1	Wordlist rules syntax (hashcat extensions).
2
3John 1.9.0-jumbo-1 has added new rules syntax (and some slightly different
4rules processing logic), so that hashcat rules are handled 100% identical
5to how hashcat processes them (on CPU).
6
7New .conf file flags added.
8
9There are 2 new 'flags' added.  These tell both the config loader (part of
10john which loads the .conf files), how to process things a bit differently,
11and tells the rules engine that the rules processing should be done fully
12using hashcat logic (or not).  These flags are:
13
14!! hashcat logic ON
15!! hashcat logic OFF
16
17Normally, the hashcat rules files should be included into John's configuration
18and the best way to do this is to add lines to a john-local.conf file that
19you create (or update) that is either in the current working directory or
20in the run directory where the john program is located.  Within this file,
21one simply creates include sections, like this:
22
23[List.Rules:HC_dive]
24!! hashcat logic ON
25.include '/code/hashcat/rules/dive.rule'
26!! hashcat logic OFF
27
28[List.Rules:HC_deadone]
29!! hashcat logic ON
30.include '/code/hashcat//rules/d3ad0ne.rule'
31!! hashcat logic OFF
32
33... etc.
34
35Within hashcat mode, there is no rules preprocessor.  So rules such as [ and ]
36which would NORMALLY require quoting such as \[ or \] no longer require
37quoting.  Also, there are no 'character classes' within hashcat logic, so
38the ? will be usable as is :  such as  $? where in John's normal rules, this
39would have to be $??  (for class ?)
40
41Note, the "!! hashcat logic ON" / "!! hashcat logic OFF" do not have to
42be used right before/after a .include statement.  However, be very cautious
43when using '!! hashcat logic ON' pragma lines, as this will cause the
44.conf file loading to fail to load sections, and has other strange side
45effects, if the '!! hashcat logic OFF' is not present, and there might be
46few or no immediately obvious side effects, other than sections which are
47expected to be seen or options that are expected to be changed, are NOT showing
48up or working.
49
50
51	New rules added (many work fine outside of hashcat logic sections).
52
53+-------+------------------+-------+------------+------------------------+-----+
54| Rule  |  Explanation     |Example| Input data |      Output Data       |notes|
55+-------+------------------+-------+------------+------------------------+-----+
56|  pN   | Dup word N times |  p2   | P@ss       |   P@ssP@ssP@ss         |  23 |
57+-------+------------------+-------+------------+------------------------+-----+
58|  RN   | bitshift right   |  R2   | P@ss       |   P@9s                 |  24 |
59+-------+------------------+-------+------------+------------------------+-----+
60|  LN   | bitshift left    |  L1   | P4ss       |   Phss                 |  24 |
61+-------+------------------+-------+------------+------------------------+-----+
62|  k    | swap first 2     |  k    | P@ss       |   @Pss                 |  1  |
63+-------+------------------+-------+------------+------------------------+-----+
64|  K    | swap last 2      |  K    | P@sS       |   P@Ss                 |  1  |
65+-------+------------------+-------+------------+------------------------+-----+
66|  *NM  | swaps N with M   |  M*0m | P@sS       |   S@sP                 |  1  |
67+-------+------------------+-------+------------+------------------------+-----+
68|  +N   | increment char   |  +1   | P@sS       |   PAsS                 |  25 |
69+-------+------------------+-------+------------+------------------------+-----+
70|  -N   | decrement char   |  -1   | P@sS       |   P?sS                 |  1  |
71+-------+------------------+-------+------------+------------------------+-----+
72|  4    | append memory    |  uMl4 | P@ss       |   p@ssP@SS             |  1  |
73+-------+------------------+-------+------------+------------------------+-----+
74|  6    | prepend memory   |  uMl6 | P@ss       |   P@SSp@ss             |  1  |
75+-------+------------------+-------+------------+------------------------+-----+
76|  ONM  | Omit range       |  O34  | 012345678  |   01278                |  1  |
77+-------+------------------+-------+------------+------------------------+-----+
78|  zN   | dupe 1st char    |  z2   | P@sS       |   PPP@sS               |  1  |
79+-------+------------------+-------+------------+------------------------+-----+
80|  ZN   | dupe last char   |  Z2   | P@sS       |   P@sSSS               |  1  |
81+-------+------------------+-------+------------+------------------------+-----+
82|  .N   | replace char N   |  .2   | P@sS       |   P@SS                 |  1  |
83|       | with next char   |       |            |                        |     |
84+-------+------------------+-------+------------+------------------------+-----+
85|  ,N   | replace char N   |  ,2   | P@sS       |   P@@S                 |  1  |
86|       | with prior char  |       |            |                        |     |
87+-------+------------------+-------+------------+------------------------+-----+
88|  yN   | duplicate first  |  y2   | P@sS       |   P@P@sS               |  1  |
89+-------+------------------+-------+------------+------------------------+-----+
90|  YN   | duplicate last   |  Y2   | P@sS       |   P@sSsS               |  1  |
91+-------+------------------+-------+------------+------------------------+-----+
92|  E    | Title case       |  E    | test word  |   Test Word            |  1  |
93+-------+------------------+-------+------------+------------------------+-----+
94|  q    | dupe all chars   |  1    | P@sS       |   PP@@ssSS             |  1  |
95+-------+------------------+-------+------------+------------------------+-----+
96
97Notes:
981. works fully without being in hashcat mode
992. works to a limited extent without being in hashcat mode
1003. p in non hashcat mode is pluralize.  If p is followed by 0 to 9, then it is
101   treated as the hashcat duplicate word, even if not in HC mode.
1024. R and L are keyboard shift R and L if not in hashcat mode.  But in hashcat
103   mode, these are bitshift character at location N.  If R or N are followed by
104   0 to 9 in non hashcat mode, then they are treated as the hashcat rules.
1055. +N does not work in single mode, unless hashcat logic is used.
106