Dialtone Tech Notes

Macintosh AOL 2.7

A deep technical exploration of AOL's proprietary FDO88 binary GUI protocol, the P3 transport layer, and the underground tool scene that hacked it all through the mid-1990s.

119

FDO88 Commands

57

Executable Modules

171

Canned Forms

86

Underground Tools

2158

Extracted Art

57

Sounds

FDO88 (Form Definition Opcode 88) was America Online's proprietary binary bytecode language for defining, rendering, and controlling the graphical user interface of its client software. Every window, button, text field, and menu on AOL was described as an FDO88 stream — a compact sequence of opcodes sent from AOL's host computers over the P3 transport protocol and interpreted in real-time by the client.

This project documents the complete FDO88 instruction set from the original confidential AOL engineering manual (January 1994, Release 1.0), maps the internal architecture of the AOL 2.7 Macintosh client through resource fork analysis, and preserves the underground "hacker tool" ecosystem that exploited these protocols — including the infamous AOL4FREE billing bypass. The 83 tools catalogued here represent a nearly complete archive of the AOL Macintosh underground scene.

Protocol Architecture

How the AOL 2.7 Macintosh client processed data from modem to screen

Client Architecture

The AOL 2.7 Mac client was a single 851KB binary containing 57 executable modules (what the classic Mac OS called "CODE resources" — essentially the 1990s equivalent of DLLs, loaded into memory on demand). Each module handled a distinct subsystem: protocol networking, form rendering, sound playback, modem control, etc. The following diagram shows the data flow from network connection to rendered UI:


          AOL 2.7 Mac Client - Internal Architecture
          ============================================

  [  Modem (300-28800 baud) or TCP to AmericaOnline.aol.com:5190  ]
                                  |
                                  v
  +---------------------------------------------------------------+
  |                    P3 Protocol Engine                          |
  |  Reliable transport: sync ($5A), CRC-16, sequence numbers,    |
  |  sliding window flow control, 119-byte max payload per frame  |
  +---------------------------------------------------------------+
                                  |
                                  v
  +---------------------------------------------------------------+
  |                      Token Handler                             |
  |  Routes each packet by its 2-byte ASCII token identifier:      |
  |  AF/RF = FDO88 forms, iT/iP = IMs, AA-AX = Chat, OT = Tools  |
  +-------------------------------+-------------------------------+
                |                                   |
                v                                   v
  +----------------------------+      +----------------------------+
  |   FDO88 Form Pipeline      |      |      Online Tools          |
  |                            |      |                            |
  |  DataParsing               |      |  Chat        (tokens AA-AX)|
  |    Reads binary stream     |      |  Mail        (tokens iT/iP)|
  |    byte by byte, decodes   |      |  File Xfer   (token f1)   |
  |    opcodes + parameters    |      |  Members     (tokens iA/iB)|
  |           |                |      |  Goto, Setup, Compression  |
  |           v                |      +----------------------------+
  |  FormModifiers             |
  |    Interprets each opcode: |
  |    Window16, Field16,      |
  |    Text, dispch, Switch,   |
  |    Picture, SetFont...     |
  |           |                |
  |           v                |
  |  FormsCreation             |
  |    Builds Mac UI elements: |
  |    _NewWindow, TextEdit,   |
  |    buttons, lists, popups  |
  |           |                |
  |           v                |
  |  Drawing (QuickDraw)       |
  |    Renders pixels on screen|
  +----------------------------+
                |
                v
  +---------------------------------------------------------------+
  |               MOPs - Dispatch Execution                        |
  |  User clicks button -> reads 6-byte dispatch structure:        |
  |  [MOP code] [token hi] [token lo] [info1] [info2] [info3]     |
  |  Sends P3 token to server -> server responds with new form     |
  +---------------------------------------------------------------+
                |
                v
          (back to P3 Protocol Engine — full cycle)

P3 Packet Structure

P3 (Protocol 3) was AOL's reliable transport layer, sitting between the raw serial/TCP connection and the application-level token dispatching. Each P3 frame carried a 2-byte token identifier that determined how the payload was routed. FDO88 form data, chat messages, IMs, and billing signals all traveled as P3 packets.

[5A]        Sync byte 'Z'
[CRC hi]    CRC-16 high byte
[CRC lo]    CRC-16 low byte
[00]        Padding
[length]    Payload length
[tx_seq]    Transmit sequence
[rx_seq]    Receive sequence
[space]     0x20
[token hi]  Token identifier
[token lo]  Token identifier
[data...]   FDO88 payload

The sync byte 0x5A ('Z') marked the start of every frame. CRC-16 provided integrity checking. The tx/rx sequence numbers implemented reliable delivery with retransmission — critical when the transport was a 2400 baud modem connection. The 2-byte token after the header determined which handler in the client would process the payload.

7-Phase Connection Sequence

Phase 1: Physical Link — Modem dials AOL access number via the CCL interpreter. SerStuff manages the serial port. Baud rate negotiation at hardware level.

Phase 2: P3 Handshake — Client sends P3 init sequence. Protocol version negotiation. CRC and sequence number initialization in the P3 engine.

Phase 3: Authentication — Screen name and password transmitted. Server validates credentials. Session token issued.

Phase 4: Client Configuration — Server sends configuration tokens. Client version verified. Feature flags set based on account type.

Phase 5: Form Loading — Initial FDO88 streams arrive via AF (Add Form) tokens. Welcome screen and navigation forms constructed. DataParsing decodes the atom stream, FormModifiers interprets opcodes, FormsCreation builds the windows.

Phase 6: Idle Loop — Main event loop processes Mac events. The Schedule handler manages keepalives. P3 handles incoming tokens and routes to handlers.

Phase 7: Teardown — Disconnect token sent. P3 session closed. FormsDeletion tears down windows. Modem hung up.

Token Dispatch Table

When a P3 packet arrived, the TokenHandler examined the 2-byte token and routed the payload to the appropriate handler. These ASCII token pairs were the fundamental addressing scheme of the AOL protocol:

Token	Hex	Handler	Purpose
wS	0x7753	Window Show	Show/activate window by ID
wC	0x7743	Window Close	Close window by ID
wH	0x7748	Window Hide	Hide window (keep state)
hS	0x6853	Host String	Display host message
AF	0x4146	Add Form	Create new FDO88 form
RF	0x5246	Return Form	Update existing form
OT	0x4F54	Online Tools	Tool management
iP	0x6950	IM Present	IM presence probe
iT	0x6954	IM Text	IM message body
AA-AX	0x4141+	Chat	Chat room operations

Module Map

The 57 executable modules inside the AOL 2.7 binary. Classic Mac apps split their code into numbered "CODE resources" loaded into memory on demand — think of each row as a separate DLL with a specific job:

#	Size (bytes)	Module	What it does
0	12,928	Jump table	Segment loader — contains the inter-segment jump table. The Macintosh Segment Loader resolves CODE resource references through this table.
1	42,206	Main	Application entry point and main event loop. After initialization, all user interaction flows through this loop.
2	20,448	InitUnit	Startup initialization and globals setup. Sets up the A5 globals world including the P3 state block. AOL4Free patches at offsets $1376, $13C0, and appends 64 bytes at $4DA2.
3	31,490	Libs	Shared library routines used across multiple segments. AOL4Free patches at offset $7AB8.
4	27,106	Events	Event dispatch and idle processing. Routes Mac OS events. AOL4Free patches at offset $69E2. Contains BSR calls and CMP.B #$33 comparisons for event type testing.
5	22,524	P3	P3 protocol engine. First function accesses globals at A5-$ACAA, uses _BlockMove ($A02E) for packet assembly. AOL4Free patches at offsets $1ABA, $56A4, $56CE and appends 448 bytes at $57FC — the largest single patch, injecting billing-stop token logic.
6	27,088	DataParsing	The FDO88 binary decoder. Reads FDO88 streams byte by byte: checks high bit for byte-count vs fixed params, handles $F8 extended prefix, routes each decoded opcode to FormModifiers. Called from TokenHandler via JSR $10D2(A5).
7	20,588	ToolkitUtils	Online Tool loading and management. Loads tool files from the Online Tools/ directory.
8	19,072	Toolkit	Tool API framework. Provides the interface between the main client and loaded Online Tools.
9	4,218	TokenHandler	Routes incoming P3 DATA packets by their 2-byte token. Takes 4 parameters (output status, output type, data length, data buffer). Clears output buffers, reads token bytes, dispatches via cross-segment JSR to DataParsing at $10D2(A5).
10	18,004	FormsInfo	FDO88 form state machine. Tracks active form context (the window being built), field counter (sequential numbering), and stream continuation state for multi-packet forms using break.
11	14,294	Drawing	Mac QuickDraw rendering of FDO88 forms. Translates decoded form elements into QuickDraw drawing calls.
12	28,048	FormModifiers	The FDO88 opcode interpreter. First function is a Pascal-convention stub (LINK/UNLK/pop 8 bytes/JMP). Second function at $0010: LINK A6,#-2; reads byte from stream via A4 structure at $000C(A4); sign-extends with ADD.W #$0100 for unsigned 0x80-0xFF range; increments stream pointer. Cross-segment calls via JSR $04DA(A5). AOL4Free patches at offset $6D92.
13	26,278	CCL	Connection Control Language interpreter. Runs modem scripts from Online Files/. Sends AT commands, dials the access number, waits for CONNECT.
14	2,436	Dbase	Local database access. Opens the Online Database resource file containing DB08-DB16 canned FDO88 forms. Uses Mac Resource Manager traps (_GetResource=$A9A0, _LoadResource=$A9A4, _SizeRsrc=$A9A3).
15	2,898	Dialogs	Alert and dialog management.
16	1,258	Utils	Miscellaneous utility routines.
17	16,940	SerStuff	Serial port / modem I/O. Uses SERi resource 128 (160 bytes) as the serial input ring buffer. Handles baud rate negotiation (300-28800 baud).
18	4,802	Printing	Print support.
19	2,242	WindowUtes	Window utility routines.
20	3,130	FormsDeletion	Form teardown and cleanup. Destroys windows and releases form state when disconnecting or navigating away.
21	28,006	FormsCreation	Converts decoded FDO88 commands into Macintosh windows and controls: Window16 -> _NewWindow/_NewCWindow, Field16 -> text fields/buttons/lists/popups, Picture -> PICT/ICON, Title -> _SetWTitle.
22	17,894	Menus	Menu bar construction and dispatch. AOL4Free patches at offset $45E6, modifying _MenuSelect ($A9BF) trap handling.
23	20,300	Schedule	Background task scheduling. Handles keepalives and periodic maintenance during idle time.
24	9,232	UDO	User Data Objects — user preferences and session state.
25	23,752	ToolCallbacks	Callback handlers for Online Tools. Provides the bridge between the tool API and the main client's token dispatch.
26	9,602	EditStuff	Text editing via Macintosh TextEdit integration.
27	11,100	MOPs	Menu Operation dispatch. Allocates 268 bytes of locals (LINK A6,#-268). Accesses method dispatch table at struct offset $82 (130 bytes). Uses SNE D0 for conditional dispatch. AOL4Free patches at offsets $21E0 and $2B5C.
28	13,980	DiskIO	File system operations.
29	6,030	SoundUtil	Sound playback for Sound and Note commands.
30-50	varies	TDI Charting	Embedded TDI charting engine: 2D_ENGINE_SUPPORT, AREA_LINE, BAR_ENGINE, PIE_ENGINE, COM, DRAW. Uses D3DF definition resources and precomputed sine tables (DGDS "FixedSinTable") for pie chart rendering.

FDO88 Command Reference

All 119 commands from the internal AOL FDO88 Manual (January 1994)

Loading FDO88 manual data

AOL4FREE: The Full Story

In 1995, a teenager called Happy Hardcore wrote a binary patcher that let Mac users access AOL without paying hourly charges. We disassembled both his patcher and the AOL client it targets.

AOL's Mac client is a single 851KB 68k application where every byte of executable code lives in the resource fork as numbered modules. 57 modules, 721KB of Motorola 68000 assembly. The client renders its entire UI using FDO88 — every window, button, text field, and chat room is a binary FDO88 stream interpreted in real-time.

Happy Hardcore's patcher contains no FDO88 data whatsoever. It is pure 68k machine code patches stored as ZAP resources (using Michael Hecht's ResCompare patcher, v4.0.3), applied to the AOL 2.6 executable and three Online Tools: Chat, File Transfer, and Mail. But here is what made it invaluable to us: his ZAP# resources name every module he patches — InitUnit, Libs, Events, P3, FormModifiers, Menus, MOPs. The AOL binary itself has no symbols. His labels gave us the map.

The Fundamental Flaw

The exploit targets a fundamental design flaw that Happy Hardcore describes perfectly in his docs:

"To go to the free area, you select 'Member Services', and the client sends a 'token' to the host telling it to stop billing, and telling it to send the client the information for the 'Free Area' window. The catch is that it's the client's job to close all of the other windows. It's the client's job to tell you you can't IM and read EMAIL. The host couldn't give a shit."

When you click Member Services, the client sends a P3 token to the Stratus servers saying "stop billing me." Then the FormModifiers module —28,048 bytes of 68k assembly — processes the FDO88 form for the free area and closes your other windows. The host trusts the client to enforce this.

The Patches, Byte by Byte

FormModifiers — The core patch is 2 bytes: 60 10. That is BRA.S $0012, an unconditional branch that jumps over 16 bytes of the original enforcement code. The code it skips is what closes your chat windows, disables your IM, and restricts you to free area content. With those 2 bytes bypassed, the client sends the billing-stop token but never closes anything.

P3 Protocol — The biggest patch: 460 bytes of injected code in the protocol handler. It intercepts the P3 data stream and periodically re-injects "enter free area" tokens to keep billing suppressed. There is a CMPI.B #$15 instruction that checks for start (opcode $15) in the stream — it watches for new forms being sent and re-sends the billing-stop token before each one renders.

Events — Injects two JSR calls into the main event loop: periodic callbacks that fire on every idle cycle to maintain the billing suppression state. Without these, the free area would time out and billing would resume.

Menus —190 bytes that add the "Hell" menu to the menu bar with two items: "Enable Ultrabomb" and "Secret Guide Room" (which navigates to a hidden AOL staff chat room called "Center of the Earth").

Chat Tool —3 bytes: 4E 71 60. NOP followed by BRA, skipping chat billing verification entirely.

Mail Tool —3 bytes: 3C 00 00. Modifies the Mail tool so the Send Now button does not dim after sending, enabling the UltraBomb macro to rapid-fire mail at about one message per second.

Each patched file also gets a vers resource stamp: "2.6Free v4 AOL4Free2.6 v4 by Happy Hardcore". He signed his work.

Stealth (v4)

v4 added stealth after AOL found a detection method. From leaked internal AOL staff email, August-September 1995:

From: Appelman
To: MayLiang
"These people are idable as stealing time. I think we have enough to go forward with legal action."

From: MayLiang
"We then should get verification from TOS and then hand them over to the Secret Service."

His fix was only a few lines of additional code that eliminated the error patterns the Stratus server logs were using to identify AOL4Free users.

Why This Matters

The irony is his patcher helped more than official documentation. The 1994 FDO88 manual gave us the spec, but his named modules gave us the architecture. We used both to build a complete FDO88 compiler, disassemble the 68k client, extract 44 P3 tokens, and map the full connection flow toward getting Dialtone to serve real AOL 2.7 clients.

A teenager's weekend project from 1995 turned out to be the best reverse engineering documentation we had.

Happy Hardcore's Own Words

The AOL4Free2.6 v4 Docs file is a standalone Macintosh application containing a custom document viewer with 13 chapters. We extracted all 13 TEXT resources. Click any chapter to read the original text:

Loading AOL4Free documentation...

Underground Tool Gallery

83 extracted Macintosh AOL hacker tools — icons, art, sounds, and text

Has Art Has Sound

Loading tool manifest

Decompiled FDO88 Source

Examples of FDO88 bytecode decompiled to human-readable form definition streams

FDO88 streams were stored as binary data in DB12 resources within the application and online tools. Each DB12 record defined a complete form (window) with its fields, buttons, text, images, and dispatch actions. The decompiler translates the binary opcodes into the assembly-like syntax documented in the FDO88 manual.

Example 1: Token/Record Request Form

From XprtX 1.0b4 (DB12 Record 1). A utility form that lets the user request any form by library/token or record number — the fundamental debug tool for FDO88 developers.

; DB12 Record 1 - Token/Record Request Form
; Source: XprtX 1.0b4. Binary: 247 bytes.

start                              ; begin form stream
Window16 center center 220 180 normal  ; 220x180 centered window
Field16 Text 10 10 200 40 none    ; static label
Text 00 "Enter token or rec to request:"
Field16 Text 42 181 200 40 none
Text 00 "Made By Res/GOH  "
Field16 Text 10 60 60 20 none
Text 00 "L/T #:"
; editable input: sendform = send contents to server
Field16 Text 80 60 20 15 sendform editable
; mark $D400: server identifies this field by marker
Mark field=0 mark=54272
Field16 Text 10 85 60 20 none
Text 00 "R/D #:"
Field16 Text 80 85 80 15 sendform editable
Mark field=0 mark=54528
; dispatch button: action defined by next dispch
Field16 Button 120 120 80 20 dispatch
; MOP $24: invoke_record - fetch from host DB
dispch invoke_record info=170000
Text 00 "REC#"
Field16 Button 20 120 80 20 dispatch
dispch invoke_record info=160000
Text 00 "Token"
; default = responds to Enter key
Field16 Button 70 153 80 20 default
dispch close
Text 00 "Cancel"
enddef

Opcode Quick Reference

Command	Opcode	Parameters	What it does
`start`	$15	none	Begins a form definition stream. Every form starts with this.
`Window16`	$A6	col, row, width, height, type	Creates a window at pixel coordinates. `center` = auto-centered. `normal` = standard resizable window.
`Field16`	$A1	type, col, row, w, h, flags	Creates a UI element. Types: `Text`, `Button`, `List`, `Popup`, `Check`.
`Text`	$04	field_num, string	Sets text content of a field. Field 00 = current. Defines labels and button text.
`Mark`	$C2	field, mark	Tags a field with a 16-bit ID so the server knows which field is which on submit.
`dispch`	$05	MOP, token, info	Defines what happens when a button is clicked. The MOP code determines the action.
`enddef`	$09	none	End of form. Client renders the completed window.

Field Flags (bitmask)

Flag	Hex	Meaning
`sendform`	$80	Field contents are sent to the server when the form is submitted
`editable`	$40	User can type in this field
`scrollable`	$20	Field has a scrollbar
`default`	$08	This button responds to the Enter/Return key
`dispatch`	$04	Next `dispch` opcode defines this field's click action

MOP Codes (dispatch actions)

MOP	Name	What it does
$05	`close`	Close this window
$12	`send_form`	Send all sendform field contents to the server
$24	`invoke_record`	Dispatch an action by event code (info byte 1). Bit 7 clear = local action table, bit 7 set = send request to server. Does NOT directly encode DB type + record ID.
$80	`no_action`	Placeholder — click does nothing
$81	`goto_keyword`	Navigate to an AOL keyword
$89	`run_tool`	Launch an Online Tool
$8A	`open_room`	Create or enter a chat room

Example 2: Private Room Entry

From XprtX 1.0b4 (DB12 Record 22). The dialog that let users create or join unlisted chat rooms. Demonstrates 16-bit coordinates, icon resources, switch commands, and the open_room dispatch.

; DB12 Record 22 - Private Room Entry (301 bytes)

start
Window16 center -14336 8192 5120 normal
Title "        Private Room"
; icon resource #658 (AOL globe), click = no action
SMultiIcon resid=658 at 26,88 flags=$60
dispch no_action
Field16 Text 238 238 272 50 none
Text 00 "To create or enter a private room, type the room name in the box below and click on the Go button."
Field16 Text 90 86 88 16 none
Text 00 "Room name:"
; font: application (id 1), 9pt, bold, green
TextDesc application 9pt bold green
; the room name input, max 20 chars
Field16 Text 10 10 135 18 sendform editable
SetSize 20
Switch AccentsOk
EncodeType $00 $02
TextDesc application 9pt bold magenta
Field16 Button 160 8 30 16 default
Text 00 "PR"
; MOP $8A: open_room sends token ".X" + room name
; server creates/joins that private room
dispch open_room token=".X"
enddef

Example 3: Typical Underground Tool Form

Underground tools used the same FDO88 opcodes to build their interfaces. This is a real form from ZealTool v3.0 (DB19 Record 29) — a board ID request dialog. Compare with Example 1: same pattern, same opcodes, just different content.

; ZealTool v3.0 - DB19 Record 29 (Board ID Request)
; Real decompiled output from atomforge-fdo-java

start
window center 4 45 8 type_2
TextDesc geneva 12pt bold black
Field16 Text 15 25 145 50 none
ListDispatch item=1
Text 01 "Enter Board ID:"
TextDesc geneva 12pt plain black
Field16 Text 140 25 75 15 sendform editable smallbtn
SetSize 4
Field16 Button 120 85 55 16 default
ListDispatch item=2
Text 03 "OK"
; open_room with token ".." + board ID from input
dispch open_room token=".."
setfld 2
enddef

This form pattern was ubiquitous across the underground tool scene: a compact modal dialog with an input field and an action button dispatching a P3 token. The tools added their own DB resources to the AOL client's resource fork via ResEdit or custom installers.

RE Toolkit

Tools and techniques used to reverse engineer AOL 2.7 and extract these artifacts

Macintosh Resource Fork Architecture

Every classic Macintosh file had two data streams: the data fork (normal file content) and the resource fork (a structured database of typed, numbered entries). AOL tools — and the AOL client itself — stored almost everything in the resource fork: executable code, icons, sounds, dialog definitions, version info, and FDO88 form data.

Each resource has a 4-character type code (like PICT, snd , ICN#) and a numeric ID. The resource fork's internal structure is a header pointing to a resource map (type list + reference list + name list) and a resource data section. The map provides O(1) lookup by type+ID, making it efficient for the OS to load executable modules on demand.

Resource Types Found in AOL Tools

Type	Description	Usage in AOL Tools
CODE	Executable modules (68k machine code)	Each module handles a subsystem — loaded on demand like DLLs
AOtk	AOL Online Tool code	The tool's main code entry point, registered with AOL's tool API
DB08-DB19	FDO88 form definitions	Binary FDO88 streams — each DB type/ID pair is one form. DB numbers vary by tool.
dbDB	FDO88 form variant	Alternate FDO88 storage used by some tools (e.g. SteveCase tool has 50 dbDB resources)
ICN# / icl4 / icl8	32x32 icon family	1-bit (with mask), 4-bit (16 color), and 8-bit (256 color) icon variants
ics# / ics4 / ics8	16x16 small icon family	Small icons for Finder lists and menus
PICT	QuickDraw picture	Splash screens, about boxes, custom art — some tools have 60+ PICTs
snd	Sound resource	Replacement sounds for Welcome, Goodbye, You've Got Mail, IM alerts, and custom effects
STR# / STR	String list / single string	Menu definitions, token commands, screen names, area keywords, README text
TEXT / styl	Styled text	About boxes, help text, credits, README documents
vers	Version info	Structured version number, copyright, and long description string
ppat	Pixel pattern	Custom window background patterns
Tinf / Tevt	Tool info / events	AOL tool registration metadata
Ttkn	Tool tokens	P3 token registrations — which tokens this tool handles (found in AOL's own Online Tools)
ZAP / ZAP# / ZVER	ResCompare patch system	Michael Hecht's ResCompare format: ZAP=patch payloads, ZAP#=target files, ZVER=file locators, ZIS#=instruction sets, ZAPS=format signature

The STR# Menu System

Most AOL tools defined their custom menus via STR# resources. The format encodes menu items, keyboard shortcuts, and the P3 token commands they send. For example, from BOO'S TOOL:

Enter A Private Room     L3
Enter Macwarez           cV [token] MacWarezˇ
Turn IM's On             iS [token] $IM_ON  $ˇ
Turn IM's Off            iS [token] $IM_OFF  $ˇ

These strings contain inline P3 token data — the cV is a "go to keyword" token, iS controls IM state, L3 opens a private room dialog. The tool's AOtk code registered these strings with AOL's menu system at load time.

atomforge-fdo-java

The atomforge-fdo-java library (Java 21, MIT license) provides complete FDO88 decompilation and compilation. It passes 80,000+ golden tests against AOL 2.7's 140 official canned forms with 100% binary fidelity. The library includes a full opcode registry, a type-safe DSL for building FDO88 streams programmatically, and code generation that converts binary forms to compilable Java source.

Format Conversion Notes

Extracting usable media from 1996 Macintosh binaries required solving several format-specific challenges. These notes document the techniques used, in case they're useful to anyone doing similar preservation work.

StuffIt Archives (.sit)

The 86 tool archives use StuffIt 3.x/4.x format. unar (from The Unarchiver project) is the only modern tool that handles these reliably while preserving macOS resource forks via extended attributes. The resource fork data ends up accessible at filename/..namedfork/rsrc on macOS.

Resource Forks

Classic Mac files stored structured data in a second file stream called the resource fork. The fork has its own internal filesystem: a header pointing to a resource map (type list, reference list, name list) and a data section. Each resource is identified by a 4-character type code and numeric ID. Our Python parser (scripts/extract_resources.py) implements the full resource fork binary format to extract resources without relying on Apple's deprecated Resource Manager APIs.

PICT Images

PICT is Apple's QuickDraw metafile format — it stores drawing commands (lines, text, fill, bitmap blits) rather than pixel data. Rendering PICTs requires interpreting QuickDraw opcodes, which modern tools handle inconsistently:

ImageMagick (magick) correctly renders most PICTs including those with PackBits-compressed bitmap data and basic drawing commands. It recovered 152 images that sips rendered as blank white.
Apple's sips only handles simple bitmap PICTs and produces blank output for vector/text-only images.
PICT files require a 512-byte zero header prepended to the raw resource data for file-based tools to recognize them.
29 PICTs use exotic QuickDraw opcodes that neither tool can render — these are preserved as raw .pict files for future conversion.

Sound Resources (snd)

Mac snd resources use a container format with a header, sound commands, and a sampled sound data section. Three encoding types exist:

Standard (stdSH, encoding $00) — Uncompressed 8-bit unsigned PCM. Direct conversion to WAV by writing a RIFF header and copying the sample data.
Extended (extSH, encoding $FF) — Uncompressed but with a different header layout. The numSamples field at offset 4 is actually numChannels; the real frame count is at offset 22; sample data starts at offset 64. Six sounds were initially broken due to parsing the extSH header as stdSH.
Compressed (cmpSH, encoding $FE) — MACE 3:1 or 6:1 compression. These cannot be decoded by directly reading the PCM data. The solution: wrap the compressed audio in an AIFF-C container with a COMM chunk specifying the MAC3 compression type, then pipe through ffmpeg which has a built-in MACE decoder. This recovered 5 sounds including "OHYEAH!", "BabyPenut", and "Its-OJ-".

FDO88 Binary Streams

FDO88 forms are stored in DB-prefixed resources (DB08-DB19, plus non-standard types like db69, db81, db96, dbAB, dbDD used by underground tools). The binary format uses three encoding modes: low-bit opcodes ($00-$7F) with fixed-size parameters, high-bit opcodes ($80-$FF) with a byte-count prefix, and extended opcodes ($F8 + sub-opcode). Low-bit opcodes like $21 (Field16) and $26 (Window16) are mirrors of their high-bit counterparts $A1 and $A6 — same command, different parameter encoding. The atomforge-fdo-java decompiler resolves these to named commands, decodes dispatch structures (6-byte MOP + token + info), and converts numeric constants to their named equivalents (window types, field types, fonts, colors, switch values).

Disassembly

Interactive 68k disassembly of all 57 CODE segments from the AOL 2.7 binary

Offset Bytes Mnemonic Operands Comment

Select a CODE segment to begin disassembly

About This Project

Preservation, documentation, and historical context

Purpose

This is a digital preservation project. AOL 2.7 and its surrounding ecosystem represent a significant chapter in internet history — one of the first mass-market online services, the first widespread encounter with "hacking" for many users, and a fascinating case study in proprietary protocol design. The FDO88 protocol, the P3 transport layer, and the underground tools that exploited them are all at risk of being lost as vintage Macintosh software becomes increasingly difficult to run and archives disappear.

This site collects and documents these artifacts in a format that will remain accessible: static HTML with no external dependencies, data encoded as JSON, art preserved as PNG, sounds as WAV. No server required. No frameworks to break. No dependencies to rot.

What's Preserved Here

The complete FDO88 instruction set from AOL's internal engineering manual
Architecture analysis of the AOL 2.7 Mac client binary (57 executable modules)
P3 protocol documentation reconstructed from binary analysis
83 underground Macintosh AOL tools with extracted art, sounds, and text
Decompiled FDO88 form definitions from tool DB12 resources
Technical analysis of the AOL4FREE billing exploit

License

This documentation and tooling is released under the MIT License. The original AOL software, FDO88 manual content, and underground tools are presented for historical and educational purposes under fair use principles.

Disclaimer

This project is not affiliated with, endorsed by, or connected to AOL, Verizon, Yahoo, or any successor entity. All trademarks are the property of their respective owners. The underground tools documented here are presented as historical artifacts. This project does not endorse or encourage unauthorized access to computer systems.

Related Resources

Contact

@SiliconForested on X

DIALTONE

Dialtone Tech Notes