Incremental Markov attacks
#1
Hi all,
  I'm trying to understand Markov chains in relation to incremental brute force attacks a little better and was playing around with masks over the weekend.  I'm not actually trying to crack anything, just learning about Markov.

  Let's assume I have some awesome hardware (better than the stats below) and wanted to brute force a WPA2 handshake by way of an incremental attack starting at 8 and ending with 50 using the following

Code:
hashcat64 -w 4 --restore-file-path=~/my.restore -o ~/cracked.txt -m 2500 -a 3  --increment --increment-min=8 --increment-max=50 handshakes.hccapx ?a?a?a?a?a?a?a?a

I might get the following output

Code:
Session..........: hashcat
Status...........: Running
Hash.Type........: WPA/WPA2
Hash.Target......: handshakes.hccapx
Time.Started.....: xxxxxxx (9 hours, 30 mins)
Time.Estimated...: xxxxxx (3 years, 61 days)
Guess.Mask.......: ?a?a?a?a?a?a?a?a [8]
Guess.Queue......: 1/1 (100.00%)
Speed.Dev.#1.....:    98261 H/s (55.75ms)
Recovered........: 0/80 (0.00%) Digests, 0/24 (0.00%) Salts
Progress.........: 94919065600/159220903509375000 (0.00%)
Rejected.........: 0/94919065600 (0.00%)
Restore.Point....: 41615360/69833729609375 (0.00%)
Candidates.#1....: hH2Pmane -> hXU<LINA
HWMon.Dev.#1.....: Temp: 59c Fan:100% Util: 98% Core:1024MHz Mem:1333MHz Bus:16

My question is specific to how Markov chains increment.  Let's take Candidates.#1 as an example

Code:
Candidates.#1....: hH2Pmane -> hXU<LINA

Even though I'm able to crack through 98261 H/s, I've noticed when checking the status, there are times where the progress moves forward but the candidates do not changes for X seconds.  Let's call it 15 seconds which got me thinking.

How exactly does Markov increment in hashcat?  Will hashcat start with the first 8 character candidate and work it's way to the last 8 character candidate before it increments?

Or will the Markov chain increment the current candidate until the max length is reached before moving on to the next?

Example


Code:
"aaaaaaaa"
"aaaaaaab"
"aaaaaaac"
"aaaaaaad"


and so on until all possible 8 character combinations are satisfied

or

Code:
"aaaaaaaa"
"aaaaaaaab"
"aaaaaaaabc"

and so on until the current candidate has tried all possible combinations between 8 and 50?

I don't fully understand Markov chains yet so it's difficult to articulate my question in exactly the right way, please ask if you have any questions about what I'm asking.
#2
Yes, in incremental mode, a length will be exhausted before the next length is started.

Also, the Candidate progress display shows a range. It is normal for this to only change when another range is started.
~