Android Pattern Lock Cracker
This is a little tool to crack the pattern lock on Android devices.
How does the pattern lock works?
Really, the pattern lock is the SHA1 hash sequence of digits (0-8) with length from 3 (4 since Android 2.3.3) to 8.
Since Android does not allows the pattern to repeat "balls" and it does not use a salt when computing the SHA1 hash, it really takes a very short period of time to crack the hash and get the pattern.
The gesture board is a 3x3(*) matrix, and can be repressented as follows (each digit represents a "ball"):
-------------------
| 0 | | 1 | | 2 |
-------------------
| 3 | | 4 | | 5 |
-------------------
| 6 | | 7 | | 8 |
-------------------
So if you set the pattern lock to 0 -> 1 -> 2 -> 5 -> 4, the SHA1 hash will be output of SHA1("\x00\x01\x02\x05\x04"), and that is the hash to be cracked by this tool.
Where can I find the hash?
The hash is stored at "/data/system/gesture.key", and (From a rooted device) can be downloaded as follows:
~$ android-sdk-linux/platform-tools/adb pull /data/system/gesture.key
0 KB/s (20 bytes in 0.071s)
~$ ls -l gesture.key
-rw-r--r-- 1 sch3m4 sch3m4 20 ago 21 15:21 gesture.key
~$
How does this tool works?
Let's see a basic output:
~$ python crack.pattern.py
################################
# Android Pattern Lock Cracker #
# v0.1 #
# ---------------------------- #
# Written by Chema Garcia #
# http://safetybits.net #
# chema@safetybits.net #
# @sch3m4 #
################################
[i] Taken from: http://forensics.spreitzenbarth.de/2012/02/28/cracking-the-pattern-lock-on-android/
[+] Usage: crack.pattern.py /path/to/gesture.key
~$
And now the output with a given gesture.key:
~$ time python crack.pattern.py gesture.sample.key
################################
# Android Pattern Lock Cracker #
# v0.1 #
# ---------------------------- #
# Written by Chema Garcia #
# http://safetybits.net #
# chema@safetybits.net #
# @sch3m4 #
################################
[i] Taken from: http://forensics.spreitzenbarth.de/2012/02/28/cracking-the-pattern-lock-on-android/
[+] Checking length 3
[+] Checking length 4
[+] Checking length 5
[+] Checking length 6
[+] Checking length 7
[+] Checking length 8
[+] Checking length 9
[:D] The pattern has been FOUND!!! => 210345876
[+] Gesture:
----- ----- -----
| 3 | | 2 | | 1 |
----- ----- -----
----- ----- -----
| 4 | | 5 | | 6 |
----- ----- -----
----- ----- -----
| 9 | | 8 | | 7 |
----- ----- -----
real 0m17.982s
user 0m17.945s
sys 0m0.016s
~$
Research & Credits
The information above has been taken from http://forensics.spreitzenbarth.de/2012/02/28/cracking-the-pattern-lock-on-android/ (*) Cyanogenmod v10 allows to use higher dimension matrices (up to 6x6). Source from: https://github.com/CyanogenMod/android_frameworks_base/blob/jellybean/core/java/com/android/internal/widget/LockPatternView.java
There is nothing new
Of course this is not the first tool to crack the pattern lock, many Mobile Forensic Frameworks such as ADE deal with this task and much more, but this tool is mine ;-)