06-02-2016, 08:23 AM
(06-01-2016, 12:19 PM)kefir Wrote: it doesn't seem the author knows the difference between UTF8 and UNICODE.
Unicode is a character set and UTF-8 is one of several encodings that can represent it. So "difference between them" is a weird notion.
(06-01-2016, 12:19 PM)kefir Wrote: If all UTF8 bytes were encoded with a "base code" and a "character code" as in the blog you mentioned, the solution of something like ?1?2?1?2?1?2 for a 3 character password could be possible, as suggested. But how are you going to do this if the alphabet contains characters that are one, two or three bytes long, and you want to crack a password up to 8 characters?
On the other hand, what would be a good solution? The hard part here is defining the syntax: You probably wouldn't want eg. ?s or ?S to represent all specials in Unicode. That would just end up in far too large keyspaces. JtR currently use the legacy notion of "codepage" which is fairly easy to understand (if your internal codepage is CP-1252 and you use ?S, it will include "€") but has some limits (you can't crack a password that includes characters from two different codepages). I would love a better solution but can't think of any.