FCRACKZIP(1)

FCRACKZIP — the Free/Fast Zip Password Cracker 💅

okay bestie, sit DOWN, because we're about to talk about fcrackzip, a whole entire manual page from the General Commands Manual section, and it's giving iconic chaotic hacker energy. It's the Free/Fast Zip Password Cracker, and it's literally here to guess your zip passwords. no cap. 🔥

---

✨ NAME ✨

fcrackzip — a Free/Fast Zip Password Cracker. that's the whole vibe. that's the name. 🎀

---

🌸 SYNOPSIS 🌸

fcrackzip [-bDBchVvplum2] [--brute-force] [--dictionary] [--benchmark]
[--charset characterset] [--help] [--validate] [--verbose]
[--init-password string/path] [--length min-max] [--use-unzip] [--method
name] [--modulo r/m] file...

look at all those little flags. it's giving alphabet soup but make it threatening. 🍓

---

🦋 DESCRIPTION 🦋

so here's the tea, bestie: fcrackzip goes through every zipfile you hand it, hunts down the encrypted files inside, and tries to guess the password. main character behaviour, honestly.

important though — all the files have to be encrypted with the same password. and the more files you give it, the better it works. so like, don't be stingy, give it the whole collection. 💖

---

🎀 OPTIONS 🎀

okay this is the part where we go through every single one, no skipping, we're not cowards:

• -h, --help — prints the version number plus (hopefully 🙈) some genuinely helpful insights. it's trying its best and we respect it.
• -v, --verbose — every single -v you add makes the program more verbose. stack them like accessories. ✨
• -b, --brute-force — picks brute force mode. it literally tries all possible combinations of the letters you specify. every. single. one.
• -D, --dictionary — picks dictionary mode. here fcrackzip reads passwords from a file, which must have one password per line, and should be alphabetically sorted (like, use sort(1), bestie, it's right there).
• -c, --charset characterset-specification — picks which characters get used in brute-force cracking. it has to be one of these:
  • a — include all lowercase characters [a-z]
  • A — include all uppercase characters [A-Z]
  • 1 — include the digits [0-9]
  • ! — include [:$%&/()=?{[]}+*~#]
  • : — the following characters up to the end of the specification string are included in the character set. This way you can include any character except binary null (at least under unix).

for example, a1:$% selects lowercase characters, digits and the dollar and percent signs. cute, right? 💅

• -p, --init-password string — sets the initial (starting) password for brute-force searching to string, or uses the file named string to supply passwords for dictionary searching.
• -l, --length min[-max] — starts with an initial password of length min, then checks all passwords up to length max (inclusive, bestie). you can totally omit the max parameter if you want.
• -u, --use-unzip — tries to decompress the first file by calling unzip with the guessed password. this weeds out false positives when you haven't given it enough files. very "second opinion" of it. 🫶
• -m, --method name — uses method number name instead of the default cracking method. the --help switch will print a list of available methods. use --benchmark to see which method performs best on your machine. the name can also just be the number of the method to use.
• -2, --modulo r/m — calculates only r/m of the password. not yet supported. 🫠
• -B, --benchmark — makes a small benchmark. the output is nearly meaningless. iconic honesty, honestly. 💀
• -V, --validate — makes some basic checks to see whether the cracker actually works. vibe check, basically. 🌈

---

💜 ZIP PASSWORD BASICS 💜

have you ever mis-typed a password for unzip? and unzip came back immediately with ´incorrect password´, without decrypting the whole file? yeah. that's not magic, bestie, that's a hook. 😭

so the encryption algorithm zip uses is relatively secure, but PK made cracking easy by providing hooks for very fast password-checking, directly inside the zip file. understanding these is crucial to zip password cracking. let's break it down:

• for every password that gets tried, the first twelve bytes of the file are decrypted.
• depending on the version of zip used to encrypt the file (more on that later), the first ten or eleven bytes are random, followed by one or two bytes whose values are stored elsewhere in the zip file — i.e. they're known beforehand.
• if those last bytes don't have the correct (known) value, the password is definitely wrong.
• if the bytes are correct, the password might be correct — but the only method to find out is to unzip the file and compare the uncompressed length and crc´s.

earlier versions of pkzip (1.xx) — and, incidentally, many zip clones for other operating systems! — stored two known bytes. so the error rate was roughly 1/2^16 = 0.01%. then PKWARE ´improved´ (interesting what industry calls improved 👀) the security of their format by only including one byte, so the possibility of false passwords is now raised to 0.4%. unfortunately, there is no real way to distinguish one byte from two byte formats, so we have to be conservative. periodt.

---

🔥 BRUTE FORCE MODE 🔥

by default, brute force starts at the given starting password, and successively tries all combinations until they are exhausted, printing all passwords that it detects, together with a rough correctness indicator.

the starting password given by the -p switch determines the length. fcrackzip will not currently increase the password length automatically, unless the -l switch is used. so like, use -l, bestie. 🙈

---

🌟 DICTIONARY MODE 🌟

this mode is similar to brute force mode, but instead of generating passwords using a given set of characters and a length, the passwords will be read from a file that you have to specify using the -p switch. it's giving "we have a list, let's use the list". 📋

---

🧚 CP MASK 🧚

a CP mask is a method to obscure images or parts of images using a password. these obscured images can be restored even when saved as JPEG files. in most of these files the password is actually hidden and can be decoded easily (using one of the many available viewer and masking programs, e.g. xv). if you convert the image, the password, however, is lost. 💀

the cpmask crack method can be used to brute-force these images. instead of a zip file you supply the obscured part (and nothing else) of the image in the PPM-Image Format (xv and other viewers can easily do this).

⚠️ the cpmask method can only cope with passwords composed of uppercase letters, so be sure to supply the --charset A or equivalent option, together with a suitable initialization password.

---

🌈 EXAMPLES 🌈

• fcrackzip -c a -p aaaaaa sample.zip — checks the encrypted files in sample.zip for all lowercase 6 character passwords (aaaaaa ... abaaba ... ghfgrg ... zzzzzz).
• fcrackzip --method cpmask --charset A --init AAAA test.ppm — checks the obscured image test.ppm for all four character passwords.
• fcrackzip -D -p passwords.txt sample.zip — check for every password listed in the file passwords.txt.

---

👑 PERFORMANCE 👑

fzc, which seems to be widely used as a fast password cracker, claims to make 204570 checks per second on my machine (measured under plain dos w/o memory manager).

fcrackzip, being written in C and not in assembler, naturally is slower. measured on a slightly loaded unix (same machine), it´s 12 percent slower (the compiler used was pgcc, from http://www.gcc.ml.org/).

to remedy this a bit, I converted small parts of the encryption core to x86 assembler (it will still compile on non x86 machines), and now it´s about 4-12 percent faster than fzc (again, the fcrackzip performance was measured under a multitasking os, so there are inevitably some meaurement errors), so there shouldn't be a tempting reason to switch to other programs. slay. 💅

further improvements are definitely possible: fzc took 4 years to get into shape, while fcrackzip was hacked together in under 10 hours. and not to forget — you have the source, while other programs (like fzc), even come as an encrypted .exe file (maybe because their programmers are afraid of other people could having a look at their lack of programming skills? nobody knows...). not me calling them out 😭

---

⭐ RATIONALE ⭐

the reason I wrote fcrackzip was NOT to have the fastest zip cracker available, but to provide a portable, free (thus extensible), but still fast zip password cracker.

I was really pissed of with that dumb, nonextendable zipcrackers that were either slow, were too limited, or wouldn't run in the background (say, under unix). (and you can't run them on your superfast 600Mhz Alpha). so yeah. that's the origin story. 🦋

---

💀 BUGS 💀

listen. we're being honest here:

• No automatic unzip checking.
• Stop/resume facility is missing.
• Should be able to distinguish between files with 16 bit stored CRC´s and 8 bit stored CRC´s.
• The benchmark does not work on all systems.
• It's still early alpha.
• Method "cpmask" only accepts ppms.
• Could be faster.

it's giving early alpha and self-aware. we love a program that knows its flaws. 🙈

---

💖 AUTHOR 💖

fcrackzip was written by Marc Lehmann <pcg@goof.com>. the main fcrackzip page is at http://www.goof.com/pcg/marc/fcrackzip.html)

---

and that's the whole page, bestie — brought to you by the Free/Fast Zip Password Cracker source, straight out of the FCRACKZIP(1) manual. go forth, crack responsibly, and remember: every flag matters, no skipping. mwah. 💅✨🎀