john-users - Re: Overstrike rule with UTF-8 characters?

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 19 Aug 2015 03:47:08 -0500
From: nyxgeek <nyxgeek@...abs.co>
To: "john-users@...ts.openwall.com" <john-users@...ts.openwall.com>
Subject: Re: Overstrike rule with UTF-8 characters?

Thanks everyone for the feedback!

After this year's Crack Me If You Can contest by KoreLogic at DefCon I have been focusing on UTF-8. 

I have been publishing my rules at

https://github.com/nyxgeek/nyxgeek-rules

They are a work-in-progress. If anybody would like to contribute, just let me know.

Thanks again,

nyxgeek

> On Aug 16, 2015, at 2:16 PM, Frank Dittrich <frank.dittrich@...lbox.org> wrote:
> 
>> On 08/16/2015 09:08 PM, Solar Designer wrote:
>> As an alternative to magnum's response:
>> 
>>> On Sun, Aug 16, 2015 at 07:50:21AM -0500, nyxgeek wrote:
>>> Unicode is possible in other areas with John rules.  For example, I can do the following, and it works to INSERT:
>>> 
>>> <* >\r[00123456789] A\p[z0-9]"\xc3\x94"
>> 
>> BTW, you can shorten this to:
>> 
>> <* >\r[00-9] A\p[z0-9]"\xc3\x94"
>> 
>> and actually the same approach works for overstriking as well.  You just
>> need to delete the two "characters" you want to overstrike first:
>> 
>>> [0-9A-F] D\0 D\0 A\0"\xc3\x94"
> 
> In case you want to overwrite an ascii character, e.g., an 'o', don't
> delete two bytes, but just one:
> 
>> [0-9A-F] D\0 A\0"\xc3\x94"
> 
> Ot, of you want to overwrite an 'o':
> /o Dp Ap"\xc3\x94"
> 
> Frank

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.