Markov Chains and hashcat.hcstat File

[epixoip]

close,

1) hcstat file is created with statsprocessor by using a corpus of words.

hcstat file is created with hcstatgen from hashcat-utils by using a corpus of words.

2) For up to 15 positions, statsprocessor goes through the corpus and determines the frequency of each character for each position. [And does it also consider the character in the prior position?]

hcstatgen generates full per-position statistics for the corpus. i'm not sure if hcstatgen has a 15-char limitation.

7) Unless a threshold parameter is specified (or it is -t 0), the maximum size of the key-space is the (mask-length) ^ (#-of-characters used by statsprocessor). For example, if -1 ?l?u was used by statsprocessor and the mask-length used by hashcast was 11, then max-key-space = 11^26.

no, it's (# of chars)^(length). so 26^11, not 11^26. but yes, it will try the entire keyspace as an ordered brute force with no truncating.

8) If a threshold parameter is specified, then the max-key-space is (mask-length) ^ (t). For the example above, if a -t 8 is specified, then the max-key-space = 11^8.

no, it's logarithmic. $k = antilog(base $t)($l), where $k = keyspace, $t = threshold, and $l = length.

a threshold of 3 and a length of 6 is antilog(base 3)(6) = 729.
a threshold of 10 and length of 8 is antilog(base 10)(8) = 100000000.

hope that helps.