[Java] Decrypt minecraft lastlogin

Deque · 12-06-2012, 11:30 AM

Hello HC,

this little program decrypts the minecraft lastlogin file.
If the minecraft player checked the "remember my password" box, you can easily decrypt name and password this way.

If you run it without any argument, it tries to find the file in the default location. Otherwise it takes the first argument as loginfile.

Requires Java 7.

Code:
import java.io.DataInputStream;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.security.InvalidAlgorithmParameterException;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.security.spec.InvalidKeySpecException;
import java.util.Random;

import javax.crypto.Cipher;
import javax.crypto.CipherInputStream;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.PBEParameterSpec;

public class MineCraftLoginReader {

    private static final long MAGIC_SEED = 43287234L;
    private static final int SALT_LENGTH = 8;
    private static final String LOGIN_FILE_NAME = "lastlogin";
    private static final String USER_HOME = System
            .getProperty("user.home", ".");
    private static final String NEWLINE = System.getProperty("line.separator");
    private static final char[] PASSWORD = "passwordfile".toCharArray();

    private Cipher cipher;

    public static void main(String[] args) {
        Path login = null;
        if (args.length == 1) {
            login = Paths.get(args[0]);
        } else {
            login = getDefaultLoginFile();
        }
        System.out.println("reading file: " + login);
        if (login != null && Files.exists(login)) {
            try {
                System.out.println(new MineCraftLoginReader().decrypt(login));
            } catch (IOException e) {
                System.err.println(e.getMessage());
            }
        } else {
            System.err.println("login not found");
        }
    }

    public MineCraftLoginReader() {
        initCipher();
    }

    private void initCipher() {
        final int iterationCount = 5;
        PBEParameterSpec paramSpec = new PBEParameterSpec(initSalt(),
                iterationCount);
        PBEKeySpec keySpec = new PBEKeySpec(PASSWORD);
        try {
            SecretKey key = SecretKeyFactory.getInstance("PBEWithMD5AndDES")
                    .generateSecret(keySpec);
            cipher = Cipher.getInstance("PBEWithMD5AndDES");
            cipher.init(Cipher.DECRYPT_MODE, key, paramSpec);
        } catch (InvalidKeySpecException | NoSuchAlgorithmException
                | NoSuchPaddingException | InvalidKeyException
                | InvalidAlgorithmParameterException e) {
            e.printStackTrace();
        }
    }

    private byte[] initSalt() {
        byte[] salt = new byte[SALT_LENGTH];
        Random rand = new Random(MAGIC_SEED);
        rand.nextBytes(salt);
        return salt;
    }

    public String decrypt(Path loginFile) throws FileNotFoundException,
            IOException {
        try (FileInputStream fis = new FileInputStream(loginFile.toFile());
                CipherInputStream cis = new CipherInputStream(fis, cipher);
                DataInputStream dis = new DataInputStream(cis) {

            return "name: " + dis.readUTF() + NEWLINE + "password: "
                    + dis.readUTF();
        }
    }

    private static Path getDefaultLoginFile() {
        String os = System.getProperty("os.name").toLowerCase();

        if (os.contains("windows")) {
            return getWindowsLoginFile();
        }
        if (os.contains("mac")) {
            return getMacLoginFile();
        }
        return getNixLoginFile();
    }

    private static Path getNixLoginFile() {
        return Paths.get(USER_HOME, ".minecraft", LOGIN_FILE_NAME);
    }

    private static Path getMacLoginFile() {
        return Paths.get(USER_HOME, "Library", "Application Support",
                "minecraft", LOGIN_FILE_NAME);
    }

    private static Path getWindowsLoginFile() {
        String appData = System.getenv("APPDATA");
        if (appData != null) {
            return Paths.get(appData, ".minecraft", LOGIN_FILE_NAME);
        }
        return Paths.get(USER_HOME, ".minecraft", LOGIN_FILE_NAME);
    }
}

Deque · 12-07-2012, 01:36 PM

I got asked in another forum, how I found out. It is not that hard, since bytecode is easily decompiled:

I get the launcher minecraft.jar, extract it and run (on Linux):

Code:
grep -r lastlogin .

The answer is that the string "lastlogin" is located in LoginForm.class
So I decompile that class with JAD:

Code:
./jad LoginForm.class

As a result I get a LoginForm.jad file with Java source code. There you find this (search for the term "lastlogin" again):

Code:
private void writeUsername()
    {
        try
        {
            File lastLogin = new File(Util.getWorkingDirectory(), "lastlogin");
            Cipher cipher = getCipher(1, "passwordfile");
            DataOutputStream dos;
            if(cipher != null)
                dos = new DataOutputStream(new CipherOutputStream(new FileOutputStream(lastLogin), cipher));
            else
                dos = new DataOutputStream(new FileOutputStream(lastLogin));
            dos.writeUTF(userName.getText());
            dos.writeUTF(rememberBox.isSelected() ? new String(password.getPassword()) : "");
            dos.close();
        }
        catch(Exception e)
        {
            e.printStackTrace();
        }
    }

    private Cipher getCipher(int mode, String password)
        throws Exception
    {
        Random random = new Random(0x29482c2L);
        byte salt[] = new byte[8];
        random.nextBytes(salt);
        PBEParameterSpec pbeParamSpec = new PBEParameterSpec(salt, 5);
        javax.crypto.SecretKey pbeKey = SecretKeyFactory.getInstance("PBEWithMD5AndDES").generateSecret(new PBEKeySpec(password.toCharArray()));
        Cipher cipher = Cipher.getInstance("PBEWithMD5AndDES");
        cipher.init(mode, pbeKey, pbeParamSpec);
        return cipher;
    }

This is pretty much all you need to know. You have the password, the cipher and the salt.

Deque · 12-07-2012, 01:36 PM

I got asked in another forum, how I found out. It is not that hard, since bytecode is easily decompiled:

I get the launcher minecraft.jar, extract it and run (on Linux):

Code:
grep -r lastlogin .

The answer is that the string "lastlogin" is located in LoginForm.class
So I decompile that class with JAD:

Code:
./jad LoginForm.class

As a result I get a LoginForm.jad file with Java source code. There you find this (search for the term "lastlogin" again):

Code:
private void writeUsername()
    {
        try
        {
            File lastLogin = new File(Util.getWorkingDirectory(), "lastlogin");
            Cipher cipher = getCipher(1, "passwordfile");
            DataOutputStream dos;
            if(cipher != null)
                dos = new DataOutputStream(new CipherOutputStream(new FileOutputStream(lastLogin), cipher));
            else
                dos = new DataOutputStream(new FileOutputStream(lastLogin));
            dos.writeUTF(userName.getText());
            dos.writeUTF(rememberBox.isSelected() ? new String(password.getPassword()) : "");
            dos.close();
        }
        catch(Exception e)
        {
            e.printStackTrace();
        }
    }

    private Cipher getCipher(int mode, String password)
        throws Exception
    {
        Random random = new Random(0x29482c2L);
        byte salt[] = new byte[8];
        random.nextBytes(salt);
        PBEParameterSpec pbeParamSpec = new PBEParameterSpec(salt, 5);
        javax.crypto.SecretKey pbeKey = SecretKeyFactory.getInstance("PBEWithMD5AndDES").generateSecret(new PBEKeySpec(password.toCharArray()));
        Cipher cipher = Cipher.getInstance("PBEWithMD5AndDES");
        cipher.init(mode, pbeKey, pbeParamSpec);
        return cipher;
    }

This is pretty much all you need to know. You have the password, the cipher and the salt.

bluedog.tar.gz · 12-07-2012, 03:28 PM

Oh cool, I didn't even know!
Thanks for the share bud.

bluedog.tar.gz · 12-07-2012, 03:28 PM

Oh cool, I didn't even know!
Thanks for the share bud.