Rulecat - Advanced Rule Generation Tool

A sophisticated password rule generator and mutator for password cracking tools (hashcat, John the Ripper, mdxfind) that uses statistical learning to create high-quality transformation rules.

Overview

Rulecat analyzes existing password transformation rules to learn patterns and generate new rules that mimic real-world password creation behaviors. It uses statistical pattern recognition and parameter distribution learning to produce rules that are more likely to crack passwords than purely random generation.

Rulecat can be used independently on existing rule sets or used on the output produced by rulechef. Since rulechef does not introduce unseen rules, rulecat can be used add novel mutations/transformations.

Visual overview of workflow

Core Features

1. Training Mode (-t)

Analyzes existing rule files to build a statistical model:

• Pattern Extraction: Breaks rules into operation sequences (e.g., lowercase ? append ? capitalize)
• Parameter Learning: Records character/position distributions for each operation
• Frequency Analysis: Tracks which operations and patterns appear most often
• Output: Binary .model file containing learned statistics

Statistics Collected:

• Global operation frequencies across all rules
• Character type distributions (lowercase, uppercase, digits, special chars)
• Most common characters for each operation
• Position parameter distributions with averages
• Pattern-specific operation preferences

2. Model Generation Mode (-g model)

Creates entirely new rules from learned patterns:

• Selects patterns probabilistically based on training data frequency
• Generates parameters using learned character/position distributions
• 70% probability of using top learned characters, 30% type-based generation
• Validates rules to avoid conflicts (e.g., sXX where both chars are identical)

3. Mutation Mode (-g mutate)

Applies random mutations to existing rules (no training dataset needed):

Mutation Features:

• Respects learned parameter distributions when available
• Validates memory operation constraints (M must precede X/4/6)
• Prevents redundant operations (e.g., double lowercase ll)
• Avoids canceling operations (e.g., append + delete last: $X])
• Configurable mutation count (1-10 per rule)

4. Guided Mode (-g guided)

Hybrid approach combining mutation with trained input:

• Mutates input rules like mutation mode
• Validates each mutation against learned patterns
• Only outputs rules matching ?70% of known patterns
• Falls back to standard mutation after 30 failed attempts
• Ensures generated rules resemble training data style

Use Case: Generate variations of known-good rules while maintaining structural similarity to proven patterns.

Technical Architecture

Pattern Classification System

Operations grouped by behavior impact:

• Idempotent: Can only apply once meaningfully (l, u, c, r)
• Cumulative: Can stack multiple times ($, ^, d)
• Destructive: Remove characters (], [, @)
• Positional: Operate on specific positions (T, i, o, s, *)

Statistical Learning

Character Parameter Statistics:

• Tracks character type ratios (40% lowercase, 30% uppercase, etc.)
• Maintains top-20 most frequent characters with counts
• Uses weighted random selection for generation

Position Parameter Statistics:

• Records position frequency distribution (0-9, A-Z, a-z)
• Calculates average position with variance
• 80% probability uses learned distribution, 20% samples around average

Conflict Detection

Prevents wasteful rule generation:

• Self-conflicts: sXX (substitute same char), *NN (swap same position)
• Canceling pairs: $X] (append then delete), ^X[ (prepend then delete)
• Redundant operations: Multiple identical idempotent ops (ll, uu)
• Sequential conflicts: iNX DN at same position

Usage

make

Usage

Train a model from existing rules

./rulecat -t password-rules.txt -m output.model

Generate 1000 new rules from model

./rulecat -g model -n 1000 -m output.model > new-rules.txt

Mutate existing rules (max 3 mutations each), no training needed as mutations are done directly on inputs without reference

./rulecat -g mutate -n 500 -i base-rules.txt -x 3 > mutated-rules.txt

Guided mutation (maintains 70% pattern similarity against model)

./rulecat -g guided -n 750 -m output.model -i base-rules.txt -x 2 > guided-rules.txt