We have managed to disassemble and modify the Palm Crossfire client to enable it to skip all activation checks. It is working well for us so far. The applications that we found useful were: PILOTDIS, PRC2BIN, and PRCEdit.
The changes are in the pCOM.prc file, change these bytes: (it's all in hex)
1FE3: 66 -> 60
2261: 6600009E -> 600000BA
In more detail it is: (address are from the beginning of the code block)
00001bae 486efffc L152 PEA -4(A6)
00001bb2 4ebaf544 JSR L88
00001bb6 2800 MOVE.L D0,D4
00001bb8 584f ADDQ.W #4,A7
00001bba 660000d6 BNE L157
changed to
00001bba 600000d6 BRA L157
And
00001e36 4a07 L168 TST.B D7
00001e38 6600009e BNE L172
changed to
00001e38 600000BA BRA L174
I hope this helps.
Angel