Cracking Android Pattern Hash - Printable Version

Code:

$ adb devices

$ adb pull /data/system/gesture.key gesture.key01458

$ wc gesture.key01458

0 1 20 gesture.key01458

$ # several test show, that length is ALWAYS 20 (sha1?)

$ cat gesture.key01458|xxd -g1

0000000: ae 93 f0 d3 b7 7f 4a b4 2a 4c 90 de 52 91 a8 a1  ......J.*L..R...

0000010: 9b b6 54 0f                                      ..T.

$ javac PatternLock.java;java PatternLock 01458

ae93f0d3b77f4ab42a4c90de5291a8a19bb6540f

Code:

import java.lang.Integer;

import java.security.NoSuchAlgorithmException;

import java.security.MessageDigest;



public class PatternLock {

    public static void printHash(byte[] hash) {

        // a simple dumper, use other Java build-ins instead if u prefer

        int i;

        if (hash.length!=20) {

            System.out.print("[!] Warning: hash length is different than 20...w t f ?");

        }

        for (i=0;i<hash.length;i++) {

            System.out.printf("%02x",hash[i]);

        }

        System.out.println();

    }

    public static void main(String[] args) {

        if (args.length<1) {

            System.out.println("[-] Please specify the pattern as first command line argument, e.g 01234");

            System.exit(1);

        }

        // size check

        String pattern=args[0];

        if (pattern.length()<4) {

            System.out.println("[!] Warning: Android does *not* allow pattern smaller than 4");

        }

        int i,cur_pattern;

        byte[] res=new byte[pattern.length()];

        for (i=0;i<pattern.length();i++) {

            try {

                cur_pattern=Integer.parseInt(pattern.substring(i,i+1));

                if (cur_pattern>=0 && cur_pattern<9) {

                    res[i]=(byte)cur_pattern;

                } else { // we should never be able to enter here !?

                    System.out.println("[!] Warning: The number is *not* within the allowed range");

                }

            } catch(NumberFormatException e) {

                System.out.println("[!] Warning: C'mmon the pattern should be numerical");

            }

        }

        try {

            MessageDigest md=MessageDigest.getInstance("SHA-1");

            byte[] hash=md.digest(res);

            printHash(hash);

        } catch (NoSuchAlgorithmException nsa) {

            printHash(res);

        }

    }

}