How to analyse RBT table?

dog-man · Dec 20, 2015

Could some kind person tell me how I can look at the content of my tables and see what chains are in them?

Colibri.DVB · Dec 20, 2015

You need version 1.19e or higher.
The feature will show a list of chains inside your RBT v1.

Activation:
- press <Ctrl> + t
- "Enter test number" will be shown
- for showing a list of chains inside your RBT enter the following number: 53465
- the "Analyze RBT" dialog will be shown
- enter the RBT src file and press the Analyze button

Here is an example of the output:

Code:

start
File length: 16911433728 bytes
   1: prefix:000138
   2: prefix:000160
   3: prefix:000150
   4: prefix:000128
   5: prefix:000108
   6: prefix:000130
   7: prefix:000114
   8: prefix:000134
   9: prefix:00014C
  10: prefix:000120
  11: prefix:000154
  12: prefix:00011C
  13: prefix:00010C
  14: prefix:00015C
  15: prefix:000100
  16: prefix:000110
  17: prefix:000118
  18: prefix:00012C
  19: prefix:000104
  20: prefix:000144
  21: prefix:000164
----------
prefix:000100h, count:4000000h
prefix:000104h, count:4000000h
prefix:000108h, count:4000000h
prefix:00010Ch, count:4000000h
prefix:000110h, count:4000000h
prefix:000114h, count:4000000h
prefix:000118h, count:4000000h
prefix:00011Ch, count:4000000h
prefix:000120h, count:4000000h
prefix:000128h, count:4000000h
prefix:00012Ch, count:4000000h
prefix:000130h, count:4000000h
prefix:000134h, count:4000000h
prefix:000138h, count:4000000h
prefix:000144h, count:4000000h
prefix:00014Ch, count:4000000h
prefix:000150h, count:4000000h
prefix:000154h, count:4000000h
prefix:00015Ch, count:4000000h
prefix:000160h, count:4000000h
prefix:000164h, count:4000000h
done

There first part above the line will show an prefix as soon it was found the first time.
The second part below the line will be displayed after the RBT file reading was finished. It shows additionally how many times the prefix is present in the RBT.
If a chain files was only merged once than the count should be 4000000h. If you have merged it twice by mistake it should show 8000000h.

dog-man · Dec 20, 2015

So it is possible to merge the same chain into a table more than once?

Reason I ask, is that I in partnership with another person made tables of around 460 GB.

I experimented by merging a copy of one of my tables with the ones you recently made available. I assumed that only chains I didn't have would be merged into my table, but it ended up as a table over 800 GB in size much to my amazement.
I am guessing now that I have many duplicated chains in that very large table.

If that is true, is there any way to remove the duplicated chains or must I delete them and make a new chain?

I still have the original copy so no harm done.

pimenta · Dec 20, 2015

Hi, Colibri
Could you share some info about this hidden menus?
Thanks.

Colibri.DVB · Dec 21, 2015

dog-man said:
If that is true, is there any way to remove the duplicated chains or must I delete them and make a new chain?

Since version 1.14 of the tool the merge rainbow tables creates a rainbow table without duplicate chains.
You should verfiy it and check if "count:4000000h" is shown for all prefixes.

pimenta said:
Could you share some info about this hidden menus?

All access codes: http://www.sat-universe.com/showthread.php?t=290751

dog-man · Dec 21, 2015

When I try to analyse a table I get this error???

>start
ERROR: Can't open file "O:\RBT_B8hx030000h" for exclusive reading.

Colibri.DVB · Dec 22, 2015

dog-man said:
When I try to analyse a table I get this error???

>start
ERROR: Can't open file "O:\RBT_B8hx030000h" for exclusive reading.

Make sure that you enter the RBT file name in the field "RBT src file" (and not the RBT dir name).
Try to use
O:\RBT_B8hx030000h\CSA_B8hx030000h_10000h.rbt
instead of
O:\RBT_B8hx030000h

dog-man · Dec 22, 2015

I already did and got same error.

> start
ERROR: Can't open file "O:\RBT_B8hx030000h\CSA_B8x030000h_10000h.rbt" for exclusive reading.

Could it be because I am using windows 10?

gotya · Dec 22, 2015

tested on Win7 Pro / OS 64bit and OK

it does analyze all the chains

thanks Colibri.DVB

mario12 · Dec 22, 2015

tested on Windows 10 and all OK

dog-man · Dec 22, 2015

Hmm, strange why I get that error then.
I run the 64 bit version of win 10 pro. I have another computer that runs win 10 home, I will try that one also.

denmar69 · Dec 22, 2015

tested ok Win10 x64

dog-man · Dec 22, 2015

Now working for me.

I left one letter out.

Liquor Twát · Dec 29, 2015

I have a v1 B8hx030000h_10000h table that has some bad chain counts in it. Is there a way to delete the bad chains from the table?

Code:

prefix:FF0AF0h, count:4000000h
prefix:FF2800h, count:4000000h
prefix:3712C8h, count:3000000h
prefix:C710A4h, count:3000000h
prefix:3820A4h, count:2000000h
prefix:3820A8h, count:2000000h
prefix:F0EE38h, count:2000000h
prefix:F0EE3Ch, count:2000000h
prefix:3712C4h, count:1000000h
prefix:C710A8h, count:1000000h
done

It looks like some chains have become split into 2 parts. For all of the chains with bad counts they seem to be paired with another bad count chain and the total count of the pair adds up to 4000000h.

For example, in the list above, prefixes 3712C4h and 3712C8h have bad counts but the sum of their counts is 4000000h.

Similar pairs of bad count chains from my table analysis are:

C710A4h and C710A8h
3820A4h and 3820A8h
F0EE38h and F0EE3Ch

In these examples there seems to be some type of link between the bad pairs as the chain ID's are very close?

Thx for any feedback.

xosef1234 · Dec 30, 2015

Liquor Twát said:
I have a v1 B8hx030000h_10000h table that has some bad chain counts in it. Is there a way to delete the bad chains from the table?

I made a little tool which allows you to delete a chain of the table. However, since I am a bad coder it could be done much better

_https://mega.nz/#!Upp02ZzC!ziev2S7xBnR2l6vYg5-0b_x9TyJhQXRvsa6GEsf-S80

gotya · Dec 30, 2015

xosef1234 said:
I made a little tool which allows you to delete a chain of the table. However, since I am a bad coder it could be done much better

_https://mega.nz/#!Upp02ZzC!ziev2S7xBnR2l6vYg5-0b_x9TyJhQXRvsa6GEsf-S80

it's a good thing to make this tool

but after I did a scan in virustotal I got this feedback

Code:

https://www.virustotal.com/en/file/0c59b497f343c96243c23df050390640c54a3824b05823051aa7a49faadd795d/analysis/

Can you describe this ?

dog-man · Dec 30, 2015

ESET Nod32 finds nothing.

xosef1234 · Dec 30, 2015

Hmm, I can't tell you...
I just did it the same way as I do other tools...

Gesendet von iPhone mit Tapatalk

Liquor Twát · Dec 30, 2015

xosef1234 said:
I made a little tool which allows you to delete a chain of the table.

xosef1234,

Thx for sharing your work. Can you please tell me how long it takes for your tool to delete a chain from a table? Is it depending on the table size?

Also, when entering the name for the chain to delete is this only the prefix or is it the full name of the chain? A screen capture might be useful?

Thx

xosef1234 · Dec 30, 2015

The tool is not the fastest ...

In my case it takes 6 min to delete a chain from a 15GB table. It depends strongly on the table size, the cpu, the harddisk. Anyway, since this is not a regular process it is ok for me...

+8+NPPP3Yj5+CQCAQSHnn0flPPvKjf3jq2RdfeOGFtWvXbty4ccuWLQqF4v8DWWCsuB5NIMwAAAAASUVORK5CYII=

The original table will be kept and a second table "..._mod.rbt" will be created in the same folder.

How to analyse RBT table?

dog-man

Colibri.DVB

dog-man

pimenta

Registered

Colibri.DVB

dog-man

Colibri.DVB

dog-man

gotya

mario12

dog-man

denmar69

Registered

dog-man

Liquor Twát

Registered

xosef1234

Registered

gotya

dog-man

xosef1234

Registered

Liquor Twát

Registered

xosef1234

Registered