How To Bypass Smartphone Lock Screen

Bypass lock screen of iPhone and Samsung Smartphones bypass vulnerabilities. Which has founded by security researchers.

Bypass iOS7 Lock Screen Samsung Galaxy Note2 and S3 Samsung Galaxy Note2 Security specialist Terence Eden explained in his blog that unauthorized users can press the “emergency call” and the “in case of an emergency” (ICE) contact list buttons and hold down the home button at the same time to cause the device’s home screen to pop up. From there a user can touch an app and gain access to it. Steps: Lock the device with a "secure" pattern, PIN, or password. Activate the screen. Press "Emergency Call". Press the "ICE" button on the bottom left. Hold down the physical home key for a few seconds and then release. The phone's home screen will be displayed - briefly. While the home screen is displayed, click on an app or a widget. The app or widget will launch. If the widget is "direct dial" the phone will start ringing. How to bypass the Lock screen Samsung Galaxy S3 The bug was discovered by Sean McMillan Steps: 1) On the code entry screen press Emergency Call 2) Then press Emergency Contacts 3) Press the Home button once 4) Just after pressing the Home button press the power button quickly 5) If successful, pressing the power button again will bring you to the S3's home screen McMillan said that it can "take quite a few attempts to get this working, sometimes this method works straight away, other times it can take more than 20 attempts."

Find My iPhone iCloud Lock BYPASS Activation Lock Bypass Apple iOS 6.1.2 This vulnerability was founded by Vulnerability Lab researcher. This vulnerability allows users to bypass the lock screen pass code and access the phones photos and contacts. Researchers say the vulnerable device can be plugged into a computer via USB and access data like voice mails, pictures, contacts, etc.  Steps: Connect your device with itunes and the appstore to make sure the code lock is activated. Push the power button (top|right) The mobile will be activated and the iOS code lock will be visible Now, you click on the emergency call Try to dail any random emergency call number from a public listing (we used 911, 110 and 112) Call the number and cancel the call directly after the dail without a direct connection to the number Push again the power button and push after it the iphone button (square) in the middle In the next step you push the power button 3 secounds and in the third secound you push also with one finger the square and with another the emergency call button After pushing all 3 buttons you turn your finger of the square (middle) button and after it of the power button The display of the iOS will be black (blackscreen) Take our your usb plug and connect it with the iOS device in black screen mode All files like photos, contacts and co. will be available directly from the device harddrive without the pin to access. Bypass Smartphone Lock Screen Through Viber App: First send viber message to victim Victim get viber message popups do some action on it. Then send another message to victim mobile. Victim mobile again get popup. Press back button of victim mobile. Now you get a full access of victim phone.

MAKING A KEYGEN.

Tutorial on making of  Key Generators

Tools!

For tools you need a minimum of debugger like SoftIce for Windows (hence WinIce), and a C compiler with Dos libraries.

Content!

In this tutorial I will show how to make a key-gen for Ize and Swiftsearch. The protection that these programs use is the well known Enter-Name-and-Registration-Number method. After selecting ‘register’, a window pops up where you can enter your name and your registration number. The strategy here is to find out where in memory the data you enter is stored and then to find out what is done with it.

Part 1: Scanline Swiftsearch 2.0!

Swiftsearch is a useful little program that you can use to search on the web. I will explain step by step how to crack it.

step 1. Start the program :)

step 2: Choose register from the menus. You will now get a window where you can enter your name and your registration number.

step 3: Enter SoftIce (ctrl-d)

step 4: We will now set a breakpoint on functions like GetWindowText(a) and GetDlgItemText(a) to find out where in memory the data that we just entered is stored. The function that is used by this program is GetDlgItemTexta (trial and error, just try yourself :) so, in SoftIce type BPX GetDlgItemTexta and exit SoftIce with the g command.

step 5: Now type a name and a registration number (I used PANKAJMISHRA and 12345) and press OK, this will put you back in SoftIce. Since you are now inside the GetDlgItemTexta function press F11 to get out of it. You should see the following code:

lea eax, [ebp-2C] :<— we are looking for this location

push eax

push 00000404

push [ebp+08]

call [USER32!GetDlgItemTextA]

mov edi, eax :<— eax has the length of the string

and is stored in edi for later usage.

We see that EAX is loaded with a memory address and then pushed to the stack as a parameter for the function GetDlgItemTextA. Since the function GetDlgItemTextA is already been run we can look at EBP-2c (with ED EDP-2c) and see that the name we entered is there. Now we know where the name is stored in memory, normally it would be wise to write that address down, but we will see that in this case it wont be necessary.

So, what next? Now we have to allow the program to read the registration number we entered. Just type g and return and when back in SoftIce press F11. You should see the following code:

push 0000000B

lea ecx, [ebp-18] : <–So, ebp-18 is where the reg. number

push ecx : is stored.

push 0000042A

push [ebp+08]

call [USER32!GetDlgItemTextA]

mov ebx, eax : <–save the lenght of string in EBX

test edi, edi : <–remember EDI had the lenght of the

jne 00402FBF : name we entered?

We see that the registration number is stored at location EBP-18 , check it with ED EBP-18. Again, normally it would be wise to note that address down. Also we see that it is checked if the length of the name we gave was not zero. If it is not zero the program will continue.

Step 6: Ok, now we know where the data we entered is stored in memory. What next?

Now we have to find out what is DONE with it. Usually it would we wise to put breakpoints on those memory locations and find out where in the program they are read. But in this case the answer is just a few F10’s away. Press F10 until you see the following code :

cmp ebx, 0000000A :<–remember EPX had the length of the

je 00402FDE : registration code we entered?

These two lines are important. They check if the length of the registration code we entered is equal to 10. If not the registration number will be considered wrong already. The program wont even bother to check it. Modify EBX or the FLAG register in the register window to allow the jump. Continue Pressing F10 until you get to the following code (note that the adresses you will see could be different) :

:00402FDE xor esi, esi :<– Clear ESI

:00402FE0 xor eax, eax :<– Clear EAX

:00402FE2 test edi, edi

:00402FE4 jle 00402FF2

:00402FE6 movsx byte ptr ecx, [ebp + eax – 2C] :<– ECX is loaded with a letter of the name we entered.

:00402FEB add esi, ecx :<– Add the letter to ESI

:00402FED inc eax :<– Increment EAX to get next letter

:00402FEE cmp eax, edi :<– Did we reach the end of the string?

:00402FF0 jl 00402FE6 :<– If not, go get the next letter.

Well, we see that the program adds together all the letters of the name we entered. Knowing that ESI contains the sum of the letters, lets continue and find out what the program does with that value :

:00402FF2 push 0000000A

:00402FF4 lea eax, [ebp-18] :<– Load EAX with the address of the reg. number we entered

:00402FF7 push 00000000

:00402FF9 push eax :<– Push EAX (as a parameter for the following function)

:00402FFA call 00403870 :<– Well, what do you think this function does? :)

:00402FFF add esp, 0000000C

:00403002 cmp eax, esi :<– Hey!

:00403004 je 00403020

We see that a function is called and when RETurned ESI is compared with EAX. Hmm, lets look at what’s in EAX. A ‘? EAX’ reveals :

00003039 0000012345 “09”

Bingo. That’s what we entered as the registration number. It should have been what’s inside

ESI. And we know what’s inside ESI, the sum of the letters of the name we entered!

Step 7: Now we know how the program computes the registration code we can make a key-gen.

But we should not forget that the program checks also that the registration number has 10

digits.

A simple C code that will compute the registration number for this program could look like this:

#include <stdio.h>

#include <string.h>

main()

{

char Name[100];

int NameLength,Offset;

long int Reg = 0, Dummy2 = 10;

int Dummy = 0;

int LengtDummy = 1;

int Lengt , Teller;

printf(“Scanline SwiftSearch 2.0 crack by PANKAJMISHRA.\n”);

printf(“Enter your name: “);

gets(Name);

NameLength=strlen(Name);

/* the for lus calculates the sum of the letters in Name */

/* and places that value in Reg */

for (Offset=0;Offset<NameLength;Offset=Offset+1)

{

Reg=Reg+Name[Offset];

}

/* the while lus calculates the lenght of the figure in */

/* Reg and places it in Lengt */

while (Dummy != 1)

{

if ( Reg < Dummy2 )

{ Lengt = LengtDummy ; Dummy =1;

}

else

{ LengtDummy=LengtDummy + 1; Dummy2=Dummy2*10;

}

};

printf(“\nYour registration number is : ” );

/* First print 10-Lengt times a 0 */

Lengt=10-Lengt;

for (Teller=1;Teller<=Lengt;Teller=Teller+1) printf(“0”);

/* Then print the registration number */

printf(“%lu\n”,Reg);

}

Case 2 Ize 2.04 from Gadgetware

Ize from Gadgetware is a cute little program that will put a pair of eyes on your screen which will

follow your mousepointer. It has a register function where you can enter your name and a registration

number. The strategy in this case is still the same : Find out where in memory the entered information

is stored and then find out what is done with that information.

Step 1: Start Ize. Chose register and enter a name and a number. I used ‘PANKAJMISHRA’ and ‘12345’.

Sterp 2: Enter (CTRL-D) Softice and set a breakpoint on GetDlgItemTextA.

Step 3: Leave SoftIce and press OK. This will put you back in Softice. You will be inside the GetDlgItemTextA

function. To get out of it press F11. You should see the following code :

mov esi, [esp + 0C]

push 00000064

push 0040C3A0 :<–On this memory location the NAME we entered will be stored.

mov edi, [USER32!GetDlgItemTextA] :<–Load edi with adress of GetDlgItemTextA

push 00004EE9

push esi

call edi :<– Call GetDlgItemTextA

push 00000064 :<– (you should be here now)

push 0040C210 :<–On this memory location the NUMBER we entered will be stored

push 00004EEA

push esi

call edi :<– Call GetDlgItemTextA

We see that the function GetDlgItemTextA is called twice in this code fragment. The first call has

already happened. With ED 40C3A0 we can check that the name we entered is stored on that location.

To allow the program to read in the number we entered we type G and enter. Now we are inside the Get-

DlgItemTextA function again and we press f11 to get out of it. We check memory location 40C210 and

we see the number we entered is stored there.

Now we know the locations were the name and the number are stored,we note those down!

Step 4: Ok, what next? We now know where in memory the name and the number are stored. We need to find out

what the program does with those values. In order to do that we could set breakpoints on those memory

locations to see where they are read. But in this case it wont be necessary. The answer is right after the

above code :

push 0040C210 :<–save the location of the number we entered (as a parameter for the next call)

call 00404490 :<– call this unknown function

add esp, 00000004

mov edi, eax :<– save EAX (hmmmm)

We see a function being called with the number-location as a parameter. We could trace into the function and see what it does, but that is not needed. With your experience of the Swiftsearch

example you should be able to guess what this function does. It calculates the numerical value of the registration number and puts it in EAX. To be sure we step further using F10 untill we are past the call and check the contents of EAX (with ? EAX). In my case it showed : 00003039 0000012345 “09”.

Knowing that EDI contains our registration number we proceed:

push 0040C3A0 :<– save the location of the name we entered (as a parameter for the next call)

push 00409080 :<– save an unknown memory-location (as a parameter for the next call)

call 004043B0 :<–call to an unknown function

add esp, 00000008

cmp edi, eax :<–compare EDI (reg # we entered) with EAX (unknown, since the previous call changed it)

jne 004018A1 :<–jump if not equal

We see that a function is called with two parameters. One of the parameters is the location of the name

we entered. The other we dont know, but we can find out with ED 409080. We see the text ‘Ize’.

This function calculates the right registration number using those two parameters. If you just want to

crack this program, you can place a breakpoint right after the call and check the contents of EAX. It will

contain the right registration number. But since we want to know HOW the reg. # is calculated we will trace inside the function (using T). We will then try to find out HOW the contents of EAX got in there.

Step 5: Once inside the interesting function you will see that we are dealing with a rather long function. It wont be necessary for me to include the complete listing of this function, because we wont need all of it to make our key-gen.

But in order find out which part of the code is essential for the computation of the right registration number, you have to trace STEP by STEP and figure out what EXACTLY is going on!

Afther doing this i found out that the first part of the function computes some kind of “key”. Then this

“key” is stored in memory and in that way passed on to the second part of the function.

The second part of the function then computes the right registration number, based on this “key” AND

the name we entered.

The code that is essential and that we need for our key-gen is the following:

( Note that before the following code starts, the registers that are used will have the following values:

EBX will point to the first letter of the name we entered,

EDX will be zero,

EBP will be zero,

The “key” that we talked about earlier is stored in memory location 0040B828 and will

have 0xA4CC as its initial value. )

:00404425 movsx byte ptr edi, [ebx + edx] :<– Put first letter of the name in EDI

:00404429 lea esi, [edx+01] :<– ESI gets the “letter-number”

:0040442C call 00404470 :<– Call function

:00404431 imul edi, eax :<– EDI=EDI*EAX (eax is the return value of the the previous call)

:00404434 call 00404470 :<– Call function

:00404439 mov edx, esi

:0040443B mov ecx, FFFFFFFF

:00404440 imul edi, eax :<– EDI=EDI*EAX (eax is the return value of the previous call)

:00404443 imul edi, esi :<– EDI=EDI*ESI ( esi is the number of the letter position)

:00404446 add ebp, edi :<– EBP=EBP+EDI (beware that EBP will finally contain the right reg#)

:00404448 mov edi, ebx :<–these lines compute the lenght of the name we entered

:0040444A sub eax, eax :<–these lines compute the lenght of the name we entered

:0040444C repnz :<–these lines compute the lenght of the name we entered

:0040444D scasb :<–these lines compute the lenght of the name we entered

:0040444E not ecx :<–these lines compute the lenght of the name we entered

:00404450 dec ecx :<– ECX now contains the lenght of the name

:00404451 cmp ecx, esi

:00404453 ja 00404425 :<– If its not the end of the name , go do the same with the next letter

:00404455 mov eax, ebp :<– SAVE EBP TO EAX !!!!

:00404457 pop ebp

:00404458 pop edi

:00404459 pop esi

:0040445A pop ebx

:0040445B ret

_____

:00404470 mov eax, [0040B828] :<– Put “key” in EAX

:00404475 mul eax, eax, 015A4E35 :<– EAX=EAX * 15A4E35

:0040447B inc eax :<– EAX=EAX + 1

:0040447C mov [0040B828], eax :<– Replace the “key” with the new value of EAX

:00404481 and eax, 7FFF0000 :<– EAX=EAX && 7FFF0000

:00404486 shr eax, 10 :<– EAX=EAX >>10

:00404489 ret

The above code consists of a loop that goes trough all the letters of the name we entered. With each

letter some value is calculated, all these values are added up together (in EBP). Then this value is stored

in EAX and the function RETurns. And that was what we were looking for, we wanted to know how EAX got its value!

Step 6: Now to make a key-gen we have to translate the above method of calculating the right reg# into a

c program. It could be done in the following way :

(Note : I am a bad c programmer :)

#include <stdio.h>

#include <string.h>

main()

{

char Name[100];

int NameLength,Offset;

unsigned long Letter,DummyA;

unsigned long Key = 0xa4cc;

unsigned long Number = 0;

printf(“Ize 2.04 crack by PANKAJMISHRA\n”);

printf(“Enter your name: “);

gets(Name);

NameLength=strlen(Name);

for (Offset=0;Offset<NameLength;Offset=Offset+1)

{

Letter=Name[Offset];

DummyA=Key;

DummyA=DummyA*0x15a4e35;

DummyA=DummyA+1;

Key=DummyA;

DummyA=DummyA & 0x7fff0000;

DummyA=DummyA >> 0x10;

Letter=Letter*DummyA;

DummyA=Key;

DummyA=DummyA*0x15a4e35;

DummyA=DummyA+1;

Key=DummyA;

DummyA=DummyA & 0x7fff0000;

DummyA=DummyA >> 0x10;

Letter=Letter*DummyA;

Letter=Letter*(Offset+1);

Number=Number+Letter;

}

printf(“\nYour registration number is : %lu\n”,Number);

}

Final



WINDOWS PASSWORD HACK(XP, VISTA, WINDOWS7) MULTIPLE WAYS.

METHOD 1:-(EASIEST ONE) FOR XP ONLY.

OPEN WINDOWS IN SAFE MODE.(ADMINISTRATOR ACC.)

OPEN RUN-TYPE EXACTLY “CONTROL USERPASSWORDS2” WITHOUT BRACKETS

AND THEN CLICK ON ADMINISTRATOR AND CHANGE PASSWORD.

OR EVEN YOU CAN REMOVE PASSWORD BY CLICKING ON REMOVE “PASSWORD OPTION”

IT WILL NOT ASK FOR THE OLD PASSWORD.

ENJY!!!

METHOD 2:-FOR XP ONLY.

IF YOU HAVE AN ADMINISTRATOR ACCOUNT (NOT GUEST)

THEN THE XP USERS’ PASSWORDS CAN BE RESET USING COMMAND PROMPT.

GO TO THE TASK-BAR AND CLICK ON THE START BUTTON, THEN CLICK ON RUN AND IN THE PLACE GIVEN ON DIALOG BOX TYPE “COMMAND”, PRESS ENTER.

NOW IN THE COMMAND PROMPT TYPE “NET USER”

THE SCREEN WILL DISPLAY THE LIST OF USERS AVAILABLE ON MACHINE

SUPPOSE THERE ARE THREE ADMINISTRATOR USERS WITH THE NAME OF ADMIN1, ADMIN2 AND ADMIN3

THEN THE PASSWORD OF ANY USER CAN BE CHANGED BY LOGGING INTO THE ACCOUNT OF ANY ONE ADMINISTRATOR

FOR EXAMPLE IF WE WANT TO CHANGE THE PASSWORD OF ADMIN1

THEN WE CAN CHANGE IT FROM THE FOLLOWING COMMAND

NET USER ADMIN1 PASSWORD

THE GENERAL SYNTAX IS FOR CHANGING PASSWORD IS

NET USER <USER-NAME> <PASSWORD>

LIMITATIONS: THE ABOVE METHOD WILL ONLY WORK IF YOU ARE LOGGED IN AS THE ADMINISTRATOR USER.

METHOD 3:-FOR XP ONLY.

WINDOWS RECOVERY OPTION,

BOOT FROM THE WINDOWS XP CD AND PRESS ENTER WHEN YOU ARE PROMPTED TO INSTALL WINDOWS COPY, ON THE NEXT SCREEN THERE IS A REPAIR EXISTING WINDOWS VERSION. THIS METHOD IS ALSO KNOWN AS WINDOWS RECOVERY METHOD,

THE REPAIR OPTION WILL TAKE AS MUCH TIME AS THE INSTALLATION WOULD HAVE TAKEN BECAUSE THE WINDOWS FILE-SYSTEM IS REPLACED INCLUDING THE SAM FILE WHERE THE PASSWORD IS STORED.

C:\WINDOWS\SYSTEM32\CONFIG\SAM

WHEREAS THE USERS’ SETTING REMAIN UNTOUCHED.

THUS THE USERS’ PASSWORD IS RESET TO NULL VALUE.

METHOD 4:-FOR XP ONLY.

BOOT THE COMP IN SAFE MODE.

DISABLE PASSWORD.

METHOD 5:-FOR (XP, VISTA, WINDOWS7).

BOOT YOUR COMPUTER FROM A LIVE LINUX CD OR DVD WHICH HAS AN NTFS/HPFS FILE-SYSTEM SUPPORT.

THEN MOUNT THE DRIVE WHICH HAS WINDOWS COPY INSTALLED ON IT. COPY THE SAM FILE ON THE LOCATION

C:\WINDOWS\SYSTEM32\CONFIG\SAM

WHICH WILL BE MENTIONED AS /MEDIA/DISK-1/WINDOWS/SYSTEM32/CONFIG/SAM

IT IS A COMMON MISCONCEPTION THAT SAM FILE CAN BE VIEWED THROUGH NORMAL TEXT EDITOR, SAM FILE ISNT A NORMAL TEXT FILE.

GNOME, KDE OR VIM TEXT EDITORS WON’T DISPLAY THE CONTENT OF THIS FILE

OPEN THE FILE USING EMACS EDITOR (AVAILABLE IN NEARLY ALL THE DISTRIBUTIONS OF LIVE LINUX). IT WILL BE HARD TO FIND THE THE PASSWORD HASHES, SO GO FOR THE USER-NAMES WHICH ARE NOT ENCRYPTED, JUST AFTER THE USER-NAMES PASSWORDS’ HASHES CAN BE FOUND OUT, COPY THE CODE BETWEEN “%” SIGN AND ON THE THE GOOGLE SEARCH FOR THE RAINBOW TABLES, THEY WILL PROVIDE THE DECRYPTED VALUE WHICH HAVE ALREADY BEEN BRUTE-FORCED EARLIER. THIS IS ISN’T A SURE SHOT METHOD, AS THE RAINBOW PROJECT IS STILL UNDER DEVELOPMENT. THE PASSWORD CAN BE SET TO NULL BY DELETING THE CONTENT, BUT THIS MIGHT RESULT IN THE CORRUPTION OF THE SAM FILE, AND RECOVERY IS THE ONLY OPTION LEFT AFTER IT.

LIMITATIONS: THIS METHOD CAN CORRUPT YOUR SAM FILE, WHICH MAY LEAD TO A REPAIR OF WINDOWS XP, AND YOU CAN RISK YOUR PERSONAL DATA WITH THAT.

METHOD 6:-FOR (XP, VISTA, WINDOWS7) .

Bestest way that works in all windows platform but you need to be a admin to do this.

Goto run

Type compmgmt.msc

click on local users and groups.

open up the ‘users’ folder

click on the user name whom you want to change password of

look for password never expires option which is checked

uncheck password never expires option and apply and press ok.

Then go back to the user name and right click the mouse there you will get

set password…
all tasks
delete
rename
properties
help

and you are done.

METHOD 7:-FOR (XP, VISTA, WINDOWS7) .

THROUGH PASSWORD RESET/CRACK SOFWARES LIKE

1.  Ophcrack

2. Offline NT Password & Registry Editor

3. Cain &  Abel

4. LCP

5. John The Ripper

These are the best freewares available on the internet and which I know.