fiddlesticks 0.3.0__tar.gz → 0.4.0__tar.gz

fiddlesticks-0.4.0/.gitattributes

@@ -0,0 +1,5 @@
+* text eol=lf
+*.kdbx binary
+*.7z binary
+*.docx binary
+*.xlsx binary

fiddlesticks-0.4.0/.github/workflows/tests.yml

@@ -0,0 +1,44 @@
+name: Tests
+
+on:
+  workflow_dispatch:
+  push:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Check out repo
+      uses: actions/checkout@v7
+    
+    - name: Set up Python
+      uses: actions/setup-python@v7
+      with:
+        python-version: "3.14"
+    
+
+    - name: Check Git hasn't corrupted test data files
+      run: |
+        sha256sum tests/data_files/Test_vault_Do_Not_Use.kdbx
+
+    - name: Install Veracrypt from unit193's apt repo
+      run: |
+        sudo add-apt-repository ppa:unit193/encryption
+        sudo apt update
+        sudo apt install veracrypt
+
+    - name: Create venv
+      run: |
+        python3 -m venv .venv
+
+    - name: Install dependencies
+      run: |
+        . ./.venv/bin/activate
+        pip install -e . --group=test
+
+    - name: Run PyTest (via Coverage)
+      run: |
+        . ./.venv/bin/activate
+        coverage run -m pytest -rA -vv --tb=short tests && coverage combine && coverage report

{fiddlesticks-0.3.0 → fiddlesticks-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: fiddlesticks
-Version: 0.3.0
+Version: 0.4.0
 Summary: Password recovery tool for encrypted files (.7z archives .kdbx files, and Aegis archives).
 Project-URL: GitHub, https://github.com/Hazardous-Area/fiddlesticks
 Author-email: James Parrott <james@jamesparrott.dev>
@@ -11,8 +11,13 @@ Provides-Extra: aegis
 Requires-Dist: py-avdu; extra == 'aegis'
 Provides-Extra: keepassxc
 Requires-Dist: pykeepass; extra == 'keepassxc'
+Provides-Extra: msoffice
+Requires-Dist: msoffcrypto-tool; extra == 'msoffice'
 Provides-Extra: py7zr
 Requires-Dist: py7zr; extra == 'py7zr'
+Provides-Extra: ssh
+Requires-Dist: bcrypt; extra == 'ssh'
+Requires-Dist: cryptography>=47; extra == 'ssh'
 Description-Content-Type: text/markdown
 
 # Fiddlesticks!
@@ -20,14 +25,16 @@ Description-Content-Type: text/markdown
 ![Tests passing](https://github.com/Hazardous-Area/fiddlesticks/actions/workflows/tests.yml/badge.svg)
 ![Code qual](https://github.com/Hazardous-Area/fiddlesticks/actions/workflows/lint.yml/badge.svg)
 
-Version 0.3.0
+Version 0.4.0
 
 ## Description
 Password recovery tool, for password-encrypted files, using simple off-line brute 
 force attacks.  Password candidates are generated, using common variations 
-of a guessed password (e.g. typos and substitutions).  .7z, .kdbx and Aegis archives 
-are directly supported, but Fiddlesticks can also call any shell command, that accepts 
-a candidate password.
+of a guessed password (e.g. typos and substitutions). SSH keys, Aegis archives, 
+and Veracrypt volumes, plus .7z, .kdbx, .xlsx, and .docx files, 
+are directly supported as optional dependencies.  But 
+Fiddlesticks can also call any shell command, that accepts a candidate password, 
+e.g. for Veracrypt volumes (and can pipe candidates to stdout).
 
 ### Raison d'etre
  - Password-protected file owners recovering their own password themselves, as long as 

{fiddlesticks-0.3.0 → fiddlesticks-0.4.0}/README.md

@@ -3,14 +3,16 @@
 ![Tests passing](https://github.com/Hazardous-Area/fiddlesticks/actions/workflows/tests.yml/badge.svg)
 ![Code qual](https://github.com/Hazardous-Area/fiddlesticks/actions/workflows/lint.yml/badge.svg)
 
-Version 0.3.0
+Version 0.4.0
 
 ## Description
 Password recovery tool, for password-encrypted files, using simple off-line brute 
 force attacks.  Password candidates are generated, using common variations 
-of a guessed password (e.g. typos and substitutions).  .7z, .kdbx and Aegis archives 
-are directly supported, but Fiddlesticks can also call any shell command, that accepts 
-a candidate password.
+of a guessed password (e.g. typos and substitutions). SSH keys, Aegis archives, 
+and Veracrypt volumes, plus .7z, .kdbx, .xlsx, and .docx files, 
+are directly supported as optional dependencies.  But 
+Fiddlesticks can also call any shell command, that accepts a candidate password, 
+e.g. for Veracrypt volumes (and can pipe candidates to stdout).
 
 ### Raison d'etre
  - Password-protected file owners recovering their own password themselves, as long as 

{fiddlesticks-0.3.0 → fiddlesticks-0.4.0}/pyproject.toml

@@ -23,14 +23,21 @@ GitHub = "https://github.com/Hazardous-Area/fiddlesticks"
 fiddlesticks = "fiddlesticks:cli"
 
 [project.optional-dependencies]
-py7zr = [
-    "py7zr",
+ssh = [
+    "cryptography>=47", # For "incorrect PW" error message from Rust code
+    "bcrypt",
+]
+keepassxc = [
+    "pykeepass",
 ]
 aegis = [
     "py-avdu",
 ]
-keepassxc = [
-    "pykeepass",
+py7zr = [
+    "py7zr",
+]
+msoffice = [
+    "msoffcrypto-tool",
 ]
 
 [dependency-groups]
@@ -39,7 +46,7 @@ dev = [
     {include-group = "test"},
 ]
 test = [
-    "fiddlesticks[py7zr,aegis,keepassxc]",
+    "fiddlesticks[ssh,keepassxc,aegis,py7zr,msoffice]",
     "pytest",
     "hypothesis",
     "coverage>=7.13",

{fiddlesticks-0.3.0 → fiddlesticks-0.4.0}/src/fiddlesticks.py

@@ -5,13 +5,21 @@
 
 # # Non-compliant with PEP 723:
 # optional_dependencies = [
-#   py7zr = ["py7zr"],
+#   # External 7zip, e.g.:
+#   #   sudo apt-get install -y 7zip
+#   ssh = ["bcrypt", "cryptography>=47"], # v47 min for "incorrect PW" error message from Rust code
 #   aegis = ["py-avdu"],
 #   keepassxc = ["pykeepass"],
+#   # External Veracrypt, e.g.:
+#   #   sudo add-apt-repository ppa:unit193/encryption
+#   #   sudo apt update
+#   #   sudo apt install veracrypt
+#   msoffice = ["msoffcrypto-tool"]
+#   py7zr = ["py7zr"],
 # ]
 # ///
 
-__version__ = "0.3.0"
+__version__ = "0.4.0"
 
 import argparse
 import atexit
@@ -80,11 +88,11 @@ for c, v in list(LEET_SPEAK.items()):
     LEET_SPEAK[c.upper()] = v
 
 
-def print_to_stderr(*objects, file=sys.stderr, **kwargs):
+def print_to_stderr(*objects, **kwargs):
     """Simple wrapper to print to stderr instead of stdout,
-    for easy piping to stdout.
+    for easy piping (of other output) to stdout.
     """
-    print(*objects, file=file, **kwargs)
+    print(*objects, file=sys.stderr, **kwargs)
 
 
 def _calculate_total(lengths, M):
@@ -189,6 +197,26 @@ def candidate_passwords_from_alt_chars(
     return total_num_candidates, _candidates_from_alts_dict(guesses_alts, max_subs)
 
 
+def possibly_output_found_password(
+    password: str,
+    i: int,
+    t: float | None = None,
+    print_passwords: bool = False,
+    output_file: str = "",
+    **kwargs,
+):
+    msg = f"\n Found password (candidate number: {i})"
+    if t is not None:
+        msg = f"{msg} in {t:.3f} seconds"
+    print_to_stderr(msg, end="")
+
+    print_to_stderr(f" {password=}" if print_passwords else "")
+
+    if output_file:
+        with open(output_file, "at") as f:
+            f.write(password)
+
+
 def make_py7zr_checker(archive: str, extract_to: str | None = None, **kwargs):
     from _lzma import LZMAError
 
@@ -196,7 +224,7 @@ def make_py7zr_checker(archive: str, extract_to: str | None = None, **kwargs):
     from py7zr.exceptions import Bad7zFile, PasswordRequired
 
     if extract_to is None:
-        extract_to = str(_make_new_tmp_sub_dir(archive))
+        extract_to = str(_make_new_tmp_sub_dir_for_7z(archive))
     stream = io.BytesIO(Path(archive).read_bytes())
 
     def is_correct_password_for_7z_file(candidate: str) -> bool:
@@ -221,10 +249,10 @@ def make_subprocess_checker(*args: str, **kwargs):
     # On the other hand, if last == "-p", e.g. with 7z,
     # the password is expected with no space separating it
     # from the -p.
-    # Therefore to stick with out contract of "any partial
+    # Therefore to honour our contract of "any partial
     # Bash command to which a password guess can be appended"
-    # it's easiest to use a single string,
-    # and (unless on Windows) shell=True
+    # it's easiest to use a single string (instead of an args list),
+    # and (unless on Windows) shell=True.
 
     def checker(candidate: str) -> bool:
         result = subprocess.run(
@@ -238,13 +266,18 @@ def make_subprocess_checker(*args: str, **kwargs):
     return checker
 
 
-def _make_new_tmp_sub_dir(file: str, tmp_dir: Path = TMP_DIR) -> Path:
+def _make_new_tmp_sub_dir(tmp_dir, name: str = "extracted") -> Path:
     i = -1
     suffix = ""
-    while (p := tmp_dir / f"extracted{suffix}").is_dir():
+    while (p := tmp_dir / f"{name}{suffix}").is_dir():
         i += 1
         suffix = f"_{i}"
-    p.mkdir()
+    p.mkdir(parents=True, exist_ok=False)
+    return p
+
+
+def _make_new_tmp_sub_dir_for_7z(file: str, tmp_dir: Path = TMP_DIR) -> Path:
+    p = _make_new_tmp_sub_dir(tmp_dir)
     print_to_stderr(f"If {file} is unzipped successfully, contents will be in: {p}")
     return p
 
@@ -255,7 +288,7 @@ def make_7zip_checker(file: str, extract_to: str | None = None, **kwargs):
     subprocess.run(["7z", "--help"], capture_output=True, check=True)
 
     if extract_to is None:
-        extract_to = str(_make_new_tmp_sub_dir(file))
+        extract_to = str(_make_new_tmp_sub_dir_for_7z(file))
 
     return make_subprocess_checker("7z", "x", f"-o{extract_to}", file, "-p")
 
@@ -285,7 +318,7 @@ done
 
 def make_persistent_7zip_checker(file: str, extract_to: str | None = None, **kwargs):
     if extract_to is None:
-        extract_to = str(_make_new_tmp_sub_dir(file))
+        extract_to = str(_make_new_tmp_sub_dir_for_7z(file))
 
     cmd = textwrap.dedent(
         PERSISTENT_7Z_CHECKER_OUTLINE.format(extract_to=extract_to, file=file)
@@ -353,6 +386,162 @@ def make_pykeepass_checker(file: os.PathLike, **kwargs):
     return checker
 
 
+def _get_hopefully_incorrect_password() -> str:
+    try:
+        return getpass.getuser()
+    except OSError:
+        return "password123"
+
+
+def _try_make_ssh_key_checker_from_loader(
+    loader,
+    incorrect_password_msg: str,
+    file: os.PathLike,
+    **kwargs,
+) -> Callable[[str], bool]:
+
+    private_key_data = Path(file).read_bytes()
+    hopefully_incorrect_password = _get_hopefully_incorrect_password()
+    try:
+        loader(private_key_data, password=hopefully_incorrect_password.encode())
+    except ValueError as e:
+        if e.args[0] != incorrect_password_msg:
+            raise
+    else:
+        possibly_output_found_password(
+            hopefully_incorrect_password,
+            i=-12345,
+            t=None,
+            **kwargs,
+        )
+        sys.exit(0)
+
+    def checker(candidate: str) -> bool:
+        try:
+            loader(
+                private_key_data,
+                password=candidate.encode(),
+                # Fail fast.  Key pair validation is out of scope
+                # (but on success we do it anyway to give the user a heads up).
+                # https://cryptography.io/en/latest/hazmat/primitives/asymmetric/serialization/#cryptography.hazmat.primitives.serialization.load_ssh_private_key
+                unsafe_skip_rsa_key_validation=True,
+            )
+        except ValueError:
+            return False
+        loader(
+            private_key_data,
+            password=candidate.encode(),
+            # Validate key pair, only once we already know
+            # we have the correct password.
+            unsafe_skip_rsa_key_validation=False,
+        )
+        return True
+
+    return checker
+
+
+def make_ssh_key_checker(file: os.PathLike, **kwargs):
+
+    exceptions = []
+
+    for factory in [
+        make_openSSH_key_checker,
+        make_ssh_pem_key_checker,
+    ]:
+        try:
+            return factory(file, **kwargs)
+        except ValueError as e:
+            exceptions.append(e)
+
+    raise ExceptionGroup(
+        (
+            f"Could not find valid SSH key loader for {file=}. "
+            "Is it corrupted or in the incorrect format?"
+        ),
+        exceptions,
+    )
+
+
+def make_openSSH_key_checker(file: os.PathLike, **kwargs):
+    from cryptography.hazmat.primitives.serialization import load_ssh_private_key
+
+    return _try_make_ssh_key_checker_from_loader(
+        load_ssh_private_key,
+        "Corrupt data: broken checksum",  # Defined in cryptography's ssh.py, since 2020
+        file,
+        **kwargs,
+    )
+
+
+def make_ssh_pem_key_checker(file: os.PathLike, **kwargs):
+    from cryptography.hazmat.primitives.serialization import load_pem_private_key
+
+    return _try_make_ssh_key_checker_from_loader(
+        load_pem_private_key,
+        "Incorrect password, could not decrypt key",  # Defined in cryptography's Rust extension since Apr 2025
+        # TODO: Investigate the other error strings that have been seen.  See misc_tests.py
+        file,
+        **kwargs,
+    )
+
+
+def make_MS_Office_files_key_checker(file: os.PathLike, **kwargs):
+
+    import msoffcrypto
+    import msoffcrypto.exceptions
+
+    encrypted = io.BytesIO(Path(file).read_bytes())
+    office_file = msoffcrypto.OfficeFile(encrypted)
+
+    stream = io.BytesIO()
+
+    def checker(candidate: str) -> bool:
+        office_file.load_key(password=candidate)
+        try:
+            office_file.decrypt(stream)
+            return True
+        except msoffcrypto.exceptions.InvalidKeyError:
+            return False
+
+    return checker
+
+
+def make_Veracrypt_checker(file: os.PathLike, **kwargs):
+
+    path = Path(file).resolve()
+    assert path.is_file()
+
+    # Ensure we can run Veracrypt in a subprocess.
+    subprocess.run(["veracrypt", "--help"], capture_output=True, check=True)
+
+    temp_dir = tempfile.TemporaryDirectory(delete=False)
+
+    mount_point = _make_new_tmp_sub_dir(
+        tmp_dir=Path(temp_dir.name) / "mnt",
+        name="veracrypt_volume",
+    ).resolve()
+
+    args = [
+        "veracrypt",
+        "--text",
+        "--non-interactive",
+        "--keyfiles=",
+        "--pim=0",
+        "--protect-hidden=no",
+        "--mount",
+        path.as_posix(),
+        mount_point.as_posix(),
+        "--password=",
+    ]
+
+    @atexit.register
+    def cleanup():
+        subprocess.run(["veracrypt", "--unmount"], capture_output=True, check=True)
+        temp_dir.cleanup()
+
+    return make_subprocess_checker(*args)
+
+
 def check_passwords_sequentially(
     candidates: Iterable[tuple[str, int]],
     test_func: Callable[[str], bool],
@@ -405,6 +594,13 @@ default_password_protected_file_checker_factories = {
     ".json": make_py_avdu_aegis_checker,
     ".kdbx": make_pykeepass_checker,
     ".kdb": make_pykeepass_checker,
+    ".pem": make_ssh_key_checker,  # could make this the legacy PEM one?
+    ".key": make_ssh_key_checker,
+    ".priv": make_ssh_key_checker,
+    ".docx": make_MS_Office_files_key_checker,
+    ".xlsx": make_MS_Office_files_key_checker,
+    ".hc": make_Veracrypt_checker,
+    ".tc": make_Veracrypt_checker,
 }
 
 
@@ -543,12 +739,9 @@ def add_command_arg(name, command, help: str | None = None):
     )
 
 
+add_command_arg("--shell", make_subprocess_checker)
 add_command_arg("--7zip", make_7zip_checker)
 add_command_arg("--7zip-persistent", make_persistent_7zip_checker)
-add_command_arg("--shell", make_subprocess_checker)
-add_command_arg("--py7zr", make_py7zr_checker)
-add_command_arg("--aegis", make_py_avdu_aegis_checker)
-add_command_arg("--keypassxc", make_pykeepass_checker)
 add_command_arg(
     "--pipe",
     make_password_candidate_piper,
@@ -559,6 +752,15 @@ add_command_arg(
     ),
 )
 add_command_arg("--print-char-map", "print-char-map")
+# Optional commands requiring extra deps
+add_command_arg("--ssh", make_ssh_key_checker)
+add_command_arg("--openssh", make_openSSH_key_checker)
+add_command_arg("--ssh-pem", make_ssh_pem_key_checker)
+add_command_arg("--keypassxc", make_pykeepass_checker)
+add_command_arg("--aegis", make_py_avdu_aegis_checker)
+add_command_arg("--py7zr", make_py7zr_checker)
+add_command_arg("--msoffice", make_MS_Office_files_key_checker)
+add_command_arg("--veracrypt", make_Veracrypt_checker)
 
 
 alt_char_map_group = add_mutex_group(
@@ -635,9 +837,7 @@ def cli(args: list[str] = sys.argv[1:]) -> int:
         ):
             password_guesses.append(password_guess)
 
-    output_file = kwargs.pop("output_file")
     extras = kwargs.pop("extras")
-    extract_to = kwargs.pop("extract_to")
 
     if ns.command is None:
         command = _default_factory_selector(*extras)
@@ -645,13 +845,19 @@ def cli(args: list[str] = sys.argv[1:]) -> int:
         command = ns.command
 
     if (
-        (command is make_py_avdu_aegis_checker or command is make_pykeepass_checker)
+        command
+        not in (
+            make_7zip_checker,
+            make_persistent_7zip_checker,
+            make_subprocess_checker,
+            make_password_candidate_piper,
+        )
         and not ns.print_passwords
-        and not output_file
+        and not ns.output_file
         and ns.verbosity == 0
     ):
         warnings.warn(
-            "The Keepass and the Aegis vault checkers do not decrypt files. "
+            "The SSH key, Keepass and the Aegis vault checkers do not decrypt files. "
             "When running fiddlesticks without print-passwords, without "
             "an output-file, and with verbosity=0, only the candidate number "
             "of any recovered password will be printed. "
@@ -660,7 +866,7 @@ def cli(args: list[str] = sys.argv[1:]) -> int:
     total, candidates = ns.password_generator(
         guesses=password_guesses, max_subs=ns.max_subs, alt_char_map=alt_char_map
     )
-    checker = command(*extras, extract_to=extract_to)
+    checker = command(*extras, **kwargs)
 
     t0 = time.time()
 
@@ -678,14 +884,9 @@ def cli(args: list[str] = sys.argv[1:]) -> int:
         return 1
 
     password, i = result
-    msg = f"\n Found password (guess number: {i}) in {t1 - t0:.3f} seconds"
-    print_to_stderr(msg, end="")
 
-    print_to_stderr(f" {password=}" if ns.print_passwords else "")
+    possibly_output_found_password(password, i, t1 - t0, **kwargs)
 
-    if output_file:
-        with open(output_file, "at") as f:
-            f.write(f"{password}")
     return 0
 
 

fiddlesticks-0.4.0/tests/checker_tests.py

@@ -0,0 +1,144 @@
+import stat
+import subprocess
+from pathlib import Path
+from unittest.mock import patch
+
+import pytest
+
+from fiddlesticks import (
+    IS_WINDOWS,
+    _make_new_tmp_sub_dir,
+    check_passwords_sequentially,
+    make_MS_Office_files_key_checker,
+    make_py_avdu_aegis_checker,
+    make_pykeepass_checker,
+    make_ssh_key_checker,
+    make_subprocess_checker,
+    make_Veracrypt_checker,
+)
+
+from .helpers import (
+    DOCX_FILE,
+    KDBX_TEST_VAULT,
+    SEVEN_ZIP_TEST_ARCHIVE,
+    XLSX_FILE,
+    _assert_output_on_found_password,
+    _try_make_ssh_key_files,
+    _try_make_veracrypt_volume,
+    avdu_test_vault,  # noqa: F401
+)
+
+
+@pytest.mark.skipif(
+    IS_WINDOWS, reason="I haven't figured out the 7zip CLI on Windows yet"
+)
+def test_is_7zip_installed():
+    args = ["7z", "--help"]
+    subprocess.run(args, capture_output=True, check=True)
+
+
+def test_aegis_checker_against_avdu_vault(avdu_test_vault):  # noqa: F811
+    checker = make_py_avdu_aegis_checker(avdu_test_vault)
+    # """
+    # # Run using the encrypted test file. (Enter password "test" when prompted.)
+    # go run ./cmd/avdu -p test/data/aegis_encrypted.json -e
+    # https://github.com/Sammy-T/avdu/blob/master/README.md
+    # """
+    assert checker("test")
+    assert not checker("wrong_password")
+
+
+def test_pykeepass_checker_against_Test_vault():
+    checker = make_pykeepass_checker(KDBX_TEST_VAULT)
+    assert checker("test")
+    assert not checker("wrong_password")
+
+
+def test_make_new_tmp_sub_dir(tmp_path, capsys):
+    _make_new_tmp_sub_dir(tmp_path)
+    # repeat to test while loop, and append a suffix.
+    _make_new_tmp_sub_dir(tmp_path)
+    capsys.readouterr()
+
+
+def test_make_subprocess_checker(tmp_path):
+    script = tmp_path / "extract_with_7z.sh"
+    script.write_text(f"""\
+#!/usr/bin/env bash
+set -eu
+
+7z x -p$1 -o{tmp_path} {SEVEN_ZIP_TEST_ARCHIVE}
+""")
+    script.chmod(script.stat().st_mode | stat.S_IXUSR | stat.S_IRUSR)
+    checker = make_subprocess_checker(f"{script} ")
+    assert checker("test")
+
+
+def test_sequential_passwords_checker_verbosity_2(capsys):
+    result = check_passwords_sequentially(
+        candidates=[("A", 0), ("B", 0), ("C", 0)],
+        test_func=lambda candidate: False,
+        verbosity=2,
+        update_every=1,
+        total=3,
+        print_passwords=True,
+    )
+    capsys.readouterr()
+    assert result is None
+
+
+def test_ssh_key_checker(tmp_path):
+    ssh_test_keys = _try_make_ssh_key_files(tmp_path)
+    for key_file, pw in ssh_test_keys:
+        assert key_file.is_file()
+        checker = make_ssh_key_checker(key_file)
+        assert not checker("incorrect")
+        assert checker(pw)
+
+
+@pytest.mark.parametrize(
+    "print_passwords",
+    [True, False],
+)
+def test_ssh_key_checker_no_username_finds_password_on_init(
+    print_passwords: bool,
+    tmp_path,
+    capsys,
+):
+    keyfiles_and_pwds = _try_make_ssh_key_files(tmp_path, "password123")
+    with patch("getpass.getuser", side_effect=OSError):
+        for file, _pwd in keyfiles_and_pwds:
+            with pytest.raises(SystemExit):
+                make_ssh_key_checker(file, print_passwords=print_passwords)
+            stdout, stderr = capsys.readouterr()
+            _assert_output_on_found_password(
+                "password123", -12345, print_passwords, stdout, stderr
+            )
+
+
+def test_ssh_key_checker_bad_file(tmp_path):
+    file = tmp_path / "test_bad_key"
+    file.write_bytes(b"oh2343gsbnwRPJWG32546OMPJDFAFSDGH&53423NZjiga")
+    with pytest.raises(ExceptionGroup):
+        make_ssh_key_checker(file)
+
+
+@pytest.mark.parametrize("path", [XLSX_FILE, DOCX_FILE])
+def test_ms_office_crypto_tool_checker(path: Path):
+    checker = make_MS_Office_files_key_checker(path)
+    assert not checker("not_test")
+    assert checker("test")
+
+
+def test_veracrypt_checker(tmp_path):
+    volume = tmp_path / "test.hc"
+    password = "test"
+    # Default mount point ./mnt/veracrypt_volume{_X}
+    _try_make_veracrypt_volume(volume, password)
+
+    checker = make_Veracrypt_checker(file=volume)
+    assert not checker("not_test")
+
+    # This can fail if the volume is already mounted, or
+    # if something is already mounted to the same mount point.
+    assert checker("test")

{fiddlesticks-0.3.0 → fiddlesticks-0.4.0}/tests/end_to_end_tests.py

@@ -21,6 +21,7 @@ from .helpers import (
     _assert_candidate_within_M_of_pwds,
     _assert_files_same,
     _create_password_protected_7z_archive,
+    _try_make_veracrypt_volume,
     avdu_test_vault,  # noqa: F401
     chars_without_Bash_syntax,
     file_names_and_contents,
@@ -169,7 +170,20 @@ def test_default_command_with_aegis_vault(avdu_test_vault, tmp_path):  # noqa: F
         _collate_args(2, ["7est"], avdu_test_vault),
         capture_output=True,
         check=False,
-        env={"TMPDIR": str(tmp_path), **os.environ},
+    )
+    assert result.returncode == 0
+
+
+def test_default_command_with_Veracrypt_volume(tmp_path):
+    volume = tmp_path / "test.hc"
+    password = "test"
+    # Default mount point ./mnt/veracrypt_volume{_X}
+    result = _try_make_veracrypt_volume(volume, password)
+
+    result = subprocess.run(
+        _collate_args(2, ["7est"], volume.as_posix()),
+        capture_output=True,
+        check=False,
     )
     assert result.returncode == 0
 
@@ -199,7 +213,7 @@ def test_input_and_output_file(tmp_path):
             "--py7zr",
             f"--input-file={guesses_file}",
             f"--output-file={output_file}",
-            str(Path(__file__).parent / "foo.7z"),
+            str(SEVEN_ZIP_TEST_ARCHIVE),
         ],
         capture_output=True,
         check=True,

{fiddlesticks-0.3.0 → fiddlesticks-0.4.0}/tests/helpers.py

@@ -17,8 +17,11 @@ import fiddlesticks
 
 BI_MAP = fiddlesticks.SHIFT_AND_LEET_BI_MAP
 PARENT_DIR = Path(__file__).parent
-KDBX_TEST_VAULT = PARENT_DIR / "Test_vault_Do_Not_Use.kdbx"
-SEVEN_ZIP_TEST_ARCHIVE = PARENT_DIR / "foo.7z"
+DATA_FILES = PARENT_DIR / "data_files"
+KDBX_TEST_VAULT = DATA_FILES / "Test_vault_Do_Not_Use.kdbx"
+SEVEN_ZIP_TEST_ARCHIVE = DATA_FILES / "foo.7z"
+XLSX_FILE = DATA_FILES / "test.xlsx"
+DOCX_FILE = DATA_FILES / "test.docx"
 
 file_names = text(
     alphabet=string.ascii_letters + string.digits,
@@ -174,7 +177,7 @@ def _assert_candidate_within_M_of_pwds(
 
 
 @pytest.fixture(scope="session")
-def avdu_test_vault(tmp_path_factory):
+def avdu_test_vault(tmp_path_factory) -> Path:
     avdu_repo = tmp_path_factory.mktemp("avdu")
     subprocess.run(
         [
@@ -188,3 +191,81 @@ def avdu_test_vault(tmp_path_factory):
         capture_output=True,
     )
     return avdu_repo / "test" / "data" / "aegis_encrypted.json"
+
+
+def _try_make_ssh_key_files(
+    keys_dir: Path,
+    password: str = "",
+) -> list[tuple[Path, str]]:
+    keyfiles_and_pwds = []
+    for cmd, pwd, key_file in [
+        (
+            'openssl genrsa -aes128 -passout pass:{password} -out "{key_file}" 2048',
+            "test",
+            "openssl_PEM.key",
+        ),
+        (
+            'ssh-keygen -m PEM -t rsa -b 2048 -N "{password}" -f "{key_file}"',
+            "testtest",
+            "basic_PEM.key",
+        ),
+        (
+            'ssh-keygen -t rsa -b 2048 -N "{password}" -f "{key_file}"',
+            "testtest",
+            "openssh-modern.key",
+        ),
+    ]:
+        pwd = password or pwd
+        subprocess.run(
+            cmd.format(password=pwd, key_file=(keys_dir / key_file).as_posix()),
+            check=True,
+            capture_output=True,
+            shell=True,
+        )
+        keyfiles_and_pwds.append((keys_dir / key_file, pwd))
+    return keyfiles_and_pwds
+
+
+def _assert_output_on_found_password(
+    password: str,
+    i: int,
+    print_passwords: bool,
+    stdout: str,
+    stderr: str,
+) -> None:
+    assert not stdout
+    assert "Found password" in stderr, f"{stderr=}"
+    assert f"candidate number: {i}" in stderr, f"{stderr=}"
+    if print_passwords:
+        assert password in stderr, f"{stderr=}"
+    else:
+        assert password not in stderr, f"{stderr=}"
+
+
+def _try_make_veracrypt_volume(
+    volume: Path,
+    password: str,
+) -> subprocess.CompletedProcess:
+
+    args = [
+        "veracrypt",
+        "--text",
+        "--non-interactive",
+        "--create",
+        "--encryption=AES",
+        "--hash=SHA-512",
+        "--pim=0",
+        "--volume-type=normal",
+        "--filesystem=FAT",
+        "--keyfiles=",
+        "--size=512K",
+        f"--password={password}",
+        volume.as_posix(),
+    ]
+
+    return subprocess.run(
+        " ".join(args),
+        check=True,
+        capture_output=True,
+        shell=True,
+    )

fiddlesticks-0.4.0/tests/misc_tests.py

@@ -0,0 +1,121 @@
+import io
+from pathlib import Path
+from unittest.mock import patch
+
+import msoffcrypto
+import msoffcrypto.exceptions
+import pytest
+from cryptography.hazmat.primitives.serialization import (
+    load_pem_private_key,
+    load_ssh_private_key,
+)
+
+from fiddlesticks import (
+    IS_WINDOWS,
+    _get_hopefully_incorrect_password,
+    cli,
+    possibly_output_found_password,
+)
+
+from .helpers import (
+    DOCX_FILE,
+    SEVEN_ZIP_TEST_ARCHIVE,
+    XLSX_FILE,
+    _assert_output_on_found_password,
+    _try_make_ssh_key_files,
+)
+
+
+@pytest.mark.skipif(
+    IS_WINDOWS, reason="I haven't figured out the 7zip CLI on Windows yet"
+)
+def test_password_from_getpass_in_CLI(capsys):
+    with patch("getpass.getpass", side_effect=["test", ""]):
+        assert 0 == cli(["--max-subs", "0", str(SEVEN_ZIP_TEST_ARCHIVE)])
+    capsys.readouterr()
+
+
+def test_get_hopefully_incorrect_password_username_not_found(capsys):
+    with patch("getpass.getuser", side_effect=OSError):
+        assert "password123" == _get_hopefully_incorrect_password()
+
+
+@pytest.mark.parametrize(
+    "print_passwords",
+    [True, False],
+)
+def test_possibly_output_found_password_no_time(
+    print_passwords: bool,
+    capsys,
+):
+    password = "abcde"
+    i = 5
+    # This currently only gets called without a calculation time
+    # if the password was the user's username, or "password123",
+    # when using an SSH key password checker.
+    possibly_output_found_password(
+        password=password,
+        i=i,
+        t=None,
+        print_passwords=print_passwords,
+    )
+
+    stdout, stderr = capsys.readouterr()
+    _assert_output_on_found_password(password, i, print_passwords, stdout, stderr)
+
+
+def test_are_error_strings_in_cryptography_unchanged(tmp_path):
+    keyfiles_and_pwds = _try_make_ssh_key_files(tmp_path, "testtesttest")
+    n = 0
+    for error_str, loader, file in [
+        (
+            "Corrupt data: broken checksum",
+            load_ssh_private_key,
+            keyfiles_and_pwds[-1][0],
+        ),
+        (
+            "Incorrect password, could not decrypt key",
+            load_pem_private_key,
+            keyfiles_and_pwds[1][0],
+        ),
+        # Seen other errors:
+        #
+        #         3
+        # =================================== FAILURES ===================================
+        # _______________ test_are_error_strings_in_cryptography_unchanged _______________
+        # tests/misc_tests.py:78: in test_are_error_strings_in_cryptography_unchanged
+        #     loader(private_key_data, ***"the_wrong_password")
+        # E   ValueError: Could not deserialize key data. The data may be in an incorrect format, it may be encrypted with an unsupported algorithm, or it may be an unsupported key type (e.g. EC curves with explicit parameters). Details: ASN.1 parsing error: unexpected tag (got Tag { value: 20, constructed: false, class: Application })
+        # E   If your key is in PKCS#8 format, you must use BEGIN/END PRIVATE KEY PEM delimiters
+        #
+        # https://github.com/Hazardous-Area/fiddlesticks/actions/runs/33859787867/job/100981355309#logs
+    ]:
+        private_key_data = file.read_bytes()
+        try:
+            loader(private_key_data, password=b"the_wrong_password")
+        except ValueError as e:
+            assert e.args[0] == error_str, (
+                "The error string in the Cryptography dependency has changed. "
+            )
+            n += 1
+
+    assert n == 2, (
+        "SSH Key file loaded via cryptography primitive with the_wrong_password??!!"
+    )
+
+
+@pytest.mark.parametrize("path", [XLSX_FILE, DOCX_FILE])
+def test_msoffice_crypto_tools(path: Path):
+    # Not so different to msoffcrypto-tool's example:
+    # https://github.com/nolze/msoffcrypto-tool#as-library
+    encrypted = io.BytesIO(path.read_bytes())
+    stream = io.BytesIO()
+
+    office_file = msoffcrypto.OfficeFile(encrypted)
+
+    office_file.load_key(password="not_test")
+    with pytest.raises(msoffcrypto.exceptions.InvalidKeyError):
+        office_file.decrypt(stream)
+
+    office_file.load_key(password="test")
+    office_file.decrypt(stream)

{fiddlesticks-0.3.0 → fiddlesticks-0.4.0}/tests/pw_generator_tests.py

@@ -1,12 +1,9 @@
-from unittest.mock import patch
-
 import pytest
 from hypothesis import HealthCheck, given, settings
 
 import fiddlesticks
 
 from .helpers import (
-    SEVEN_ZIP_TEST_ARCHIVE,
     _assert_candidate_within_M_of_pwds,
     _candidate_is_within_M_of_pwd,
     passwords_guesses_and_num_subs,
@@ -56,11 +53,3 @@ def test_multiple_guesses(pwds):
     _total, candidates = fiddlesticks.candidate_passwords_from_alt_chars(pwds, 2)
     for candidate, _num_subs in candidates:
         _assert_candidate_within_M_of_pwds(candidate, pwds, 2)
-
-
-@pytest.mark.skipif(
-    fiddlesticks.IS_WINDOWS, reason="I haven't figured out the 7zip CLI on Windows yet"
-)
-def test_password_from_getpass_in_CLI(capsys):
-    with patch("getpass.getpass", side_effect=["test", ""]):
-        assert 0 == fiddlesticks.cli(["--max-subs", "0", str(SEVEN_ZIP_TEST_ARCHIVE)])

fiddlesticks-0.3.0/.gitattributes

@@ -1,2 +0,0 @@
-* text eol=lf
-*.kdbx,*.7z binary

fiddlesticks-0.3.0/.github/workflows/tests.yml

@@ -1,27 +0,0 @@
-name: Tests
-
-on:
-  workflow_dispatch:
-  push:
-  pull_request:
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Check out repo
-      uses: actions/checkout@v7
-    
-    - name: Set up Python
-      uses: actions/setup-python@v7
-      with:
-        python-version: "3.14"
-    
-    - name: Install dependencies
-      run: |
-        pip install -e . --group=test
-
-    - name: Run PyTest (via Coverage)
-      run: |
-        coverage run -m pytest -rA --tb=short tests && coverage combine && coverage report

fiddlesticks-0.3.0/tests/checker_tests.py

@@ -1,75 +0,0 @@
-import stat
-import subprocess
-
-import pytest
-
-from fiddlesticks import (
-    IS_WINDOWS,
-    _make_new_tmp_sub_dir,
-    check_passwords_sequentially,
-    make_py_avdu_aegis_checker,
-    make_pykeepass_checker,
-    make_subprocess_checker,
-)
-
-from .helpers import (
-    KDBX_TEST_VAULT,
-    SEVEN_ZIP_TEST_ARCHIVE,
-    avdu_test_vault,  # noqa: F401
-)
-
-
-@pytest.mark.skipif(
-    IS_WINDOWS, reason="I haven't figured out the 7zip CLI on Windows yet"
-)
-def test_is_7zip_installed():
-    args = ["7z", "--help"]
-    subprocess.run(args, capture_output=True, check=True)
-
-
-def test_aegis_checker_against_avdu_vault(avdu_test_vault):  # noqa: F811
-    checker = make_py_avdu_aegis_checker(avdu_test_vault)
-    # """
-    # # Run using the encrypted test file. (Enter password "test" when prompted.)
-    # go run ./cmd/avdu -p test/data/aegis_encrypted.json -e
-    # https://github.com/Sammy-T/avdu/blob/master/README.md
-    # """
-    assert checker("test")
-    assert not checker("wrong_password")
-
-
-def test_pykeepass_checker_against_Test_vault():
-    checker = make_pykeepass_checker(KDBX_TEST_VAULT)
-    assert checker("test")
-    assert not checker("wrong_password")
-
-
-def test_make_new_tmp_sub_dir(tmp_path, capsys):
-    _make_new_tmp_sub_dir("", tmp_path)
-    # repeat to test while loop, and append a suffix.
-    _make_new_tmp_sub_dir("", tmp_path)
-
-
-def test_make_subprocess_checker(tmp_path):
-    script = tmp_path / "extract_with_7z.sh"
-    script.write_text(f"""\
-#!/usr/bin/env bash
-set -eu
-
-7z x -p$1 -o{tmp_path} {SEVEN_ZIP_TEST_ARCHIVE}
-""")
-    script.chmod(script.stat().st_mode | stat.S_IXUSR | stat.S_IRUSR)
-    checker = make_subprocess_checker(f"{script} ")
-    assert checker("test")
-
-
-def test_sequential_passwords_checker_verbosity_2(capsys):
-    result = check_passwords_sequentially(
-        candidates=[("A", 0), ("B", 0), ("C", 0)],
-        test_func=lambda candidate: False,
-        verbosity=2,
-        update_every=1,
-        total=3,
-        print_passwords=True,
-    )
-    assert result is None