Breaking the Screenlock – A short Update

The posts about how to break the screen lock are very frequently visited. This is why I thought it’s time  to give you a short update and provide you with a Python script, that can do most of the attack in an automated way.

First of all, there has been one minor change in the latest versions of Android. The SQLite database with the salt needed for the hash-calculation can now be find in a different location: /data/system/locksettings.db

To extract the salt from the database you can use the following SQLite statement: “SELECT value FROM locksettings WHERE name=’lockscreen.password_salt'”

Everything else is still the same, even after several years and many new Android versions.

With the help of the following Python script, you can get everything needed from a connected and rooted device:

As soon as the script has finished successfully you will receive a file – crack.hash – which contains the sha256 hash of the users PIN/Password and the salt extracted from the corresponding system database.

If you now want to start the brute-force attack you only need hashcat and the following command:

Very often people are asking “why to brute-force the PIN/Password when you already have root access?”. The answer is very simple. Users of mobile devices are often lazy and use the same PIN/Password at multiple locations (e.g., secure containers, password-protected apps, etc.). If you can get the PIN/Password here, where it is documented and there are tools available that help to perform the attack, why to try to reverse the protection functions in other apps and hope that you have tools available that do the brute-force attack for you. Just use the PIN/Password from the screen lock and test it whenever an app is asking for something similar.

During my daily work, this often helped me to save a lot of time.

1 comment

Leave a Reply

%d bloggers like this: