rules: updated OneRuleToRuleThemStill from 1.1 to 1.3 from upstream

[exploide]

Turns out OneRuleToRuleThemStill.rule got an update some time ago. This PR updates the vendored copy to latest upstream.

[solardiz]

Thank you @exploide! You might also want to consider #5038.

[solardiz]

FWIW, here's how this affects the numbers for All:

0:00:00:00 - 9526968 preprocessed word mangling rules were reduced by dropping 152906 rules
0:00:00:00 - 9374062 preprocessed word mangling rules

0:00:00:00 - 9526153 preprocessed word mangling rules were reduced by dropping 152286 rules
0:00:00:00 - 9373867 preprocessed word mangling rules

Only a slight change, so looks good to me.

The reason I went to check this is to ensure that despite of the introduction of space separators between rule commands in this new revision of OneRuleToRuleThemStill, our code is still able to identify and remove duplicates between this ruleset and the hashcat ruleset, which is also part of All. Most rules in OneRuleToRuleThemStill are expected to also be in hashcat because of this optimized ruleset's heritage.

I also find this introduction of space separators curious - while we squeeze them out at startup, I thought hashcat didn't do that? Don't they still have performance impact for hashcat?

[exploide]

Numbers look reasonable. AFAIK OneRuleToRuleThemStill has been reduced by about 800 duplicate rules.

I'm not familiar with the rule syntax. Didn't test yet whether formatting with spaces could have a performance impact.

[solardiz]

Didn't test yet whether formatting with spaces could have a performance impact.

There's no need to test this with john - we know we squeeze them out at startup, so there should be no further runtime performance impact. We also actively use them for clarity outselves. It's just unusual to see them in a ruleset intended for hashcat, because I think there is performance impact for hashcat.

[exploide]

It's just unusual to see them in a ruleset intended for hashcat, because I think there is performance impact for hashcat.

This made me curious and I performed a test but I'm not able to reproduce a performance regression.

Test setup:

• hashcat v6.2.6
• 1x RTX 3070 Ti + 2x RTX 2080 SUPER
• 300 NT hashes
• 15GB crackstation.txt wordlist
• OneRuleToRuleThemStill with commits stealthsploit/OneRuleToRuleThemStill@dc41688 and stealthsploit/OneRuleToRuleThemStill@b40ceac (right before and after the introduction of spaces)

Both times, the cracking attempt took 24 minutes with around 42700 MH/s.