FPGA-based Oracle RDBMS passwords cracker

This is FPGA-based Oracle passwords (DES-based) solver, connected directly to Internet and working 24h (for demonstration purpose).

It was made on top of Altera Nios II Development Kit, Stratix II Edition.

It is capable to search nearly 60 million passwords per second. Compare to software Oracle password solvers: on Intel Core Duo they do at most 1.5 million passwords per second.

This means, you need at least 40 of these computers to achieve the same results. 60 million passwords per second is enough to search all possible 8-symbol alpha passwords within one hour (considering short usernames like SYS or DBSNMP).

It also allow to search all possible 8-symbol Oracle RDBMS passwords (A-Z0-9#$_) within 16.5 hours.

Unfortunately, speed is depends on username length, so, while solving passwords for 20-symbol username, speed is about 33 million passwords per second.

Here is how it looks like (without fan). Click for larger photo

Article about it.

Previous version of the article in Russian language.

Click here to access its web-interface. It is possible to submit any hash you'd like to queue.

A following SQL query can be used for passwords hash fetching (login as SYS):

select name,password from sys.user$;

After the moment of password solved or not, it will remain in table for 14 days. Usernames with only alpha symbols and underscore (_) are allowed (so far). Please do not submit any hashes from production systems: they are visible to anyone.

Currently, it solving all 1-8 symbol passwords within about about 16.5 hours.

See also: Oracle passwords (DES) solver 0.3 (SSE2/AVX)

Source code

Here is full source code. It is ready to compile and run on top of Nios II dev kit I already mentioned here. The first part is Altera Quartus archived project. It is derived from Altera empty project example, hence its name.

NiosII_stratixII_2s60_RoHS_full_featured.qar

Here is archive of most important verilog sources: ops_src_v.zip

Here is also clumsy C++ utility to generate oracle_hashes.v file with variable block count. gen_oracle_hashes_v.zip

The second part is written in C and running on Nios II processor. It is derived from modified web server example.

nios_ops.rar

→ [back to the main page]