Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 7 Nov 2014 14:55:16 +0300
From: Aleksey Cherepanov <>
Subject: Re: [RFC] Johnny further development proposal

On Wed, Oct 29, 2014 at 01:56:05PM +0300, Aleksey Cherepanov wrote:
> On Wed, Oct 08, 2014 at 09:58:27AM +0300, Shinnok wrote:
> > 2. Fix any outstanding bugs or crashes (crash on exit while john is running,
> > pause not working, etc..)
> I hope there are no outstanding bugs or crashes at the moment. I think
> the crash on exit was due to multithreading. I avoided threading in
> 2012. So I think Johnny does not crash anymore, right?
> The threading was intended to unfreeze ui when john produces a lot of
> output. But there was a problem: the main load is not from the output
> itself but it is from handling the output (including placing it into
> the table). I've added hash table and the other way to get output
> (using `john --show` and temporary file) so the handling is really
> fast. It could be improved further but one should move the whole
> handling into other thread, it looks unnecessary complex.
> `john --show` needs more explanations: it prints hashes in john's
> canonical form (as they are stored in .pot file) but we have
> original form in the table (these forms are not always equal). To
> solve this, we craft file with hashes that has original hash in 2
> fields: in hash position and in gecos position. `john --show` prints
> gecos unmodified so we get original hash and password.
> These are methods:
> void MainWindow::callJohnShow()
> void MainWindow::readJohnShow()
> Temporary file is populated in
> void MainWindow::showJohnStarted()
> Hm, what if we have two "original" forms of 1 hash?... I have to try.

It works fine.

Though I found some other problems:

I use
to construct lines of temporary file for `john --show` so if user or
has %1 inside then line is broken and johnny misses the result. %N and
.arg are not suitable for untrusted data and multiple substitutions.

Example from python repl:
>>> from PyQt4.QtCore import *
>>> QString("%1 %2").arg("%1").arg("asdf")
PyQt4.QtCore.QString(u'asdf %2')

Also I found that temporary files is not removed if program is closed
by ^C on terminal. I guess other signals are handled bad too.


Aleksey Cherepanov

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.