hashcat Forum

Hi everybody!
First of all I want to say thanks for this great program, it's very useful!
In a specific use-case I believe I am facing a bug: if in mask-attack mode you use large hcmask file (e.g. rockyou-5-86400.hcmask from standard pack with hashcat) in random Guess.Queue place hashcat throws an error: "Restore value is greater than keyspace." and halts. If you rerun the program with the same cmdline the bug may reoccur in another Guess.Queue place.
Example of cmdline:
hashcat -m 10 /hashes.txt -a 3 /usr/share/hashcat/masks/rockyou-5-86400.hcmask --potfile-disable
I use the latest hashcat version from The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali) Linux repo 3.60-1
Thanks for your attention, if you know the solution, please post it in the comments.

3.6.0 is pretty old (June 2017.) Please test with 4.0.1 or latest build from github.

I'm running into the same issue using a large hcmask file created from PACK.  This is using hashcat version v4.0.1-74-ga680f194

Session..........: joe18
Status...........: Exhausted
Hash.Type........: MD5
Hash.Target......: eXXXXXXXXXXXXXXXXXXXXXXXd4285098
Time.Started.....: Tue Jan 16 13:38:50 2018 (58 secs)
Time.Estimated...: Tue Jan 16 13:39:48 2018 (0 secs)
Guess.Mask.......: ?u?l?u?l?d?s?l?s?l [9]
Guess.Queue......: 158/10713 (1.47%)
Speed.Dev.#2.....: 33185.3 MH/s (170.50ms)
Speed.Dev.#3.....: 24040.9 MH/s (172.81ms)
Speed.Dev.#*.....: 57226.2 MH/s
Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 3364092800640/3364092800640 (100.00%)
Rejected.........: 0/3364092800640 (0.00%)
Restore.Point....: 190085668/191402640 (99.31%)
Candidates.#2....: NwFr6)a[t -> XqIq6 z%z
Candidates.#3....: NwFt9<s&q -> XqIl6)a[t
HWMon.Dev.#2.....: Temp: 59c Fan:100% Util: 66% Core:1860MHz Mem:5005MHz Bus:8
HWMon.Dev.#3.....: Temp: 62c Fan:100% Util: 92% Core:1835MHz Mem:4513MHz Bus:16

Restore value is greater than keyspace.

Started: Tue Jan 16 12:37:13 2018
Stopped: Tue Jan 16 13:39:51 2018

C:\hashcat-4.0.1>hashcat64.exe --version
v4.0.1-74-ga680f194

Hey guys, just wondering if there's a version that has this issue fixed?

Please try with https://hashcat.net/beta/

Guys, thank you for your replies! Unfortunately, when I tried with latest stable release and with latest beta version (https://hashcat.net/beta/hashcat-4.0.1%2B95.7z) this error occuring again.

Output example:

And hashcat version:

Can you please give clear instruction on how to reproduce this?

Do you just run "./hashcat64.bin --restore" and it immediately gives you the "Restore value is greater than keyspace." error ? Does it happen immediately after starting the --restore command? Are you able to reproduce it all the time (or does it only happen sometimes/randomly)?

I'm not sure on how to reproduce it. I can't reproduce it locally. Maybe I'm not trying the correct commands. Please give more details

Of course, first of all - I didn't restore last session. It occurs in new session too.
cmd-line for start hashcat:
This issue happens randomly, if I restart this cmd-line problem may occur in another Guess.Queue place.

Can not reproduce locally. Can you retry with a single GPU?

Atom - I'm able to reproduce this issue when running both GPU's every time I run it.  Normally it will occur within a day or two.. sometimes it takes another day or so.

Like the other poster, it happens both on a new session and also on a restored session and it also occurs at varying positions within the hcmask file.

As you suggested, I attempted to reproduce the problem using only a single GPU (of the 2 that are in my rig), and it's been running for a longer time than it normally would if I were using multiple GPU's.

I can let it run longer (with a single GPU) if you'd like to be sure it won't occur when using just 1 GPU.  Otherwise, if there's other information needed, please let me know.

PS - this is using the latest version of hashcat 4.1.0 (downloaded directly from https://hashcat.net/files/hashcat-4.1.0.7z) on windows 10