chore: update contributors - #1
Open
github-actions[bot] wants to merge 1 commit into
Open
Conversation
hahwul
added a commit
that referenced
this pull request
Jun 4, 2026
- Fix manual_clamp clippy lint with .clamp(1, N) - Add min/max validation to target-field brute, server::crack_brute, and MCP brute paths - Use .chars().count() instead of .len() for charset size in estimate_combinations calls (and legacy generator for consistency) - Use saturating_pow + guards/break to prevent u64/usize overflow panics and wrong wrapped search spaces in estimate and enumeration loops These changes make pre-commit (fmt, clippy -D warnings, test) pass. (Review issues 5-9 remain for separate consideration; no GitHub comments were posted.) Co-authored-by: bsysop <9998303+bsysop@users.noreply.github.com>
hahwul
added a commit
that referenced
this pull request
Jun 4, 2026
- Fix manual_clamp clippy lint with .clamp(1, MAX_POWER_THREADS) - Add --min/--max validation to target-field brute, server::crack_brute, and MCP brute paths - Use .chars().count() instead of .len() for charset size in estimate_combinations (and legacy generator for consistency) - Use saturating_pow + early break on u64::MAX to prevent overflow panics/wraps in estimate and enumeration loops These changes make pre-commit (fmt, clippy -D warnings, test) pass. Co-authored-by: bsysop <9998303+bsysop@users.noreply.github.com>
bsysop
added a commit
that referenced
this pull request
Jun 4, 2026
…ches (hahwul#208) * perf: reduce memory consumption by ~99% with mimalloc + streaming batches - Swap global allocator to mimalloc for aggressive page reclamation - Stream dictionary wordlists in 100K batches instead of loading entire file - Eliminate duplicate expanded Vec in targeted field dictionary path - Cap --power thread pool at 32 to prevent allocator pressure - Remove redundant shrink_to_fit/re-reserve cycles in batch loops Peak RSS drops from ~15.9 GB to ~10 MB (-99.94%) while throughput improves from 939K to 1.44M keys/sec (+53%). * feat: add --min flag for brute-force cracking Allows starting brute-force from a minimum password length instead of always beginning at 1. Skips computationally wasteful short combinations when the target secret is known to be longer. Example: jwt-hack crack TOKEN --mode brute --chars az --min 4 --max 8 - Add min: usize to CrackOptions and CLI args (default: 1) - Update estimate_combinations to accept min_len - Update crack_bruteforce to loop min_length..=max_length - Update server/mcp/shell call sites - Add validation: min >= 1, min <= max - Add tests for min/max range estimation * fix: address review findings #1-4 - Fix manual_clamp clippy lint with .clamp(1, MAX_POWER_THREADS) - Add --min/--max validation to target-field brute, server::crack_brute, and MCP brute paths - Use .chars().count() instead of .len() for charset size in estimate_combinations (and legacy generator for consistency) - Use saturating_pow + early break on u64::MAX to prevent overflow panics/wraps in estimate and enumeration loops These changes make pre-commit (fmt, clippy -D warnings, test) pass. Co-authored-by: bsysop <9998303+bsysop@users.noreply.github.com> --------- Co-authored-by: hahwul <hahwul@gmail.com> Co-authored-by: bsysop <9998303+bsysop@users.noreply.github.com>
github-actions
Bot
force-pushed
the
chore/update-contributors
branch
from
June 4, 2026 19:51
3d18437 to
6d22ec5
Compare
bsysop
added a commit
that referenced
this pull request
Jun 5, 2026
Critical: - CPU fallback when GPU init or dispatch fails (#1) - Zero-initialise Metal results buffer to prevent false positives (hahwul#2) - Skip candidates > 64 bytes in kernel (HMAC key-hashing not implemented) (hahwul#3) High: - Remove redundant secret/k_padded double copy in kernel (hahwul#4) - Remove unused total_remaining variable (hahwul#5) - Replace byte-by-byte zeroing with drop+reallocate (hahwul#6) Medium: - Add keys/sec rate to GPU progress line (hahwul#7) - Flush stderr after progress update (hahwul#8) - Always show progress (not just for multi-batch runs) (hahwul#9) - Add --no-gpu flag to force CPU mode (hahwul#10)
bsysop
added a commit
that referenced
this pull request
Jun 5, 2026
High: - make_buffer uses saturating_mul to prevent overflow (#1) - Move use std::io::Write to top-level imports (hahwul#2) Medium: - is_available() checks MTLGPUFamily::Common2, not just device presence (hahwul#3) - Cache device info with OnceLock to avoid double objc lookup (hahwul#4) - Show progress after dispatch (rate reflects actual work) (hahwul#5) - Add ETA to progress line (hahwul#6) Low: - Fix kernel typo 'anyally' → 'computationally' (hahwul#7)
bsysop
added a commit
that referenced
this pull request
Jun 6, 2026
High: - Add Hs256Verifier::into_parts() to avoid re-parsing token on GPU path (#1) - Reuse verifier's signing_input + expected_sig instead of re-deriving Medium: - Extract validate_brute_lengths() shared by CPU and GPU paths (hahwul#3) - Show 'ETA <1s' instead of 'ETA 0s' when near completion (hahwul#4) - Use labelled break 'length: instead of fragile double-break (hahwul#5) - Remove unused base64::Engine import (decode now via into_parts)
bsysop
added a commit
that referenced
this pull request
Jun 6, 2026
Critical: - Re-add expected_sig.len() != 32 check after into_parts() refactor. prepare_hs256_verifier does not validate signature byte length; a malformed token could cause GPU kernel to read past buffer (#1) Medium: - ETA now computed against global total_combinations, not per-length total. Cracking 5..=7 now shows ETA for the entire job (hahwul#2) Low: - Remove redundant local GPU_BATCH const, use gpu::GPU_BATCH_SIZE (hahwul#3)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated update of
CONTRIBUTORS.svg.