Cracking Android Lock Screens

SO as you can probably tell from the title, this will be a small tutorial on how to get the password for android devices, specifically if it has a gesture password (see image left of here) For this demonstration I was getting the password for my HTC sensation, using the latest version of Debian.

For this to work you need to be able to access the /data/system/gesture.key file on the target device, This is done either with ADB or through a JTAG hardware interface. For this demonstration I'll be using ADB.

This is for educational purposes only, you should only do this on your own devices or with the owners permission.

So lets get started. There are a few programs you will need if you don't have them already:

Firstly check that ADB is working, and that there is only 1 device. If you have more than one device then you will need to remember the device ID and modify the commands accordingly.

This command will pull down the gesture.key file onto your local system.

Now download the rainbow table of all the possible codes and correlating pins and unrar it

Finally just search the rainbow table for the hash (gesture.key)

Viola there is the key: 1845;00 07 03 04;05AD28E1C5B9E2813612D3B4CE38697DE29F1C01

Now that it's all set up, from now on you will only need 2 commands. Get gesture.key then search for it in the rainbow table:

Sidenote
If you want a prettier output like me then you can pipe the output of the grep command to cut giving you just the password as the output:

You can improve this further by making it a one-liner and formatting the output, leaving us with this:

I hope you've liked this article and learnt something. If so I would appreciate any likes, comments or shares.