from the simulator, "9930-nv.dmp" is the file we want to look into, but where is the password?1. in order to find the location of the password, let's set one on our own first, open simulator, do factory reset, so we can set our password2. set screen lock password --> "password", generate SHA1 hash, which is "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8"3. use winhex, go to 9930-nv.dmp, search for "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8"the offset is 000530204. check the original 9930-nv.dmp, go to the same offset, got the hash "3E270F54C6EB3175B4EF8B20080795EF2EE15589"5. search "3E270F54C6EB3175B4EF8B20080795EF2EE15589", we got "fuckfuckfuckyouhahaha"...6. unlock with "fuckfuckfuckyouhahaha", and to go contact for  hints7. we got the contact "Plaid CTF", and the answer is there...8... perm.ly/h0grm, blackberry.dmp, open winhex, search for the same pattern, "3C000000" which is before the SHA1, we got "5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8" again, which is "password"...9. oh well, password is not correct, let's continue to search (with patience), we got "AC0CFE7BD0AE22B44722F1A01ECB6CE102CA27C5"<span>10. google it... "BerryGood"</span>Ref:http://crackberry.com/security-blackberry-balanceThe personal master key is also randomly generated. The personal master key is stored in NVRAM on the device and is encrypted with the system master keyhttp://www.forensicfocus.com/Forums/viewtopic/t=7055/password should be in SHA15baa61e4c9b93f3f0682250b6cf8331b7ee68fd8 - password<span>3E270F54C6EB3175B4EF8B20080795EF2EE15589 - fuckfuckfuckyouhahahafull writeup with screens will be provided soon</span>