PwlTool
v5.0

password recovery tools for MS Windows 95/98

(c) 1998 Vitas Ramanchauskas & Eugene Korolev, vitas@webdon.com

HOME   RePwl   Vitas' site   License   Register now   TechNotes   Setup    FAQ   Bug Report

RePwl

What's new in PwlTool v5.0 ?

"Old" and "new" PWL files

There are two different PWL file types : "old" PWL files and "new" PWL files. Old PWL files are from original Windows 95 and Windows 3.11. New PWL files are from Windows 95B (OSR2) and Windows 98. Previous versions of PwlTool does not support old PWL files. PwlTool v5.0 able to handle old PWL files. There are some very important notices related to old PWL files. You should read this page if you're going to deal with old PWL files.

About Windows NT

With some limitations you can use PwlTool under Windows NT to find login password of PWL file from Windows 95/98/3.11. PwlTool unable to show PWL file contents under NT. So under NT you can use PwlTool to find unknown login password only. Then you have to run it under Windows 95 and instantly view PWL file contents using previously found login password. When running under NT please ignore error 'mspsw32.dll not found'.

User name selection
You have to know user name exactly to find login password for PWL file. It's impossible to find a login password if you do not know user name. Usually PWL file name is same as user name. So when you select PWL file in PwlTool user name textbox is automatically filled with PWL file name. If PWL file was renamed you have to enter correct user name. Also you have to correct user name if it is longer than 8 characters, because Windows never generates PWL files with long names. For example, user ADMINISTRATOR has PWL file named administ.pwl.

User names coincidence
Unfortunately current version of PwlTool has a bug: you can't see contents of PWL file from another computer if user with same name is also registered in your system. You can search for login password for such PWL file, but when password is found you won't see results ("Incorrect password" error appears). There are two ways how you can to work around.

1. You can explore this PWL file on another computer. You can search  for login password on your computer and then instantly see contents of the PWL file on another computer using found password.

2. You can temporarily unregister user with conflicting name on your computer. To do this perform following steps:

a) Open system.ini file (from Windows directory) in any text editor.
b) Locate [Password Lists] section. This section contains line like this: <username>=<PWL file path>
c) place ';' (semicolon) at the start of that line
d) save system.ini
e) use PwlTool
f) DO NOT forget to restore system.ini !


Program Usage: How to...

...view cached passwords for the current user (user must be logged in)
just run RePwl. You'll see all cached passwords in 'cached passwords' text box.
 
...view cached passwords for another user (login password is known)
select user in the list of 'user name' combobox. Leave 'PWL file' field empty. Type the known login password into 'Password' text box. Press the 'CheckPassword' button.
 
...view cached passwords stored in PWL file from another computer (login password is known)
select a PWL file (use 'Browse' button or enter a complete filename manually). Adjust username, if necessary. Enter the known login password. Press 'CheckPassword' button.
 
...find unknown login password  (and view cached passwords)
select a PWL file (use 'Browse' button or enter a complete filename manually). Adjust username if necessary. Now you may try a dictionary search ('dictionary' tab), a linear search (also known as 'brute force attack')  or a Smart Force Attack (an optimized version of linear search).

Dictionary search (available in the registered version only).
The point is that passwords are made up by living people, and many people are alike. Therefore people use some words more frequently than others. Frequency dictionaries list the most popular words. Good dictionaries contain hundreds thousand words. Remember that a good frequency dictionary is not just a dictionary. A usual dictionary does not contain names of corporations, movie titles, trademarks etc. A good frequency dictionary is composed of actual passwords made up by people just like you. Dictionary search is fast enough (even if a huge dictionary is used). So try the dictionary search first!

Select dictionary on the 'Dictionary' tab. There are no dictionaries included into RePwl package. You may download a relatively small (~80 Kb compressed) dictionary from http://webdon.com/DownLoad/DIC1.ZIP or a huge one (~9 Mb compressed) http://www.kull.ch/Bauersachs/download/allwords2.zip .

Important! Make sure that all words in dictionary are in upper case. Use any text editor to capitalize it if necessary.

Linear Search (brute force attack).
Set password length range and character set (A-Z by default) and press the 'SearchPasswordFast' button. Note that Windows capitalizes all passwords.

Smart Force Attack (available in the registered version only)

Brute force attack (searching all possible passwords) is not suitable for long passwords because it takes too much time. For the most part there are combinations like jkqmzwd which are totally senseless among billions and trillions of passwords being searched. Smart force attack is an optimized search algorithm which only tries ‘reasonable’ passwords. But it also has some disadvantages:

1. Current version adopted for English language only. Next versions will support other west European languages.

2. Smart Force does not recover passwords which contain digits or symbols. For example, 'soft4you' password is not recoverable with Smart Force Attack.

3. Some words are difficult for Smart Force. For instance, word 'runway' is very hard for Smart Force because 'nw' sequence in the middle of that word is considered as an impossible by Smart Force.

You should specify Smart Force level as an integer in range 1...26. The less Smart Force level the faster it works. But also the less this level the higher probability to miss right password. If the level equal to 26 (maximum value) then Smart Force works like Brute Force method without acceleration. So reasonable values for Smart Force level are 9..16 (default is 13). The following table will help you estimate search time.

Smart force does not support short passwords (use brute force method instead).

For more information please visit:
http://soft4you.com/vitas/smartforce.htm  - more about Smart Force method
http://soft4you.com/vitas/psw.htm - general info about passwords.

The password search time varies with respect to the password length and charset size. This is the time it takes to get a password in the most unfavorable case. In the 'best case' (i.e., the most favorable case) the very first password will be the right one. The probability to find a password during the time of t equals to p=t/T, for example, a probability to find the password during the half of time indicated equals to 50%. Please note, for smart force attack it is possible to miss right password (the lower smart force level, the higher probability to miss right password). The search speed is assumed equal to 50,000 passwords per second (Pentium-200).

psw len

Smart Force (k=10)
letters only

Smart Force (k=13)
letters only

26 (letters only)

36 (letters & digits)

70 (all printable)

4

N/A N/A

Instantly

instantly

8 minutes

5

Instantly Instantly

4 minutes

20 minutes

9 hours

6

a minute 3 minutes

100 minutes

12 hours

27 days

7

9 minutes 42 minutes

45 hours

18 days

5 years

8

1.5 hour 9 hours

49 days

21 months

371 years

9

14 hours 5 days

42 months

65 years

26,000 years


Controls description

 
PWL file and browse button
Select desired PWL file. If this file is registered in your system (i.e. this is a file of another user) then use 'User Name' combobox.
 
User Name
List of this combobox contains names of all users registered in system. By default current user is selected. You can use this control to: a) examine user list b) quickly select user's PWL file c) adjust user name for PWL file from another computer
 
Password edit box
If login password is known enter it here. Then press 'CheckPass' button to verify entered password and view PWL file contents. Leave this field empty if you do not know login password.
 
CheckPass button
Examines password entered in 'Password' edit box and shows PWL file contents if password is right. Does not work under Windows NT.
 
CheckPassFast button
Acts like 'CheckPass' button but does not show PWL file contents. It works under NT.
 
Zombie mode
when this option is checked, RePwl won't spend time on handling user interface during password search. This way you will see neither progress bar nor 'Cancel' button. To terminate RePwl in zombie mode press Ctrl-Alt-Del, select RePwl in the task list and terminate it -- this is the only way to do it. Moreover, in the zombie mode RePwl runs at higher priority; as a result, RePwl works faster in the zombie mode, but you may have problems with multitasking environment (other tasks may slow down significantly).
 
SearchPassword vs SearchPasswordFast
'SearchPassword' button is a leftover from the past. It uses standard (but undocumented) Windows API for password search. It works slowly (like in the demo version). Moreover, it will work only with PWL files registered in the system (listed in system.ini file). Normally you should use SearchPasswordFast button. It does not use Windows API and works at the highest speed possible. It seems that this is as fast as it gets…
 
Glide
For old PWL files only. Click here for more details.
 
Password Variator
For old PWL files only. Click here for more details.
 
Charset string
Contains all characters that may appear in password. You can manually adjust charset or select desired one from list of most common charsets.
 
Status indicators
display the last password found, time elapsed (h:m:s:ms) and search speed.

Tips

Password search sequence sample

Here is a sample how to find a password. It's assumed that you know nothing about password. Otherwise you can optimize the search.

1. Select PWL file.

2. Press 'CheckPass' button - probably password is empty and you can instantly access all stored passwords.

3. Press 'Glide' button - probably this PWL file is in old format.

4. Try dictionary search. It should take just a few minutes.

5. Try brute force attack for short passwords (1..4 symbols). Use A-Z,0-9 charset. It should take a minute.

6. It seems the password is long enough. Try Smart Force attack. Specify password length 7..9 and smart force level 10..15 (depends on how long are you ready to wait).

7. Try Brute Force Attack for 5..7 characters passwords.

8. Last chance - try to search for numerical passwords using Brute Force.

Experimental feature:

Press F2 key to open PwlTool's history. History is a simple text document containing all previously found passwords. It's editable, so you can remove/append items, enter your comments and notes.


Thanks again for having registered the program!
As a registered user you will be receiving program updates for FREE. If you have any questions, please feel free to ask.

Some WEB Links:

http://webdon.com  Author's home page

http://webdon.com/vitas/pwltool.htm PwlTool home page

http://webdon.com/vitas/psw.htm  Everything about passwords: how to choose and how to recover them

http://webdon.com/vitas/pwl.htm Some info about PWL files

http://webdon.com/vitas/softmare.htm Security related stuff