Advanced Office Password Recovery (AOPR)

Advanced Office Password Recovery (AOPR) is ElcomSoft's comprehensive recovery suite supporting all versions of Microsoft® Office (including international versions) and all other Microsoft® software using the new encryption method based on Cryptographic Service Provider (CSP) file protection for Office XP and later.

Advanced Office Password Recovery requires the following system configuration to run properly:
· Pentium or higher CPU
· Windows® 95, Windows® 98, Windows® ME, Windows® NT 4.0, Windows® 2000, Windows® XP or Windows® Server 2003
· About four megabytes of free space on hard disk
· Some features may require Administrative Rights on Windows® NT, 2000, XP or 2003 Server

When AOPR is the active window pressing the function key F1 will give you AOPR's comprehensive help file. Alternatively go to the menu bar, select "Help | Help Contents".

Help for particular controls:

Right-click on any control to display a "What's This?" menu that leads to a description of the control. This works with menu items as well. This way, if you are uncertain about a control's function or impact help is at hand.

To select a file you want to recover the password(s) for simply press the "Open File" button (or select the "File | Open File" menu item) and browse for the appropriate file (or press on a small arrow at the right to load a file you have been working with recently).

File Format will be recognized automatically with corresponding message in the Log Window. If the specified File Format is not supported by AOPR, or it's corrupted, or used by another application – the appropriate error message will be displayed.

You can clear the Recent Files list selecting the "File | Clear Files History" menu item.

After the File selection, the dialog box with results will be displayed automatically. The following situations may occur as the result of the File Processing:

· All or some Passwords were recovered. The dialog box with passwords is displayed. Password fields may contain those auxilary messages:
· - the password is not set;
· - the password cannot be recovered instantly, you must select the Attack Options and Start the Attack to recover this password. You can Create a Project to save the Attack parameters to the file.
· - the password cannot be recovered, but can be changed or deleted. In this case a Dialog with results contains two additional buttons: "Change Password" and "Delete Password". You can change or delete the password simply clicking those buttons. Selected File must not be write-protected to complete this operation successfully.
· - the Password cannot be recovered by some reason. The possible reasons are:
· Selected File Format does not have such password
· Password that decrypts a document is not found yet
· - an error occured while Password Recovery process. The error message box is displayed to explain the error.
· - the Password is not supported by current version of AOPR.
· - the Password was found but its length exceeds the Trial Version Limitations. You must purchase AOPR License to see that Password.

Any found Password can be copied to the Clipboard. Simply press the "Copy to Clipboard" button located at the right of the corresponding Password. You can insert the copied Password to any field by pressing the "Ctrl-V" buttons combiantion (usually the Paste menu item is disabled, but the keyboard shortcut always works). Passwords which contains international symbols can be displayed incorrectly on Windows® 95, 98 and Me. These Windows® versions don't support Unicode and therefore we recommend to use Windows® NT, 2000 or XP to recover passwords with international symbols.

Path to the selected File is displayed under "File Path:" caption. You can open the File simply clicking the "Open..." button.

· File Format is not supported. This may occur when you're selecting file which Format is not supported by AOPR. Please see the "Supported File Types and Passwords" section to learn what File Formats are supported by AOPR.
· An Error occured. The Error message box is displayed.

Please examine the Passwords Manual to get more information about Document Passwords.

If you need to recover the "open" password for Word®/Excel® 97/2000/XP, PowerPoint® XP or Money 2002/2003/2004 document and this password cannot be recovered instantly, you may create a project. Project file contains all information about the source File, selected Options and Character Set. You can simply copy the Project File to another computer and you don't need to copy the source File -- the Project contains all information needed to recover a Password.

When you open the file for password recovery and this Password cannot be recovered instantly, the program creates a new Project automatically. Project files have an ".OPR" extension. By default the Project name is equal to the source File name. For example if you're opening the "test.doc" file, the Project name is "test.opr".

When the file is loaded, you can save your project -- all the changes you've made will be reflected in the project file. The name for the project is selected automatically based on the name of the file. If you want to give an alternative name – use "File | Save Project As..." menu item. If you don't want to change the name, just use the "File | Save Project" menu item.

If a Project was created and you're trying to quit AOPR, the Saving Project Prompt will be displayed. You can disable this Prompt unckecking the "Prompt if project was changed" checkbox at the Options tab.

If you have a document with password-protected VBA project, but for some reason the password cannot be recovered, or the password shown by AOPR cannot be entered (for example it contains non-English characters that cannot be entered using your keyboard), or AOPR only allows to change or remove that password (but you would not like to do that), you can use the "VBA backdoor" feature. It works for all applications which can create VBA projects in their documents, not only Microsoft® Office (for example, Corel WordPerfect Office and AutoCAD).

With that feature, the password is not being recovered at all. However, you're able to open a VBA project (to view/edit the code). Of course you should have the application (this document has been created with, or later version) installed.

Just press the "VBA Backdoor" button on AOPR toolbar (or select VBA Backdoor | Open file through backdoor menu item). The program will prompt you for the document file.

Here you set the additional Command Line parameters if needed. AOPR will run the application (with a special way) this document has been created with, and load your document into it. Now go into VBA properties (typically, it is under "Tools | Macro | Visual Basic Editor" or "Tools | VBAProject Properties". You'll be prompted for the Password. Enter ANY one (e.g., xyz), and it will be accepted!

If your document has been created in Microsoft® Office 97, you can use Office 2000 or Office XP, too. However, the reverse is not true: if you would like to unprotect Office 2000/XP document, but have only Office 97 installed, AOPR will still run it (with a warning message), but Backdoor will not work.

In addition (for example, in the case if the extension of the protected files is not registered in the system, so AOPR don't know what program to execute), you can just run the desired application (the one with VBA support: Word®, Excel®, FrontPage, AutoCad etc) using the same technology: select "VBA Backdoor | Launch application" menu item. Backdoor will be activated, and for all documents you will open in that application, any password will be accepted.

Please note that this backdoor is supported only for a limited number of versions of VBA engine (VBE.DLL or VBE6.DLL) – the ones that were available when current version of AOPR has been released (the latest one comes with Microsoft® Office 2003). When the application is executed, AOPR prints (into the Log Window) the size and version number of that DLL. If your one is not supported yet, AOPR uses "generic" patch, which may fail under certain circumstances.

You can use the Benchmark feature to estimate the speed of your computer and calculate the time needed to recover the Strong Password. Just press the appropriate "Calculate" button on the "Benchmark" tab. To determine the time needed to recover the password, simply divide the total number of passwords to the speed displayed in the Benchmark dialog. Total number of passwords is just the number of the characters in selected character set in a power of the password length.

If a Password cannot be recovered instantly you must use one of the Attack Types. The following Attack Types are available in AOPR:

· Brute-Force Attack. This Attack will try all possible characters combinations in the specified Range. The Range is defined by Password Length and Brute-Force Range Options.
· Brute-Force with Mask. This Attack is useful when you remeber a part of Password. For example if you remember that length of your password was 5 characters and password begins from "A", you can define the mask "A????" and save the time by trying 4 symbols instead of 5. A Password Mask must be defined to use this Attack.
· Dictionary Attack. This Attack verifies the words stored in the specified Dictionary File. The dictionary is just the text (ASCII file) with one work at a line; the lines are separated with line breaks. You can set additional Dictionary Options for this Attack. A Dictionary Attack is much more faster than Brute-Force so we recommend to run it first. AOPR has supplied with one small Dictionary File containing English words. Additional Dictionaries can be obtained on a CD with any Elcomsoft program.

To select the needed Attack Type click the corresponding radio button under "Type of Attack for Documents with Strong Encryption".

Preliminary Attack is the set of predefined Attacks which are tried when Password cannot be recovered instantly.

Preliminary Attack consists of four independed Attacks which can be enabled/disabled in program Options.

· Found Passwords Attack. This Attack is always available. It checks all Passwords that were found in the document prior to finding the current Password. For example Microsoft® Word® Files may have a VBA Project Password. This Password is checked first beacuse many users uses the same Passwords in different places.
· Password Cache Attack. This Attack checks the Password Cache (all passwords found in other documents by AOPR). This Attack can be enabled/disabled by "Password Cache Preliminary Attack" checkbox at the "Options" tab.
· Preliminary Dictionary Attack. Performs the Dictionary Attack by Default Dictionary with "Smart Mutations" Option. This Attack can be enabled/disabled by "Preliminary Dictionary Attack" checkbox at the "Options" tab.
· Preliminary Brute-Force Attack. Performs the Brute-Force Attack by several predefined Character Sets. This Attack can be enabled/disabled by "Preliminary Brute-Force Attack" at the "Options" tab.

Preliminary Attack may take several minutes to run. You can stop it at any time clicking the "Stop" button.

This is one of the most important options affecting checking time. You can check all 4-character (and shorter) passwords in a few minutes. But for longer passwords you have to have patience and/or some knowledge about the password (including the character set which has been used, or even better – the mask).

AOPR allows you to set a Password Length range by defining the Minimal and Maximal Length. These values can be set using the "Password Length" controls at the "Brute-Force" tab. The minimal length cannot be set to a value greater than maximal one. In this case the appropriate error message will be displayed.

If the Minimal and Maximal Lengths are not the same, the program tries the shorter passwords first. For example, if you set Minimal=3 and Maximal=7, the program will start from 3-character Passwords, then try 4-character ones and so on -- up to 7. While AOPR is running, it shows the current Password Length, as well as the current Password, Average Speed, Elapsed and Remaining Time, and Total and Processed number of passwords (some of these Parameters are displaying in the "Extended Statistics" Dialog. All of this information except average speed and elapsed time, which are global, is related only to the current length.

In MS Office documents passwords may contain the following Characters: latin letters (both small and capital), digits, special symbols (like @, #, $ etc) and national languages symbols. You can select these Ranges separately, or define your own Password Range. To define your own range, check the box "Custom charset" and press the "Custom charset…" button.

The Predefined Passwords Ranges contain the following Characters:

· "a - z": abcdefghijklmnopqrstuvwxyz
· "A - Z": ABCDEFGHIJKLMNOPQRSTUVWXYZ
· "0 - 9": 0123456789
· "!@..." (special characters): !@#$%^&*()_+-=<>,./?[]{}~:;`'|"\
· "All Printable": contains all Ranges defined above

If you already know some characters in the Password, you can specify the Mask to decrease the total number of passwords to be verified. At the moment, you can set the Mask only for fixed-length Passwords, but doing this can still help.

For example, you know that the Password contains 8 characters, starts with 'x', and ends with '99'; the other symbols are small or capital letters. So, the Mask to be set is "x?????99", and the charset has to be set to All caps and All small. With such options, the total number of the passwords that AOPR will try will be the same as if you're working with 5-character passwords which don't contain digits; it is much less than if the length were set to 8 and the All Printable option were selected. In the above example, the '?' chars indicate the unknown symbols.

If you know that the Password contains an occurrence of the Mask character '?', you can choose a different Mask Character to avoid having one character, '?', represent both an unknown pattern position and a known character. In this case, you could change the Mask Symbol from '?' to, for example, '#' or '*', and use a mask pattern of "x######?" (for mask symbol '#') or "x******?" (for mask symbol '*').

The Mask and Mask Symbol can be defined in the "Mask / Mask Character" control at the "Brute-Force" tab.

At first you have to select the desired Dictionary File. Click the "Select Dictionary File..." button at the "Dictionary" tab and select the needed file.

In that Attack the program will try all words from it as passwords for the selected Document. It really helps when the Password has some meaning, i.e. the whole word. You can select an option "Smart mutations" or "Try all possible upper/lower case combinations" – it may really help if you're not sure about the register the Password has been typed in. For example, let's assume that the next word in dictionary is «PASSword» (the case, actually, doesn't matter here). With the second option enabled, the program will just try all possible combinations, like:

password
passworD
passwoRd
passwoRD
passwOrd
…
PASSWORd
PASSWORD

However, checking all such combinations takes a lot of time: in the example above, the program will check 2^8 words (i.e. 256) instead of one. With Smart Mutations, you can eliminate a number of "virtually impossible" combinations, and here are all the words which will be checked:

PASSword (as is)
passWORD (reversed)
password (all lower case)
PASSWORD (all upper case)
Password (first uppercase, rest lowercase)
pASSWORD (first lower case, rest uppercase)
PaSSWoRD (elite: vowels in lc, others in uc)
pAsswOrd (noelite)
PaSsWoRd (alt/1)
pAsSwOrD (alt/2)

So, it makes only 10 combinations for each word.

The "Start line #" option allows you to start an Attack from a given line (in dictionary); if you'll interrupt the attack, the "current" line number will be written there (and saved to the Project File, of course).

Default Dictionary is used when the Preliminary Attack is running. To select the Default Dictionary click the "Select Default Dictionary..." at the "Dictionary" tab. Please note, this Dictionary Attack is running with "Smart Mutations" Option and a long Dictionary File may slow down the Preliminary Attack.


Home page URL : http://www.elcomsoft.com/aopr.html