john-users - --salts vs --salt-list... and a tiny fix

Openwall wordlists collection for password cracking (20+ languages)
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 01 Feb 2011 13:29:28 +0100
From: magnum <rawsmooth@...dband.net>
To: john-users@...ts.openwall.com
Subject: --salts vs --salt-list... and a tiny fix

The (jumbo patch option) --salt-list is very buggy. I never noticed 
until now but it's mentioned before on this list. In fact I can't get to 
work at all with eg. DES and MD5, it just segfaults. It would be nice to 
have this fixed but unfortunately I'm not able to contribute.

So we're stuck with the --salts option. The problem with this one is 
that if you resume a job, the remaining number of salts have likely 
decreased. If you picked the most frequent hash, chances are the job 
will resume with no hashes loaded. If you picked a lower minimum or a 
range, it will load hashes but you can't really predict the behaviour - 
it will resume on a different set (or at best a subset) of the hashes 
than what was used before stopping the job.

I just had a look at this and found out that if you just swap two lines 
in loader.c, john will apply the --salts threshold (or range) before 
nuking already cracked passwords. Some testing indicate it doesn't have 
any ill side-effects but I am not 100% sure about all possible cases.

I'm not sure everybody wants it this way though? Personally I sure do.

magnum

diff --git a/src/loader.c b/src/loader.c
index 202bf2f..6aa861d 100644
--- a/src/loader.c
+++ b/src/loader.c
@@ -844,8 +844,8 @@ void ldr_fix_database(struct db_main *db)
 	MEM_FREE(db->password_hash);
 	MEM_FREE(db->salt_hash);
 
-	ldr_remove_marked(db);
 	ldr_filter_salts(db);
+	ldr_remove_marked(db);
 
 	ldr_init_hash(db);