B6B29D694DD9AB3 ] || exit
printf '\xE0\x03\x1F\xAA\xC0\x03\x5F\xD6' | dd of=sublime_text bs=1 seek=$((0xFCE7CC)) conv=notrunc
printf '\x1F\x20\x03\xD5'             | dd of=sublime_text bs=1 seek=$((0xF60190)) conv=notrunc
printf '\x1F\x20\x03\xD5'             | dd of=sublime_text bs=1 seek=$((0xF601A4)) conv=notrunc
printf '\xC0\x03\x5F\xD6'             | dd of=sublime_text bs=1 seek=$((0xFCF8C8)) conv=notrunc
printf '\xC0\x03\x5F\xD6'             | dd of=sublime_text bs=1 seek=$((0xFCE45C)) conv=notrunc
printf '\xC0\x03\x5F\xD6'             | dd of=sublime_text bs=1 seek=$((0xF5B814)) conv=notrunc

@maboloshi That's not working since the md5sum of that sublime_text binary (the original one downloaded from Sublime's website) is exactly the one in the exit line. So printf and dd commands are not actually executed. If I run them and patch the binary with those commands, the app crashes.

» md5sum sublime_text
b996ecd0cd2f60425b6b29d694dd9ab3  sublime_text

I've also tried with that bash patch using these patterns, same result, app crashes:

	0x92F32 E0 03 1F AA C0 03 5F D6
	0xF69744 1F 20 03 D5
	0xF69758 1F 20 03 D5
	0xFD8F38 C0 03 5F D6
	0xFD7AAC C0 03 5F D6
	0xF64DB8 C0 03 5F D6

@bms8197 oops, I didn't recognize that you want to patch ST4116 on Mac M1. All the patches of maboloshi only work on x64. The experimental patch for Mac M1 is only tested for ST4114.
If you want it so bad, you could follow leogx9r's guide to dissassemble. Maybe you'll be the first to find the patch for Mac M1.

@Destitute-Streetdwelling-Guttersnipe I'll give it a try although I have zero assembly knowledge so the chances that I'll manage to discover the working patterns are slim... But it worth to try. I don't want it so bad, atm I'm using v4114 but since all the other versions can be patched (Windows, Linux, MacOS (not arm)) it's a little bit frustrating not to have it patched on MaCOS M1.

I did my best but it beats me how to patch it. I tried to look at the v4114 patched binary. I've also downloaded v4117 supposedly cracked by TNT (but I didn't run it since I don't trust that site) but anyway I was looking at the binary trying to find a pattern. This assembly stuff is way over my knowledge. If anyone is able to patch v4118 for MacOS M1 please share, otherwise I'll just stick to v4114

I know I said I wouldn't be doing this again but ... I had some spare time, decided to patch ARM64 again but for both Sublime Text and Sublime Merge this time. Below are the patched variants for both x64 and ARM64. I may have patched them wrong (as I've no way to test so verify yourselves). Yes you'll need to resign the file for it to work as expected on MacOS.

Sublime Text v4118 MacOS (x64 + ARM64)

These are the patched IDA offsets shown using a mapped base of 0x100000000 instead of a file offset for Mach-O ARM64. x64 offsets are in my above post.

Thumb Translations

1F 20 03 D5 = NOP
E0 03 1F AA = MOV X0, XZR
C0 03 5F D6 = RET X30

Get it here. Virus scan here.

Sublime Merge v2062 MacOS (x64 + ARM64)

These are the patched IDA offsets shown using a mapped base of 0x100000000 instead of a file offset for Mach-O ARM64. x64 offsets are in my above post. With this one, mov x0, xzr isn't correct since 281 is required to be the correct return value. mov x0, #281 instead works fine.

Yes, I realized I accidentally omitted the offsets here but the patched bytes and original bytes + the provided file should be enough for you to get them. Sorry about that.

Thumb Translations

1F 20 03 D5 = NOP
20 23 80 D2 = MOV X0, #0x119
C0 03 5F D6 = RET X30

Get it here. Virus scan here.

Maybe this time I'll actually not do this again. 😄