john-users - Re: External mode: keyboard

Openwall wordlists collection for password cracking (20+ languages)
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 10 Jun 2012 21:43:07 +0200
From: Frank Dittrich <frank_dittrich@...mail.com>
To: john-users@...ts.openwall.com
Subject: Re: External mode: keyboard

On 06/10/2012 09:04 PM, madfran@...-ezine.org wrote:
> I am using jtr 1.7.9 jumbo.

Which jumbo version?
1.7.9-jumbo-5?

Please post the output of this command:
./john |head -n 1


> I am trying to modify the external mode keyboard to meet a cyrilic
> keyboard.

What encoding are you using?
CP1251 aka Windows-1251?
Or koi8-r, or something else, like  UTF-8?

For a single byte encoding (cp1251 or koi8-r), creating a cyrillic
keyboard mode should be possible.

Instead of modifying [External:Keyboard], it would have been better to
copy that section to [External:Keyboard-cp1251] or
[External:Keyboard-koi8-r], and adjust the copy.

Then, you could have shared the working result with john-users.

> The modification of the john.conf was done with Microsoft Word and save
> with encoding "Cyrilic Windows"
> See attached part of the modification.
> 
> When I try the following command the system fault.
> 
> # ./john --format=nt2 --external=Keyboard2 --session=key2 list.txt
> Segmentation fault (core dumped)


The segfault should be fixed (not by you).

But I assume when you define a correct external mode for your code page,
no segfault should occur.

> ************************************************************************
> /*
>  * This defines the keyboard layout, by default for a QWERTY keyboard.
>  * Please note that the sizes of m[] and mc[] arrays assume 7-bit
>  * characters and will need to be doubled for 8-bit characters such as
>  * umlauts.
>  */
>     i = 0; while (i < 0x40) k[i++] = 0;
>     k[0] = '`';
>     i = 0; while (++i <= 9) k[i] = '0' + i;
>     k[10] = '0'; k[11] = '-'; k[12] = '=';
>     k[0x11] = '&#1081;'; k[0x12] = '&#1094;'; k[0x13] = '&#1091;';
> k[0x14] = '&#1082;';
>     k[0x15] = '&#1077;'; k[0x16] = '&#1085;'; k[0x17] = '&#1075;';
> k[0x18] = '&#1096;';
>     k[0x19] = '&#1097;'; k[0x1a] = '&#1079;'; k[0x1b] = '&#1093;';
> k[0x1c] = '&#1098;';

All these definitions '&#1096;'... look wrong to me.

Here is you you should proceed:

Find out which code page you use (koi8-r or cp1251).
Here is the code page layout for cp1251:
http://en.wikipedia.org/wiki/Windows-1251

And here the one for koi8-r:

http://en.wikipedia.org/wiki/KOI8-R

To compare your cyrillic keyboard layout with a US QWERTY layout (for
which the [External:Keyboard] mode has been designed), look here:

http://en.wikipedia.org/wiki/Keyboard_layout

Replace the character which is used in the [External:Keyboard] mode with
the one that is positioned at the same place.

To know what to use as replacement, check the correct code page
mentioned above.

for http://en.wikipedia.org/wiki/KOI8-R, you'll find this information
for б (lower case cyrillic b):
0431
194
You need to remenber the 194.

If you use the Russian Windows keyboard layout, this letter is located
where the comma ',' is located on the US-American keyboard.

So, change

k[0x38] = ',';

in the [External:Keyboard] section to

k[0x38] = 194;

You can also use the hexadecimal value C2, because 0xc2 = 194.
If you prefer that notation, use

k[0x38] = 0xc2;

instead.


Frank