Ethereum json file and ethereum aes.json file

[philsmd]

I think a diff (patch) to the source code like this could work in the case of shorter ciphertext length and therefore solve the github issue #2017 on https://github.com/hashcat/hashcat/issues/2017 :

patch_ethereum_15700_github_2017_base64.diff

Code:

ZGlmZiAtLWdpdCBhL09wZW5DTC9tMTU3MDAtcHVyZS5jbCBiL09wZW5DTC9tMTU3MDAtcHVyZS5jbAppbmRleCBjM2UzMmZhZTkuLjg0ZWY2ZGQ1NCAxMDA2NDQKLS0tIGEvT3BlbkNML20xNTcwMC1wdXJlLmNsCisrKyBiL09wZW5DTC9tMTU3MDAtcHVyZS5jbApAQCAtNDQsNyArNDQsOSBAQCBpbmxpbmUgX19kZXZpY2VfXyB1aW50NCByb3RhdGUgKGNvbnN0IHVpbnQ0IGEsIGNvbnN0IGludCBuKQogdHlwZWRlZiBzdHJ1Y3QgZXRoZXJldW1fc2NyeXB0CiB7CiAgIHUzMiBzYWx0X2J1ZlsxNl07Ci0gIHUzMiBjaXBoZXJ0ZXh0WzhdOworICB1MzIgY2lwaGVydGV4dFs5XTsKKworICB1MzIgY2lwaGVydGV4dF9sZW47CiAKIH0gZXRoZXJldW1fc2NyeXB0X3Q7CiAKQEAgLTU5OSw3ICs2MDEsNyBAQCBLRVJORUxfRlEgdm9pZCBtMTU3MDBfY29tcCAoS0VSTl9BVFRSX1RNUFNfRVNBTFQgKHNjcnlwdF90bXBfdCwgZXRoZXJldW1fc2NyeXB0XwogICAgKiBrZWNjYWsKICAgICovCiAKLSAgdTMyIGNpcGhlcnRleHRbOF07CisgIHUzMiBjaXBoZXJ0ZXh0WzldOwogCiAgIGNpcGhlcnRleHRbMF0gPSBlc2FsdF9idWZzW0RJR0VTVFNfT0ZGU0VUXS5jaXBoZXJ0ZXh0WzBdOwogICBjaXBoZXJ0ZXh0WzFdID0gZXNhbHRfYnVmc1tESUdFU1RTX09GRlNFVF0uY2lwaGVydGV4dFsxXTsKQEAgLTYwOSw2ICs2MTEsNyBAQCBLRVJORUxfRlEgdm9pZCBtMTU3MDBfY29tcCAoS0VSTl9BVFRSX1RNUFNfRVNBTFQgKHNjcnlwdF90bXBfdCwgZXRoZXJldW1fc2NyeXB0XwogICBjaXBoZXJ0ZXh0WzVdID0gZXNhbHRfYnVmc1tESUdFU1RTX09GRlNFVF0uY2lwaGVydGV4dFs1XTsKICAgY2lwaGVydGV4dFs2XSA9IGVzYWx0X2J1ZnNbRElHRVNUU19PRkZTRVRdLmNpcGhlcnRleHRbNl07CiAgIGNpcGhlcnRleHRbN10gPSBlc2FsdF9idWZzW0RJR0VTVFNfT0ZGU0VUXS5jaXBoZXJ0ZXh0WzddOworICBjaXBoZXJ0ZXh0WzhdID0gZXNhbHRfYnVmc1tESUdFU1RTX09GRlNFVF0uY2lwaGVydGV4dFs4XTsKIAogICB1MzIga2V5WzRdOwogCkBAIC02MjUsNyArNjI4LDcgQEAgS0VSTkVMX0ZRIHZvaWQgbTE1NzAwX2NvbXAgKEtFUk5fQVRUUl9UTVBTX0VTQUxUIChzY3J5cHRfdG1wX3QsIGV0aGVyZXVtX3NjcnlwdF8KICAgc3RbIDNdID0gaGwzMl90b182NF9TIChjaXBoZXJ0ZXh0WzNdLCBjaXBoZXJ0ZXh0WzJdKTsKICAgc3RbIDRdID0gaGwzMl90b182NF9TIChjaXBoZXJ0ZXh0WzVdLCBjaXBoZXJ0ZXh0WzRdKTsKICAgc3RbIDVdID0gaGwzMl90b182NF9TIChjaXBoZXJ0ZXh0WzddLCBjaXBoZXJ0ZXh0WzZdKTsKLSAgc3RbIDZdID0gMHgwMTsKKyAgc3RbIDZdID0gaGwzMl90b182NF9TICggICAgICAgICAgICAwLCBjaXBoZXJ0ZXh0WzhdKTsKICAgc3RbIDddID0gMDsKICAgc3RbIDhdID0gMDsKICAgc3RbIDldID0gMDsKZGlmZiAtLWdpdCBhL3NyYy9tb2R1bGVzL21vZHVsZV8xNTcwMC5jIGIvc3JjL21vZHVsZXMvbW9kdWxlXzE1NzAwLmMKaW5kZXggYjU0YjkyMmI4Li5lMGMzYjI1NzMgMTAwNjQ0Ci0tLSBhL3NyYy9tb2R1bGVzL21vZHVsZV8xNTcwMC5jCisrKyBiL3NyYy9tb2R1bGVzL21vZHVsZV8xNTcwMC5jCkBAIC00Niw3ICs0Niw5IEBAIGNvbnN0IGNoYXIgKm1vZHVsZV9zdF9wYXNzICAgICAgICAoTUFZQkVfVU5VU0VEIGNvbnN0IGhhc2hjb25maWdfdCAqaGFzaGNvbmZpZywKIHR5cGVkZWYgc3RydWN0IGV0aGVyZXVtX3NjcnlwdAogewogICB1MzIgc2FsdF9idWZbMTZdOwotICB1MzIgY2lwaGVydGV4dFs4XTsKKyAgdTMyIGNpcGhlcnRleHRbOV07CisKKyAgdTMyIGNpcGhlcnRleHRfbGVuOwogCiB9IGV0aGVyZXVtX3NjcnlwdF90OwogCkBAIC0zMzcsNyArMzM5LDcgQEAgaW50IG1vZHVsZV9oYXNoX2RlY29kZSAoTUFZQkVfVU5VU0VEIGNvbnN0IGhhc2hjb25maWdfdCAqaGFzaGNvbmZpZywgTUFZQkVfVU5VU0UKICAgICAgICAgICAgICAgICAgICB8IFRPS0VOX0FUVFJfVkVSSUZZX0hFWDsKIAogICB0b2tlbi5zZXBbNV0gICAgID0gJyonOwotICB0b2tlbi5sZW5fbWluWzVdID0gNjQ7CisgIHRva2VuLmxlbl9taW5bNV0gPSAzMjsKICAgdG9rZW4ubGVuX21heFs1XSA9IDY0OwogICB0b2tlbi5hdHRyWzVdICAgID0gVE9LRU5fQVRUUl9WRVJJRllfTEVOR1RICiAgICAgICAgICAgICAgICAgICAgfCBUT0tFTl9BVFRSX1ZFUklGWV9IRVg7CkBAIC0zODksMTUgKzM5MSwxNyBAQCBpbnQgbW9kdWxlX2hhc2hfZGVjb2RlIChNQVlCRV9VTlVTRUQgY29uc3QgaGFzaGNvbmZpZ190ICpoYXNoY29uZmlnLCBNQVlCRV9VTlVTRQogICAvLyBjaXBoZXJ0ZXh0CiAKICAgY29uc3QgdTggKmNpcGhlcnRleHRfcG9zID0gdG9rZW4uYnVmWzVdOworICBjb25zdCBpbnQgY2lwaGVydGV4dF9sZW4gPSB0b2tlbi5sZW5bNV07CisKKyAgaWYgKChjaXBoZXJ0ZXh0X2xlbiAlIDIpICE9IDApIHJldHVybiAoUEFSU0VSX0hBU0hfTEVOR1RIKTsKKworICB1OCAqY2lwaGVydGV4dF9wdHIgPSAodTggKikgZXRoZXJldW1fc2NyeXB0LT5jaXBoZXJ0ZXh0OworCisgIGNvbnN0IGludCBjaXBoZXJfbGVuID0gaGV4X2RlY29kZSAoY2lwaGVydGV4dF9wb3MsIGNpcGhlcnRleHRfbGVuLCBjaXBoZXJ0ZXh0X3B0cik7CiAKLSAgZXRoZXJldW1fc2NyeXB0LT5jaXBoZXJ0ZXh0WzBdID0gaGV4X3RvX3UzMiAoKGNvbnN0IHU4ICopICZjaXBoZXJ0ZXh0X3Bvc1sgMF0pOwotICBldGhlcmV1bV9zY3J5cHQtPmNpcGhlcnRleHRbMV0gPSBoZXhfdG9fdTMyICgoY29uc3QgdTggKikgJmNpcGhlcnRleHRfcG9zWyA4XSk7Ci0gIGV0aGVyZXVtX3NjcnlwdC0+Y2lwaGVydGV4dFsyXSA9IGhleF90b191MzIgKChjb25zdCB1OCAqKSAmY2lwaGVydGV4dF9wb3NbMTZdKTsKLSAgZXRoZXJldW1fc2NyeXB0LT5jaXBoZXJ0ZXh0WzNdID0gaGV4X3RvX3UzMiAoKGNvbnN0IHU4ICopICZjaXBoZXJ0ZXh0X3Bvc1syNF0pOwotICBldGhlcmV1bV9zY3J5cHQtPmNpcGhlcnRleHRbNF0gPSBoZXhfdG9fdTMyICgoY29uc3QgdTggKikgJmNpcGhlcnRleHRfcG9zWzMyXSk7Ci0gIGV0aGVyZXVtX3NjcnlwdC0+Y2lwaGVydGV4dFs1XSA9IGhleF90b191MzIgKChjb25zdCB1OCAqKSAmY2lwaGVydGV4dF9wb3NbNDBdKTsKLSAgZXRoZXJldW1fc2NyeXB0LT5jaXBoZXJ0ZXh0WzZdID0gaGV4X3RvX3UzMiAoKGNvbnN0IHU4ICopICZjaXBoZXJ0ZXh0X3Bvc1s0OF0pOwotICBldGhlcmV1bV9zY3J5cHQtPmNpcGhlcnRleHRbN10gPSBoZXhfdG9fdTMyICgoY29uc3QgdTggKikgJmNpcGhlcnRleHRfcG9zWzU2XSk7CisgIGNpcGhlcnRleHRfcHRyW2NpcGhlcl9sZW5dID0gMHgwMTsgLy8gYWRkIDB4MDEgYXQgdGhlIGVuZAorCisgIGV0aGVyZXVtX3NjcnlwdC0+Y2lwaGVydGV4dF9sZW4gPSAodTMyKSBjaXBoZXJfbGVuOwogCiAgIC8vIGhhc2gKIApAQCAtNDI3LDIwICs0MzEsMTggQEAgaW50IG1vZHVsZV9oYXNoX2VuY29kZSAoTUFZQkVfVU5VU0VEIGNvbnN0IGhhc2hjb25maWdfdCAqaGFzaGNvbmZpZywgTUFZQkVfVU5VU0UKIAogICBldGhlcmV1bV9zY3J5cHRfdCAqZXRoZXJldW1fc2NyeXB0ID0gKGV0aGVyZXVtX3NjcnlwdF90ICopIGVzYWx0X2J1ZjsKIAotICBjb25zdCBpbnQgbGluZV9sZW4gPSBzbnByaW50ZiAobGluZV9idWYsIGxpbmVfc2l6ZSwgIiVzKiV1KiV1KiV1KiVzKiUwOHglMDh4JTA4eCUwOHglMDh4JTA4eCUwOHglMDh4KiUwOHglMDh4JTA4eCUwOHglMDh4JTA4eCUwOHglMDh4IiwKKyAgLy8gY2lwaGVydGV4dDoKKyAgY2hhciBjaXBoZXJ0ZXh0X2hleFs2NCArIDFdID0geyAwIH07CisKKyAgaGV4X2VuY29kZSAoKGNvbnN0IHU4ICopIGV0aGVyZXVtX3NjcnlwdC0+Y2lwaGVydGV4dCwgKGNvbnN0IGludCkgZXRoZXJldW1fc2NyeXB0LT5jaXBoZXJ0ZXh0X2xlbiwgKHU4ICopIGNpcGhlcnRleHRfaGV4KTsKKworICBjb25zdCBpbnQgbGluZV9sZW4gPSBzbnByaW50ZiAobGluZV9idWYsIGxpbmVfc2l6ZSwgIiVzKiV1KiV1KiV1KiVzKiVzKiUwOHglMDh4JTA4eCUwOHglMDh4JTA4eCUwOHglMDh4IiwKICAgICBTSUdOQVRVUkVfRVRIRVJFVU1fU0NSWVBULAogICAgIHNhbHQtPnNjcnlwdF9OLAogICAgIHNhbHQtPnNjcnlwdF9yLAogICAgIHNhbHQtPnNjcnlwdF9wLAogICAgIChjaGFyICopIHRtcF9zYWx0LAotICAgIGJ5dGVfc3dhcF8zMiAoZXRoZXJldW1fc2NyeXB0LT5jaXBoZXJ0ZXh0WzBdKSwKLSAgICBieXRlX3N3YXBfMzIgKGV0aGVyZXVtX3NjcnlwdC0+Y2lwaGVydGV4dFsxXSksCi0gICAgYnl0ZV9zd2FwXzMyIChldGhlcmV1bV9zY3J5cHQtPmNpcGhlcnRleHRbMl0pLAotICAgIGJ5dGVfc3dhcF8zMiAoZXRoZXJldW1fc2NyeXB0LT5jaXBoZXJ0ZXh0WzNdKSwKLSAgICBieXRlX3N3YXBfMzIgKGV0aGVyZXVtX3NjcnlwdC0+Y2lwaGVydGV4dFs0XSksCi0gICAgYnl0ZV9zd2FwXzMyIChldGhlcmV1bV9zY3J5cHQtPmNpcGhlcnRleHRbNV0pLAotICAgIGJ5dGVfc3dhcF8zMiAoZXRoZXJldW1fc2NyeXB0LT5jaXBoZXJ0ZXh0WzZdKSwKLSAgICBieXRlX3N3YXBfMzIgKGV0aGVyZXVtX3NjcnlwdC0+Y2lwaGVydGV4dFs3XSksCisgICAgY2lwaGVydGV4dF9oZXgsCiAgICAgYnl0ZV9zd2FwXzMyIChkaWdlc3RbMF0pLAogICAgIGJ5dGVfc3dhcF8zMiAoZGlnZXN0WzFdKSwKICAgICBieXRlX3N3YXBfMzIgKGRpZ2VzdFsyXSksCmRpZmYgLS1naXQgYS90b29scy90ZXN0X21vZHVsZXMvbTE1NzAwLnBtIGIvdG9vbHMvdGVzdF9tb2R1bGVzL20xNTcwMC5wbQppbmRleCA4OTZjZTY2ZTUuLjgzN2NmYjYxMiAxMDA2NDQKLS0tIGEvdG9vbHMvdGVzdF9tb2R1bGVzL20xNTcwMC5wbQorKysgYi90b29scy90ZXN0X21vZHVsZXMvbTE1NzAwLnBtCkBAIC0yMCw3ICsyMCw3IEBAIHN1YiBtb2R1bGVfZ2VuZXJhdGVfaGFzaAogICBteSAkc2NyeXB0X04gICA9IHNoaWZ0IHx8IDEwMjQgOyAjIDI2MjE0NCBvcmlnaW5hbGx5CiAgIG15ICRzY3J5cHRfciAgID0gc2hpZnQgfHwgMTsgIyA4IG9yaWdpbmFsbHkKICAgbXkgJHNjcnlwdF9wICAgPSBzaGlmdCB8fCAxOwotICBteSAkY2lwaGVydGV4dCA9IHNoaWZ0IHx8IHJhbmRvbV9ieXRlcyAoMzIpOworICBteSAkY2lwaGVydGV4dCA9IHNoaWZ0IHx8IHJhbmRvbV9ieXRlcyAocmFuZG9tX251bWJlciAoMTYsIDMyKSk7CiAKICAgbXkgJGRlcml2ZWRfa2V5ID0gc2NyeXB0X3JhdyAoJHdvcmQsICRzYWx0LCAkc2NyeXB0X04sICRzY3J5cHRfciwgJHNjcnlwdF9wLCAzMik7CiAK

to apply this patch:

Code:

git clone https://github.com/hashcat/hashcat hashcat_15700_mod
cd hashcat_15700_mod
git checkout 15bf8b7302fd2febd93845eb26d60efed6255bae
base64 -d patch_ethereum_15700_github_2017_base64.diff > patch_ethereum_15700_github_2017.diff
git apply patch_ethereum_15700_github_2017.diff
make
./hashcat -m 15700 -b

(use hashcat.exe instead of ./hashcat for windows)

the patch above is in base64 encoded format, otherwise the forum software or pastebin etc add some whitespace problems such that the patch can't be applied. Therefore it needs to be base64 decoded first (base64 -d of patch_ethereum_15700_github_2017_base64.diff to patch_ethereum_15700_github_2017.diff)

Of course you need to make sure that you do not confuse this hashcat_15700_mod modified hashcat version with other release (or beta) version of hashcat. remember that it's a modified/patched version

Of course this would need to be tested with several keystore files to make sure it doesn't break anything and at the same time also works with the keystore files with shorter ciphertext lengths.

Please test

update: I've updated the patch above to add tests with much shorter ciphertext lengths and corrected the keccak computation in the kernel after I've discovered that some shorter lengths failed (should be fixed now)