[<prev] [day] [month] [year] [list]
Message-ID: <1r99tMg2uwA-VZXghMmAJJmGeOybqZCybrzzFTF3r7LnY1MzPmPmnyP9jfsyDPmMAkY2GrFMWU_5gnNiNHLC7m60r7gRyUmAINFD-rCc7VQ=@proton.me>
Date: Wed, 29 Apr 2026 23:31:58 +0000
From: Dob Peter <d1pp1@...ton.me>
To: "john-users@...ts.openwall.com" <john-users@...ts.openwall.com>
Subject: Acronis True Image 9 (2009) .tib
I have a .tib archive created by Acronis True Image 9 around 2009 and I forgot the password.
The issue I am having is that they seem to use a proprietary method to hash the password or a custom KDF.
I managed to create some test archives and extract what appears to be a SHA-1 hash as well as a salt from the files, but neither JTR nor hashid have been able to detect the hash type.
Some AI results have talked about a plugin for acronis and mention 'acronis2john.py' and 'acronis_fmt_plug.h', but I haven't been able to find those files, even in older versions so that might be a hallucination.
Does anyone have any pointers on how I can figure out the method to generate the hash? Some examples of the salt / hash are included below, there were all created with the password: "password". Any pointers to get me going in the right direction would be appreciated.
Example1:
salt: c983962001000000
hash: 7030895732bc865653c7d1fbda38836723c91187
Example2:
salt: 933e660701000000hash: 427e080e096165ac623ef38de5398e31a9264891
Example3:
salt: 53d38a6a01000000hash: d807c49366e0de20132a3040cc1e3e18daa4e68d
Example4:
salt: 7f1740e001000000hash: bf4a37909c58673133728dde210e11c129f00330
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
