Issue with large hcmask file - Printable Version

Issue with large hcmask file - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Issue with large hcmask file (/thread-7208.html)

Pages: 1 2

Issue with large hcmask file - guest106 - 01-17-2018

Hi everybody!
First of all I want to say thanks for this great program, it's very useful!
In a specific use-case I believe I am facing a bug: if in mask-attack mode you use large hcmask file (e.g. rockyou-5-86400.hcmask from standard pack with hashcat) in random Guess.Queue place hashcat throws an error: "Restore value is greater than keyspace." and halts. If you rerun the program with the same cmdline the bug may reoccur in another Guess.Queue place.
Example of cmdline:
hashcat -m 10 /hashes.txt -a 3 /usr/share/hashcat/masks/rockyou-5-86400.hcmask --potfile-disable
I use the latest hashcat version from The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali) Linux repo 3.60-1
Thanks for your attention, if you know the solution, please post it in the comments.

RE: Issue with large hcmask file - epixoip - 01-17-2018

3.6.0 is pretty old (June 2017.) Please test with 4.0.1 or latest build from github.

RE: Issue with large hcmask file - walterlacka - 01-17-2018

I'm running into the same issue using a large hcmask file created from PACK. This is using hashcat version v4.0.1-74-ga680f194

Session..........: joe18
Status...........: Exhausted
Hash.Type........: MD5
Hash.Target......: eXXXXXXXXXXXXXXXXXXXXXXXd4285098
Time.Started.....: Tue Jan 16 13:38:50 2018 (58 secs)
Time.Estimated...: Tue Jan 16 13:39:48 2018 (0 secs)
Guess.Mask.......: ?u?l?u?l?d?s?l?s?l [9]
Guess.Queue......: 158/10713 (1.47%)
Speed.Dev.#2.....: 33185.3 MH/s (170.50ms)
Speed.Dev.#3.....: 24040.9 MH/s (172.81ms)
Speed.Dev.#*.....: 57226.2 MH/s
Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 3364092800640/3364092800640 (100.00%)
Rejected.........: 0/3364092800640 (0.00%)
Restore.Point....: 190085668/191402640 (99.31%)
Candidates.#2....: NwFr6)a[t -> XqIq6 z%z
Candidates.#3....: NwFt9<s&q -> XqIl6)a[t
HWMon.Dev.#2.....: Temp: 59c Fan:100% Util: 66% Core:1860MHz Mem:5005MHz Bus:8
HWMon.Dev.#3.....: Temp: 62c Fan:100% Util: 92% Core:1835MHz Mem:4513MHz Bus:16

Restore value is greater than keyspace.

Started: Tue Jan 16 12:37:13 2018
Stopped: Tue Jan 16 13:39:51 2018

C:\hashcat-4.0.1>hashcat64.exe --version
v4.0.1-74-ga680f194

RE: Issue with large hcmask file - walterlacka - 01-19-2018

Hey guys, just wondering if there's a version that has this issue fixed?

RE: Issue with large hcmask file - philsmd - 01-19-2018

Please try with https://hashcat.net/beta/

RE: Issue with large hcmask file - guest106 - 01-22-2018

Guys, thank you for your replies! Unfortunately, when I tried with latest stable release and with latest beta version (https://hashcat.net/beta/hashcat-4.0.1%2B95.7z) this error occuring again.

Output example:

Code:
Session..........: hashcat

Status...........: Exhausted

Hash.Type........: MD5

Hash.Target......: af221f1870b6b6ec91682XXXXXXXXXXX

Time.Started.....: Mon Jan 22 05:52:05 2018 (7 secs)

Time.Estimated...: Mon Jan 22 05:52:12 2018 (0 secs)

Guess.Mask.......: ?d?l?l?l?l?l?l?l [8]

Guess.Queue......: 1274/10613 (12.00%)

Speed.Dev.#1.....:  5566.4 MH/s (46.15ms)

Speed.Dev.#2.....:  5658.9 MH/s (81.29ms)

Speed.Dev.#*.....: 11225.3 MH/s

Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts

Progress.........: 80318101760/80318101760 (100.00%)

Rejected.........: 0/80318101760 (0.00%)

Restore.Point....: 11796480/11881376 (99.29%)

Candidates.#1....: 9fzpfgeq -> 6qxuciqf

Candidates.#2....: 9fzftiqf -> 6qxqxqgx

HWMon.Dev.#1.....: Temp: 57c Fan: 44% Util:  0% Core:1974MHz Mem:4513MHz Bus:16

HWMon.Dev.#2.....: Temp: 53c Fan: 42% Util:  0% Core:1923MHz Mem:4513MHz Bus:1

Restore value is greater than keyspace.

And hashcat version:

Code:
./hashcat64.bin --version

v4.0.1-95-gce0cee0a

RE: Issue with large hcmask file - philsmd - 01-22-2018

Can you please give clear instruction on how to reproduce this?

Do you just run "./hashcat64.bin --restore" and it immediately gives you the "Restore value is greater than keyspace." error ? Does it happen immediately after starting the --restore command? Are you able to reproduce it all the time (or does it only happen sometimes/randomly)?

I'm not sure on how to reproduce it. I can't reproduce it locally. Maybe I'm not trying the correct commands. Please give more details

RE: Issue with large hcmask file - guest106 - 01-22-2018

Of course, first of all - I didn't restore last session. It occurs in new session too.
cmd-line for start hashcat:

Code:
./hashcat64.bin -m 0 /tmp/issue_test.txt -a 3 /usr/share/hashcat/masks/rockyou-5-86400.hcmask

This issue happens randomly, if I restart this cmd-line problem may occur in another Guess.Queue place.

RE: Issue with large hcmask file - atom - 01-23-2018

Can not reproduce locally. Can you retry with a single GPU?

RE: Issue with large hcmask file - walterlacka - 03-16-2018

Atom - I'm able to reproduce this issue when running both GPU's every time I run it. Normally it will occur within a day or two.. sometimes it takes another day or so.

Like the other poster, it happens both on a new session and also on a restored session and it also occurs at varying positions within the hcmask file.

As you suggested, I attempted to reproduce the problem using only a single GPU (of the 2 that are in my rig), and it's been running for a longer time than it normally would if I were using multiple GPU's.

I can let it run longer (with a single GPU) if you'd like to be sure it won't occur when using just 1 GPU. Otherwise, if there's other information needed, please let me know.

PS - this is using the latest version of hashcat 4.1.0 (downloaded directly from https://hashcat.net/files/hashcat-4.1.0.7z) on windows 10