md5(salt.pass) troubles and tricks

[d0znpp]

Hi all,
I'm use oclHashcat-lite-0.10 with HD6990 on Debian sid.
Need to brute md5($salt.$pass) hash, but could not find it in hash types ;(
Salt is 12345678
Pass is 8 bytes of [a-Z0-9]

First solution to brute it:

Code:

./oclHashcat-lite64.bin --gpu-accel 800 --gpu-loops 1024 --gpu-temp-disable --outfile-watch 0 --restore-timer 0 --custom-charset1 ?l?d?u --hash-type 0 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' SALT1234?1?1?1?1?1?1?1?1

Got low speed (~370M/sec), while salt has 4 byte or more.
While salt has 3 bytes speed is ~8600M/sec
While salt has 1-2 bytes speed is ~10800M/sec

Second trick to brute:

Code:

./oclHashcat-lite64.bin --gpu-accel 800 --gpu-loops 1024 --gpu-temp-disable --outfile-watch 0 --restore-timer 0 --custom-charset1 ?l?d?u --custom-charset2 SALT1234 --hash-type 0 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' ?2?2?2?2?2?2?2?2?1?1?1?1?1?1?1?1

Speed is ~10800M/sec

How to set --pw-skip to skip false combinations?
I can not understand in what sequence will move the characters from the ?2 charset