Issue with character class command ~e?C

[b8vr]

There's a minor issue with the new character class command ~e?C

The following 3 uses of the command works as expected:

echo p@ssW0rd | hashcat --stdout -j '~e?d' P@ssw0Rd

echo p@ssW0rd | hashcat --stdout -j '~e?s' P@Ssw0rd

echo p@ssWord | hashcat --stdout -j '~e?u' (I replaced 0 with o to emphazise the result) P@ssWOrd

But with character class ?l: echo p@ssW0rd | hashcat --stdout -j '~e?l' P@ssW0rd

In the last case I would expect the following: P@sSW0rD

With character class ?H: echo abCDefGHij | hashcat --stdout -j '~e?H' AbCDEfghij

Works ish', but used on a word that contains characters not in A-F, I would not expect it to lowercase them. I would expect: AbCDEfGHij

With character class ?h: echo abCDefGHijKL | hashcat --stdout -j '~e?h' AbCdefGhijkl

With ?h I would expect: AbCDeFGHij

On https://hashcat.net/wiki/doku.php?id=rule_based_attack in the description of the command, it says:

Capitalize the rst letter and every letter following a character from class C

I suggest changing it to:

Capitalize the first letter and every first letter following a character from class C

[coiseiw]

I have looked at your issue and got to another understanding. The behaviour I have observed would match with the following definition: Capitalize the first letter and every other letter "x" following a character of class C except if this letter "x" is also from class C

So if we take your example: echo p@ssW0rd | hashcat --stdout -j '~e?l' P@ssW0rd You expect to get P@sSW0rD therefore that the second s and the d are capitalised while they are not in the hashcat output. Considering the definition I gave above, those two letters are capitalised as they belong to the class ?l themselves.

I ahve checked with many example and for example echo -n hashcat | hashcat --stdout -j '~e?l' Hashcat According to the definition given above, it properly capitalised the first one but no other letters as they all belong to ?l

So to my opinion, either the explanation of the rule can be refined specifying that letter belonging to the class should not be capitalised, or the rule itself needs to be modified to match the current definition.

[matrix]

@b8vr look here

$ echo p@ssW0rd | ./hashcat --stdout -j '~e?l'
P@ssW0rd
$ cat r.rule 
~e?l
$ echo p@ssW0rd | ./hashcat --stdout -r r.rule 
P@sSW0rD

[b8vr]

Good catch @matrix

So no matter how the rule is supposed to be interpreted, it seems to behave differently between the CPU rule engine and the GPU rule engine, right?

[b8vr]

There are actually more issues here:

$ echo hAShcAt | hashcat --stdout -j '~e?u' HASHcAT

$ cat test.rule ~e?u

$ echo hAShcAt | hashcat --stdout -r test.rule HaSHcaT

[matrix]

Good catch @matrix

So no matter how the rule is supposed to be interpreted, it seems to behave differently between the CPU rule engine and the GPU rule engine, right?

Using -r is the way