hashcat Forum
how to deal with synonymous rules? - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Deprecated; Previous versions (https://hashcat.net/forum/forum-29.html)
+--- Forum: General Help (https://hashcat.net/forum/forum-8.html)
+--- Thread: how to deal with synonymous rules? (/thread-4627.html)



how to deal with synonymous rules? - forumhero - 08-22-2015

Using --generate-rules with 1,000,000 created many rules. The issue I'm seeing is that several rules do the same thing.

Example (Baseword:GeneratedRule:MangledBaseword)
Code:
password:$_.BE:Password_
password:$_ u E:Password_
password:c T8 i8_:Password_
password:$_ u E:Password_
password:i8_ E:Password_
password:x36 $_ c:Password_
I've tried using cleanup.rule from hashcat utilities but did not help. Perhaps I used it wrong? Any advice how to clean this up?


RE: how to deal with synonymous rules? - atom - 08-23-2015

Wait, the output of a rule does not only depend on the rule itself, it also depends on the input word. For example if the input word is "password" as in your example, those rules do the same:

[/quote]
password:$_ E:Password_
password:i8_ E:Password_
[/quote]

But if the input word is "hello", the ruleas do the following:

Quote:hello:$_ E:Hello_
hello:i8_ E:Hello

That's why there's no way to automatically recognize if a rule really does the same thing. There's only one thing you can really do, that is if you find out if a rule is doing exactly the same thing as an other rule and then sort it out. There's an extra tool "rules_optimize" that comes with oclHashcat in the extra/ folder that removes unused function calls. After using this you get a bit a better sort -u hitrate. Read here for details: http://hashcat.net/forum/thread-3133.html

Btw, the cleanup-rule from hashcat-utils is not used for this task at all. It's used for sorting out rules that work on CPU but not on GPU.