oclhashcat-Plus64.exe 0.14 bizzare output sections
#1
Running some tests on the linkedin hash list, with oclhashcat-Plus4 in brute force mode (3), using --remove and --outfile-format=7, looking I see a lot of hashes cracked, in hash:plaintextPW:hexPW format, as expected. Then, suddenly, I see a line that's more than 40 characters with no colon, an even longer line with a colon after 80-(previous line's length) character, another 40 characters, what may be a password, and another 40 characters of hex.
Hex lines of length 42 without passwords continue for a bit, interrupted by lines with 0 to 2 characters, another couple long lines, and then a small set of lines of length 42. After several sets of that, the output file looks good again, nice and normal.

It looks like sometimes, perhaps after many hashes are cracked very quickly, the output format goes a little weird. Alternately, maybe a character combination does it?

This happens for longer brute forces with custom charsets as well, at least - I'm still tracking down some other issues.

Code:
oclHashcat-plus64.exe --attack-mode=3 -m 100 --remove -1 ?d?l?u?s --outfile=linkedin.hash --outfile-format=7 linkedin.lst ?1?1?1?1?1?1

Windows 7 64-bit SP1, fully patched.
ATI 13.1 Catalyst drivers, with an HD6950 card.
AMD 1090T Phenom II CPU.

clinfo
Code:
Number of platforms:                 1
  Platform Profile:                 FULL_PROFILE
  Platform Version:                 OpenCL 1.2 AMD-APP (1084.4)
  Platform Name:                 AMD Accelerated Parallel Processing
  Platform Vendor:                 Advanced Micro Devices, Inc.
  Platform Extensions:                 cl_khr_icd cl_amd_event_callback cl_amd_offline_devices cl_khr_d3d10_sharing cl_khr_d3d11_sharing


  Platform Name:                 AMD Accelerated Parallel Processing
Number of devices:                 2
  Device Type:                     CL_DEVICE_TYPE_GPU
  Device ID:                     4098
  Board name:                     AMD Radeon HD 6900 Series
  Max compute units:                 22
  Max work items dimensions:             3
    Max work items[0]:                 256
    Max work items[1]:                 256
    Max work items[2]:                 256
  Max work group size:                 256
  Preferred vector width char:             16
  Preferred vector width short:             8
  Preferred vector width int:             4
  Preferred vector width long:             2
  Preferred vector width float:             4
  Preferred vector width double:         2
  Native vector width char:             16
  Native vector width short:             8
  Native vector width int:             4
  Native vector width long:             2
  Native vector width float:             4
  Native vector width double:             2
  Max clock frequency:                 900Mhz
  Address bits:                     32
  Max memory allocation:             536870912
  Image support:                 Yes
  Max number of images read arguments:         128
  Max number of images write arguments:         8
  Max image 2D width:                 16384
  Max image 2D height:                 16384
  Max image 3D width:                 2048
  Max image 3D height:                 2048
  Max image 3D depth:                 2048
  Max samplers within kernel:             16
  Max size of kernel argument:             1024
  Alignment (bits) of base address:         2048
  Minimum alignment (bytes) for any datatype:     128
  Single precision floating point capability
    Denorms:                     No
    Quiet NaNs:                     Yes
    Round to nearest even:             Yes
    Round to zero:                 Yes
    Round to +ve and infinity:             Yes
    IEEE754-2008 fused multiply-add:         Yes
  Cache type:                     None
  Cache line size:                 0
  Cache size:                     0
  Global memory size:                 2147483648
  Constant buffer size:                 65536
  Max number of constant args:             8
  Local memory type:                 Scratchpad
  Local memory size:                 32768
  Kernel Preferred work group size multiple:     64
  Error correction support:             0
  Unified memory for Host and Device:         0
  Profiling timer resolution:             1
  Device endianess:                 Little
  Available:                     Yes
  Compiler available:                 Yes
  Execution capabilities:                
    Execute OpenCL kernels:             Yes
    Execute native function:             No
  Queue properties:                
    Out-of-Order:                 No
    Profiling :                     Yes
  Platform ID:                     000007FEE0037FF8
  Name:                         Cayman
  Vendor:                     Advanced Micro Devices, Inc.
  Device OpenCL C version:             OpenCL C 1.2
  Driver version:                 1084.4 (VM)
  Profile:                     FULL_PROFILE
  Version:                     OpenCL 1.2 AMD-APP (1084.4)
  Extensions:                     cl_khr_fp64 cl_amd_fp64 cl_khr_global_int32_base_atomics cl_khr_global_int32_extended_atomics cl_khr_local_int32_base_atomics cl_khr_local_int32_extended_atomics cl_khr_3d_image_writes cl_khr_byte_addressable_store cl_khr_gl_sharing cl_ext_atomic_counters_32 cl_amd_device_attribute_query cl_amd_vec3 cl_amd_printf cl_amd_media_ops cl_amd_media_ops2 cl_amd_popcnt cl_khr_d3d10_sharing


  Device Type:                     CL_DEVICE_TYPE_CPU
  Device ID:                     4098
  Board name:                    
  Max compute units:                 6
  Max work items dimensions:             3
    Max work items[0]:                 1024
    Max work items[1]:                 1024
    Max work items[2]:                 1024
  Max work group size:                 1024
  Preferred vector width char:             16
  Preferred vector width short:             8
  Preferred vector width int:             4
  Preferred vector width long:             2
  Preferred vector width float:             4
  Preferred vector width double:         2
  Native vector width char:             16
  Native vector width short:             8
  Native vector width int:             4
  Native vector width long:             2
  Native vector width float:             4
  Native vector width double:             2
  Max clock frequency:                 3214Mhz
  Address bits:                     64
  Max memory allocation:             4294059008
  Image support:                 Yes
  Max number of images read arguments:         128
  Max number of images write arguments:         8
  Max image 2D width:                 8192
  Max image 2D height:                 8192
  Max image 3D width:                 2048
  Max image 3D height:                 2048
  Max image 3D depth:                 2048
  Max samplers within kernel:             16
  Max size of kernel argument:             4096
  Alignment (bits) of base address:         1024
  Minimum alignment (bytes) for any datatype:     128
  Single precision floating point capability
    Denorms:                     Yes
    Quiet NaNs:                     Yes
    Round to nearest even:             Yes
    Round to zero:                 Yes
    Round to +ve and infinity:             Yes
    IEEE754-2008 fused multiply-add:         Yes
  Cache type:                     Read/Write
  Cache line size:                 64
  Cache size:                     65536
  Global memory size:                 17176236032
  Constant buffer size:                 65536
  Max number of constant args:             8
  Local memory type:                 Global
  Local memory size:                 32768
  Kernel Preferred work group size multiple:     1
  Error correction support:             0
  Unified memory for Host and Device:         1
  Profiling timer resolution:             318
  Device endianess:                 Little
  Available:                     Yes
  Compiler available:                 Yes
  Execution capabilities:                
    Execute OpenCL kernels:             Yes
    Execute native function:             Yes
  Queue properties:                
    Out-of-Order:                 No
    Profiling :                     Yes
  Platform ID:                     000007FEE0037FF8
  Name:                         AMD Phenom(tm) II X6 1090T Processor
  Vendor:                     AuthenticAMD
  Device OpenCL C version:             OpenCL C 1.2
  Driver version:                 1084.4 (sse2)
  Profile:                     FULL_PROFILE
  Version:                     OpenCL 1.2 AMD-APP (1084.4)
  Extensions:                     cl_khr_fp64 cl_amd_fp64 cl_khr_global_int32_base_atomics cl_khr_global_int32_extended_atomics cl_khr_local_int32_base_atomics cl_khr_local_int32_extended_atomics cl_khr_int64_base_atomics cl_khr_int64_extended_atomics cl_khr_3d_image_writes cl_khr_byte_addressable_store cl_khr_gl_sharing cl_ext_device_fission cl_amd_device_attribute_query cl_amd_vec3 cl_amd_printf cl_amd_media_ops cl_amd_media_ops2 cl_amd_popcnt cl_khr_d3d10_sharing
#2
If you do not use --outfile-format, does it still produce strange outputs?
#3
I'll run that test and post results.
ETA: Still trying to duplicate the error even with --output-format=7; the "stopped working" error I just posted appears to be more frequent than the output corruption error.
#4
Yes, it's repeatable without any --output-format at all, though there are fewer short rows after the long rows.

Moreover, further testing indicates it happens just before the "has stopped working" Windows error regardless of the --output-format 7 or not present - there's only a few hundred good rows in the output file after the bizzare output sections when I make a copy of the output file after Windows shows the "stopped working" flag.

This testing was done on a hard drive, nice and normal, and all these repeatable tests have been done with brute force mode, though I believe that dictionary modes have the same issues.
#5
hmm ok, have to dig deeper into it. please post the stuff again as a trac ticket
#6
https://hashcat.net/trac/ticket/111
#7
As additional information that is probably related, I have also an HD6950 that has a tendency to crash and when it does, introduces fake cracked hash in the output file, all with blank passwords. I currently attribute the frequent crashing to not feeding the GPU enough power from PSU but it could be something else. Anyone has an HD6950 that works correctly without flaws?
#8
Interesting - thank you for the additional information!

I have zero (0) evidence of driver restarts or anything like that, and during diagnosis, I used the ATI Catalyst graphics overclocking section to add +8% more power. The power supply is a Seasonic with no symptoms of failure at this time.
#9
(04-03-2013, 04:08 PM)Incisive Wrote: I have zero (0) evidence of driver restarts or anything like that

Then what do you think is the following that you mentioned in an earlier post:
Quote:Moreover, further testing indicates it happens just before the "has stopped working" Windows error

Also, just to clarify things, I did not want to suggest that you had power problems but that it could be due to the driver crashing.
#10
Honestly, I don't know what the "has stopped working" Windows error is, but it not accompanied by the more usual driver crashes where the entire screen freezes/blanks out for a bit, and then the a small popup message in the lower right stating that the driver has been restarted. More to the point, if it were a driver restart, I'd have expected to see that Catalyst has stopped working, not that oclhashcat-plus64 has stopped working.

It's possible I'm misremembering which driver version or brand does what, of course.