+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: False Positive Crack on VeraCrypt (/thread-10847.html)
False Positive Crack on VeraCrypt - ttgoa - 06-22-2022
Hey,
I got 3 times False Positive cracked results on a VeraCrypt hidden partition using SHA-512 + XTS 1536bit (-m 13723) and --veracrypt-keyfiles. each time the password is different, none of them can open the Partition using the VeraCrypt app.
Even stranger is the fact that the crack is not consistent, meaning, if I will run another session with the same dictionary it won't crack.
Any ideas?
Using 2 AMD GPUs with
OpenCL API (OpenCL 2.2 AMD-APP (3417.0))
hashcat (v6.2.5)
RE: False Positive Crack on VeraCrypt - Snoopy - 06-23-2022
did you extract the right 512 bytes?
https://hashcat.net/wiki/doku.php?id=frequently_asked_questions#how_do_i_extract_the_hashes_from_truecrypt_volumes
is the attack target a testsetup where you know the plainpassword and hashing + encryption algorithm?
xts 1536 is only needed for cascaded encryptions (3) the default setting with veracrypt is SHA-512 - XTS 512
RE: False Positive Crack on VeraCrypt - ttgoa - 06-25-2022
(06-23-2022, 06:51 PM)Snoopy Wrote: did you extract the right 512 bytes?
https://hashcat.net/wiki/doku.php?id=frequently_asked_questions#how_do_i_extract_the_hashes_from_truecrypt_volumes
is the attack target a testsetup where you know the plainpassword and hashing + encryption algorithm?
xts 1536 is only needed for cascaded encryptions (3) the default setting with veracrypt is SHA-512 - XTS 512
I think I'm extracting good, skip is using 512 blocks so the result is 65,536 bytes skip
(65,536 is also what the console print after executing the dd)
dd.exe if=\\?\Device\Harddisk8\Partition3 of=hash.tc bs=512 count=1 skip=128
it's not a test but I run also a test and in the test the crack is positive-positive (same settings with xts 1536)
I use xts 1536 intationally as the hash is 3 cascaded encryptions.
RE: False Positive Crack on VeraCrypt - ttgoa - 07-08-2022
anyone?