9

I'm trying to crack winrar's password using some methods as explained below.

Because rar uses AES-128 encryption, brute-force and dictionary attacks are useless as they would take years.
But, if we convert a password-protected rar file into an SFX archive (I'd prefer to winconsole because GUI takes much memory) that is an EXE format, I'm quite sure that it would be out of protection from winrar's gates.
Even then rar writes the encryption keys to that exe file.

So, if we could use an exe debugger or disassembler, can't we knock out the key that contains the password?
I used w32dasm, olly dbg & pe explorer to modify these exe files.
All I could find are the strings like "Extracting, CRC failed, Encrypted" and some other things. I used several sfx archives as test files (with different passwords) and tried it through disassembly. Those hexadecimal keys are looking quite similar!

So do I need a better disassembler or debugger? OR, someone tell me that if this method is useless and why?

Another question.. Does this following image has any link to winrar encryption? If yes, please explain how.. It would be very helpful. enter image description here

DavChana
  • 1,887
  • 17
  • 32
  • 2
    The problem with any sort of useful response to this request is that we cannot be sure that what you are attempting is legal and moral. Lawyers being what they are, they could possibly come after us for assisting you in any way. We wouldn't even be able to say that we are being paid to do it - we would have no defense. – Martin James Aug 04 '12 at 10:40
  • 7
    @MartinJames well following that logic...for any well known attack that hackers use, we may blame famous computer scientist just for publishing them...the whole crypto world should be punished because they are working with things like that...is that true? – Erdem E. Aug 04 '12 at 11:02
  • @VictorS. off-topic: philosophy. TBH, I don't care as long there are no lawyers banging on MY door, no process-servers forcing papers on me or TLA's taking an unwelcome interest in my life. I am content with my position on this matter. – Martin James Aug 04 '12 at 11:07
  • Came here for the blogpost! haha still nicer than mine but I'm still new here. – mr5 Sep 20 '13 at 17:20
  • @mr5 which blogpost? context please! – Jonathan dos Santos Jan 24 '14 at 15:21
  • @Jonathan I mean, link from the blog post. – mr5 Jan 25 '14 at 12:11
  • For the record, the OP may have been referring to an installer that uses the RAR library. In that case, the password *would* be embedded in the executable. – Synetech Mar 21 '16 at 05:21

3 Answers3

20

When you create a password-protected SFX it does not store the password. It asks you for it.

You can't just "convert" password-protected content into not-protected content. If that was possible the encryption scheme would be completely worthless.

usr
  • 162,013
  • 33
  • 219
  • 345
  • i didn't ask like that.. i know that password is a part of decryption key.. the keys related to that file will be compiled in the same sfx module except the password. i mentioned the word "out of protection" for accessing it, bt i didn't mean that as not protected –  Aug 04 '12 at 12:09
  • 8
    There must be a misunderstanding. I meant that neither the key nor the password are stored in neither SFX nor rar files. Why would they be stored? This would render encryption useless. – usr Aug 04 '12 at 12:53
  • But in basic logic there must be something stored in those files that would be in use for password comparison...Idk perhaps :D – The Bumpaster Nov 02 '16 at 10:07
  • 2
    @TheBumpaster decryption does not require the correct key. It can be carried out with any key but the data will be garbled. That's why archive files sometimes store a hash of the password or of the decrypted data so that the password can actually be checked (impossible otherwise). WinRar has messed this up and only checks the password by the CRC of the decrypted data. – usr Nov 02 '16 at 17:22
3

I think the problem is that trying to change the file to an SFX does nothing to decrypt the already encrypted content of the file hence it won't work. The data is already encrypted. Unless the data is NOT encrypted, then you would have to undergo the decryption process to get to your data no matter what you did to the file. No?

Santa's Little Helper
  • 31
  • 1
1

It is not easier to attack an SFX file versus a RAR file. A RAR archive consists of your compressed and (optionally) encrypted data. An SFX file is, like RAR, a package of compressed and encrypted data, but it also includes a miniature form of WinRAR that can decrypt the packaged data after the user enters the password.

The SFX file needs your password to decrypt your data; when you enter the wrong password, it's not because it tested your password against one embedded in the file. It means that when it tried to decrypt the data with the supplied password, something went wrong. This is all due to the magic of symmetric-key cryptography: the ciphertext (packaged within the RAR/SFX archive) goes through the AES decryption using the password you entered and the result (plaintext) is exported to whatever location you chose.

In conclusion, you'd have the same luck trying to break an SFX file as you would with RAR archive.

David Schwartz
  • 1,776
  • 17
  • 28