3

To put this problem in context, I have a touch monitor screen whose firmware program is protected by a password.

The firmware program is downloaded over RS232 via a Windows utility program provided by the manufacturer of the touch screen.

The problem is, upon completing the download, the utility program asks for a 6-character alphanumeric password, and I have no idea what it is. The company I bought the screen from has closed down since, so there's nowhere I can get hold of the password.

Since it's an alphanumeric password, (2*26+10)^6 = 56,800,235,584, my questions are:

  1. How easy is it to crack the password?
  2. What are the possible ways of cracking it?
  3. How would you attempt to crack it? (ex. robot program that will try to enter all possible passwords on human's behalf, etc.) What software tools would you use?
  • 2
    What I would do is reverse the tool of the manufactor. The security they often used is on the side of the tool, and not in the board. This allows very easy bypass methods. – Stolas Jul 30 '14 at 5:45
  • 1
    Maybe you could try to extract readable strings of length 6 from the binary and see if you find any match? The strings utility on Linux could do this for you. – Ztyx Jul 30 '14 at 5:46
  • 2
    @silvernightstar Load up IDA, put the tool in there. Do a string seach. Hope you are lucky, and go from there. For questions about that I'd welcome you to the reverse engineering stack. – Stolas Jul 30 '14 at 8:30
  • 2
    @Stolas Thanks, IDA does look promising indeed. Just came back from a whole afternoon of stepping, watching and tracing the tool's program code. Was able to circumvent a check_password subroutine and its subsequent cmp and jz instructions. Finally got to load the firmware program without the password! I have some questions regarding IDA though, will post them on the Reverse Engineering stack later. Thanks again! – silvernightstar Jul 31 '14 at 10:05
  • 1
    link to follow-up question for those interested: reverseengineering.stackexchange.com/questions/5989/… – silvernightstar Jul 31 '14 at 10:48
2

You can easily inject characters as if typed either via USB tools or code. Depending on the latency of trying a code and assuming no lock-outs it may not take too long to iterate through every possibility.

A better option may be to attach a debugger, enter any code and step through until you see the check of the input string. Change the logic of the result and then let execution continue - depending on the language and hardware this may be straightforward or painful.

I'm assuming you've tried Google hacking it and user forums in-case it's a widely known default...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.