PwlTool |
password recovery tools for MS Windows 95/98 |
(c) 1998 Vitas Ramanchauskas & Eugene Korolev, vitas@webdon.com |
|
HOME RePwl Vitas' site License Register now TechNotes Setup FAQ Bug Report |
RePwl
There are two different PWL file types : "old" PWL files and "new" PWL files. Old PWL files are from original Windows 95 and Windows 3.11. New PWL files are from Windows 95B (OSR2) and Windows 98. Previous versions of PwlTool does not support old PWL files. PwlTool v5.0 able to handle old PWL files. There are some very important notices related to old PWL files. You should read this page if you're going to deal with old PWL files.
With some limitations you can use PwlTool under Windows NT to find login password of PWL file from Windows 95/98/3.11. PwlTool unable to show PWL file contents under NT. So under NT you can use PwlTool to find unknown login password only. Then you have to run it under Windows 95 and instantly view PWL file contents using previously found login password. When running under NT please ignore error 'mspsw32.dll not found'.
User name selection
You have to know user name exactly to find login password for PWL file. It's impossible to
find a login password if you do not know user name. Usually PWL file name is same as user
name. So when you select PWL file in PwlTool user name textbox is automatically filled
with PWL file name. If PWL file was renamed you have to enter correct user name. Also you
have to correct user name if it is longer than 8 characters, because Windows never
generates PWL files with long names. For example, user ADMINISTRATOR has PWL file named
administ.pwl.
User names coincidence
Unfortunately current version of PwlTool has a bug: you can't see contents of PWL
file from another computer if user with same name is also registered in your system. You
can search for login password for such PWL file, but when password is found you won't see
results ("Incorrect password" error appears). There are two ways how you can to
work around.
1. You can explore this PWL file on another computer. You can search for login password on your computer and then instantly see contents of the PWL file on another computer using found password.
2. You can temporarily unregister user with conflicting name on your computer. To do this perform following steps:
a) Open system.ini file (from Windows directory) in any text editor.
b) Locate [Password Lists] section. This section contains line like this:
<username>=<PWL file path>
c) place ';' (semicolon) at the start of that line
d) save system.ini
e) use PwlTool
f) DO NOT forget to restore system.ini !
Dictionary search (available in the registered version only).
The point is that passwords are made up by living people, and many people are
alike. Therefore people use some words more frequently than others. Frequency dictionaries
list the most popular words. Good dictionaries contain hundreds thousand words. Remember
that a good frequency dictionary is not just a dictionary. A usual dictionary does not
contain names of corporations, movie titles, trademarks etc. A good frequency dictionary
is composed of actual passwords made up by people just like you. Dictionary search is fast
enough (even if a huge dictionary is used). So try the dictionary search first!
Select dictionary on the 'Dictionary' tab. There are no dictionaries included into RePwl package. You may download a relatively small (~80 Kb compressed) dictionary from http://webdon.com/DownLoad/DIC1.ZIP or a huge one (~9 Mb compressed) http://www.kull.ch/Bauersachs/download/allwords2.zip .
Important! Make sure that all words in dictionary are in upper case. Use any text editor to capitalize it if necessary.
Linear Search (brute force attack).
Brute force attack (searching all possible passwords) is not suitable for long passwords because it takes too much time. For the most part there are combinations like jkqmzwd which are totally senseless among billions and trillions of passwords being searched. Smart force attack is an optimized search algorithm which only tries ‘reasonable’ passwords. But it also has some disadvantages:
1. Current version adopted for English language only. Next versions will support other west European languages.
2. Smart Force does not recover passwords which contain digits or symbols. For example, 'soft4you' password is not recoverable with Smart Force Attack.
3. Some words are difficult for Smart Force. For instance, word 'runway' is very hard for Smart Force because 'nw' sequence in the middle of that word is considered as an impossible by Smart Force.
You should specify Smart Force level as an integer in range 1...26. The less Smart Force level the faster it works. But also the less this level the higher probability to miss right password. If the level equal to 26 (maximum value) then Smart Force works like Brute Force method without acceleration. So reasonable values for Smart Force level are 9..16 (default is 13). The following table will help you estimate search time.
Smart force does not support short passwords (use brute force method instead).
For more information please visit:
http://soft4you.com/vitas/smartforce.htm
- more about Smart Force method
http://soft4you.com/vitas/psw.htm -
general info about passwords.
The password search time varies with respect to the password length and charset size. This is the time it takes to get a password in the most unfavorable case. In the 'best case' (i.e., the most favorable case) the very first password will be the right one. The probability to find a password during the time of t equals to p=t/T, for example, a probability to find the password during the half of time indicated equals to 50%. Please note, for smart force attack it is possible to miss right password (the lower smart force level, the higher probability to miss right password). The search speed is assumed equal to 50,000 passwords per second (Pentium-200).
psw len | Smart Force (k=10) |
Smart Force (k=13) |
26 (letters only) |
36 (letters & digits) |
70 (all printable) |
4 |
N/A | N/A | Instantly |
instantly |
8 minutes |
5 |
Instantly | Instantly | 4 minutes |
20 minutes |
9 hours |
6 |
a minute | 3 minutes | 100 minutes |
12 hours |
27 days |
7 |
9 minutes | 42 minutes | 45 hours |
18 days |
5 years |
8 |
1.5 hour | 9 hours | 49 days |
21 months |
371 years |
9 |
14 hours | 5 days | 42 months |
65 years |
26,000 years |
Here is a sample how to find a password. It's assumed that you know nothing about password. Otherwise you can optimize the search.
1. Select PWL file.
2. Press 'CheckPass' button - probably password is empty and you can instantly access all stored passwords.
3. Press 'Glide' button - probably this PWL file is in old format.
4. Try dictionary search. It should take just a few minutes.
5. Try brute force attack for short passwords (1..4 symbols). Use A-Z,0-9 charset. It should take a minute.
6. It seems the password is long enough. Try Smart Force attack. Specify password length 7..9 and smart force level 10..15 (depends on how long are you ready to wait).
7. Try Brute Force Attack for 5..7 characters passwords.
8. Last chance - try to search for numerical passwords using Brute Force.
Press F2 key to open PwlTool's history. History is a simple text document containing all previously found passwords. It's editable, so you can remove/append items, enter your comments and notes.
Thanks again for having registered the program!
As a registered user you will be receiving program updates for FREE. If you have any
questions, please feel free to ask.
Some WEB Links:
http://webdon.com Author's home page
http://webdon.com/vitas/pwltool.htm PwlTool home page
http://webdon.com/vitas/psw.htm Everything about passwords: how to choose and how to recover them
http://webdon.com/vitas/pwl.htm Some info about PWL files
http://webdon.com/vitas/softmare.htm Security related stuff