rulest - GPU Rules Extractor

[A1131]

GPU-Accelerated Rule Mining for Hash Cracking Wordlists (Full Chain Extraction)

This project implements a highly optimized tool for extracting effective word-transformation rule chains by leveraging PyOpenCL to run the transformation logic on a Graphics Processing Unit (GPU). It uses a Breadth-First Search (BFS) approach to efficiently explore multi-step rule combinations (chains) that convert base dictionary words into target dictionary words.

Overview
Rule-based attacks are highly effective against passwords. This utility automates the process of discovering the most successful rule chains (e.g., l $1 T0 - lowercase, append '1', toggle case at position 0) that have high hit rates against a specific target wordlist, accelerating rule-set generation for tools like Hashcat.

Key Features

OpenCL Acceleration: Word transformations are processed in parallel on the GPU for massive performance gains.

Rule Chaining (BFS): Supports exploring rule chains up to a configurable depth (e.g., -d 3).

Full Chain Extraction: Outputs the complete sequence of rules (R1 R2 ... Rn) responsible for a hit.

Optimized Data Handling: Uses np.uint8 and np.uint16 buffers for minimal memory overhead and fast GPU transfers.

Rule Filtering: Allows using an external file to limit the internal rule set, focusing the search space.

Requirements

Python 3.x

numpy

pyopencl (Requires OpenCL runtime drivers for your GPU vendor: NVIDIA, AMD, or Intel).

tqdm (For progress bar display)

pip install numpy pyopencl tqdm

Argument,        Short Description
--wordlist,      -w,  (Required) Path to the target dictionary (words to match).
--base-wordlist, -b,  Optional path to the base wordlist (words to apply rules to).
--chain-depth,   -d,  Number of rules to chain together.
--batch-size,         Number of words to process per GPU batch.
--output,        -o,  File to save the extracted rule chains to.
--rules_file,    -r,  Path to an external file to filter the internal rule set.

Examples

Extracting Single Rules (Depth 1) Find all single rules that transform a base word into a target word, saving the results to my_rules_d1.txt.

python rulest.py -w target_passwords.txt -b base_words.txt -d 1 -o my_rules_d1.txt

Extracting Two-Step Rule Chains (Depth 2) Find rule chains of length two (R1 R2) that lead to a hit.

python rulest.py -w target_passwords.txt -b base_words.txt -d 2 -o my_rules_d2.txt

Using a Filtered Rule Set Only test rules specified in common_leetspeak.rule for a three-step chain.

python rulest.py -w target.txt -b base.txt -d 3 -r common_leetspeak.rule -o leet_chains_d3.txt

https://github.com/A113L/rulest

[A1131]

Fyi. The OpenCl kernel used by the script has been updated with all Hashcat rules visible at https://hashcat.net/wiki/doku.php?id=rule_based_attack. This slightly increases the rule chain extraction time, but it can also lead to complex rules.

[A1131]

Updated to version 2.0. The script now extracts more likely working Hashcat rules as opposed to using BFS up to depth 3. It dynamically calculates the number of needed generated rules for depth 2 and 3 to fit in the given script runtime as well as the size of buffers adjusted to the amount of VRAM to avoid OOM errors.

[A1131]

https://gist.githubusercontent.com/A113L/64184c75477c32a448779836087ad4d8/raw/5abfc5c874b60aa9f8cf4bf1fc1be7a19388be25/gistfile1.txt

[Waffle]

I'm interested in running a quick comparison. Can I get a copy of your "zeusgame.txt" list, please?

[A1131]

zeusgame.txt

[A1131]

Key improvements

• Extended maximum rule chain depth from 3 to 6, allowing exploration of more complex transformations.
• Adaptive batch sizing based on actual GPU VRAM – now dynamically scales word batches, chain batches, and output buffer sizes according to available memory (tested on RTX 3060 Ti and 1050 Ti without errors).
• Dynamic time budgeting – distributes remaining processing time among depths proportionally, adjusting the number of chains generated for each depth based on actual phase‑1 runtime.
• VRAM‑aware bloom filter sizing – reduces bloom filter size on GPUs with less than 4 GB VRAM to prevent out‑of‑memory errors.
• Per‑depth chain limit overrides – new command‑line options (--depth2-chains, …, --depth6-chains) to manually control the number of chains generated for each depth.

Examples of found_chains.txt

[Waffle]

This is good work! This approaches the problem from what I think is a new direction, and I'm really liking what I see here. Very much appreciate you releasing it.

[A1131]

Thank you. It's a bit of reinventing the wheel, but I once encountered a problem extracting rules from available programs (ULM still rules in my opinion), and that's how rulest was created.