About exclude symbol

[AlexH]

Hello!
I have a question about how to delete characters from mask attack.
I know that the password is 8 characters long and I've already checked oclHashcat the options ?d?l with no luck. now I want to check the ?d?l?u mask but do not check the numbers and small letters(?d?l).
Is it possible?

[undeath]

so you want to run all 8 char words which contain at least one upper letter?

[AlexH]

no one it may contain 8 letter
i use this args to run oclhashcat -m0 -a3 -1 ?l?d ?1?1?1?1?1?1?1?1

i want -m0 -a3 -1 ?l?u?d ?1?1?1?1?1?1?1?1
but exclude -1 ?l?d ?1?1?1?1?1?1?1?1

[philsmd]

If I understood this correctly, I think there is a way to remove the already checked keyspace.

I think mathematically one would say there is an intersection between ?l?u?d and ?l?d and the new set of (sub-)masks (=> keyspaces) you want to check now is basically:

Code:

?l?u?d - (?l?u?d ∩ ?l?d) = ?l?u?d - ?l?d

This means you want to remove from the new keyspace the keyspace that intersects the new and old one, basically this one:



It is possible for instance to generate a mask-file (.hcmask, http://hashcat.net/wiki/doku.php?id=mask...mask_files ) that contains all the (sub-)masks which are not in (?l?u?d ∩ ?l?d), for instance:

Code:

./mp64.bin -1 lud ???1???1???1???1???1???1???1???1 > all.txt
./mp64.bin -1 ld ???1???1???1???1???1???1???1???1 > ld.txt
while read i; do fgrep $i ld.txt > /dev/null || echo $i; done < all.txt > mymask.hcmask

(Note: mp64.bin is the maskprocessor: http://hashcat.net/wiki/doku.php?id=maskprocessor )

basically the while loop removes from the full list of (sub-)mask of ?l?u?d, all masks that intersect (I use while combined w/ fgrep here, but other tools can do this too).

It would be interesting to know how much faster it is to use this mask-file approach vs full ?l?u?d (I mean if the overhead of mask-files, should be minimal, does add much to the overall time, i.e. if the time of running ?l?u?d is almost the same as running ?l?d + intersection above).

There may be other approaches too, maybe w/o the use of maskprocessor.... but this seems to work very well...
It would be great to hear other ideas too.

UPDATE: corrected image since ?l?d is a subset of ?l?u?d

[AlexH]

Yes, philsmd, understand correct.