Total Commander FTP password recovery (Java)

Total Commander (formerly known as Windows Commander) is a classic file manager for Windows, Windows CE, Windows Phone, and now also Android.

Total Commander has a built-in FTP/FXP client and it keeps the FTP logins and encrypted passwords in wcx_ftp.ini configuration file.

I have reverse engineered and recreated the password decoding algorithm years ago.

It was made available by me to another FlashFXP software to import FTP connection profiles from Total Commander.

I give you source codes for both the original assembly decoding algorithm and a Java implementation of this algorithm.

Total Commander Online Password Decoder

You can either use one of the provided source codes or use my own online implementation to make things faster:

https://www.pelock.com/products/total-commander-ftp-password-recovery

Installation

The preferred way to install the library is via Maven.

Add this dependency to your pom.xml:

<dependency>
  <groupId>com.pelock</groupId>
  <artifactId>total-commander-ftp-password-recovery</artifactId>
  <version>1.0.1</version>
</dependency>

Usage examples

Example — BasicUsage.java

/******************************************************************************
 * Total Commander FTP Password Recovery usage example.
 *
 * Version        : v1.0.1
 * Language       : Java
 * Author         : Bartosz Wójcik
 * Web page       : https://www.pelock.com
 *
 *****************************************************************************/

import com.pelock.totalcommander.TotalCommanderPasswordDecoder;

public class BasicUsage {

  public static void main(String[] args) {
    String cipherHex = "00112233445566778899aabbccddeeff";
    TotalCommanderPasswordDecoder decoder = new TotalCommanderPasswordDecoder();
    byte[] plain = decoder.decryptPassword(cipherHex);

    if (plain == null) {
      System.err.println("Decode failed.");
      System.exit(1);
    }

    System.out.println(decoder.decryptPasswordString(cipherHex));
    StringBuilder hex = new StringBuilder();
    for (byte b : plain) {
      hex.append(String.format("%02x", b & 0xFF));
    }
    System.out.println("hex: " + hex);
  }
}

See the examples/ directory in this repository for complete samples.

References

• Total Commander FTP Password Recovery (article / online tool)
• Source code recovery / reverse engineering services

Author

Bartosz Wójcik

• Visit my site at — https://www.pelock.com
• X — https://x.com/PELock
• GitHub — https://github.com/PELock