2

My Android device (A Samsung Galaxy S7 SM-G930F, version 6.0.1) has different wi-fi networks saved. I would like to recover some of the password it has stored. Browsing through the web I searched possible solutions but none of it has worked for me.

  • Stored password in wpa_supplicant.conf are encrypted, and even if I change the build properties "ro.securestorage.support" to false, old password remain encrypted or get deleted, and I would like to recover those.
  • I know that wi-fi password usually get backed-up on google drive, but I have no idea how to recover them from the backup online.
  • I heard about an Xposed module "Wifi password" which supposedly should show the wifi password instead of the normal dots, but I have a TouchWiz device and if I install the Xposed Framework i'm afraid it would wipe my data, included my wifi password.

I understand that encryption is meant to keep safe your password, but as far as I know, every time I try to connect to a wifi network it uses the real password, so they have to be stored somewhere or decrypted on the go.

Can anyone help me?

EDIT: As I said, if I change ro.securestorage.support property on build.prop file, my stored password either get deleted or they remain hashed.

If i delete .system.wpa_supplicant

all saved WiFi hotspots will be lost for the first time.

Also as said in the comments, the password isn't encrypted so there's no "way" to decrypt it, but it's hashed and there should be a way to recover it

  • 1
    Possible duplicate of Decrypting wpa_supplicant.conf on Samsung Galaxy mobiles – Irfan Latif Oct 15 at 16:14
  • I specified on the possible solutions every answer in that question, saying that changing build properties or deleting files would result in removing my stored passwords. – Iztooi Oct 16 at 10:08
  • I appreciate the effort you put in researching and asking a question which can be helpful for future visitors. Usually it's better to mention in your question any previous questions - if you find - which can be considered duplicates. But duplicates are usually discouraged. As your question too doesn't have a solution to the problem, so one may justify repeating the question. The previous question doesn't have an answer up to your expectations because Android Enthusiasts isn't the right place to answer questions explicitly about cryptography. – Irfan Latif Oct 16 at 14:09
  • Thanks for the guide, I'll consider in the future asking on a more specific StackExchange subsection. I tried here, since my problem was directly how to "recover" from an android device and not "decrypt" from the hex key. Any answer could belong in different subsections, since it's at the crossing limit. Anyway I got my answers, and I selected the one that could be more useful for anyone that could have the same issue. – Iztooi Oct 18 at 10:04
1

The hex value you found in the wpa_supplicant.conf is the PMK (not the PSK directly but some intermediate value computing the PSK or something like this). This value is not encrypted, it is hashed as defined by WPA2 using PBKDF2 SHA-1 with 4096 iterations see Wikipedia.

SHA-1 is a one-way function, which means that it can not be reversed.

Wifi still works, because the PSK is the actual key Wifi requires to work. The passphrase is just for the "dumb humans who can't remember a simple 64 hex chars value" (aka user convenience).

Hence there is no "decrypt" function. The only way to retrieve the password back is to perform a brute force search on that password (trying all possible passwords). Depending on the length of the password and your hardware (CPU, GPU) this can take some days, weeks, months or years.

There is an issue on Github with indicates that the tool "hashcat" is able to break this value using mode 12000 (-m 12000):

See also Encryption algorithm used in WPA/WPA2

  • But I (as a dumb human) cannot use that psk in any way to access the wifi with another device? Forgive my ignorance about encryption and hashing, I understand the difference but I misused the term "encrypted". – Iztooi Oct 15 at 13:25
  • @Iztooi Some systems still allow to use the PSK directly instead of the password. If the password field is limited to 63 characters it only accepts a password. If it accepts 64 characters usually everything less than 64 characters is considered to be a password and if you enter the 64 digit hex code it is taken directly as PSK. Or on Linux in the wpa_supplicant.conf you specify the password in quotes, and the PSK without. – Robert Oct 15 at 14:01
  • So I checked my wpa_supplicant.conf and every psk listed is 32 characters long, and it has no quotes (so according to what I read, it should be the hex string). Is it possible that the entirety of the psk is not shown but the remaining 32 characters are processed and added every time I try to connect? – Iztooi Oct 15 at 14:39
  • @Iztooi It seems like the 32 hex char value is not the final PSK value (therefore you can't directly use it, you have to crack it). See my updated answer, especially the hashcat part. – Robert Oct 15 at 15:18
  • I read about hashcat in your edited comment and I'm sure it will work, I'll mark the question as resolved but i'll add another answer that I found on stackexchange – Iztooi Oct 16 at 10:10
0

Reading on StackExchange this question Retrieve WiFi password the user "life-on-mars" answered that if you do a backup of the provider settings (com.android.provider.settings) with adb and extract that backup with Android Backup Extractor in the end you will obtain a file called flattened-data which has all the network saved in the same way as the wpa_supplicant.conf but with the actual passwords not hashed/encrypted.

  • Didn't work on OnePlus 6 running Android 9. On which device and Android version did you test this answer? – Firelord Oct 16 at 11:06
  • 1
    I tested this in a Samsung Galaxy S7 (SM-G930F) on a 6.0.1 version – Iztooi Oct 18 at 9:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.