The source code to BTCrack under the GPL v3 License, this was an exlusive release for Backtrack 3.0 at the time.

Authors : Eric Sesterhen & Thierry Zoller

UPDATE: 06.06.2012 - Version 1.01 released

This is a straight forward linux port of Thierry Zollers' BTCrack. Should work with most other unixes too, code is nearly ansi clean, except for strdup(), but I guess every OS should have this by now.

Compiling was tested so far with :
  • gcc version 4.1.1 (Gentoo 4.1.1-r3) on i686-pc-linux-gnu
  • gcc version 4.3.0-alpha20061216 on i586-pc-linux-gnu
  • gcc version 3.3.6 on i586-pc-linux-gnu
  • gcc version 3.4.6 on i586-pc-linux-gnu
  • gcc version 2.95.4 20011002 (Debian prerelease) on i686-pc-linux-gnu
  • gcc version 4.0.3 on sparc-sun-solaris2.8
  • icc Version 9.1 Build 20060706Z on i686-pc-linux-gnu
  • Sun WorkShop 6 update 2 C 5.3 Patch 111679-11 2003/04/02

Test it with the provided csv file: ./btcrack 1 00:11:9F:C4:F3:AE 00:60:57:1A:6B:F1 ./Pin_654321.csv


Carl said... @ 16 July, 2009 13:07

Hi there,

Thanks a lot for providing this code.

Just wanted to let you know about 2 issues I found.

1) line 460 of btcrakc.c : "GetSRES(bp->kab, bp->au_rand_s, bp->bdaddr_m, bp->calc_sres_m, bp->calc_aco_m);"
It shall be "bp->calc_aco_s" instead of "bp->calc_aco_m". With your version the master ACO is overwritten by the one of the slave.
This is not imparing the finding of the PIN or link key, but if master ACO has to be reused for some reason, one will get the wrong one when refering to calc_aco_m

2) line 446: It is not correct to always us bp->bdaddr_s for the in_bdaddr parameter of KeyInit. Indeed it depends whether the slave or the master actually sent the IN_RAND. If it's the master then bdaddr_s has to be used, but if it's the slave then bdaddr_m has to be used.

Thierry Zoller said... @ 16 July, 2009 16:10

Dear Carl,
Very interesting, would you be able to offer a direct patch to the code ?

Post a Comment