Post
Topic
Board Bitcoin Technical Support
Topic OP
How to recover your wallet.dat encryption password (Brute force)
by
NEICH
on 08/04/2013, 19:37:58 UTC
Dear bitcoiners,

I forgot my pass for my encrypted wallet.dat. At the beginning I was not really worry, as I only had a few bitcoins... but currently, due to the high value of the coin I made big efforts for  recovering my password. Finally I was able to find the password by means of some scripts I built.
I hope they are useful for you also.

First, I installed an Ubuntu system in a VMware virtual machine. I then installed bitcoind, and ruby.

Then I figured out some rules for the developing of a passwords builder, obtaining a few personal dictionaries. This way I would run some dictionaries at home, and others in the office.
In my case I usually use passwords with a specific syntax... for example
1. Something like _bitcoin001$$$... the syntax will be:  [from zero to two characters]  + [word1] + [from 0 to a few numbers] + [a few characters]
2. Something like _coin13bitcoin001$$.... the syntax will be:  [from zero to two characters]  + [word1] + [a few numbers] + [word2] + [a few characters]
3....

I then assumed some general rules. In my case for example, I use to repeat the same character at the end... Normally I don't use digits above value 3, etc...
In your case you have to figure out your own rules and tune up my code.

I provide two scripts:

Build.rub will build your dictionaries according to the rules you have defined. This script will create a text file that will be used for searching for your lost password.
It is important to have this information in a file, as it will be mandatory for resuming from the last tested password in case you switch off the PC or you have a hard reset.

In the dictionaries building it is important to minimize the characters in the list (think about the common characters you use and discard those not used in your password, also do the same for the numbers you use). In addition, I looked for 6 unknown characters.... note that this leads to a searching of one month.... maybe your case is easier, and only forgot two or three characters..... I hope that !!. It is very useful to find rules that reduces the number of possibilities. For example in my case I normally repeat the same symbol several times instead of using different symbols consecutively.

Code:
#!/usr/bin/ruby -w build.rub

arrayNumSymbols = "\#$%&*+-=@_0123".chars.to_a
arraySymbols = "\#$%&*+-=@_".chars.to_a
arrayNumbers= "0123".chars.to_a

counter = 0
NumDiccionario = 1

#--------------------------------------------------------------------------------

min_left = 0  
max_left = 1  

min_center = 0
max_center = 2

min_right =  0
max_right =  4              #  This is not including an extra character that can be added at the end
max_Right_Symbol=3     # within right characters, this constant define the number of consecutive symbols
extra_symbol=1            # value 0 or 1. It defines if an extra character shall be added at the end

#-----------------------------------------------------------------
def storeWord(file,left,center,right,counter)
  
     case NumDiccionario
        when 1  then file.puts left + "word1" + right + "\n"                                 #_$word1$$$000+          -> LCR=2-0-6
        when 2  then file.puts left + "WORD1" + right + "\n"                               #_$WORD1$$$000+        -> LCR=2-0-6
        when 3  then file.puts left + "Word1" + right + "\n"                                 #_$Word1$$$000+         -> LCR=2-0-6
        when 4  then file.puts left + "word1" + center + "word2" + right + "\n"       #_word100word2$$$0+   -> LCR=1-2-4
        when 5  then file.puts left + "WORD1" + center + "WORD2" + right + "\n"    #_WORD100WORD2$$$0+   -> LCR=1-2-4
        when 6  then file.puts left + "Word1" + center + "Word2" + right + "\n"       #_Word100Word2$$$0+        -> LCR=1-2-4
     end
     counter = counter + 1
     return counter
end
#-----------------------------------------------------------------
left = ""
center = ""
right = ""

print "Building dictionary" + NumDiccionario.to_s + " .\n"
print "Wait...\n"

# --- This code defines the number of characters in the left, center and right of the generated password
case NumDiccionario
    when 1   then max_left = 2; max_center = 0; max_right = 6;
    when 2   then max_left = 1; max_center = 2; max_right = 4;
    when 3   then max_left = 1; max_center = 2; max_right = 4;
    when 4   then max_left = 2; max_center = 0; max_right = 5;
end

nameFile = "diccionario" + NumDiccionario.to_s + ".txt"
File.open(nameFile, 'w') do |file|

# ------- Calculation of left characters  ------------  
(min_left..max_left).each do |length_left|
  arraySymbols.repeated_permutation(length_left) do |str_left|
      left = str_left.join
      # ------- Calculation of center characters -------------
      (min_center..max_center).each do |length_center|
          arrayNumSymbols.repeated_permutation(length_center) do |str_center|
             center = str_center.join
             # ------- Calculation of right characters -------------
             (min_right..max_right).each do |length_right|
        max_symbols = [length_right, max_Right_Symbol].min
                 (0..max_symbols).each do |num_symbols|
        if (num_symbols == 0)
                         arrayNumbers.repeated_permutation(length_right) do |str_numeros|  
                              right = str_numeros.join
                              counter = storeWord file,left,center,right,counter
                              if extra_symbol==1
                                arraySymbols.each do |extra_caracter|
                                   right = str_numeros.join + extra_caracter
                                   #---- Store this word in the dictionary  ----------    
                                   counter = storeWord file,left,center,right,counter
                                end  
                              end
                         end
                      else
                         arraySymbols.each do |symbol|
                         str_symbols = symbol * num_symbols
                         max_numeros= length_right-num_symbols
                         arrayNumbers.repeated_permutation(max_numeros) do |str_numeros|
      right = str_numeros.join + str_symbols
                               counter = storeWord file,left,center,right,counter                    
                right = str_symbols + str_numeros.join
                               counter = storeWord file,left,center,right,counter
                               if extra_symbol==1
                                   arraySymbols.each do |extra_caracter|
      right = str_symbols + str_numeros.join + extra_caracter
                                       counter = storeWord file,left,center,right,counter
                                   end        
                               end
                             end
                         end
                      end
                  end
             end
      end
      end  
  end
end
end
print "Words counter: #{counter}. Maximum estimated time for password recovery #{counter/36000} hours. #{counter/864000} days \n"
      
File.open('lastLine.txt', 'w') do |file2|
    file2.puts "0"
end  

Note that by changing the constant "dicctionario" and running this script you can generate all dictionaries you define in the code (following your own rules)
run the scrip by using "ruby -w build.rub"

After you have generated the password files, you can use the following script for searching for the password:

- First of all, run the bitcoind in daemon mode:  bitcoind -daemon

- Then, run this script ruby -w search.rub

Sarch.rub

Code:
#!/usr/bin/ruby -w search.rub

num_line = 0

NumDiccionario = 1

#--------------------------------------------------------------------------------

#-----------------------------------------------------------------
def checkPassword (pass)
  print pass, "\t"
  system("bitcoind", "walletpassphrase", pass, "20")
  case $?.exitstatus
  when 0
    puts "You found it!  #{pass}"
    File.open('password.txt', 'w') do |file|
       file.puts phrase + "\n"
    end
    exit 0
end
#-----------------------------------------------------------------

str_num_line = "0"

File.open('lastLine.txt', 'r') do |file2|
           str_num_line = file2.gets
end  

if (str_num_line.to_i > 0 )
   print "Last searching stopped at line " + str_num_line + "\n"
   STDOUT.flush
   print "Continue from here? y/n:"
   resp = gets.chomp
   if (resp == "y")
       num_line =str_num_line.to_i
   end
end
  

print "Starting at line " + num_line.to_s + "... Good luck!!\n"

fileName = "Dictionary" + NumDiccionario.to_s + ".txt"
File.open(fileName, 'r') do |file|

print "Shifting index..."
(0..num_line).each do |i|
   line = file.gets
end

print "Searching..."

while line = file.gets
    print "Checking line:" + num_line.to_s + ": " + line
    str = line.chomp
    checkPassword  str
    num_line = num_line + 1
    if (num_line % 100)
       File.open('lastLine.txt', 'w') do |file2|
           file2.puts num_line.to_s + "\n"
       end    
    end
end
end


If you prepare the testing system in a virtual machine, you can run several instances, one per dictionary.... I was running up to 6 at the same time with an i7 and 3GB or RAM.
If you need help, and need support, feel free to contact with me.

Good finding!


BTCTC Address for Donations:  12PxVhcqdP2ZJLmeGnR33xfpBKA6nHsE2K