Does this command work for you if you run it after doing sudo gainroot?: echo root:$(grep -A 13 lock_code /dev/mtd1|tail -1) if it does, it should give you the hash in a format like this: root:randomstring you can then use john the ripper to decrypt it in few seconds