yashsingh1/xdaforums huggingface dataset:
[Android Q&A, Help & Troubleshooting] CXZa:
bkcrack win32 versions - all of them...

Releases · cxzstuff/bkcrack

Crack legacy zip encryption with Biham and Kocher's known plaintext attack. - cxzstuff/bkcrack

github.com

Descriptions, and win64, mac and linux versions here.

Releases · kimci86/bkcrack

Crack legacy zip encryption with Biham and Kocher's known plaintext attack. - kimci86/bkcrack

github.com
[Android Q&A, Help & Troubleshooting] CXZa:
bkcrack v1.3.0 released 5 days ago

"Added the ability to recover password from internal keys."

Not really needed if only data is wanted, but if one wants to know what kind of password pattern is possibly used then this new feature might be helpful.

Testing it just now against the keys of @AkiraPerera04 . Went really fast to password length 12... The WonderShare password that I had when I did my test was 15 letters long, so it might take a while... :rolleyes:
[Android Q&A, Help & Troubleshooting] CXZa:
Well, after 8 and half hours got a working password: "NS1kxZf8uLDA†Î".

But it's obvious that it isn't the only one (if the password is like the other WS passwords, that is). So, that didn't help much...

Output is below...

Y:\bkcrack-1.3.0-win64>bkcrack -k 6eda3a27 2edfbde4 237a1e01 -r 20 ?a
bkcrack 1.3.0 - 2021-05-22
[13:52:31] Recovering password
length 0-6...
length 7...
length 8...
length 9...
length 10...
100.0 % (3844 / 3844)
length 11...
100.0 % (3844 / 3844)
length 12...
100.0 % (3844 / 3844)
length 13...
100.0 % (3844 / 3844)
length 14...
37.9 % (1455 / 3844)
[22:28:44] Password
as bytes: 4e 53 31 6b 78 5a 66 38 75 4c 44 41 86 ce
as text: NS1kxZf8uLDA†Î
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Sorry for the huge delay! I thought this thread was finished haha!

So what exactly is going on here?

Thanks.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
@CXZa

Also, can you help out with this thread as well please.

https://xdaforums.com/t/unrooted-ga...etrieve-transfer-game-save-file-help.4291069/

Thanks!
[Android Q&A, Help & Troubleshooting] CXZa:
Mainly tried the new feature of bkcrack.

Also it might give the password of your archive. Next bkcrack version that is. Wanted to see if its like the other WS passwords known...
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Ah okay, but the backup was already cracked?

I thought you were trying to figure out what program to use to open the LIST files.
[Android Q&A, Help & Troubleshooting] CXZa:
Finding that password could also reveal what WS program was used. Yes, it was cracked alright..

Sorry, no better ideas for those list files. Do you have some example about the data you want to read from them?
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
I'm confused, I thought finding the WS program was for the LIST files?

Honestly, I'm not sure. I've never done these kinds of backups before. So, my assumption is that the viewable files in the backup were my SD card, and the LIST files were everything on my internal storage.

There's just 0 information on the Internet about it, so I actually have no idea.
[Android Q&A, Help & Troubleshooting] ym_1080:
thanks bro! it works! i renamed as "Samsung SM-G350E_20191001_103009.bak" and i tried to extract by 7zip with favourite password "MobileTrans1125" and it works very well. Thank you!
[Android Q&A, Help & Troubleshooting] CXZa:
Y

You were lucky... 👍 Akira wasn't that much, but the last versions did the trick for him too...

Noticed that @jwoegerbauer now has a new name... "Deleted member 1890170". (y):ROFLMAO:

Xmas came early this year...
[Android Q&A, Help & Troubleshooting] monsizr:
Thank you very much. You're an Angel.
[Android Q&A, Help & Troubleshooting] maheshomf:
Awesome thread!! Thank you guys, You guys had the talent to even outbeat the software developers of wondershare. I had initially raised a ticket with wondershare team to process by .bak file, but they failed and informed that the file is corrupt, however, i was able to open and saw that the files were encrypted!!

the program really worked, I was able to get the password thru the .bat file and then found the password to be Dr.Fone3360 .I was using dr fone wondershare v9. I will share the steps below for recovery of corrupt .bak files:

1. Use the password cracker tool updated from the thread and find the password. In my case it took approx 20 mins.

2. Open wondershare backup and connect your phone

3. Create a dummy backup file by clicking on backup and just select contacts/simple stuff

4. Rename the extension of dummy backup file(.bak) newly created to .zip

5. Open winrar or any utility to open the dummy .zip file.

6. Extract contents from recovered/corrupt .bak file(open using winrar and extract to a new folder)

7.Paste the contents of the recovered(corrupt bak file/folder) to the dummy .zip file(open in winrar and drag/paste the data)

8. Thats it, now just open wondershare, use the default path or select the .bak file, it should be able to restore(In my case, the crack was not working, i paid for the backup version of dr fone and restored!!!!)

(Just remember, do not rename the file name, it should be same as the dummy backup file)

Love the thread!!! thank you guys!!!
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
@CXZa Hi, hopefully ur still around after all this time lol.

I'm still kind of confused, however I can't even research the topic since it's quite specific. Judging by the contents of the backup, it seems that it contains my sd card files/pictures and none of the internal storage files/pictures?

I can't quite understand the file types/extensions, but is there a part of the backup that could have the internal storage contents preserved? I recall taking around 2000-4000 pictures all of which should've been in the backup?

Since these pictures/videos were taken on the S4, they would be small in size (storage wise), so maybe they've been compressed somewhere in the backup?

Initially the culprit was the .list files but I can't figure out what they are. Are they capable of holding jpegs/mp4s/etc?

Hopefully you see this, I'll be answering super quick and will instantly trial and error the suggestions given since I've been delaying this for no reason. Hopefully we can brainstorm it and finish this haha!!

Thanks.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
@CXZa Just a bump incase u missed it.

As an update, I contacted wondershare and I might buy their product, ahhhhh.
[Android Q&A, Help & Troubleshooting] CXZa:
Cannot be sure about your list files but mine were just listing the files. Then again when testing Wondershare's products I used a tablet that was practically empty. Just some photos really.,,

Check the file sizes, if there is some having size like several MB then there might be some "extra" data inserted into it.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Okay I see, I'll take a look.

Also, I emailed wondershare about their software being unable to open my .bak and they asked if I could send the same 1.4gb .bak to them so they can attempt to open it. Should I trust them? Quite an unusual request.

Thanks.
[Android Q&A, Help & Troubleshooting] CXZa:
I remember that you had difficulties giving us even some bytes of it, thus making things harder than necessary... lol.

But anyways, if it doesn't contain anything that secret, why not?

Not unusual really. The only way they can try to see what is in it...

(after which they can recommed you a program to buy..)
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Yeah haha, I was pretty nervous since I was using the family's pc which was full on storage space. Didn't have another copy but I was eager to see what's in their. That's why I was reluctant to clown around with this .bak. I also didn't know what was on there, those bytes could've ended my whole life (lol, there was just dragon ball z pictures, bodybuilding pages and stuff from my school days haha).

So is that normal procedure for a software company like this? I've just heard that wondershare is a load of crap mainly since they lock your restore behind a paywall. I think 5/6 years ago that fact was more hidden lol. Other than that, are they known to scam/do malicious things?

Also, how is it that when I tried to use their wondershare products. Not a single one detected it or could open it?

I don't even know how to send a 1.4gb .bak file over email.

Thanks.
[Android Q&A, Help & Troubleshooting] CXZa:
Good points... And because of this, they probably get many requests like yours..

Means more "happy" customers... whose pics on the office's wall are just extra...

I somehow managed to forget with whom we are dealing with..
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Yeah, I'll let you know what happens. However, another issue.

I am trying to restore an app backup which was backed up using adb. I am now trying to test it in the secure folder. (In case I restore the internal storage and it fails/overwrites incorrectly for whatever reason)

So, as a test, I copied my game called cookie clicker which I know the backup/restore works fine for the usual internal storage. So it copied the app to the secure folder without the data, fine because that's the secure folders function (to duplicate an app minus the data). So now I tried to uninstall or restore the same app using adb commads from my pc. To uninstall I used this code.

./adb shell pm uninstall -k --user 150 it.junglestudios.cookieclickers

I got the error saying this.

Any ideas? I don't know what to do because now I can't properly test my backup/restore.

Thanks.
[Android Q&A, Help & Troubleshooting] CXZa:
Sorry, no idea about secure folders, etc.. Not so long ago I found out that adb backup doesn't work on my phone (anymore?? - might have worked before).

That's pretty secure, right? ;)

IDK, but I have used user 0 somewhere before ...
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Hmmm okay I see. Why doesn't it work? Are you using platform tools?

Yeah haha. I don't actually need to use the secure folder. I just wanted to test my backup. The issue is that I can't restore it without overwriting the original (so the only working copy would be gone if i decided to restore onto the internal). That's why I thought I could bypass this by restoring to the secure folder, but it doesn't work.

Any ideas on how I can test a backup/restore of a single app? I did think to rename the package/modify the apk, but that doesn't seem to work on these newer androids. I think it changed when they changed how we can view our files since the one ui 3 update.

The apps that use a parallel space don't seem to work since I can't restore apps to it.

Yeah, user 0 is the normal user directory where user 150 is the secure folder. (I think)

Thanks.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Hi, having yet another issue, hopefully you can help haha!

Here's the thing,

So this picture is of the app backups, they were restored from a shadow copy as per the title. But when I went to restore the apps, I entered the correct encrypted password using adb and it didn't restore? I think it's corrupted.

I entered ./adb restore app.backup

Any ideas on what I can do? Has the encrypted password changed or is the whole file corrupted?

Also, So, as to explain how this even happened, maybe you can spot an obvious error (I really hope so). Basically, I went to backup another app but I let the file name save be the same, meaning that it had overwritten the main backup containing app + data. As soon as I noticed, the main backup went from 658mb to 0 and that was it. I couldn't see any previous versions, so I went to the shadow copy's and found another one which is the one that doesn't work.

Thanks.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
@CXZa Another thing to add. Is there a way to unpack the backup file and perhaps fix it like how a chkdsk would? I have read that there is a tar file in there. I'm not too sure but the backup I want to restore (app.backup(Pictured above)) still have over 640mb preserved so the maybe the file build is a mess or something?

Any ideas?

Thanks.
[Android Q&A, Help & Troubleshooting] StrangerMachine:
This is my first time on the forum, i am not sure if its the right place for a question. So apologies in advance. I backed up my Device using Wondershares Dr. Fone totally unaware of the fact that I need to pay for the restore feature. Is there a backup file stored somewhere on my PC? which I can then manually extract? I tried to look for it in the Documents >Wondershare >dr.fone >Backup. Backup shows on the wondershare app though. Thanks in advance.
[Android Q&A, Help & Troubleshooting] CXZa:
The path sounds right to me... Only MobileTrans worked for me. Dr.Fone made that path but it maybe crashed, anyways didn't do a backup - and I think MobileGo did the same. But the paths are still there in the virtual machine used.
[Android Q&A, Help & Troubleshooting] StrangerMachine:
Thanks, what do you suggest I do?

There is no file in the directory, did you imply that MobileTrans will reveal the said file? Sorry let me k ow if I got it correct.
[Android Q&A, Help & Troubleshooting] CXZa:
Just seach the whole drive from that time period.

The backup file's extension is most likely *.bak.

MobileTrans probably doesn't help there...
[Android Q&A, Help & Troubleshooting] StrangerMachine:
I tried but no luck. I ran a system wide search for .bak files, buy it wont show up , tried show hidden files no luck there aswell.
[Android Q&A, Help & Troubleshooting] CXZa:
Too bad... :( They might have changed something. You could try to do another backup on another PC or a virtual machine and watch which files are written if any. For example Nirsoft and Sysinternals has some programs for it, I think..
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Also, I just used 7-zip and it does say that.

https://imgur.com/a/08iv1yA

What can I do about that now? It seems like you're predicting it quite well haha!

EDIT: I saw that "john the ripper" is something to use. What do u think?
[Android Q&A, Help & Troubleshooting] CXZa:
You can read (some more) and then just try some i guess...

John is a good and free option...

Good luck!

:good:
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Okay cool thanks.

So, to summarise, what are my options?
[Android Q&A, Help & Troubleshooting] CXZa:
I have mentioned two. All you need is time ...

One option more would be to pay for a full version,

if it has been created this Shenzhen Wondershare/iSkysoft crap.

But even them might not know the password, unless programs tests them all.

They have many similar programs. That level1techs forum thread is quite revealing. It might be that the passwords are just the program name and its setup's number. Like the last trial's filename is tunesgo_setup_full1323.exe and that pass mentioned there is TunesGo1323. Some other programs they have: dr.fone (different types), mobiletrans, mobilego, who knows what else...

I would first test that brute force with similar pattern...

edit: TunesGo uninstall leaves some keys to the registry that can reveal that program + number/pid.

HKEY_LOCAL_MACHINE\SOFTWARE\Wondershare

HKEY_CURRENT_USER\software\Wondershare\TunesGo

Probably iSkysoft leaves some too. So, if your brother still has that PC there might some clues in it...
[Android Q&A, Help & Troubleshooting] :
OFF-TOPIC

When I was young, I wrote a small .BAT-file that uses the BruteForce Attack method to recover a numeric password from password-protected .RAR / .ZIP-files: that always worked. It's purpose was to demonstrate that numeric passwords are abolute unsafe.

@ECHO OFF
SETLOCAL
REM
REM Adjust this to your needs
SET /A MAXPASS=10000
REM
SET "RAR_UNPACKER=D:\Program Files\WinRar\UnRAR.exe"
SET "ZIP_UNPACKER=D:\Program Files\7-Zip\7z.exe"
REM
REM ************* Do NOT make changes below **********************
REM
SET "ARCHIVE_FILEPATHNAME=%~1"
SET "RAR_ARCHIVE_ID=Ra"
SET "ZIP_ARCHIVE_ID=PK"
SET "UNPACKER_TEMPPATH=%TEMP%\%RANDOM%%RANDOM%"
FOR %%F IN ("%ARCHIVE_FILEPATHNAME%") do ( SET "ARCHIVE_FILE=%%~nxF" )
SET "HEADER=Testing Archive File on Numeric Password in Range 1-%MAXPASS%"
TITLE %HEADER%
ECHO(
ECHO Sanity check ...
ECHO(
IF ".%ARCHIVE_FILEPATHNAME%"=="." (
ECHO No archive passed.
ECHO Usage:
ECHO %0 ^<FULL_ARCHIVE_FILEPATHNAME^>
GOTO :FINISHED
)
IF NOT EXIST "%ARCHIVE_FILEPATHNAME%" (
ECHO %ARCHIVE_FILEPATHNAME% not found
GOTO :FINISHED
)
FOR %%X IN ("%ARCHIVE_FILEPATHNAME%") DO IF %%~zX==0 (
ECHO Archive file is empty & GOTO :FINISHED
)
SET "HEADER=Testing %ARCHIVE_FILE% on Numeric Password in Range 1-%MAXPASS%"
TITLE %HEADER%
MKDIR "%UNPACKER_TEMPPATH%"
ECHO Set fso=CreateObject("Scripting.FileSystemObject") > "%UNPACKER_TEMPPATH%\2byte.vbs"
ECHO Set f=fso.OpenTextFile("%ARCHIVE_FILEPATHNAME%"):buf = f.Read(2):f.Close >> "%UNPACKER_TEMPPATH%\2byte.vbs"
ECHO WSCRIPT.echo mid(buf,1,2) >> "%UNPACKER_TEMPPATH%\2byte.vbs"
FOR /F "tokens=1,2 delims=." %%A in ('CSCRIPT //nologo "%UNPACKER_TEMPPATH%\2byte.vbs"') DO (
SET "ARCHIVE_ID=%%A"
)
SET /A ARCHIVE_IS_SUPPORTED=0
IF "%ARCHIVE_ID%"=="%RAR_ARCHIVE_ID%" ( SET /A ARCHIVE_IS_SUPPORTED=1 )
IF "%ARCHIVE_ID%"=="%ZIP_ARCHIVE_ID%" ( SET /A ARCHIVE_IS_SUPPORTED=1 )
IF %ARCHIVE_IS_SUPPORTED% NEQ 1 (
ECHO %ARCHIVE_FILE% is unsupported & GOTO :FINISHED
)
ECHO(
ECHO Processing ...
FOR %%F IN ("%ZIP_UNPACKER%") do ( SET "ZIP_UNPACKER=%%~sF" )
FOR %%F IN ("%RAR_UNPACKER%") do ( SET "RAR_UNPACKER=%%~sF" )
ECHO(
SET "PASSWORD="
SET /A PASS=0
:START
SET /A PASS+=1
TITLE %HEADER% [Pass %PASS%] ...
IF "%ARCHIVE_ID%"=="RAR_ARCHIVE_ID" (
"%RAR_UNPACKER%" E -INUL -P%PASS% "%ARCHIVE_FILEPATHNAME%" "%UNPACKER_TEMPPATH%"
) ELSE (
%ZIP_UNPACKER% e "%ARCHIVE_FILEPATHNAME%" -y -p%PASS% -o"%UNPACKER_TEMPPATH%" 2>NUL >NUL
)
IF /I %ERRORLEVEL% EQU 0 ( SET "PASSWORD=%PASS%" & GOTO :END )
IF %PASS% GEQ %MAXPASS% ( GOTO :END )
GOTO START
:END
RMDIR /S /Q "%UNPACKER_TEMPPATH%"
ECHO Found Stable Password: %PASSWORD%
ECHO(
ECHO Job done!
:FINISHED
ECHO(
ECHO Press any key to exit ...
PAUSE >NUL
ENDLOCAL
EXIT
[Android Q&A, Help & Troubleshooting] CXZa:
Good idea and fast enough, no maybe complicated programs, etc.

That is, if that zip is from wondershare and their passwords are that simple.

Other apps that may have created it mentioned here :

https://forums.androidcentral.com/ask-question/1015367-file-encrypted-how-can-i-open-help.html

edit:

10 000 took less than 5 minutes using a small zip file..

Modified a bit for TunesGo. (1st version was just a one-liner...)

See the attachment.

edit2: Attachment gone because forum update.

See the new version here.

https://xdaforums.com/t/file-encrypted-how-can-i-open-it-help.4194779/post-84034013
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Thanks for your help!

Honestly, this kind of stuff is way too complicated for me haha!

Honestly, since you know alot about this, plus my pc can't handle the processing power requirements. Could I just send 1 file from the .bak to you? If you manage to crack it, then I can just use that password for all the others. (I'll just send a screenshot (hopefully it's nothing ridiculous lol!))

That would help a ton if you could. Thanks!!
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Looks quite interesting, maybe I can implement that somehow. I don't think the pin would be straight numbers, but I can try it!

Thanks!!
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
10000 in 5 minutes? How come you see programs showcasing 6 million or 2 billion passwords per second?
[Android Q&A, Help & Troubleshooting] CXZa:
You're in a hurry, eh? If it's from Wondershare then there might no need to test billions of passwords...

That bat of mine is just for you. If it is from TunesGo.

Extract the attachment somewhere, put that bak file there and run the bat.

Change the basename if necessary and try again...

But check those registry entries if possible. Maybe you don't need to crack it at all..

Have fun! :victory:
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Thanks I appreciate that, I'll have to try that and see in the background. So far I've seen this https://www.passfab.com/products/rar-password-recovery.html. What do u think of this program?

Honestly, since you know alot about this, plus my pc can't handle the processing power requirements. Could I just send 1 file from the .bak to you? If you manage to crack it, then I can just use that password for all the others. (I'll just send a screenshot (hopefully it's nothing ridiculous lol!))

Thanks!!
[Android Q&A, Help & Troubleshooting] CXZa:
No knowledge about that program. It was years ago when I played with these...

Your PC probably still tests that 10 000 faster than mine. Mine too could have performed better if I had closed some programs.

How about trying some of those online zip recoveries?

Haven't received any screenshots...
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Hmmm okay, ahhh! This is all so confusing, it's so annoying lol!

Any links do online ones?

Yeah, I can't copy the file since it requires a password lol.
[Android Q&A, Help & Troubleshooting] CXZa:
Your search is as good as mine...

You can remove files from it. Better to use a small file anyway.

Remember to take backup a copy from that backup bak file first !
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
You can? As soon as a remove a file, it says that I have to enter a password. (To navigate into the file I have to use winrar or 7zip)

Thanks!
[Android Q&A, Help & Troubleshooting] CXZa:
Sounds like a solid archive then, but zip should not be solid. Odd..

https://en.wikipedia.org/wiki/Solid_compression

7zip removes them, at least mine does...
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Ah this is ridiculous. 7zip removes what?

Also, would it be smart to try using a vps when doing a brute force? It seems that it can take days, so yeah.

I saw that google has cloud services (free trial), so I can use a virtual desktop and perhaps use it to bruteforce?

Thanks.
[Android Q&A, Help & Troubleshooting] CXZa:
Files from the zip - encrypted or not... without asking password, just confirm box is shown.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Ah, mine isn't a zip though. Its a jpg, or random file in the .bak file.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
What other passwords could I try that are used for android backups?

Thanks.
[Android Q&A, Help & Troubleshooting] CXZa:
Your bak file is a zip file... as I said before.

So you opened that bak file in 7-zip? Yes?

Okay, now select some file and just press Delete button.

Asking for a password? Odd. Not asking? Great!

Do not confirm file delete if you haven't made a backup yet!

You mean as basename?

Those program names from their website:

TunesGo

MobileTrans

MobileGo

Dr.Fone

DrFone <--- if named similar way.
[Android Q&A, Help & Troubleshooting] dk0dave:
you could also try to convert to iso or img and mount... or File Viewer .....
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
How does converting a file remove encryption?

Can you elaborate?

Thanks!
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Ah right I see.

So, I went to delete a file in the .bak through 7zip. Something about it not being implemented comes up. https://imgur.com/a/cCPwJWY

I can't even open the .bak file through winrar, it just loads a text document which never loads, then crashes.

Wait, so are the encryptions for most android backups just the website name? (With extra numbers or letters to make it unique?)
[Android Q&A, Help & Troubleshooting] CXZa:
Rename it as zip file. Then maybe rar opens it too...

Not implemented. Very weird indeed.

That wondershare firm seem to use their product name based passwords.

But is your bak file done by their program? Who knows? We can only make guesses at this point...
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Ah yeah I see, when I open it through winrar, I can just navigate in it like I can with 7zip.

Yeah, it's bizarre lol.

I'll have to check and see, I'll let u know, thanks.

Also, I found out the .bak files md5. Could that be of any use? I think I saw it being used in brute force programs.
[Android Q&A, Help & Troubleshooting] :
[MENTION=9092014]AkiraPerera04[/MENTION]

Try Kraken