New hccapx format explained

[TheFool]

For short readers: Everything is fine here. For all others, here's our analysis:

The Handshake in the cap has the following entries:

M1 and M2 from the first handshake
M1, M2, M3 and M4 from the second handshake.

The evil about this is that the ReplayCounter was always set to 4. That is kind of a bad behavior from the AP, but hashcat can deal with it. So it created the following hanshakes:

M1 + M2 of the first handshake
M1 + M2 of the second handshake
M2 + M3 of the second handshake.

Those are fine, and they all have been cracked with hashcat. There's also

M1 of the first and M2 of the second handshake.

The cap2hccapx tool exported it correctly, because the AP marked both with ReplayCounter 4, which caused by the deauth attack spam. So it's not possible to crack this, but that's the price to pay in general. We export more handshakes than required just to make sure that there's at least one that is cracking. It doesn't cost us any performance to check 4 or 1, because the calculation is done after the PBKDF2.

Thanks for the info, atom.

My newbie question still remains, however. How come I was able to crack it as a .hccap but not as a .hccapx?

.hccap was generated by aircrack-ng
.hccapx was generated with the cap2hccapx.exe tool (Windows)

Also.. what do you mean by "Those are fine, and they all have been cracked with hashcat." I just got "hashcat exhausted"....