Attack mode 6, 7 slower than Maskprocessor rulesets?

[Incisive]

I'm working up a set of prefix and suffix based dictionary cracks, and my very first pass was 1, 2, and 3 digit prefixes/suffixes.

Using oclHashcat-plus64 0.14, on an AMD HD6950 with Catalyst 13.1, Windows 7 x64 SP1, with fairly large dictionaries against a 14 million hash unsalted MD5 list, I was seeing between 384KH/s and 10.6MH/s (higher speeds with 3 character masks) with attack modes 6 and 7 (mask+dict, dict+mask).

When I switched over to using Maskprocessor to generate rules files, the 1 character rules saw 177MH/s and 2+ saw 260-277MH/s, which is much more in line with what I was expecting.

Note that Markov/bruteforce mode also shows 274MH/s on the same size list (up from 138MH/s on the original set of 25 million words), so that appears to be the top speed I can expect at this time.

My comment: If the current implementation of modes 6 and 7 are so slow, then perhaps it would be better to instead keep the command line argument the same, but internally include a copy of the Maskprocessor code and generate an internal rules list, then use the rules engine?

[epixoip]

this is to be expected if using only ?d - ?d?d?d with -a 7 because you aren't giving the left side enough work to do.

[Incisive]

Agreed; however, that's why I was suggesting a conversion to a rules based attack that covers an identical keyspace, rather than forcing me to actually generate and store multiple rules files, rather than just directly feed in masks.

Or can I pipe a rules file in via stdin???

[epixoip]

you can already do this with rules, look at the rule files in rules/hybrid/. you could do, for example,

Code:

-r rules/hybrid/prepend_d.rule -r rules/hybrid/prepend_d.rule -r rules/hybrid/prepend_d.rule

[Incisive]

Now, that's an approach I'm ashamed I hadn't considered - I was using the Maskprocessor to create single dictionaries of multiple , rather than simply using building block dictionaries and the fact that Hashcat will accept multiple rules files.

Thank you, epixoip.