removed 1 hash found in potfile

[dextor]

Hi,

i have a batch file which will run oclhashcat twice. Once with a brute force mask, and the second time with a wordlist.

i have already stored 2 resolved hashes in the pot file, but in both, runs only one is found and removed, but im still using the same hccap file, where the hashes that were resolved in the pot file are stored.

Why can oclhashcat only find and remove one hash found in the pot file, and not both?

[rico]

How many unique handshakes in the hccap file? If just one then there's your answer.

Also, there can be multiple pot files. Make sure you're using the right one ( --session=new uses new.pot )

[dextor]

How many unique handshakes in the hccap file? If just one then there's your answer.

Also, there can be multiple pot files. Make sure you're using the right one ( --session=new uses new.pot )

Im not using sessions

-there is only one pot file named "cudaHashcat.pot" where every retrieved key is saved to i think..
-i have 13 hashes in my hccap file.

and 2 of them have already been discovered, and written to the pot file, but when i run hashcat, then only one of them is identified.


should i use the same session explicit for every run?

[rico]

The cudaHashcat.pot file is the right one if you're not using sessions. It's the default pot file and will be used every time unless you specify a session like I said before.

Does cudaHashcat pick up the 13 handshakes OK? I ask because I tried joining multiple handshakes before based on this article but found that the Windows join didn't work (can't remember exactly how hashcat reacted) but the Linux one worked fine, e.g.

Linux (worked for me):
$ cat single_hccaps/*.hccap > all_in_one/multi.hccap

Windows (didn't work for me):
copy single_hccaps\*.hccap all_in_one\multi.hccap

[dextor]

i joined it within linux and transfered it to my GPU pc that is running windows for cracking.

yes, it reads all 13 hashes... maybe it it a problem because the "pot file" is written with \n and in some code of the oclhashcat windows version the file is read in with \r\n ? or something like that?... just a guess.

i will try the --remove flag, so the hash wont be in the hccap anymore in the next run.. i think that should do it .. when im understanding this --remove option right.

[rico]

Not sure --remove will delete from a hccap file like it does for a text file. Only one way to find out...

[dextor]

Not sure --remove will delete from a hccap file like it does for a text file. Only one way to find out...

yep it does.. just tested it... i have already found 3 and in the next run, there were only 10 hashes left in the file.

works.. thanks for your effort .

[rico]

works.. thanks for your effort .

Happy to be of no assistance at all.