Next, we guess the possible charset ordering like these: The missing of 1, I, l, 0, O, o, N, n seems to make sense because they are confusing characters. We collected all leaked installation passwords, such as hacking team’s password, which is leaked by WikiLeaks.įrom the collected passwords we can summarize the charset:Ģ3456789ABCDEFGHJKLMPQRSTUVWXYZabcdefghijkmpqrstuvwxyz We first tried to find the charset used by random number generator. There are at least 88 random number generators known. But the situation is different if we can grasp the methodology of password generation, which lets us enumerate the password more effectively!Īlthough we have realized we need to find how Hex-Rays generate password, it is still really difficult, as we do not know what language the random number generator is implemented with. Therefore, we cannot get the password simply with static or dynamic analyzing the installer, and brute force is apparently not an effective way. It gets harder on Windows version because the installer is built with Inno Setup, which store its password with 160-bit SHA-1 hash. BitRock released InstallBuilder 19.2.0 with the protection of installation password on 1. This problem is fixed after we reported through Hex-Rays. We found the plaintext installation password directly in the program memory of the running IDA Pro installer. The installer is built with an installer creation tool called InstallBuilder.

The first challenge is Linux and MacOS version. The following is the detailed process: * Linux and MacOS version With a Windows version installer, we only need 10 minutes to calculate the password.

However, if someday we find a leaked IDA Pro installer, is it still possible to install without an installation password? This is an interesting topic.Īfter brainstorming with our team members, we verified the answer: Yes! With a Linux or MacOS version installer, we can easily find the password directly.

The installation password is required during installation process. What is installation password? Generally, customers receive a custom installer and installation password after they purchase IDA Pro. Today, we are going to talk about the installation password of Hex-Rays IDA Pro, which is the most famous decompiler.

Ida pro hex rays decompiler