software 2026 · Rust + CUDA · RTX 4060 Ti

rarpc: GPU-accelerated RAR password cracker in Rust and CUDA

🌐 Leer esta página en español →

rarpc is a GPU-accelerated password cracker for RAR archives, using CUDA. Written in Rust with custom CUDA kernels for RAR 5, RAR 3 and RAR 1.5. Six attack modes, an interactive GUI and checkpoints to resume interrupted sessions. On an RTX 4060 Ti: 68 KH/s on RAR 5, 83 KH/s on RAR 3 and 6.69 MH/s on RAR 1.5.

rarpc — GUI in Brute Force mode: charset set to 36 characters (a-z + 0-9 + hex), GPU/Performance panel expanded, running at 62.6 KH/s against test_rar3.rar after 57 seconds
The GUI in action: brute-force attack against a RAR 3 file (AES-256-CBC, PBKDF2-HMAC-SHA256), 62.6 KH/s at 57 seconds, current password vqce.

01 — The problem with cracking modern RAR files

Cracking a password-protected RAR file isn't the same as cracking an MD5 hash. The RAR 5 format uses AES-256-CBC with PBKDF2-SHA256 as its key derivation function — the same scheme that protects many password managers — with an iteration count specifically designed to make every attempt computationally expensive. RAR 3 uses AES-128 with its own SHA-1-based KDF, faster but still meant to slow down attacks. RAR 1.5, from before the era of strong passwords, uses a proprietary cipher that's far more vulnerable.

On a CPU you typically get 200–500 passwords per second on RAR 5. That makes any password over six characters practically impossible to brute-force. The GPU changes the equation: CUDA's massive parallelism lets you run thousands of derivations at once. rarpc pushes that logic as far as it goes with hand-written kernels for each format.

The result on an RTX 4060 Ti:

02 — Supported formats

rarpc automatically detects the file's format when you open it and loads the matching cracker.

RAR 5 (AES-256 + PBKDF2-SHA256). WinRAR's modern format. The KDF derives the AES-256 key by applying PBKDF2 with SHA-256 as the PRF and a fixed iteration count. The CUDA kernel (rar5_kdf.cu) implements SHA-256 with LOP3 instructions specific to SM 89 (Ada Lovelace) to maximize throughput. Verification uses a block of known data in the file's header.

RAR 3 (AES-128 + SHA-1 KDF). WinRAR 3.x's format, still the most common one in files over ten years old. The KDF is an iterated SHA-1 construction with an 8-byte salt and 262,144 rounds. The kernel (rar3_kdf.cu) has two variants: largeblock (default, better throughput) and classic for maximum compatibility.

RAR 1.5. The original pre-SHA format. It uses a proprietary stream cipher with a simply-derived key. rarpc attacks it with a probabilistic GPU filter (rar15_filter.cu): it discards candidates based on statistical properties of the decrypted text before moving on to full verification on the CPU, achieving 89× the speed of a pure CPU attack.

03 — Attack modes

rarpc implements six attack modes, configurable from both the GUI and the command line:

Wordlist. Classic dictionary attack. Reads a text file with one password per line and tries them in order.

rarpc archivo.rar --wordlist diccionario.txt

Brute force. Pure brute force with a configurable charset. The GUI lets you build the charset visually (predefined groups: a-z, A-Z, 0-9, symbols, space, hex) or type it by hand. Configurable with minimum and maximum length.

rarpc archivo.rar --brute --charset "abcdefghijklmnopqrstuvwxyz" --min-len 4 --max-len 6

Mask. Positional-pattern brute force. The tokens ?l ?u ?d ?s ?a ?h represent character classes (lowercase, uppercase, digits, symbols, all, hex) and can be freely mixed. Useful when you roughly know the password's structure.

rarpc archivo.rar --mask "?u?l?l?l?d?d?d?d"

Rules. Applies transformations to a wordlist: uppercasing, reversing, adding numeric suffixes, substituting letters with numbers (l33t), and combinations of these. Multiplies the dictionary's effective coverage at no storage cost.

rarpc archivo.rar --wordlist diccionario.txt --rules

Markov. A trigram model trained on a wordlist. Instead of trying words in order or brute-forcing, it generates candidates ranked by linguistic probability. Finds passwords based on real words faster than pure brute force.

Combinator. Concatenates pairs or triples of dictionary words. Covers the common password pattern word1word2 or WordNumber without having to generate them by hand.

rarpc archivo.rar --wordlist diccionario.txt --combine

All modes support checkpoints to save state and resume if the attack gets interrupted:

rarpc archivo.rar --wordlist diccionario.txt --session mi_sesion
rarpc --resume mi_sesion

04 — The GPU pipeline

The bottleneck in any cracker is the KDF: every candidate password requires hundreds of thousands of cryptographic operations before it can be verified. rarpc structures this as a three-stage asynchronous pipeline that keeps the GPU busy at all times:

  1. Candidate generation (CPU) — the active attack mode produces the next batch of passwords in RAM.
  2. KDF on GPU — the CUDA kernel takes the batch, derives the keys and returns the candidates that pass the quick verification.
  3. Full verification (CPU) — candidates that survive the GPU filter are verified by decrypting the file's actual data block.

The kernels are written in CUDA C with explicit optimizations for SM 89 (Ada Lovelace): LOP3 instructions for SHA-256's boolean operations, SHA-1 with 80 unrolled scalars, and AES kept in registers without going through shared memory. The kernel source is in kernels/.

On multi-GPU systems you can pick the card with --gpu <index>, or enable CPU-only mode with --cpu if no GPU is available.

05 — The GUI

Running rarpc with no arguments opens the graphical interface, built with egui. It has four tabs: Wordlist, Brute Force, Mask and Benchmark, plus a collapsible GPU settings panel.

The Brute Force tab lets you build the charset visually by clicking group buttons (a-z, A-Z, 0-9, Symbols, Space, Hex 0-f) and shows the resulting charset in real time. The GPU/Performance panel exposes the GPU index, the batch size and the CPU-only toggle. The log at the bottom shows the operations underway, and the status bar updates attempts, speed, elapsed time and current password while the attack runs.

The GUI and the CLI share exactly the same attack engine — the GUI is a thin layer over the same pipeline.

06 — Building from source

Requirements: Windows 10/11 x64, CUDA Toolkit 12.x, Visual Studio Build Tools 2022 (MSVC C++ component) and Rust stable.

git clone https://github.com/unmateria/rarpc.git
cd rarpc
cargo build --release

The build.rs script automatically locates nvcc and Visual Studio's cl.exe. If CUDA isn't on the PATH, make sure the CUDA Toolkit is installed correctly and that the installer's environment variables have been applied. The resulting binary (target/release/rarpc.exe) has no external runtime dependencies besides the CUDA DLLs the installer copies to System32.

For other GPU architectures, change the -arch=sm_89 flag in build.rs to the target card's SM (sm_75 for Turing, sm_86 for Ampere, etc.).

GitHub repository — full source code (Rust + CUDA)

There are three precompiled executables, one per GPU generation. Download the one matching your card — they are not interchangeable:

The SM 86 and SM 75 builds are 15–25% slower on RAR 5 and RAR 3 since they lack Ada Lovelace's ISA optimizations. AMD/Intel GPUs are not supported — the code is pure CUDA.