Slowly cracking 1Password8 iOS password w/ Python. How can I do better with Hashcat?

[GonnZerg]

I got Hashcat to recognize the hash and it started but returned "Exhausted" so I'm lost again.

I was going through the cloudkeychain hash format and with the help of some other posts I understood that the format was:
[HASH]:[SALT]:[ITERATIONS]:[DATA]

I was confused by the first hash part because I couldn't identify it, but after going through this thread I think I see that the [HASH] is the last 32 bytes of the original data and the [DATA] part has those removed?
https://hashcat.net/forum/thread-6268-po...l#pid38322

Code:

SELECT lower (hex (substr (master_key_data, length (master_key_data) - 32 + 1, 32))) || ":" || lower (hex (salt)) || ":" || iterations || ":" || lower (hex (substr (master_key_data, 1, length (master_key_data) - 32))) FROM profiles;

This is the output with the hash I pieced together and a dictionary with the correct password on the last line:

Code:

hashcat -m 8200 ..\cloudkeychain-hash ..\dictionary.txt hashcat (v6.2.6) starting ADL2_Overdrive_Caps(): -5 ADL2_Overdrive_Caps(): -5 ADL2_Overdrive_Caps(): -5 ADL2_Overdrive_Caps(): -5 ADL2_Overdrive_Caps(): -5 ADL2_Overdrive_Caps(): -5 ADL2_Overdrive_Caps(): -5 ADL_Overdrive5_CurrentActivity_Get(): -1 ADL_Overdrive5_CurrentActivity_Get(): -1 ADL_Overdrive5_FanSpeed_Get(): -1 ADL_Overdrive5_CurrentActivity_Get(): -1 ADL_Overdrive5_Temperature_Get(): -1 ADL_Overdrive5_CurrentActivity_Get(): -1 HIP API (HIP 4.4) ================= * Device #1: AMD Radeon RX 6700 XT, 12269/12272 MB, 20MCU OpenCL API (OpenCL 2.1 AMD-APP (3380.6)) - Platform #1 [Advanced Micro Devices, Inc.] ===================================================================================== * Device #2: AMD Radeon RX 6700 XT, skipped Minimum password length supported by kernel: 0 Maximum password length supported by kernel: 256 Hashes: 1 digests; 1 unique digests, 1 unique salts Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates Rules: 1 Optimizers applied: * Zero-Byte * Single-Hash * Single-Salt * Slow-Hash-SIMD-LOOP * Uses-64-Bit Watchdog: Temperature abort trigger set to 90c Host memory required for this attack: 175 MB Dictionary cache built: * Filename..: ..\dictionary.txt * Passwords.: 1105 * Bytes.....: 19344 * Keyspace..: 1105 * Runtime...: 0 secs The wordlist or mask that you are using is too small. This means that hashcat cannot use the full parallel power of your device(s). Unless you supply more work, your cracking speed will drop. For tips on supplying more work, see: https://hashcat.net/faq/morework Approaching final keyspace - workload adjusted. Session..........: hashcat Status...........: Exhausted Hash.Mode........: 8200 (1Password, cloudkeychain) Hash.Target......: [hash] Time.Started.....: Mon Mar 20 12:25:33 2023 (6 secs) Time.Estimated...: Mon Mar 20 12:25:39 2023 (0 secs) Kernel.Feature...: Pure Kernel Guess.Base.......: File (..\dictionary.txt) Guess.Queue......: 1/1 (100.00%) Speed.#1.........: 196 H/s (0.55ms) @ Accel:128 Loops:64 Thr:32 Vec:1 Recovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new) Progress.........: 1105/1105 (100.00%) Rejected.........: 0/1105 (0.00%) Restore.Point....: 1105/1105 (100.00%) Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:649984-649999 Candidate.Engine.: Device Generator Candidates.#1....: asdfa2300janlsdk. -> [password] Hardware.Mon.#1..: N/A