09-22-2022, 06:03 AM
I know this is a couple of years old now, but I've just run into the same problem.
The values from my hash (excluding the 7z data itself) are:
$7z
$2
$19
$0
$
$16
$ce372a5c20db3637e64b7f825364f13c
$1069288323
$159312
$176135
$hexdata
$176135
$10
The 7z file in question contains a bunch of PNG images (photos of documents), so probably hard for additional compression, leading to the situation where it is not compressed. The archive was created by the ZArchiver app on Android.
Commenting out the check mentioned in #6 allows hashcat to run, but it has not yet found the passphrase. I can test with an archive with a known passphrase if that would be useful.
The values from my hash (excluding the 7z data itself) are:
$7z
$2
$19
$0
$
$16
$ce372a5c20db3637e64b7f825364f13c
$1069288323
$159312
$176135
$hexdata
$176135
$10
The 7z file in question contains a bunch of PNG images (photos of documents), so probably hard for additional compression, leading to the situation where it is not compressed. The archive was created by the ZArchiver app on Android.
Commenting out the check mentioned in #6 allows hashcat to run, but it has not yet found the passphrase. I can test with an archive with a known passphrase if that would be useful.