Main Index

Ultra Zip Password Cracker

© 1998-1999 Ivan Golubev

Introduction

Requirements

Usage

Template attack

“ Known plaintext”attack

National languages support

Performance

Known bugs and limitations

Future enhancements

Frequently asked questions

Limitations of unregistered version

License

How to register

Special thanks

Technical support

Where to get the latest version


Introduction

Ultra Zip Password Cracker (or UZPC) can be used to crack (or recover) passwords for .ZIP archive files. There are many programs that are similar to UZPC, but UZPC has some advantages that others do not:

 – UZPC does complete password checking, i.e. if it finds a password, it can be relied on that this is a correct password. Some other program can give false passwords, especially if the archive contains less than three files.

 – UZPC supports four types of attack: "brute-force", dictionary based, a mix of "brute-force" and dictionary based, called a template attack and “known plaintext” attack.

 – UZPC is a very fast program. It is highly optimized for speed. On a K6-2-300 system its performance is about 1 500 000 password tests per second, when the archive contains three or more files. When an archive contains less than three files, the program performance degrades depending on the archive size.

 – UZPC can works with archives that contain files with different passwords.

 – UZPC has a user friendly GUI.

 – UZPC is customizable: you can set up the minimum and maximum password length, define the type of characters used in the password for a "brute-force" attack, and you can choose the method of modifying a test password from the dictionary file, for a "dictionary based" attack.

 – You can interrupt UZPC at any time and save the current cracking status.

 – UZPC shows you an estimate of the time remaining for a solution.

 – There is multi-lingual National language support, using simple text files.


Requirements

To run this program you need:

 – A computer with running Windows 95/98/NT.

 – About 100 kilobytes of free hard disk space.

 – About 34 megabytes of (virtual) memory for "known plaintext" attack.


Usage

After starting UZPC, select the Task menu, choose New, and then select the ZIP archive file that you want to process. In the next dialog box select the attack type to be used, and the files in the archive that are to be attacked, (or select that all files have the same password).

If you have selected the "brute-force" attack, in the next dialog box define the characters to use in the password search, and the minimum and maximum password length. Then press the "Go" button.

If you have selected the "dictionary based" attack, in the next dialog box enter the dictionary name and choose how to modify passwords found in the dictionary file. Then press the "Go" button. The program automatically recognizes the line delimiter used in the dictionary file. It may be DOS <CR/LF> or UNIX <LF> or just a <CR> delimiter.

For the "template attack" description see the Template attack section.

For the "known plaintext" attack description see the “Known plaintext”attack section.

The program is now working. It shows the current status. You can see the current password being tested, the average passwords tested per second, and the estimated time to reach a solution. The status information is updating every 5 (by default) seconds. At any moment you can interrupt the cracking process by selecting the "Task\Stop" menu item. Also at any moment you can save the current cracking status by selecting the "Task\Save" menu

item. By default, UZPC will save the current cracking status in a file with an extension of .pcs, and with the same name as the ZIP archive file being processed. You can open this file later and continue the cracking process from the saved position.

If you think that your system is not stable you can use the autosave function. Select "Options\Setup" and check "autosave every xx minutes". Note that if you start a new task with autosave "on" then you will be asked for the status filename when the autosave time comes (if you have not manually saved the status previously).

Also you can change the time interval between status updates. However, we recommend that the update time interval be 5 or more seconds; if it is less than 5 seconds the speed of execution of the program will decrease by between 5% and 10%.

If you think that UZPC takes up too much space on the task bar you can select

"Options\Setup\Minimize to tray".

Also you can change program priority.

When (if) UZPC find a password it stops working and displays the results. It shows the ZIP archive filename, files that has been attacked, the password for those files and the password length. Also UZPC saves the password in a file with the extension .psw, into the same location as the ZIP archive.


Template attack

A "template attack" is a mix of "brute-force" and a dictionary-based attack. It can greatly assist in the finding of a password if you know something about the password. The main idea of a template attack is to subdivide the password using known information. Each part of a template may be either some character set with a minimum and maximum length, or some word from a dictionary file. To understand how to use a template attack let's take some examples:

I. I remember that the password starts with two digits (but I do not remember them), then I used from 4 to 6 lower case letters and maybe I used a special character at the end.

So I select template attack and describe the template as:

+----------+--------------+------------------------------+

| Position | Repeat Count |    Description               |

|          |  min  |  max |                              |

+----------+-------+------+------------------------------+

|        1 |   2   |   2  |   Digits (0123456789)        |

|        2 |   4   |   6  |   Lower case letters (abc...)|

|        3 |   0   |   1  |   Special symbols (!#$...)   |

+----------+-------+------+------------------------------+

Using this template UZPC starting to generate password from 00aaaa, 00aaab, 00aaac, ..., 00baaa, ..., 12adef$, ..., 21ivan$, ..., up to 99zzzzzz~.

This template will be processed much faster than a "brute-force" attack that uses character sets "digits" + "lower case letters" + "special symbols", and with a minimum length of 6 and a maximum length of 9.

II. Ok, let's look at the standard keyboard layout:

 1 2 3 4 5 6 7 8 9 0 - = \

  q w e r t y u i o p [ ]

   a s d f g h j k l ; '

    z x c v b n m , . /

Consider the case where I remember that the password for a file is, for example, "golubev".  Suppose I incorrectly typed the password, so that in fact "golubev" is incorrect. Then, given that word, I know which parts of the keyboard I originally pressed. Using that incorrect password I can create the following template:

+----------+--------------+----------------------------+

| Position | Repeat Count |    Description             |

|          |  min  |  max |                            |

+----------+-------+------+----------------------------+

|        1 |   1   |   1  |   rtyfghcvbn               |

|        2 |   1   |   1  |   890iopjkl;               |

|        3 |   1   |   1  |   iopkl;m,./               |

|        4 |   1   |   1  |   678yuighjk               |

|        5 |   1   |   1  |   fghjvbn and space        |

|        6 |   1   |   1  |   234wersdf                |

|        7 |   1   |   1  |   dfgcvb and space         |

+----------+-------+------+----------------------------+

Using this template UZPC can find such passwords as "go;ubev" or "holubwv".

III. Since I am smart enough not to password a file with only a simple word, I've used a more complex password, but I've forgotten that password! And, because I am so smart, the password cannot be recovered by a simple dictionary based attack (even using all available modifiers). However, I know that the password starts with from 2 to 3 digits, then I've used some simple word, and maybe I've used a special symbol at the end. So, first I create a dictionary file of the likely words that I may have used, (I do not know what word I've used but I try to anticipate it):

ivan

formula-1

f1

formula1

formula_1

password

uzpc

computer

ok

ok computer

radio

head

I have called this dictionary file mydict.txt.

Secondly, I create the following template:

+----------+--------------+-------------------------------------+

| Position | Repeat Count |    Description                      |

|          |  min  |  max |                                     |

+----------+-------+------+-------------------------------------+

|        1 |   2   |   3  |   digits                            |

|        2 |   -   |   -  |   Word from "mydict.txt":           |

|          |       |      |   all upper/lower case combinations |

|        3 |   0   |   1  |   Special symbols                   |

+----------+-------+------+-------------------------------------+

UZPC starts to work and after some time it finds the correct password "91FoRmuLa-1$". Wow, it's not so good to be too smart :-)

I hope these examples will help you to understand how to use the "template attack". But if you have some questions feel free to contact us.

One more thing, If you do not know anything about the password DO NOT use the "template attack" because it runs at about half the speed of the "brute-force" attack (but it checks much fewer passwords then does the "brute-force" method).


National languages support

UZPC can support national languages. There is a message file named uzpc.lng in the same directory as the program. You can replace this file with another that contains messages in your national language.


Known plaintext attack

“Known plaintext” attack

Description

This version of UZPC supports powerful "known plaintext" attack.

This means that if you're have only one unencrypted file from passworded archive you can extract all files from archive (of course, if its was encrypted with same password).

The basic rules are:

1. Take unencrypted file which also present in passworded archive.

2. Compress it with same method and same archiver as an encrypted archive. Note that this is strongly needed because UZPC checks file sizes and checksums of files.

3. Run UZPC, select encrypted archive, then select "plaintext" attack and browse for archive with unencrypted file. Also define name of unencrypted archive that will be created when UZPC find matching keys. After that UZPC will check files and if it found match files it starting to work.

There are four cycles in "plaintext" attack (if you're know something about .zip encrypted scheme you'll understand what I mean, if not just read estimated timings for cycles at K6-2-300):

1. Generation keys2 and first reduction cycle. At this and next cycle you're need about 34 megabytes of (virtual) memory. This cycle takes less a minute if you have enough free RAM or several minutes if you’re use virtual memory.

2. Main reduction cycle. Takes several minutes and now you can see "progress" indicator. At first it will at 0% and then it'll starts to increase rapidly. After this cycle memory will be freed and UZPC will works with about 2 megabytes only.

3. Reordering keys2. Takes few minutes. The main aim of this cycle is to estimate how long will UZPC works. Note that first three cycles have no estimate time. Only "progress" indicator.

4. Searching matching keys. This is main cycle of "plaintext" attack. Now you can see how much time you're need (in worse case) to recover archive.

After UZPC found matching keys it create archive "<archive name>_UnEncrypted.zip" (by default) which will be unencrypted and report you about done work. You can extract files from this archive with any .zip archiver.

Current version notes

1. You cannot define binary file as "plaintext" file. In next versions we'll add this ability but usually you're in any case need in whole unencrypted file.

2. "Plaintext" file must be at least 40 bytes long.

3. "Plaintext" attack cannot be saved. But when we're testing "plaintext attack" engine we'd see that you're need from 10 minutes to one hour to recover archive.

4. No estimate time for first three cycles. But you can expect that its takes only several minutes.

5. In any case you're need about 34 megabytes of RAM. If you haven't so much (is this so much? :-)) RAM you're needs enough swapspace on disk. However, we’re recommend to use “known plaintext” attack with 40-48 megabytes of RAM (because Windows itself (of course) used several megabytes of RAM).

Test results

Here is table with "known plaintext" attack test results.

All tests were made with AMD K6-2-300MHZ 96MB RAM under Windows NT.

+-----------------+-----------+-----------+-----------+-----------+-----------+

|Test             |     1     |     2     |     3     |     4     |     5     |

+-----------------+-----------+-----------+-----------+-----------+-----------+

|Size of plaintext|       47  |      264  |      554  |    1 421  |   18 848  |

|(bytes)          |           |           |           |           |           |

+-----------------+-----------+-----------+-----------+-----------+-----------+

|Cycle #1         |      10s  |      10s  |      10s  |      10s  |      10s  |

+-----------------+-----------+-----------+-----------+-----------+-----------+

|Cycle #2         |   1m 00s  |   1m 00s  |   1m 10s  |   1m 15s  |   2m 30s  |

+-----------------+-----------+-----------+-----------+-----------+-----------+

|Cycle #3         |  30m 00s  |   3m 00s  |   1m 50s  |      23s  |      15s  |

+-----------------+-----------+-----------+-----------+-----------+-----------+

|Cycle #4         |   7h 00m  |   1h 06m  |  25m 30s  |   5m 45s  |   4m 20s  |

|Estimated        |           |           |           |           |           |

+-----------------+-----------+-----------+-----------+-----------+-----------+

|Found at         |    20%    |    77%    |     4%    |    68%    |    40%    |

+-----------------+-----------+-----------+-----------+-----------+-----------+

|Total time       |   2h 00m  |  55m 00s  |   4m 00s  |   5m 40s  |   4m 40s  |

+-----------------+-----------+-----------+-----------+-----------+-----------+


Performance

Here is a small table with testing results.

+-------------------+-----------------------+--------------------------------+

|    Computer/OS    | Passwords per seconds |       Passwords per seconds    |

|                   | (one file in archive) | (two or more files in archive) |

+-------------------+-----------------------+--------------------------------+

| Cyrix PR233 Win95 |       470 000 (*)     |           580 000 (**)         |

| iPII-266    Win98 |       640 000 (*)     |         1 110 000 (**)         |

| K6-2-300    WinNT |       920 000 (*)     |         1 550 000 (**)         |

+-------------------+-----------------------+--------------------------------+

(*) in this case speed is highly depend on file size. You can increase this speed if you are using a very small file (about 1-2K). If the compressed file is large then speed will be reduced. For example, for a file with an uncompressed size of 110Kb and compressed size of 17Kb, speed on an Am5x86 system is about 35000 passwords checked per second.

(**) If you are using three or more files this is the real speed. If you are using two files then speed will reduced depending on file size.


Known bugs and limitations

 – UZPC supports only compression methods 0 (storing) and 8 (deflating) (Are you in need of other ones? :-))

 – UZPC cannot open some specific zip archives.


Future enhancements

 – Prefix & suffix options for brute-force attack.

 – Job splitter.

 – Support some “strange” zip archives.

 – Speed optimization.

 – Support local network.

 – Your wishes.


FAQ

Frequently asked questions

1.	Your program has some bugs!

I have some suggestions for your program.

First, check that you're using newest version of UZPC. You can download it from our web page at http://members.xoom.com/m53group. If newest version still contain bug that you're found or not support some features about you want to tell us, send us letter to trooper@mail.wplus.net. In the mail subject please place "UZPC x.yy" (where x.yy version number) followed by "bug", "suggestion" or whatever else.

2.	Your program does not open zip archive, when other programs do this.

Your program does not open some self-extracting archives.

Yes, UZPC cannot open some specific archives and reports "Error in zip file". Hope in next versions we'll fix this problem. But at this moment, please try to use PkZipFix utility coming with PkZip package to check and improve (or convert from .exe into .zip) archive.

3.	Can you found the archive's password for me?

No, we do not crack users' archives.

4.	I download your program and it works amazing. Due to your program called "Cracker" I think you're also cracker/hacker, so can you hack <something> for me?

NO! We're do not crack programs/serial numbers/networks/HASPs/AOLs/etc. Also, we do not know any hacking group and we do not know how to contact them. We're legal programmers and "Cracker" in most cases means "Recovery".

5.	I have passworded archive, how can I crack it?

First, try to use brute-force with all symbols and maximum length of 4-5. Secondly, try to use dictionary-based attack with good dictionary file and try all passwords’ modifying methods. If you're know something about password use template attack. If you're do not know anything about password try to use:

 – brute-force: digits, max len=10,

 – brute-force: small letters, max len=7,

 – brute-force: capital letters, max len=7,

 – brute-force: small letters and digits, max len=7,

 – brute-force: capital letters, small letters and digits, max len=7.

If you're still do not found password try to use another combinations (with increased maximum length of password and special symbols in charset).

Probably, you'll need to use faster computer :-)

If you're have one unencrypted file from passworded archive you can use "known plaintext" attack. You can extract all files from archives after several hours.

6.	You said that your program works this <...> speed, but on my system it's much slower. Why?

Note that testing speed was measured under "clear" system, i. e. without any other applications running. Also note that speed is highly depending on CPU type (not only CPU speed!). This means at modern processors (at least Celeron or K6) UZPC will work much faster then on another ones (for example, Pentium MMX).

7.	Can you implement such extension as MMX and 3DNow! in your program?

We've make test version which used MMX. But it worked slower then non-MMX version (I mean v3.00). And 3DNow! instruction also cannot help to crack passwords faster.

8.	I've translated message file for your program. Here is it!

Please, do not send us your national message files. Note that we're do not give anymore free registration for the translations.

9.	In version 1.11 you told about RAR support. Where is it?

We've see very low users activity in this question, so we do not add RAR support. Maybe in future...

10.	Ok, your program works well. So I'll buy it if you're tell me that it'll crack this archive (and then followed multi-megabyte MIME archive).

Please do not send us your archive. In any case we cannot guarantee that you'll found password you're looking for (zip archive have an enough strong encryption scheme, it's not a MS Access files). And also note that we do not receive large messages at all (to avoid spam). So, by default, if you're message greater then 256KB it'll be killed at mail server. Please, do not waste your and our time.


Limitations of unregistered version

 – UZPC does not support passwords with a length exceeding five characters for a brute-force attack.

 – UZPC does not support modifiers "All available combinations", "Reverse order" and "All available combinations in reverse order" for dictionary-based/template attacks.

 – When using “known plaintext” attack UZPC will recover only two files from encrypted archive. All other files in archive will be invalid.


License

The Ultra ZIP Password Cracker (UZPC) is shareware. This means:

 – All copyrights to UZPC are owned by Ivan Golubev.

 – You may use UZPC free during a test period of 30 days. Following this test period of 30 days or less, if you wish to continue to use UZPC, you MUST register.

 – Registered users can use UZPC and all it updates on one computer for infinite period.

The unregistered version of UZPC may be freely distributed, provided the distribution package is not modified. No person or company may charge a fee for the distribution of UZPC without written permission from the copyright holder.

 – ULTRA ZIP PASSWORD CRACKER IS DISTRIBUTED "AS IS".  NO WARRANTY OF ANY KIND IS EXPRESSED OR IMPLIED. YOU USE AT YOUR OWN RISK. THE AUTHOR WILL NOT BE LIABLE FOR DATA LOSS, DAMAGES, LOSS OF PROFITS OR ANY OTHER KIND OF LOSS WHILE USING OR MISUSING THIS SOFTWARE.

 – You may not use, copy, emulate, clone, rent, lease, sell, modify, decompile, disassemble, otherwise reverse engineer, or transfer the licensed program, or any subset of the licensed program, except as provided for in this agreement. Any such unauthorized use shall result in immediate and automatic termination of this license and may result in criminal and/or civil prosecution.

All rights not expressly granted here are reserved by Ivan Golubev.

 – Installing and using UZPC signifies acceptance of these terms and conditions of the license.

 – If you do not agree with the terms of this license you must remove UZPC files from your storage devices and cease to use the product.


How to register

At this moment there are two ways to register:

1. The fastest way is to use a credit card. You can register UZPC via the "Register Now" option at:

https://www.regnow.com/softsell/nph-softsell.cgi?item=1964-1

NOTE: The information you send about your card is in a very secure format. No one can read it other than credit card processor program.

2. You can transfer $30 direct to our bank account. If you want to use this method, tell us in what country you live and we will send you more detailed information. But please note there are taxes for bank transfers. The taxes can be up to 100%!

Once registered you will receive your own registration number. After you enter it in the Options/Registration dialog box, you will gain access to all the features of UZPC. Note that the registration number will be valid for all future updates of UZPC. Registration costs 30 US Dollars.

If you cannot use either of these ways contact to us, and we'll try to find another way.

You can contact us via e-mail at trooper@mail.wplus.net.


Special thanks

Special thanks to

Chris Gregory	who edited this file.

John Taylor	for the tests.

Steve Pepin	for the bug report.

David Hofmann	for the bug report.


Technical support

For technical support please contact:

Ivan Golubev at trooper@mail.wplus.net

or

Denis Gladysh at m53group@chat.ru.


Where to get the latest version

The latest version of this program is available from our web pages at:

http://members.xoom.com/m53group

or the Russian mirror

http://www.chat.ru/~m53group