Developer creates a password-cracking Game Boy Advance that is ‘about thirty million times slower than a modern cracking rig’

A security engineer has “ported” one of the best known password recovery utilities to the GameBoy Advance. The port is based on Hashcat, a password recovery utility that otherwise pitches itself as the “world’s fastest.” But I’m doing the bunny ears around ‘ported’ because even the developer admits this is “not really” Hashcat in full.

It turns out the 21-year-old Nintendo handheld console is also not really the best hardware for cracking passwords. “The monstrously powerful 16.78 MHz ARM7TDMI chip does an astronomical 727 SHA256 hashes per second!! Which is about thirty million times slower than a modern cracking rig,” Project developer Mark El-Khoury jokes on LinkedIn, “350 days of continuous cracking on this bad boy could be done in about 1 second with a modern GPU-accelerated cracking rig.”

Even with its snail’s pace, I can’t help but dream up a heist movie where the would-be thieves only use repurposed gaming hardware like this to crack open password-protected vaults. I can just picture the scene now: ‘How much longer is this gonna take?’ ‘Uh, well, you may want to pitch up a tent…?’ Riveting.

The engineer built GBA-Hashcat in the Butano engine, which allows developers to code software for the GBA using C++ (via Computer Base). But whereas the original password-cracking kitty can support a number of attack methods and over 300 hash algorithms, GBA-Hashcat is confined to checking one fixed word list and the hash SHA-256.

The developer briefly explains how these two elements work together, writing on the project’s GitHub page, “It generates the SHA256 hash of each line, and compares it to the (hardcoded) target hash to see if we have a match.” If the hash matches, an attacker can then use this to expose the plaintext password . Over on GitHub, El-Khoury jokingly describes this project as both “The greatest password cracking of all time” as well as his “dumbest app of all time.”

The developer has since taken to LinkedIn again this week with another jokey update, writing, “After ‘porting’ hashcat to the GBA, I realized it is slow. We can get significant speed gains by implementing it in everyone’s favorite language: the subset of LUA used in World of Warcraft addons. So you can crack hashes in-game.”

It’s not just Nintendo’s 2001 handheld console that developers have been bringing copious ‘Why? Well, why not?’ energy to in recent weeks. Back in April, one modder shrunk down the Game Boy Color into a smart watch form factor, complete with cursed control scheme. Last month, another lone developer built an E-Ink Game Boy emulator with an ‘actually playable’ refresh rate for your Pokémon Blue replay. It seems there’s life in yesteryear’s gaming hardware yet.