yashsingh1/xdaforums huggingface dataset:
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
No, it didn't work. All of the brute force programs won't detect it. It's because the main zip file isn't encrypted, but the files inside are encrypted. I can view the file names and navigate through winrar and 7zip. I can't copy or move those files since I have to enter a password.

https://imgur.com/a/SyUEcXB

Any ideas?
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
This is the full file type through 7 zip. It's one of the encrypted backed up files in the .bak.

https://imgur.com/a/Hz1xmOq
[Android Q&A, Help & Troubleshooting] CXZa:
I see that file has a different filename than you said in the 1st post.

That bat doesn't work unless you change the _zipfilename variable accordingly.

edit:

Also the 7za.exe I attached is too old. Must use newer one for this.

The 7za.exe attached is now replaced with a newer one.

https://xdaforums.com/showpost.php?p=84007055&postcount=26

With TunesGo I could only backup files as they were. Maybe too old version.

MobileTrans on the other hand created same kind of zip as yours.

So, it is made by some of those programs mentioned.

That backup opened using password like discussed.

And, yes you cannot delete files from that damn thing. Not normal way anyway...
[Android Q&A, Help & Troubleshooting] :
It is common knowledge that not the ZIP file itself but the files it contains are encrypted, at least those which have a * as related marker. :o

Hence a password-testing program always runs against the encrypted files ( of course only the 1st one found with * marker because encryption key - AKA password - is same for all files ) within the ZIP file, and not against the ZIP file itself.

BTW:

I am pretty sure you never tried KRANKER I introduced above because, as you said, all BruteForce programs do not work per se.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
"unless you change the _zipfilename variable accordingly." ?? Are you talking about changing the file so I can navigate inside it?

Okay I'll check that out and let u know how it goes.

Hmmm I see, so you've seen this kind of thing before? Have you come across a thread where they've had a similar issue like mine, and solved it?

Thanks, I appreciate you help/input a ton.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
I see, but how come when I load up a bruteforce program (passfab for rar as an example), it doesn't detect it as an encrypted file? Like, sometimes it doesn't even show up visibly in my directory as a usable file.

I get what you're saying, but it doesn't seem to be the case for me.

Kranker?

From what I can see, brute force programs don't work universally, so I had to find a rar brute force program. Is that why the program didn't detect/navigate and brute force the files inside? (Since the files inside aren't rars)

Thanks!
[Android Q&A, Help & Troubleshooting] CXZa:
Weird question. I would have then just posted that link.. :confused:

Nope, only thread I have seen is where that TunesGo password was mentioned.

I have installed Wondershare products now to see if their bak is like yours.

And they most likely are... see the updated bat. You still have to change the bak name and try those basenames one by one. If everything goes okay, it's max 20 min job... by using some more sophisticated program, few seconds...

Tell us if the bat did its job... :good:
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Ah right ok lol.

Yeah? The wondershare stuff looks like mine? That sounds great! I'll try it tomorrow morning and let u know.

"You still have to change the bak name", why?

Ok, that sounds pretty cool. Where did u even get the 7za.exe password tester thingy?

Thanks!! :D:o
[Android Q&A, Help & Troubleshooting] :
My last 2 cents here

It's completely irrelevant what type the archived files are of. The BruteForce programs ( what try to recover an archive's lost password ) don't operate on them but on archive ( ZIP/RAR/etc.pp ) wrapping these files. May be that one day you will get it???

Structure of an archive file:
[Android Q&A, Help & Troubleshooting] CXZa:
New version of WonderShare Zip Password Tester

Download: https://yadi.sk/d/KLBMhwOL-or45g

Just extract the zip somewhere and put the Samsung SM-G350E_20191001_103009.bak (if file name is different, rename it) to the same folder and run the bat. Or just drag-and-drop the bak file over the bat to run. Now it tests four basenames automatically.
[Android Q&A, Help & Troubleshooting] CXZa:
Well ?
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Do these forums even work? I tried commenting before and there was a notice that they were getting rid of it.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
I also didn't figure it out, this stuff is tough. That latest link you sent, I couldn't download it.
[Android Q&A, Help & Troubleshooting] CXZa:
edit: attachment removed
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Alright, I'll give it a try. I'll let you know tomorrow.

Thanks for your help.
[Android Q&A, Help & Troubleshooting] rhbeards:
Did you ever figure this out? I cracked a MobileGo backup by using the .bat script provided further up in the thread and slightly modifying it to just add "MobileGo" to the front of the password. PM me if you need another password to try.
[Android Q&A, Help & Troubleshooting] CXZa:
Nice first post, having absolutely nothing in it that wasn't already said in this thread many times. You are only confusing really...

In my first bat one just had to change the basename and run it again. Its attachment vanished when this forum was updated. (Also my only thanks in this thread (by some staff member) was lost too, great.. )

The new one tests four Wondershare products by default...

https://xdaforums.com/t/file-encrypted-how-can-i-open-it-help.4194779/post-84034013
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Hi, no not at all! Cracking this file has been a nightmare, since I'm only familiar with android roms and somewhat basic technology, not bruteforcing stuff lol! I really need the files on it, and this kind of issue (forgetting the encryption password and forgetting what program was used) doesn't seem common lol!

The other people in this thread have helped, but that CZXa guy has been really helpful. Learnt a ton from him, hoping it works out.

Not sure what to do next. Perhaps more intricate bruteforce methods? Aghhh!!!

Thanks.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Alright, so I tried that exact file you linked. I dragged my bak file over the bat file and let it run. It didn't work!!

Any ideas? Sees uncrackable at the moment lol! So annoying!

Thanks.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
@CXZa

See. Tried it just now. Didn't work.

Any ideas?
[Android Q&A, Help & Troubleshooting] CXZa:
Hmm... try this one. Added just a check that the target file exists as typos do happen, in bats too...

And remove the first 4+1 (end command too) lines from that basenames.txt as those you have checked already.

Download: https://yadi.sk/d/KLBMhwOL-or45g
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Alright thanks, it's currently running now.

What are you talking about removing the first 4+1? I couldn't see that in the basenames txt.

Thanks.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
@CXZa

Ahhhh it didn't work!! Do you think that the program may not be applying the passwords to the .bak file at all? I can't tell.

Thanks.
[Android Q&A, Help & Troubleshooting] CXZa:
Edit that file by removing the first 5 lines. Or just remove lines starting with ":"...

It applies them but with first 7zip I used it gave sometimes same errorlevel whether the password was right or not. This newer one worked in my tests alright. On 32-bit win7.

Here is a test you can do. Drop that "test1.zip.bak" over the bat file, what is the password?
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Ah I see. I just left the 5 lines. Only takes a few minutes extra.

@CXZa

The password is DrFoneAndroid123. For the test1.zip bak file. Found it in less than a second lol!

Thanks.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
@CXZa

Also, this is the .bak file which is my S4 backup.

For some reason it has automatically chosen to open as a word file lol! (See the icon on the left) That doesn't affect anything, does it?

Thanks.
[Android Q&A, Help & Troubleshooting] CXZa:
No, it doesn't affect what we are trying to do...
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Hmmm, okay, so what can we try next? As mentioned above, the program does work, as it cracked the test bak file.

Thanks.
[Android Q&A, Help & Troubleshooting] blackhawk:
Was it backed up with Kies?

Talk to Samsung if so.

Try using it on the same laptop preferably to the same model phone.

This is a buggy app.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Thats the thing. I can't remember. We did it years ago. Can't remember the password, or the program used. The laptop is my brothers, so I can't use it.

At the moment, we're trying bruteforce, but it isn't working.

Any ideas?

Thanks.
[Android Q&A, Help & Troubleshooting] CXZa:
If your brother PC isn't totally wiped and reinstalled, ask him for those registry keys I mentioned earlier.

----------

The file is from Wonder**** for sure. They FF parts of their zips just like this so they don't qualify as any normal zips. Just before DeviceInfo here. Also file headers and tails inside the zip seem to be modified or reordered.

----------

That is why errors like this. Any modification seem to make these common archive programs to fail similar way.

----------

I tried know plain text attack against it, but no luck. Not a proper zip or whatever said passware's program... The favorites file size matches yours, so it would be an ideal for this kind of approach...

----------

Tried that attack with normal zip. It was like ten minutes when the know text was as big that file...

The images are from AkiraPerera04.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Hmmm okay. So, the laptop he had was a mac. It was sold, however the data was transferred. How can we find those registry keys?

So what can we so now? Perhaps some different basenames or something? Aghhhh!!!! Let me know if there's anything else to perhaps try.

Thanks.
[Android Q&A, Help & Troubleshooting] CXZa:
Aghhhh!!!! My words exactly... Yes, the basenames might differ. See here some old program versions, filter with "dmg":

Wayback Machine

web.archive.org

The basename could be starting with text "mac" but how it's formatted... Now some mac users needed to give us the backup folder name.. or names... :rolleyes:

Have you contacted the company? Although they probably don't help without paying them as the idea behind this is purely some sort of blackmail...
[Android Q&A, Help & Troubleshooting] blackhawk:
Kies was the Samsung backup solution at that time. It's my guess this is what he used.

See if it looks like a Kies file would.

You don't need to set a password to do backup but if memory serves me correctly you can't directly access the data in the Kies file to view it.

If so you need to use the Kies app to restore the file to a supported Samsung phone.

Just a thought... I hope it can help you.

Kies was a pain.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Hi, thanks for your message.

Ohhhhh I see, that makes sense. I'm fairly certain it was on a mac, however it was a few years ago, so I might be wrong?

Who should I contact?

Thanks.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
I see, kies was a suggestion on another thread. I just flat out couldn't find the kies download link. There were some links on some dodgy sites. But it seems to have been discontinued and replaced by that Samsung smart switch stuff.
[Android Q&A, Help & Troubleshooting] CXZa:
Try putting just "Mac" to the start of those basenames... maybe we are lucky... (this time...)
[Android Q&A, Help & Troubleshooting] blackhawk:
Smart Switch may recognize it but don't bet on it.

Someone here might be able to give you a copy of Kies or pick the less dodgy site and scan the app with Virustotal etc before loading it.

Samsung could also supply it if hit over the head hard enough.

A Samsung Experience Center might be able to help and have a better solution.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Just the literal 3 letters "mac"? Should there be a space? Capitals?

I'll give it a try.

Thanks.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Hmmm I'll take a look. Yeah, I tried smart switch, and the options to select a backup file just didn't exist.

Alright, thanks. I tried one of those dodgy links in a virtual machine to be safe. It didn't recognise it. Tried a few versions aswell.

Thanks.
[Android Q&A, Help & Troubleshooting] blackhawk:
Smart Switch automatically recognizes it's backup file. As best I can tell it allows you to store only one copy and overwrites it if you try to create more than one. Very basic.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
If that's the case, then the file probably wasn't used with smartswitch or kies. Hmmm, what do u think?
[Android Q&A, Help & Troubleshooting] blackhawk:
I think it was Kies he used. Nothing else is available that I know of can snapshot an unrooted Samsang.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
So what kies version shall I use? I can't find any.

Thanks.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
I thought I sent the message before!!

It didnt work, just came up the same as before sadly.

Any ideas now? The guy below is under the impression that it was used with kies.

Honestly, these brute force attacks last about 10 minutes. Is it worth it to have a huge dictionary which would last days?

Thanks!
[Android Q&A, Help & Troubleshooting] blackhawk:
Samsung still has it.

Product Help & Support | Samsung Africa

We are here to help. Help & tips for your product, manuals & software download and Face-to-face support.

www.samsung.com
[Android Q&A, Help & Troubleshooting] CXZa:
I don't know about other backups but there is too many similarities in it. It's done with some Wondershare tool, no doubt about it, IMO.

If the pics etc. in it are not that special or private then making it public could be solution. Some can have a method or a machine power enough to crack it in no time. Well, in a reasonable time anyway...

Problem is that many tools need the target zip to be as standard, and that these Wonderdorks have messed quite well.

There is also ways to remove/zero parts of it, so cracking can be targeted on some not so private file...

Still, finding the right tool can be difficult...
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
I'll check that out. Thanks.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
I see.

Ah, the backup has too much personal stuff on there to share online. (There's about 20000 files in the backup.)

That's why I really wanted to try and separate 1 of the files in there and share publicly. Which isn't possible apparantly as it requires the password to move/copy a file that's inside the backup.

How would I go about removing some files from the backup? I think we discussed it a few weeks ago. As then I'd share it publicly. Then as you said, some tech genius can crack it hopefully, and I'd be grateful for eternity haha!

I see, hopefully we'll figure out something. I appreciate your help by the way, same for everyone else chipping in on this thread!

Thanks.
[Android Q&A, Help & Troubleshooting] :
Me again:

As you were already told the password is stored in AES 256 encrypted manner within the archive - keywords: Archive Decrpytion Header, Archive Extra Data Record.

AFAIK there is no publicly-known way to extract - will say: decipher - the AES key with non-trivial probability, given any number of plaintext-ciphertext pairs, in a practical amount of time using a practical amount of computing resources.

My advice: Stop wasting your time with this, or take the password-protected archive to NSA in order to decipher it - may be they have the appropriate tools and computer resources. :)
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Hmmm alright thats a shame. Nsa, wouldn't be easy to ask them haha!

But yeah, I see. I still have hope mainly because there's a password set, with no password attempts limit. So yeah, hopefully I can just outright crack it with bruteforce like before or something.

Thanks.
[Android Q&A, Help & Troubleshooting] CXZa:
You could use that hex editor and search "favorites.list" and copy that file from it. It's the smallest and doesn't contain any info. Mine is the same length. So like in the pic from hex 50 4B 03 to next one. The zip will not be correct but for the new batch attached (4badzip version) it's usable. And maybe there is some other tools that can accept it too?? The Favorites.list.zip included is from the backup I made. Now what was its password again?...
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Alright, so I kind of got the jist of your message. But what exactly shall I do? What shall I share on here from the hex editor?

Thanks.
[Android Q&A, Help & Troubleshooting] CXZa:
That part that is selected, yours is a bit different of course. Or just search that favorites text and give us the screenshot good enough...
[Android Q&A, Help & Troubleshooting] CXZa:
Some damn bug in this last batch version still. But it doesn't change the previous post...

My Favorites zip was just a bit too long. The batch work with it okay now. (I hope...) Still a bug or two... LOL

edit: Okay one bug found. Maybe it works now...

Download : https://xdaforums.com/posts/84034013/
[Android Q&A, Help & Troubleshooting] blackhawk:
I think what jwoegerbauer is saying is you might need a supercomputer to crack it.
[Android Q&A, Help & Troubleshooting] CXZa:
That might the case with very long passwords but that we want to avoid by guessworking a bit. The bak file is most likely encrypted using zipcrypto not aes, although that doesn't matter much if bruteforcing...
[Android Q&A, Help & Troubleshooting] blackhawk:
I'm sort of joking but at some point it becomes a lost cause.

Rule #1 of data backup, don't encrypt.

Apps like Kies arent directly viewable but not sure if it encrypts them or what it uses as a key if so.

I think this apk is most likely what was used.
[Android Q&A, Help & Troubleshooting] CXZa:
And therefore one decides to give useless ideas about something that one doesn't know about...

(y)
[Android Q&A, Help & Troubleshooting] blackhawk:
If it's not Kies it's a lost cause. Better?
[Android Q&A, Help & Troubleshooting] CXZa:
Kies was the first guess Akira got on another forum. Better?
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Why did you attach that?

Also, here's the screenshot of the "favorites.list" from hex editor. Not sure what you meant by "copy the file from it".

The line of code for my favorites is tiny compared to yours. Perhaps I haven't added any favorites and you have?

Does this help at all?

Thanks!
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Ah, either that or I'll just leave my pc on for a few weeks lol!
[Android Q&A, Help & Troubleshooting] blackhawk:
I feel you. Lost data before as well.

Sleeping on a bit tends to bring new ideas and insight.

Again could it be Kies that created it?

No password is needed so if it was Kies that used I doubt one was set.

I don't think Kies distinguishes or cares about which PC/Samsung phone is used to retrieve the profile.

Samsung Kies - Wikipedia

en.m.wikipedia.org

Did you try loading Kies on the PC then connecting the phone to the PC then commanding a data restore to the phone with that file?

Kies always was a twitchy apk...
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Yeah totally, there's so many files on the backup! Retrieving the backup in the first place was pretty tough, as it was deleted lol! Can't believe that after using all those file restorations, my file may not even be usable!

I'll give it another try.

"Commanding a data restore"?
[Android Q&A, Help & Troubleshooting] blackhawk:
Sorry been years since I used Kies; can't recall it's menu or wording. You get the idea... doubt it's that commanding a prompt. Just hope it takes.
[Android Q&A, Help & Troubleshooting] CXZa:
That is a little too little. A screenshot or data from text PK to PK like I posted... We both have no favorities... The file size is the same.

Here is a little tool to extract that part, and few bytes more but not much, as you can verify in hex editor...

Makes Favorites.list.bin file that you can post here or PM me for further editing...
[Android Q&A, Help & Troubleshooting] CXZa:
The newest bat works with that zip data you wanted to share. In case there is some other who would really want to help you... (by trying other basewords for example)... Or has similar problem...
[Android Q&A, Help & Troubleshooting] CXZa:
Happen to have/found any bak file done by Kies? Then it would be quite easy to make comparison... is it a zip file having similarly named files and is it messed up like Wondershare's?
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
I'm kind of lost here. On hex editor, I searched favorites.list. That's what it highlighted?
[Android Q&A, Help & Troubleshooting] CXZa:
Just use the tool attached..

edit: modified it a bit, so that the bak file doesn't have be in the same folder.
[Android Q&A, Help & Troubleshooting] CXZa:
So, you found the right spot. Now just take a screen shot like mine. If necessary scroll it a bit up like two lines so that the word "PK" is showing. And so that at the end shows ÿÿÿÿÿÿÿÿ or as hex FF FF FF... That small bit. My Favorites.list is included in the last WonderShare-Zip-Password-Tester_[cxz].zip, also the zip so if interested one can test the bat and get the password used for it...

Or use the tool...

I chose the Favorites.list because it doesn't give any info. And also because it might be used in known-plaintext attack... What I noticed that my backup was packed using deflate while yours was deflate64, but there is tools for that format too...
[Android Q&A, Help & Troubleshooting] CXZa:
Here is another favorites.list dumper specially for you. Based on your screenshot.

It makes three files Favorites.list1.zip which can be used with my password tester.

Favorites.list2.zip has the extra tail in it. Favorites.list3.zip has a bit more just for checking.

(And making them all public doesn't reveal nothing of you...)

I could not do this any easier for you than this...:p
[Android Q&A, Help & Troubleshooting] CXZa:
My Favorites.list.zip made about normal. Normal enough that some other tools might give it green light and don't complain about it. For plaintext-attack it might not work, not with the older tools anyway, but bruteforce etc. methods work. Also something like the SureZip Recovery might work, but for that at least five files is needed from the zip file...
[Android Q&A, Help & Troubleshooting] CXZa:
Well...? It should not be difficult now...

Could not get that Kraken thing to work. Failed in error after start but some better if run as long as this thread is old, could be quite close to success by now...

I finally read something about zip format... (I usually like to figure out things the hard way.)

The structure of a PKZip file

users.cs.jmu.edu

They have used data description that is what that tail is. Above compressed data is also file sizes. So, removed from one place and put into two...

-- > ZIP64 format...

Compression is somehow wrong as one can see that compressed is bigger than the original. Zipcrypto Store it should be. Strong encryption flag is not set.
[Android Q&A, Help & Troubleshooting] AkiraPerera04:
Hi, thanks for your message. Hmmm, sounds pretty complicated. So the idea is to extract the favorites file, then crack that file right?

Alright, you sent quite a lot of information recently. As of now, what should I be doing? (Sorry, I just got a bit lost lol!)

Thanks!

EDIT: "Close to success". Sorry, I'm not understanding.
[Android Q&A, Help & Troubleshooting] CXZa:
Right.

You should share that zip dumped (or all three), so others, if they like, could try their methods/tools if any. I can edit it same way I did mine if necessary.

Or, you can continue on your own... ¯\_(ツ)_/¯

Well, closer anyway... if run almost 2 months...