Rar2John - Salt w/0000000000000000

[ag1122]

Hello -

Sorry if this is a dumb question, but I've never run across this...

I'm working on a RAR file (with headers encrypted), and I'm seeing (what I believe to be the) salt from rar2john that I haven't seen before, and wanted to ask folks for their thoughts.  I've tested with numerous versions of rar going back a few years, but haven't been able to reproduce.

FILENAME:$RAR3$*0*0000000000000000*0d7...<normal rar2john output>

Anyone else see this before?

Thanks,

ag

[magnum]

That's the salt, yes. I haven't seen anything like that. On a side note I saw many same-salts when I rar'ed a lot of small files in a batch, which led me to believe the salt was somehow correlated to wall clock.

[ag1122]

Thanks much, and interesting theory. I'll see if I can test it out a bit. Thanks again!