Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 6 Feb 2012 09:45:06 -0600
From: "jfoug" <jfoug@....net>
To: <john-dev@...ts.openwall.com>
Subject: Was: RE: [john-users] Segmentation fault in john-1.7.9-jumbo-5 under some conditions

Moved to john-dev, from john-users

>From: Solar Designer [mailto:solar@...nwall.com]
>
>On Thu, Feb 02, 2012 at 06:10:32PM +0100, madfran@...-ezine.org wrote:
>> No solution for the problem of segmentation fault when traying to
>> restore a session initiate with the external option
>> "Keyboard" ?
>
>I tried to reproduce it on several Linux systems with no luck.  Since
>the problem is specific to -jumbo (or so it appears) and to Windows
>(which I normally don't use), I am leaving it for the contributors to
>-jumbo to debug.  Jim - maybe you? ;-)
>
>Alexander

I am able to reproduce this under cygwin (which I have had very little
success debugging), but I can also have it happen under a VC build, which I
do have ability to debug.   However, I am not comfortable in any knowledge
of your compiler code.  I have written some myself, for gmp-ecm, OpenPGW,
and even a simple parser/compiler in pass_gen.pl.  However, I have not dug
in, or figured out the compiler code in john.  So I will list some
'findings', and possibly we can track down just what is going on.

It dies within the extern / compiler code.  I think it gets through the
loader

Here is where it dies:

compiler.c 1351

static void c_op_index(void)
{
	c_sp -= 2;
**	(c_sp - 2)->imm = *((c_sp - 1)->mem += c_sp->imm);
}

Here is the call stack (note, non gcc build, so uses difference compiler
execute, but SAME results).

compiler.c:1351 c_op_index
compiler.c:876  c_execute_fast
external.c:264  do_external_crack
john.c:508      john_run

I rebuilt and re-ran #defining PRINT_INSNS.  Here is the 'end' of the
output. (sorry long).  I believe that the init or restore code ends right
where the 'Loaded 5 passwords' text is output.  There was about 8k-9k
compiler emit lines prior to that.  Since the last line before the 'loaded'
message is a return, I am pretty sure that the push_mem_imm is the first
operation within generate.

op: push_mem_imm
op: <
op: bz
op: push_mem_imm
op: [
op: push_imm
op: assign_pop
op: push_mem_mem
op: assign_pop
op: return
Loaded 5 password hashes with no different salts (LM DES [128/128 BS SSE2])
op: push_mem_imm
op: assign_pop
op: push_mem_mem
op: [
op: bz
op: push_mem
op: ++
op: pop
op: ba
op: push_mem_mem
op: [
op: bz
op: push_mem
op: ++
op: pop
op: ba
op: push_mem_mem
op: [
op: bz
op: push_mem
op: ++
op: pop
op: ba
op: push_mem_mem
op: [
op: bz
op: push_mem
op: ++
op: pop
op: ba
op: push_mem_mem
op: [
op: bz
op: push_mem
op: ++
op: pop
op: ba
op: push_mem_mem
op: [
op: bz
op: push_mem
op: ++
op: pop
op: ba
op: push_mem_mem
op: [
op: bz
op: push_mem
op: ++
op: pop
op: ba
op: push_mem_mem
op: [
op: bz
op: push_mem_imm
op: -
op: assign_pop
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: ba
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_imm
op: [
op: ==
op: bz
op: push_mem_imm
op: [
op: push_mem
op: assign_pop
op: ba
op: return
op: push_mem_mem
op: push_imm
op: =
op: [
op: push_mem_mem_mem_imm
op: [
op: [
op: =
op: assign_pop
op: push_mem
op: ++
op: push_mem
op: <
op: bz
op: push_mem_mem
op: [
op: push_mem_mem_mem_imm
op: <<
op: push_mem_mem
op: [
op: +
op: [


Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ