bitlocker_rpc — GPU-accelerated BitLocker Recovery Password Tester

High-throughput CUDA C++ tool to test BitLocker recovery-password candidates for lawful, authorized recovery of drives you own.

Features

• CUDA-accelerated candidate generation and testing for the 48-digit BitLocker recovery password (8 groups of 6 digits).
• Correct BitLocker recovery crypto path (aligned with libbde / BitCracker / hashcat mode 22100):
  • Distill recovery groups to 16 little-endian bytes (group / 11)
  • Stretch-SHA256 KDF over an 88-byte state (iterations, default 0x100000) — not PBKDF2
  • AES-CTR decrypt of the VMK blob + structure check (hashcat type 0)
  • Optional full MAC verify with -M (hashcat type 1)
• Mask mode (-m) for known groups; keyspace uses Microsoft-valid range (PER_GROUP = 65536)
• Multi-GPU keyspace split (-d 0,1,...)
• Benchmark mode (-B) for password-generation throughput only
• Self-test mode (-T) for host+device crypto regression checks
• Progress / ETA display with pause (p), resume (r/space), and quit-on-q
• Session checkpointing: quit and resume later via -c FILE / -r

Legal & Ethical Disclaimer

THIS PROJECT IS A SECURITY-SENSITIVE TOOL. Use of this software to access or attempt to access data without explicit authorization is illegal and unethical. By using this software you confirm that you are the owner of the target device or otherwise have explicit written authorization to perform recovery operations on it.

• Do not use this software for unauthorized access.
• The authors accept no liability for misuse.
• See SECURITY.md for responsible disclosure.

How BitLocker Recovery Passwords Work

Recovery passwords are 48 digits shown as 8 groups of 6 (e.g. 111111-222222-...). Each group must be divisible by 11. Microsoft also constrains groups to < 720896, so each unknown group has 65536 candidates (k * 11 for k in [0, 65536)).

Crypto pipeline for recovery passwords:

1. Parse 8 groups → 8×uint16 = group/11, packed little-endian (16 bytes)
2. initial = SHA256(distilled16)
3. Stretch loop on 88-byte struct {last[32]|initial[32]|salt[16]|count_le64} for iterations (default 1,048,576) SHA-256 hashes → 32-byte AES key
4. AES-CTR (nonce 12, flags 0x02, counter starts at 1 for body) decrypt first VMK block after the 16-byte MAC
5. Structure check: size 0x002c, version 0x0001, type byte <=5, key type 0x20
6. Optional: full CCM-style MAC verify (-M)

Hardware & Software Requirements

• NVIDIA GPU + CUDA Toolkit (nvcc)
• Windows (MSVC host compiler) or Linux (g++)
• CUDA driver matching your toolkit

Build Instructions

Windows

cd <repo-root>
scripts\build.bat

Output: build\bitlocker_rpc.exe

Optional: set SM (compute capability without dot), e.g. set SM=89 for Ada.

Linux

cd <repo-root>
chmod +x scripts/build.sh
./scripts/build.sh

Output: build/bitlocker_rpc

Manual nvcc example

nvcc -gencode arch=compute_75,code=sm_75 -I src -I src/include -rdc=true -O3 \
  -o build/bitlocker_rpc \
  src/bitlocker_rpc.cu src/hash_parser.cpp src/kernel.cu src/password_gen.cu \
  src/utils.cpp src/checkpoint.cpp src/selftest.cu \
  src/crypto/aes256.cu src/crypto/sha256.cu \
  src/crypto/bitlocker_kdf.cu src/crypto/bitlocker_vmk.cu

(-rdc=true is required for cross-translation-unit device calls.)

Active crypto sources: sha256, aes256, bitlocker_kdf, bitlocker_vmk. Host also builds checkpoint.cpp for quit/resume. Legacy PBKDF2/HMAC/AES-CCM/AES-128 sources live under src/crypto/legacy/ and are not built.

Usage

build\bitlocker_rpc.exe -h
build\bitlocker_rpc.exe -T
build\bitlocker_rpc.exe -B -t 256 -b 1024
build\bitlocker_rpc.exe -f hash.txt -m "123456-??????-??????-??????-??????-??????-??????-??????"
build\bitlocker_rpc.exe -d 0,1 -M -f hash.txt
build\bitlocker_rpc.exe -f hash.txt -c job.ckpt
build\bitlocker_rpc.exe -r -c job.ckpt

Options

Flag	Meaning
-f FILE	Hash from file
-t N	Threads per block (default 256)
-b N	Blocks per launch (default 256)
-B	Password-gen benchmark only
-T	Run host+device self-tests and exit
-o FILE	Output file if found (default found.txt)
-m MASK	55-char mask (? wildcards; whole groups only)
-d DEVS	Comma-separated GPU ids (default: all)
-c FILE	Checkpoint path (default bitlocker_rpc.ckpt)
-r	Resume from checkpoint (-c FILE); hash/mask/mac loaded from file
-M	Enable full MAC verify (slower; type 1)
-h	Help

Interactive controls (while running)

Key	Action
p	Pause after the current GPU launch batch
r or Space	Resume from the same keyspace offset
q then y	Quit (confirm with y); writes checkpoint for later -r

Paused time is excluded from elapsed/ETA. Progress and keyspace position are preserved across pause/resume.

Quit and resume later

Candidates are generated sequentially from a flat index, so progress is just the next untested index ranges.

1. Start a job with an explicit checkpoint path:

   build\bitlocker_rpc.exe -f hash.txt -m "123456-??????-..." -c job.ckpt

2. Press q then y to stop. A checkpoint is written (also autosaved after each GPU batch).
3. Resume later (hash/mask/mac come from the checkpoint; you can still pass -d/-t/-b):

   build\bitlocker_rpc.exe -r -c job.ckpt

On success (found) or full keyspace exhaustion the checkpoint file is removed. If you change -m or -M relative to the checkpoint, restore refuses to run.

Self-tests (-T)

Runs without a hash. Checks include:

• Host SHA-256 FIPS vector ("abc")
• Distill of a known recovery password (and rejection of a bad group)
• Stretch KDF host reference vs device (small iteration counts)
• Device SHA-256 FIPS vector
• Crafted VMK structure accept/reject
• generate_password(0) → all-zero groups under default mask

Exit code 0 = all passed; non-zero = failure.

Hash format

BitCracker / hashcat-style:

bitlocker$version$saltLen$saltHex$iterations$ivLen$ivHex$encryptedLen$encryptedHex

Typical values: salt 16 bytes, iterations 1048576, IV/nonce 12 bytes, encrypted 60 bytes (16 MAC + 44 body).

Obtain hashes only from systems you are authorized to recover (e.g. BitCracker HashExtractor / libbde tooling).

Performance Notes

• Full crack throughput is dominated by the stretch KDF (~1M SHA-256 per candidate). Expect orders-of-magnitude lower H/s than password-gen benchmark mode.
• -B measures generator throughput only and is not representative of full crypto speed.
• Tune -t / -b for occupancy; multi-GPU splits the index space evenly.
• Full 8-unknown keyspace is 65536^8 (~3.4e38) — only practical with strong masks / partial knowledge.

Roadmap & Limitations

• Optional CMake build
• User-password (UTF-16LE double-SHA256) path not implemented — recovery passwords only
• Legacy crypto sources retained under src/crypto/legacy/ for history only
• Checkpoint restore re-splits remaining ranges across the GPUs selected at resume time (device set may change)

Contributing & License

See CONTRIBUTING.md, CODE_OF_CONDUCT.md, and SECURITY.md.

License: GPL-3.0 — see LICENSE.