[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 7 Nov 2014 14:55:16 +0300
From: Aleksey Cherepanov <lyosha@...nwall.com>
To: john-dev@...ts.openwall.com
Subject: Re: [RFC] Johnny further development proposal
On Wed, Oct 29, 2014 at 01:56:05PM +0300, Aleksey Cherepanov wrote:
> On Wed, Oct 08, 2014 at 09:58:27AM +0300, Shinnok wrote:
> > 2. Fix any outstanding bugs or crashes (crash on exit while john is running,
> > pause not working, etc..)
>
> I hope there are no outstanding bugs or crashes at the moment. I think
> the crash on exit was due to multithreading. I avoided threading in
> 2012. So I think Johnny does not crash anymore, right?
>
> The threading was intended to unfreeze ui when john produces a lot of
> output. But there was a problem: the main load is not from the output
> itself but it is from handling the output (including placing it into
> the table). I've added hash table and the other way to get output
> (using `john --show` and temporary file) so the handling is really
> fast. It could be improved further but one should move the whole
> handling into other thread, it looks unnecessary complex.
>
> `john --show` needs more explanations: it prints hashes in john's
> canonical form (as they are stored in .pot file) but we have
> original form in the table (these forms are not always equal). To
> solve this, we craft file with hashes that has original hash in 2
> fields: in hash position and in gecos position. `john --show` prints
> gecos unmodified so we get original hash and password.
>
> These are methods:
> void MainWindow::callJohnShow()
> void MainWindow::readJohnShow()
>
> Temporary file is populated in
> void MainWindow::showJohnStarted()
>
> Hm, what if we have two "original" forms of 1 hash?... I have to try.
It works fine.
Though I found some other problems:
I use
QString("%1:%2::%3\n").arg(user).arg(hash).arg(hash)
to construct lines of temporary file for `john --show` so if user or
has %1 inside then line is broken and johnny misses the result. %N and
.arg are not suitable for untrusted data and multiple substitutions.
Example from python repl:
>>> from PyQt4.QtCore import *
>>> QString("%1 %2").arg("%1").arg("asdf")
PyQt4.QtCore.QString(u'asdf %2')
Also I found that temporary files is not removed if program is closed
by ^C on terminal. I guess other signals are handled bad too.
Thanks!
--
Regards,
Aleksey Cherepanov
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
