Utility Mill


Decodes password hash from LoginRecovery service into pwdump format


Instructions / Discussion

LoginRecovery.com is a service for recovering your Windows passwords. It can be run by booting from either a floppy disk or CD. The resulting hashes are either written to a file (for the floppy) or displayed on the screen (for the CD). You may upload this file to the company's website and either wait a long time before they will decode it, or pay a fee for a quicker service. However, this is a rip-off as there are free services online that will do the same thing (e.g. Plain-Text.info, Astalavista.net, LMcrack.com, and many others), but they expect the input in "pwdump" format.

The original versions of the LoginRecovery program output their file in a slightly modified pwdump format; they simply added commas between the bytes, and added a newline and underscore, and some extra checksums. However, newer versions of the program (since 2006~2007) obfuscate the data to make it harder for you to get the actual hash. This utility will help you decode it back into pwdump format.

The output file will consist of a series of 2-line entries, one for each account on the system. Each entry will look something like this (please remove any spaces that may have been added accidentally; there are no spaces in the correct format):

Administrator:500:D4,A0,32,6E,9F,81,EF,F9,9D,7E,A7,88,09,89,E8,D8,C2: _6D,42,3B,34,A1,B1,5C,E9,76,96,1E,E5,E0,C4,14,CF,XX:::

The output will look something like this:


Enter ONLY ONE entry at a time into the box above.

Utility Mill is another wonderful Blended Technologies project.

copyright, owned and operated by Blended Technologies LLC.

Powered by Python and the ineffable Web.py