A little Brute Force engine for B+

A little brute force engine for BlitzPlus. Unfortunately B+ can't handle numbers bigger than ~2 000 000 000 so there may not be that many candidate possibilities either.
This example searches for up to 5 lettered candidates with symbols "abcdefghijklmnopqrstuvwõäöüxyABCDEFGHIJKLMNOPQRSTUVWÕÄÖÜXY0123456789" in it. My 1.6GHz processor tries about 60 000 - 100 000 candidates per second

Example:

result$ = "hElLo"

; from 1 to 5 letters
For l% = 1 To 5
	brute% = StartBruteforce%(l%, "abcdefghijklmnopqrstuvwõäöüxyABCDEFGHIJKLMNOPQRSTUVWÕÄÖÜXY0123456789")
	total# = BruteforceTotal(brute%)
	Notify "Starting bruteforce with " + Int(total#) + " canditates!"

	; trie all possible candidates with l% symbols in it
	For i = 1 To total#
		BruteforceNext%(brute%)
		value$ = BruteforceCurrentValue$(brute%)
		If value$ = result$ Then RuntimeError "FOUND -> " + value$
	Next
Next

Engine:

Function StartBruteforce%(count%, letters$ = "")
	Local brute% = CreateBank(2 + 4 + Len(letters$))
	
	PokeShort(brute%, 0, count%)
	PokeInt(brute%, 2, 0)
	For i% = 1 To Len(letters$)
		PokeByte(brute%, 6 + i% - 1, Asc(Mid$(letters$, i%, 1)))
	Next
	
	Return brute%
End Function

Function BruteforceNext%(brute%)
	PokeInt(brute%, 2, PeekInt(brute%, 2) + 1)
End Function

Function BruteforceCurrentIndex%(brute%)
	Return PeekInt(brute%, 2)
End Function

Function BruteforceCurrentValue$(brute%)
	Local txt$ = ""
	Local length# = PeekShort(brute%, 0)
	Local value# = PeekInt(brute%, 2)
	Local letters# = BankSize(brute%) - 6
	
	For i# = length# To 1 Step -1
		txt$ = txt$ + Chr( PeekByte(brute%, 6 + (Floor((value# - 1) / letters#^(i# - 1)) Mod letters#)  ))
	Next
	
	Return txt$
End Function

Function BruteforceTotal(brute%)
	Return (BankSize(brute%) - 6)^PeekShort(brute%, 0)
End Function

Call me stupid, but what is a brute force engine?

Its for cracking passwords. Stuff like this doesn't belong here, imho.

dont be so rude, GfK. it is kind of a hacking tool, but it is propaply good for learning, too. and if you have choosen a good password for your forums, this one will fail.

I'm not being rude, I'm having an opinion, just like you are.

I'll rewrite it in BlitzMAX so it will be able to try even longer and more complex candidates.
I couldn't come on a better forum than this, it's blitz and i wanted to show it, so Blitz Showcase on my opinion :) Maybe Code archive's "Algorithms", but there i wouldn't have much feedback.

I always welcome open source code much like this and someone recently released a back door program stigma which is open source I think its good for learning purposes. I am an administrator for an ISP seeing the source to programs like this helps me better understand attacks and things people might try.

Love what you have so far Andres

Here's BlitzMAX version of the engine. Much faster and supports longer candidates and stuff:

29 different symbols and 6 lettered candidate takes longer than an hour :(

Example output:

Starting candidates with 1 letters and 29 possibilities...
Ended with 0 seconds (1.#INF0000/s)
Starting candidates with 2 letters and 841 possibilities...
Ended with 0 seconds (841000.000/s)
Starting candidates with 3 letters and 24389 possibilities...
Ended with 0 seconds (393370.969/s)
Starting candidates with 4 letters and 707281 possibilities...
Ended with 3 seconds (180936.563/s)
Starting candidates with 5 letters and 20511149 possibilities...
Ended with 141 seconds (144744.391/s)
Starting candidates with 6 letters and 594823321 possibilities...
FOUND! -> andres

Example:

SuperStrict

Global result:String = "andres"

For Local l:Int = 1 To 10
	Local brute:TBrute = StartBruteforce(l, "abcdefghijklmnopqrstuvwõäöüxy")
	Local total:Long = BruteforceTotal(brute)

	Print "Starting candidates with " + l + " letters and " + total + " possibilities..."
	Local tim:Long = MilliSecs()
	For Local i:Int = 1 To total
		BruteforceNext(brute)
		Local value:String = BruteforceCurrentValue(brute)
		If value = result Then
			Print "FOUND! -> " + value
			End
		EndIf
	Next
	EndBruteforce(brute)
	Print "Ended with " + Int(Float (MilliSecs() - tim) / 1000) + " seconds (" + (total / (Float (MilliSecs() - tim) / 1000)) + "/s)"
Next

Engine:

Type TBrute
	Field length:Long
	Field index:Long
	Field symbols:TBank
End Type

Function StartBruteforce:TBrute(length:Int, symbols:String)
	Local brute:TBrute = New TBrute
		brute.length = length
		brute.index = 0
		brute.symbols = CreateBank(Len(symbols))
		
	For Local i:Int = 1 To Len(symbols)
		PokeByte(brute.symbols, i - 1, Asc(Mid$(symbols, i, 1)))
	Next
	
	Return brute
End Function

Function BruteforceNext:Long(brute:TBrute)
	brute.index :+ 1
	Return brute.index
End Function

Function BruteforceCurrentIndex:Long(brute:TBrute)
	Return brute.index
End Function

Function BruteforceCurrentValue:String(brute:TBrute)
	Local result:String = ""
	Local letters:Long = BankSize(brute.symbols)
	
	For Local i:Int = brute.length To 1 Step -1
		result :+ Chr(PeekByte(brute.symbols, Floor((brute.index - 1) / letters^(i - 1)) Mod letters))
	Next
	
	Return result
End Function

Function BruteforceTotal:Long(brute:TBrute)
	Return BankSize(brute.symbols)^brute.length
End Function

Function EndBruteforce:Int(brute:TBrute)
	brute = Null
	Return True
End Function

I agree it's more of a learning thing, because even crappy web hosts should be able to realise that "594823321 possibilities..."
594823321 connection attempts within a small period (which is impossible, probobly even for LAN) is a hack attempt. And most professional login systems log so many failed attempts and warn the administrator of this.

Keyloggers are more of something to worry about these days.

Nice code Andres, fun to mess around with.

I'm thinking more on zip/rar archive password "recovering" or something like that :)

its pretty useless as long as it can't hook into something...
also, as you don't know the length of a password there is no point in not making it start from 1 till max in length.

It can hook into anything which runs from the command line, which would certainly include zip and rar programs.


Apart from the fact that it would run for one hell of a long time and make people think it had crashed. If you had a specific purpose in mind, I imagine it wouldn't be too much trouble to change that.