02-21-2020, 08:42 PM
(02-21-2020, 08:17 PM)philsmd Wrote: the decrypted bytes do have a specific structure:
https://github.com/hashcat/hashcat/blob/...#L157-L167
Ah ok thanks. I did see that comment and thought that might be the case originally, especially as some of the values its looking for matched with the perl script. But then the fact that the code in that function carries on for so long afterwards made me think it can't be the final part where it checks to see if the hash has been decrypted correctly.
So what are the extra 100 lines of code after that doing?