+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Deprecated; Previous versions (https://hashcat.net/forum/forum-29.html)
+--- Forum: Old oclHashcat Support (https://hashcat.net/forum/forum-38.html)
+--- Thread: About exclude symbol (/thread-3051.html)
About exclude symbol - AlexH - 01-20-2014
Hello!
I have a question about how to delete characters from mask attack.
I know that the password is 8 characters long and I've already checked oclHashcat the options ?d?l with no luck. now I want to check the ?d?l?u mask but do not check the numbers and small letters(?d?l).
Is it possible?
RE: About exclude symbol - undeath - 01-20-2014
so you want to run all 8 char words which contain at least one upper letter?
RE: About exclude symbol - AlexH - 01-20-2014
no one it may contain 8 letter
i use this args to run oclhashcat -m0 -a3 -1 ?l?d ?1?1?1?1?1?1?1?1
i want -m0 -a3 -1 ?l?u?d ?1?1?1?1?1?1?1?1
but exclude -1 ?l?d ?1?1?1?1?1?1?1?1
RE: About exclude symbol - philsmd - 01-20-2014
If I understood this correctly, I think there is a way to remove the already checked keyspace.
I think mathematically one would say there is an intersection between ?l?u?d and ?l?d and the new set of (sub-)masks (=> keyspaces) you want to check now is basically:
Code:
?l?u?d - (?l?u?d ∩ ?l?d) = ?l?u?d - ?l?dThis means you want to remove from the new keyspace the keyspace that intersects the new and old one, basically this one:
![[Image: qorKzO8.png]](http://i.imgur.com/qorKzO8.png)
It is possible for instance to generate a mask-file (.hcmask, http://hashcat.net/wiki/doku.php?id=mask_attack#hashcat_mask_files ) that contains all the (sub-)masks which are not in (?l?u?d ∩ ?l?d), for instance:
Code:
./mp64.bin -1 lud ???1???1???1???1???1???1???1???1 > all.txt
./mp64.bin -1 ld ???1???1???1???1???1???1???1???1 > ld.txt
while read i; do fgrep $i ld.txt > /dev/null || echo $i; done < all.txt > mymask.hcmask(Note: mp64.bin is the maskprocessor: http://hashcat.net/wiki/doku.php?id=maskprocessor )
basically the while loop removes from the full list of (sub-)mask of ?l?u?d, all masks that intersect (I use while combined w/ fgrep here, but other tools can do this too).
It would be interesting to know how much faster it is to use this mask-file approach vs full ?l?u?d (I mean if the overhead of mask-files, should be minimal, does add much to the overall time, i.e. if the time of running ?l?u?d is almost the same as running ?l?d + intersection above).
There may be other approaches too, maybe w/o the use of maskprocessor.... but this seems to work very well...
It would be great to hear other ideas too.
UPDATE: corrected image since ?l?d is a subset of ?l?u?d
RE: About exclude symbol - AlexH - 01-20-2014
Yes, philsmd, understand correct.