Keyboard layout mapping

Description

--keyboard-layout-mapping reproduces the way TrueCrypt and VeraCrypt system encryption treat the keyboard. Pre-boot authentication happens before the operating system loads, so the firmware reads the keyboard as a US layout whatever is printed on the keys.

Both programs handle this at setup time by switching the system to the US layout while their password prompt is open, so the bytes stored match the bytes the bootloader will later see. The consequence for cracking is that the password you are guessing is not the password the owner typed: it is what those keystrokes produce under a US layout.

A German keyboard is QWERTZ, so y and z trade places and most symbols move. For a non-Latin layout the difference is total, and an Arabic phrase comes out as an unrelated run of Latin characters.

Using it

You need to know which physical layout the password was typed on. The tables ship in tables/layouts:

$ hashcat -m 29461 hash.txt wordlist.txt --keyboard-layout-mapping tables/layouts/de.table

Fourteen ship: ch_de, ch_fr, da, de, it, ru and se, each with a -reverse partner mapping the other way.

Without the right one the attack runs to exhaustion and finds no plain even when the password is in your wordlist.

TrueCrypt and VeraCrypt reject Alt and AltGr during password entry, so characters that need them cannot be in the password at all. On a German layout that rules out @, [, ], \, |, {, } and ~.

A mapping only covers characters reachable unmodified or with Shift, and a character with no mapping is passed through unchanged.

Adding a layout

Not every layout ships, and closely related ones still differ: UK and US English need separate tables. The upstream document explains how to record one by typing every character-producing key in order under both layouts, and pull requests for missing tables are welcome.

Full documentation

Except where otherwise noted, content on this wiki is licensed under the following license: Public Domain