Breaking the Screenlock – A short Update

The posts about how to break the screen lock are very frequently visited. This is why I thought it’s time  to give you a short update and provide you with a Python script, that can do most of the attack in an automated way.

First of all, there has been one minor change in the latest versions of Android. The SQLite database with the salt needed for the hash-calculation can now be find in a different location: /data/system/locksettings.db

To extract the salt from the database you can use the following SQLite statement: “SELECT value FROM locksettings WHERE name=’lockscreen.password_salt'”

Everything else is still the same, even after several years and many new Android versions.

With the help of the following Python script, you can get everything needed from a connected and rooted device:

As soon as the script has finished successfully you will receive a file – crack.hash – which contains the sha256 hash of the users PIN/Password and the salt extracted from the corresponding system database.

If you now want to start the brute-force attack you only need hashcat and the following command:

Very often people are asking “why to brute-force the PIN/Password when you already have root access?”. The answer is very simple. Users of mobile devices are often lazy and use the same PIN/Password at multiple locations (e.g., secure containers, password-protected apps, etc.). If you can get the PIN/Password here, where it is documented and there are tools available that help to perform the attack, why to try to reverse the protection functions in other apps and hope that you have tools available that do the brute-force attack for you. Just use the PIN/Password from the screen lock and test it whenever an app is asking for something similar.

During my daily work, this often helped me to save a lot of time.

4 Replies to “Breaking the Screenlock – A short Update”

  1. Hello, where and how to run the Python script – on the PC with the mobile connected via USB to the PC? In my case my mobile has a forgotten screen lock password, but when I connect via USB, I am able to see the folders inside the mobile. I would appreciate your reply.

  2. Hi. I’ve forgotton the PIN to my Android phone. It’s Android 8.0 and rooted (as I like root). The only thing I’m after off my phone is a bunch of beer receipes. I’ll try your script this evening. Seems in 8.0 locksettings.db still exists in hte same location, but password.key is now called gatekeeper.password.key and gatekeeper.pattern.key. MTG, James

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.