Skip to content

Instantly share code, notes, and snippets.

@Fadi002
Created May 23, 2025 22:20
Show Gist options
  • Select an option

  • Save Fadi002/51a505cece648915bc2f32f3b7e6b71d to your computer and use it in GitHub Desktop.

Select an option

Save Fadi002/51a505cece648915bc2f32f3b7e6b71d to your computer and use it in GitHub Desktop.
Crack Sublime Text 4.2.0.0 Build 4200 [latest version]
import sys
import os

NOP = 0x90
offsets_and_values = {
    0x00030170: 0x00,
    0x000A94D0: NOP, 0x000A94D1: NOP, 0x000A94D2: NOP, 0x000A94D3: NOP, 0x000A94D4: NOP, 0x000A94D5: NOP, 0x000A94D6: NOP, 0x000A94D7: NOP, 0x000A94D8: NOP, 0x000A94D9: NOP, 0x000A94DA: NOP, 0x000A94DB: NOP, 0x000A94DC: NOP, 0x000A94DD: NOP, 0x000A94DE: NOP, 0x000A94DF: NOP, 0x000A94E0: NOP, 0x000A94E1: NOP, 0x000A94E2: NOP, 0x000A94E3: NOP, 0x000A94E4: NOP, 0x000A94E5: NOP, 0x000A94E6: NOP, 0x000A94E7: NOP, 0x000A94E8: NOP, 0x000A94E9: NOP, 0x000A94EA: NOP, 0x000A94EB: NOP, 0x000A94EC: NOP, 0x000A94ED: NOP, 0x000A94EE: NOP, 0x000A94EF: NOP, 0x000A94F0: NOP, 0x000A94F1: NOP, 0x000A94F2: NOP, 0x000A94F3: NOP, 0x000A94F4: NOP, 0x000A94F5: NOP, 0x000A94F6: NOP, 0x000A94F7: NOP, 0x000A94F8: NOP, 0x000A94F9: NOP, 0x000A94FA: NOP, 0x000A94FB: NOP, 0x000A94FC: NOP, 0x000A94FD: NOP, 0x000A94FE: NOP, 0x000A94FF: NOP, 0x000A9500: NOP, 0x000A9501: NOP, 0x000A9502: NOP, 0x000A9503: NOP, 0x000A9504: NOP, 0x000A9505: NOP, 0x000A9506: NOP, 0x000A9507: NOP, 0x000A9508: NOP, 0x000A9509: NOP, 0x000A950A: NOP, 0x000A950B: NOP, 0x000A950C: NOP, 0x000A950D: NOP, 0x000A950E: NOP, 0x000A950F: NOP,
    0x001C6CCD: 0x02,
    0x001C6CE4: 0x00,
    0x001C6CFB: 0x00,
}

def patch_exe(input_file, output_file=None):
    output_file = output_file or f"{os.path.splitext(input_file)[0]}_patched.exe"
    try:
        with open(input_file, 'rb') as f:
            data = f.read()
        patched_data = bytearray(data)
        for offset, value in offsets_and_values.items():
            if offset < len(patched_data):
                patched_data[offset] = value
        with open(output_file, 'wb') as f:
            f.write(patched_data)
        print(f"[+] Patch applied successfully! Saved as: {output_file}")

    except Exception as e:
        print(f"Error: {e}")

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python patcher.py <input_file> [output_file]")
    else:
        patch_exe(sys.argv[1], sys.argv[2] if len(sys.argv) > 2 else None)

How to Run:

  1. Save the code in a Python script (e.g., patcher.py).

  2. Open the terminal/command prompt and run the script like so:

    python patcher.py "path_to_sublime_text.exe"

    Replace "path_to_sublime_text.exe" with the actual path to the sublime_text.exe file.

  3. The patched version will be saved in the same directory as the original file (or you can specify a custom output path).

Note:

Please be aware that even after applying the patch, the status may still display as (UNREGISTERED). This is normal, and you can safely disregard this message because the app is already activited.
big thanks to @AdvDebug

@yashodhahiregoudar94

yashodhahiregoudar94 commented Aug 20, 2026

Copy link
Copy Markdown

@Termot

Termot commented Sep 2, 2026

Copy link
Copy Markdown

Working perfectly in OS: Debian GNU/Linux 13.6 (trixie) :

sudo perl -pi -e 's/\x0F\xB6\x51\x05\x83\xF2\x01/\xC6\x41\x05\x01\xB2\x00\x90/' /opt/sublime_text/sublime_text

Thanks :)

working perfectly on Steam OS (arch)
me use this:
sudo perl -pi -e 's/\x0F\xB6\x51\x05\x83\xF2\x01/\xC6\x41\x05\x01\xB2\x00\x90/' /var/lib/flatpak/app/com.sublimehq.SublimeText/x86_64/stable/active/files/extra/sublime_text/sublime_text
thanks ^^

@drubicza

drubicza commented Sep 5, 2026

Copy link
Copy Markdown
image image

@erbanku

erbanku commented Sep 8, 2026

Copy link
Copy Markdown

Build 4200 · macOS · Universal Binary

(Apple Silicon native + x86_64 Rosetta)

Screen Shot 2026-09-08 at 15 16 06 PM

Verified on macOS 26 / Apple Silicon, Sublime Text Build 4200 (CFBundleVersion 4200).

Clean universal binary md5 4aa67b38ccfcc37a2e7af0239750f889
Patched universal binary md5 50adbbfb5e5092bb83c749146378126c
ARM64 thin slice md5 88859ce97336a17b4e3eb9fad1f37cf4

1. Quit Sublime Text

osascript -e 'quit app "Sublime Text"' 2>/dev/null || true
sleep 2
pgrep sublime_text && echo "still running" || echo "stopped"

2. Backup

SUBLIME_BIN="/Applications/Sublime Text.app/Contents/MacOS/sublime_text"
sudo cp "$SUBLIME_BIN" "${SUBLIME_BIN}.backup_$(date +%Y%m%d)"

3. Clone ARM64 patcher

git clone --depth 1 https://github.com/saoGITo/ST_crack.git /tmp/ST_crack

Pattern hits on clean Build 4200 universal binary (each exactly once):

Pattern (original) Offset
628F0294 0xEF3570
5D8F0294 0xEF3584
F657BDA9F44F01A9FD7B02A9FD8300918F910A94 0xEFADA4
E6031EAAC7B80A94 0xEF9E24
F657BDA9F44F01A9FD7B02A9FD830091FF430CD1 0xEF9B4C

x86_64 flag-store (Rosetta slice), offset 0x290500:

0F B6 51 05 83 F2 01  →  C6 41 05 01 B2 00 90

Reference: qzzhoulu1995/sublime · patch_sublime.sh

4. Patch (ARM64 + x86_64)

WORK=/tmp/sublime_patch_work
rm -rf "$WORK" && mkdir -p "$WORK"
cp "$SUBLIME_BIN" "$WORK/sublime_text"

python3 "/tmp/ST_crack/build 4200/patch.py" "$WORK/sublime_text" "$WORK/sublime_text_patched"

python3 - <<'PY'
from pathlib import Path
p = Path("/tmp/sublime_patch_work/sublime_text_patched")
data = bytearray(p.read_bytes())
off = 0x290500
old = bytes.fromhex("0FB6510583F201")
new = bytes.fromhex("C6410501B20090")
assert data[off:off+7] == old, f"x86 mismatch: {data[off:off+7].hex()}"
data[off:off+7] = new
p.write_bytes(data)
print("x86 slice patched")
PY

Expected patch.py output: 5 locations patched.

5. Install + re-sign

SUBLIME_APP="/Applications/Sublime Text.app"
sudo cp "$WORK/sublime_text_patched" "$SUBLIME_BIN"
sudo xattr -rc "$SUBLIME_APP"
sudo codesign --force --deep --sign - "$SUBLIME_APP"

6. Verify bytes

python3 - <<'PY'
import hashlib
from pathlib import Path
data = Path("/Applications/Sublime Text.app/Contents/MacOS/sublime_text").read_bytes()
print("md5", hashlib.md5(data).hexdigest())
print("arm nop1", data[0xEF3570:0xEF3574].hex() == "1f2003d5")
print("x86 flag", data[0x290500:0x290507].hex() == "c6410501b20090")
PY

Expected patched md5: 50adbbfb5e5092bb83c749146378126c

Launch check: start. Help → AboutRemove License in Help menu = patch OK. Title bar may still show (UNREGISTERED).

Restore

sudo cp "${SUBLIME_BIN}.backup_YYYYMMDD" "$SUBLIME_BIN"
sudo codesign --force --deep --sign - "/Applications/Sublime Text.app"

Sublime updates overwrite the patch — re-run after upgrade.

@erbanku

erbanku commented Sep 8, 2026

Copy link
Copy Markdown

@fredquie

Copy link
Copy Markdown

Stop-Process -Name "sublime_text" -ErrorAction SilentlyContinue; $path = "C:\Program Files\Sublime Text\sublime_text.exe"; if (Test-Path $path) { Copy-Item $path "$path.bak" -Force; [byte[]]$b = [System.IO.File]::ReadAllBytes($path); $s = byte[]; $r = byte[]; for($i=0; $i -le $b.Length - $s.Length; $i++){ $match=$true; for($j=0; $j -lt $s.Length; $j++){ if($b[$i+$j] -ne $s[$j]){ $match=$false; break } }; if($match){ for($j=0; $j -lt $s.Length; $j++){ $b[$i+$j] = $r[$j] }; break } }; [System.IO.File]::WriteAllBytes($path, $b); Write-Host "Patch applied and .bak backup created successfully!" -ForegroundColor Green } else { Write-Host "Error: sublime_text.exe not found in the default path." -ForegroundColor Red }

Works great ! Thx

@pug-referee

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment