How does 0xae get skipped from 0x00-0xff range in --hex-charset ?b mask??? - Printable Version +- hashcat Forum (https://hashcat.net/forum) +-- Forum: Support (https://hashcat.net/forum/forum-3.html) +--- Forum: hashcat (https://hashcat.net/forum/forum-45.html) +--- Thread: How does 0xae get skipped from 0x00-0xff range in --hex-charset ?b mask??? (/thread-11055.html) |
How does 0xae get skipped from 0x00-0xff range in --hex-charset ?b mask??? - saulys - 10-11-2022 Hi, I was playing around with old office secret key cracking based on: https://hashcat.net/forum/thread-7643.html description. I was using the same good file.hash: $oldoffice$1*d6aabb63363188b9b73a88efb9c9152e*afbbb9254764273f8f4fad9a5d82981f*6f09fd2eafc4ade522b5f2bee0eaf66d with known RC4 key: f2ab1219ae It is strange that hashcat succeeded in finding RC4 key if I ran it as: hashcat file.hash -m 9710 -a 3 --hex-charset f2ab1219ae but hashcat failed in finding RC4 key with statement that it exhausted all variants from $HEX[f2ab121900] to $HEX[f2ab1219ff] if I ran it as: hashcat file.hash -m 9710 -a 3 --hex-charset f2ab1219?b Isn't 0xae part of 0x00-0xff range? How does hashcat get to this result? RE: How does 0xae get skipped from 0x00-0xff range in --hex-charset ?b mask??? - saulys - 10-11-2022 Can someone replicate this behavior, please? RE: How does 0xae get skipped from 0x00-0xff range in --hex-charset ?b mask??? - saulys - 10-11-2022 It looks as reappearance of 8 year old bug in hashcat: https://hashcat.net/forum/thread-3665-page-2.html Environment info: hashcat (v6.2.6) starting in backend information mode OpenCL Info: ============ OpenCL Platform ID #1 Vendor..: Intel(R) Corporation Name....: Intel(R) OpenCL HD Graphics Version.: OpenCL 3.0 Backend Device ID #1 Type...........: GPU Vendor.ID......: 8 Vendor.........: Intel(R) Corporation Name...........: Intel(R) UHD Graphics Version........: OpenCL 3.0 NEO Processor(s)...: 24 Clock..........: 1100 Memory.Total...: 6462 MB (limited to 1615 MB allocatable in one block) Memory.Free....: 3168 MB Local.Memory...: 64 KB OpenCL.Version.: OpenCL C 1.2 Driver.Version.: 30.0.101.1404 RE: How does 0xae get skipped from 0x00-0xff range in --hex-charset ?b mask??? - slyexe - 10-12-2022 Are you sure hashcat is not just "Skipping" your hash because it has previously been found in the potfile? Show us the code of your attack running, or being exhausted. RE: How does 0xae get skipped from 0x00-0xff range in --hex-charset ?b mask??? - saulys - 10-12-2022 (10-12-2022, 12:33 AM)slyexe Wrote: Are you sure hashcat is not just "Skipping" your hash because it has previously been found in the potfile?Nope, it's not in potfile. Please check run results with full key and masked key below. Successful attack with full key: Quote:hashcat test.hash -m 9710 -a 3 --hex-charset f2ab1219ae --potfile-disable Exhausted attack with masked key: Quote:hashcat test.hash -m 9710 -a 3 --hex-charset f2ab1219?b --potfile-disable RE: How does 0xae get skipped from 0x00-0xff range in --hex-charset ?b mask??? - Snoopy - 10-12-2022 working as expected y:\hashcat>hashcat -D1 -d1 -m9710 -a3 --hex-charset hash.txt f2ab1219?b Session..........: hashcat Status...........: Cracked Hash.Mode........: 9710 (MS Office <= 2003 $0/$1, MD5 + RC4, collider #1) Hash.Target......: $oldoffice$1*d6aabb63363188b9b73a88efb9c9152e*afbbb...eaf66d Time.Started.....: Wed Oct 12 14:16:51 2022 (0 secs) Time.Estimated...: Wed Oct 12 14:16:51 2022 (0 secs) Kernel.Feature...: Optimized Kernel Guess.Mask.......: f2ab1219?b [5] Guess.Queue......: 1/1 (100.00%) Speed.#1.........: 479.9 kH/s (0.09ms) @ Accel:1024 Loops:1 Thr:1 Vec:8 Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new) Progress.........: 256/256 (100.00%) Rejected.........: 0/256 (0.00%) Restore.Point....: 0/256 (0.00%) Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1 Candidate.Engine.: Device Generator Candidates.#1....: $HEX[f2ab121900] -> $HEX[f2ab1219ff] i believe the problem is still the broken intel opencl GPU driver (this problem is as old as the intel integrated cpu/gpu devices) you have to stick to CPU opencl drivers (in my case i can force hashcat with options -D -d1 to use CPU) your device Device #1: Intel(R) UHD Graphics try using intel opencl drivers for CPU only (you will need to deinstall the UHD graphics driver beforehand, if you just have a laptop without a separate gpu this approach will not work for you) RE: How does 0xae get skipped from 0x00-0xff range in --hex-charset ?b mask??? - saulys - 10-12-2022 (10-12-2022, 02:29 PM)Snoopy Wrote: i believe the problem is still the broken intel opencl GPU driver (this problem is as old as the intel integrated cpu/gpu devices) you have to stick to CPU opencl drivers (in my case i can force hashcat with options -D -d1 to use CPU) Yes, falling back to Intel OpenCL CPU only runtimes helped. It would be worth implementing some OpenCL bug check while starting hashcat masked attack, otherwise people may run it for days not knowing that attack will never succeed... RE: How does 0xae get skipped from 0x00-0xff range in --hex-charset ?b mask??? - Snoopy - 10-12-2022 well i think there was such a check in hashcat 62.5, i will open a github issue to check this |