90% Reduction in performance when adding a single character

[ipen]

Hi folks,

Reaching out because I am at a loss. 

In a nutshell, this command has me at 4500mh/s on a 4090:

Code:

hashcat -a 3 -O -m 22500 --hex-charset w.txt -1 61626364656667686A6B6D6E707172737475767778797A41424344454647484A4B4C4D4E 202020?1?1?1?1?1?1?1?1

But adding a single character to this results in a 90% reduction in performance, starts hashing at 450mh/s:

Code:

hashcat -a 3 -O -m 22500 --hex-charset w.txt -1 61626364656667686A6B6D6E707172737475767778797A41424344454647484A4B4C4D4E 20202020?1?1?1?1?1?1?1?1

Util of the GPU is curious in the second instance: idle-busy-idle-busy-idle-busy. Hashcat's util numbers mirror what is illustrated in the attached image.

Something simple I am perhaps missing?

[royce]

There is a known "bias" built into hashcat - a byproduct of how it optimizes for speed - that makes static components of the first four bytes on the left-hand side less performant.

[ipen]

Ah ok got it, thanks. Good to know I was not doing something stupid. I introduced a -2 2021 which got the speed back but also obviously exploded the problem set.

Any other way to work around this?

[Snoopy]

Ah ok got it, thanks. Good to know I was not doing something stupid. I introduced a -2 2021 which got the speed back but also obviously exploded the problem set.

Any other way to work around this?

without knowing the outcome, what about trying to use a hybridattack? wordlist + mask?

dont know how this affect the 4byte bias mentioned by royce, but think its worth a try

so your input wordlist would be just a single line with 4 spaces, thenn add the rest of the mask

or you could generate lets say a wordlist with all possiblities of first 8 bytes given your hexinput, didnt do the math right now, if its to many combinations forget that

[ipen]

Ah ok got it, thanks. Good to know I was not doing something stupid. I introduced a -2 2021 which got the speed back but also obviously exploded the problem set.

Any other way to work around this?

without knowing the outcome, what about trying to use a hybridattack? wordlist + mask?

dont know how this affect the 4byte bias mentioned by royce, but think its worth a try

so your input wordlist would be just a single line with 4 spaces, thenn add the rest of the mask

or you could generate lets say a wordlist with all possiblities of first 8 bytes given your hexinput, didnt do the math right now, if its to many combinations forget that

I'll give this a bash, thanks