[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 6 Feb 2012 09:45:06 -0600
From: "jfoug" <jfoug@....net>
To: <john-dev@...ts.openwall.com>
Subject: Was: RE: [john-users] Segmentation fault in john-1.7.9-jumbo-5 under some conditions
Moved to john-dev, from john-users
>From: Solar Designer [mailto:solar@...nwall.com]
>
>On Thu, Feb 02, 2012 at 06:10:32PM +0100, madfran@...-ezine.org wrote:
>> No solution for the problem of segmentation fault when traying to
>> restore a session initiate with the external option
>> "Keyboard" ?
>
>I tried to reproduce it on several Linux systems with no luck. Since
>the problem is specific to -jumbo (or so it appears) and to Windows
>(which I normally don't use), I am leaving it for the contributors to
>-jumbo to debug. Jim - maybe you? ;-)
>
>Alexander
I am able to reproduce this under cygwin (which I have had very little
success debugging), but I can also have it happen under a VC build, which I
do have ability to debug. However, I am not comfortable in any knowledge
of your compiler code. I have written some myself, for gmp-ecm, OpenPGW,
and even a simple parser/compiler in pass_gen.pl. However, I have not dug
in, or figured out the compiler code in john. So I will list some
'findings', and possibly we can track down just what is going on.
It dies within the extern / compiler code. I think it gets through the
loader
Here is where it dies:
compiler.c 1351
static void c_op_index(void)
{
c_sp -= 2;
** (c_sp - 2)->imm = *((c_sp - 1)->mem += c_sp->imm);
}
Here is the call stack (note, non gcc build, so uses difference compiler
execute, but SAME results).
compiler.c:1351 c_op_index
compiler.c:876 c_execute_fast
external.c:264 do_external_crack
john.c:508 john_run
I rebuilt and re-ran #defining PRINT_INSNS. Here is the 'end' of the
output. (sorry long). I believe that the init or restore code ends right
where the 'Loaded 5 passwords' text is output. There was about 8k-9k
compiler emit lines prior to that. Since the last line before the 'loaded'
message is a return, I am pretty sure that the push_mem_imm is the first
operation within generate.
op: push_mem_imm
op: <
op: bz
op: push_mem_imm
op: [
op: push_imm
op: assign_pop
op: push_mem_mem
op: assign_pop
op: return
Loaded 5 password hashes with no different salts (LM DES [128/128 BS SSE2])
op: push_mem_imm
op: assign_pop
op: push_mem_mem
op: [
op: bz
op: push_mem
op: ++
op: pop
op: ba
op: push_mem_mem
op: [
op: bz
op: push_mem
op: ++
op: pop
op: ba
op: push_mem_mem
op: [
op: bz
op: push_mem
op: ++
op: pop
op: ba
op: push_mem_mem
op: [
op: bz
op: push_mem
op: ++
op: pop
op: ba
op: push_mem_mem
op: [
op: bz
op: push_mem
op: ++
op: pop
op: ba
op: push_mem_mem
op: [
op: bz
op: push_mem
op: ++
op: pop
op: ba
op: push_mem_mem
op: [
op: bz
op: push_mem
op: ++
op: pop
op: ba
op: push_mem_mem
op: [
op: bz
op: push_mem_imm
op: -
op: assign_pop
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: push_mem_imm
op: [
op: push_mem
op: assign_pop
op: ba
op: return
op: push_mem_mem
op: push_imm
op: =
op: [
op: push_mem_mem_mem_imm
op: [
op: [
op: =
op: assign_pop
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_mem_mem_imm
op: <<
op: push_mem_mem
op: [
op: +
op: [
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
