hashcat Forum

Hi,

I just encoutered a strange behavior with the mask files (.hcmask)

With this in the mask file :

Quote:?l,?d,?1?1?1?1?1?2?2?2?2
?u,?d,?1?1?1?1?1?2?2?2?2

The calculated keyspace is normally the same for both line : 118 813 760 000.
But, when you execute it, the second line get processed with a keyspace of 3 802 040 320 000. And of course, the time/cost is much higher.

Win7-64 / cudaHashcat64 1.35
command : cudaHashcat64.exe -m 5100 -a 3 --remove -o hashs.txt.out hashs.txt test.hcmask

If I execute it with only one line in the file at a time, everything is fine.

So, I was testing another syntax to try isolating the problem :

Quote:?l?l?l?l?l?d?d?d?d
?u?u?u?u?u?d?d?d?d

1st line OK
2nd line OK

Quote:abcdefghijklmnopqrstuvwxyz,?d,?1?1?1?1?1?2?2?2?2
ABCDEFGHIJKLMNOPQRSTUVWXYZ,?d,?1?1?1?1?1?2?2?2?2

1st line OK
2nd line NOK

At this point, it seems related to the [1],[2],[3],[4],[mask] syntax.

Furthermore, if I use :

Quote:?l,?d,?1?1?1?1?1?2?2?2?2
?u,?d,?1?1?1?1?1?2?2?2?2
?l,?d,?1?1?1?1?1?2?2?2?2

1st line OK
2nd line NOK
3rd line NOK

And if I invert the line :

Quote:?u,?d,?1?1?1?1?1?2?2?2?2
?l,?d,?1?1?1?1?1?2?2?2?2

1st line OK
2nd line NOK

I was looking in docs, forums, trac, etc. to find a possible explanation, but nothing. So I turn this to you for a look with new eyes.

thank you for your time.



edit :
It seems there is some kind of interaction between the line when the charsets are not from the same "defaults" charsets.

Quote:abc,?1
123,?1

1st line keyspace = 3
2nd line keyspace = 6 ???

From my first exemple :

Quote:?l,?d,?1?1?1?1?1?2?2?2?2
?u,?d,?1?1?1?1?1?2?2?2?2

1st line keyspace = 118 813 760 000
2nd line keyspace = 3 802 040 320 000 (118 813 760 000 * 32) NOK

With the example on the wiki :

Quote:?d?l,test?1?1?1
abcdef,0123,ABC,789,?3?3?3?1?1?1?1?2?2?4?4?4?4
company?d?d?d?d?d
?l?l?l?l?d?d?d?d?d?d

1st line keyspace = 46 656
2nd line keyspace = 58 773 123 072 (45 349 632 * 1 296) NOK
3rd line keyspace = 100 000
4th line keyspace = 45 697 600 000

Thanks for the report.

Next time please do not hesitate to open a trac ticket ( see https://hashcat.net/trac/ticket/617 ).

Thanks for your action.

For information, i was able to reproduce it on every version available to download (so, since 1.20).

Oh, thanks for the info.
Strange that this problem wasn't found earlier. Nice find indeed.

Fortunately, the problem will be fixed with next release version (1.37).
Thanks again