8

I've inherited a bunch of dBase (.dbf) files from a legacy application, and I need to import the data into MS SQL or MS Access. I know these programs have built in "import" functions, but the dBase files are protected with a password, which nobody around here seems to know.

Anyone know of any way around the password, or of cracking the password?

(Edit: added C# tag bc that's the language I'll likely use for any programmatic solution)

Bounty awarded: I don't really have a good solution yet, but it's only 2 hours till the bounty closes, so I guess I should award it to the most useful answer thus far. And in that respect, I think the $75 paid solution is probably the most time and energy efficient, even if it doesn't give me the intellectual satisfaction of cracking it myself! :)

I'm going to leave the question "unanswered" for the meantime, until I see if any of the solutions actually work...

Shaul Behr
  • 36,951
  • 69
  • 249
  • 387
  • Are the files currently in use or are they just archives? – this.josh May 18 '11 at 19:39
  • What is the source of these files, do they come from FoxPro? How are the files encrypted? – this.josh May 20 '11 at 22:06
  • They are from 3rd party software that my client has installed. My client wants me to export the data from this program into a SQL database. I have no idea what kind of encryption the 3rd party vendor used; all I know is that the files are .dbf, and when I try open them using MS Access, it asks me for a password... – Shaul Behr May 22 '11 at 08:32
  • 1
    If this is still unsolved, can you look into the dBase file (in a HEX editor as Jeff suggested) and glean any details whatsoever? The dBase file format is pretty basic, but it depends on the version you are using. Having written some code related to reading and writing basic dBase files (version 4, I believe), I remember the format being incredibly basic and it looks like the dBase version 7 format is [just as basic](http://www.dbase.com/KnowledgeBase/int/db7_file_fmt.htm). This is for [dBase version 3-5](http://www.clicketyclick.dk/databases/xbase/format/dbf.html#DBF_STRUCT). – pickypg May 29 '11 at 03:37
  • Just out of curiosity, how did this end up working out for you? – Bobson Apr 12 '13 at 18:18
  • @Bobson - Never managed to find a solution. The project got canned anyway... :-/ – Shaul Behr Apr 14 '13 at 06:53

3 Answers3

5

There is probably a way around the password, and there is certainly a way to brute force access if the password cannot be bypassed. One site offers the a tip about changing certain binary data within your file using a hex editor to disable password protection: http://www.antionline.com/archive/index.php/t-218086.html. Test that on a copy.

It is still not wholly uncommon to see instances where an application respects a security setting, but the security is not particularly relevant. Cases would include where the file has a flag designating protection, but the data is not actually encrypted. If the above doesn't solve your problem, open the file in a hex editor and see if information is recognizable in plain text.

If that doesn't work, I'd suggest grabbing a copy of John the Ripper and writing some bridge code to use the output of JTR's guesses as input for a dbase library's open calls.

Jeff Ferland
  • 17,832
  • 7
  • 46
  • 76
  • Thanks @Jeff. The link is for MS Access, not dBase. There are much easier ways of cracking MS access passwords, e.g. http://www.mustap.com/databasezone_post_165_crack-access-databases – Shaul Behr May 19 '11 at 07:29
2

Just found this: http://www.pwcrack.com/dbase.shtml

They want $75 for cracking a dBase password, website seems legitimate.

(I am not affiliated)

oleschri
  • 2,012
  • 11
  • 21
  • 2
    +1 Very useful - which tells me that there has got to be a way to do this without paying $75. – Shaul Behr May 26 '11 at 13:14
  • Maybe Mr Weiss http://www.linkedin.com/pub/robert-weiss/4/88a/b92 tells you, but I fear he wants to keep his tricks to himself ;) – oleschri May 26 '11 at 13:42
  • @oleschri & @Philip - unless it's $75 per dbf file, in which case the time & effort start looking a lot more attractive... each dbf file is just one table, and there's a whole database to decode! – Shaul Behr May 27 '11 at 08:26
  • In this case maybe you contact them as told on http://www.pwcrack.com/instructions.shtml as for example on MDBs they "are quoted individually based on format and size." Chances are you will get an individual quote on the whole bundle of your dBase files. – oleschri May 27 '11 at 12:36
  • 2
    @shaul does each dbf have it's own individual password? – Moak May 29 '11 at 05:37
  • Bounty awarded - though I can't as yet vouch for the efficacy of the proposed solution - see edit to my question. – Shaul Behr May 29 '11 at 06:31
  • 1
    Thx @Shaul, would be really nice if you update us how you worked it out in the end – oleschri May 30 '11 at 07:54
0

Cain and Abel may be useful. It is free.

oleksii
  • 35,458
  • 16
  • 93
  • 163