Total Commander FTP password recovery (PHP)

Total Commander (formerly known as Windows Commander) is a classic file manager for Windows, Windows CE, Windows Phone, and now also Android.

Total Commander has a built-in FTP/FXP client and it keeps the FTP logins and encrypted passwords in wcx_ftp.ini configuration file.

I have reverse engineered and recreated the password decoding algorithm years ago.

It was made available by me to another FlashFXP software to import FTP connection profiles from Total Commander.

I give you source codes for both the original assembly decoding algorithm and a PHP implementation of this algorithm.

Total Commander Online Password Decoder

You can either use one of the provided source codes or use my own online implementation to make things faster:

https://www.pelock.com/products/total-commander-ftp-password-recovery

Requirements

• PHP 8.1+ with 64-bit integers (typical PHP 8 builds on Windows and Linux).
• Composer for local development, tests, and autoloading.

Installation

composer require pelock/total-commander-ftp-password-recovery

Usage (library)

<?php

declare(strict_types=1);

require __DIR__ . '/vendor/autoload.php';

use PELock\TotalCommanderFtpPassword\TotalCommanderPasswordDecoder;

$cipherHex = '00112233445566778899aabbccddeeff';

$decoder = new TotalCommanderPasswordDecoder();
$plain = $decoder->decryptPassword($cipherHex);

if ($plain === false) {
    throw new RuntimeException('Invalid ciphertext (bad hex, odd length, or too short).');
}

echo $plain;        // decoded bytes as a binary string
echo bin2hex($plain); // optional hex view

decryptPassword() accepts flexible hex input: ASCII case is ignored and whitespace between byte pairs is allowed (useful when pasting from an .ini file).

CLI

After installation, Composer exposes a small helper binary:

tc-ftp-password-decode 00112233445566778899aabbccddeeff

From a git checkout (without a global install), run:

php bin/tc-ftp-password-decode 00112233445566778899aabbccddeeff

Examples

• examples/basic-usage.php — minimal decrypt script.

Tests

composer install
composer test

References

• Total Commander FTP Password Recovery (article / online tool)
• Source code recovery / reverse engineering services

Author

Bartosz Wójcik

• Visit my site at — https://www.pelock.com
• X — https://x.com/PELock
• GitHub — https://github.com/PELock