Topic: GPU brute forcing an encrypted wallet (Read 16600 times)

Read additional options from tokenlist file: --pause --no-dupchecks --wallet multibit.key
Counting passwords ...
Done
Using 4 worker threads
116668178 of 642544812 [#####--------------------------] 0:06:26, ETA:  0:29:01

Read additional options from tokenlist file: --pause --no-dupchecks --wallet multibit.key
Counting passwords ...
Done
Using 4 worker threads
116668178 of 642544812 [#####--------------------------] 0:06:26, ETA:  0:29:01
Password found: 'Passwd'
Press Enter to exit ...

Read additional options from tokenlist file: --pause --no-dupchecks --wallet multibit.key
Counting passwords ...
Done
Using 4 worker threads
642544812 of 642544812 [#######################] 0:35:27, Time: 0:35:27
Password search exhausted
Press Enter to exit ...

#--pause --no-dupchecks --wallet multibit.key
%ia%0,5a

/*
Private key encryption is done based on a CMasterKey,
which holds a salt and random encryption key.

CMasterKeys are encrypted using AES-256-CBC using a key
derived using derivation method nDerivationMethod
(0 == EVP_sha512()) and derivation iterations nDeriveIterations.
vchOtherDerivationParameters is provided for alternative algorithms
which may require more parameters (such as scrypt).

Wallet Private Keys are then encrypted using AES-256-CBC
with the double-sha256 of the public key as the IV, and the
master key's key as the encryption key (see keystore.[ch]).
*/

#!/usr/bin/ruby -w
class Cracker
  def initialize(char_array, password_range)
    @char_array = char_array
    @password_range = password_range
  end

  def password_correct?(phrase)
    print "basepassword" + phrase, "\t"
    system("./bitcoind walletpassphrase basepassword#{phrase} 20")
    case $?.exitstatus
    when 0
      puts "Found it!  basepassword#{phrase}"
      exit 0
    end
    return false
  end

  def generate_password( perm_number, password_length )
    password=""
    (1..password_length).each do |char_number| # loop through characters
      char_reference = (perm_number / @char_array.length**(char_number-1)).floor % @char_array.length
      character = @char_array[char_reference]
      password << character
    end
    password
  end

  def do_combination( num_combinations, password_length )
    (0..num_combinations-1).each do |perm_number| # loop through combinations for a given length
      password = generate_password( perm_number, password_length )
      return password, perm_number if password_correct?(password)
    end
  end

  def crack()
    (@password_range).each do |password_length|  # loop to gradually increase password length
      num_combinations=@char_array.length**password_length
      password, perm_number = do_combination(num_combinations, password_length)
      if password
        puts "#{password} | Access Granted | #{perm_number} / #{num_combinations}"
        return password
      end
    end
  end
end

# I removed characters I was sure I didn't use
characters = "!$@01235@ABCDEFGIKLMNOSTWYZabcdefgiklmnopqrstuwyz".split(//)

cracker = Cracker.new( characters, (6..8) )
password = cracker.crack()

puts "No luck."
exit 1