hashcat
advanced password recovery

Hey everyone,

I'm running the latest development version of Hashcat (previously was running 3.5). One thing I've noticed is I can request checkpoint quit and hashcat just happily keeps going until it's finished or until I force a quit - for example over a time span of 16 hours, requesting a checking point quit at around 10 hour mark, it'll keep going for the last 6...

Recently I threw a huge wordlist at it to the point it would take 4+ days to complete, 12 hours into the sessions I requested a checkpoint quit... 12 more hours later and it still didn't hit a restore point. Restore point sat at 0% the whole time.

Am I missing something obvious here? It always worked for me in the past - at most taking 30 minutes to hit a checkpoint... Only difference was I was using an older GTX 960, now I'm using dual GTX 1080 Ti's and latest development version. If anything I would've thought I'd hit the restore points quicker

P.S.

Using WPA/WPA2 mode with anywhere from 5000 to 30,000 rules.

The time it takes depends on the number of amplifiers being used, in this case the rules and also the number of non-unique salts. Both can have a large impact on the time it takes. So I guess with 30k it will take some time. Doesn't sound like a bug.

Thank you so much for your response, I've done more testing and the above response is spot on. I'm literally feeding it a huge amplifier with a small password file. I've swapped them around (huge password file/small amplifier) and the checkpoints work perfectly.

Right, that's basically the best way to use hashcat in every case.

If possible: For slow hashes try to hold the amplifier around 50-500 amplifier and for fast hashes 500-5000. Shift more data to the base than to the amplifier.

This is just the behavior of checkpoint.

For some hash types, it can take a full day (sometimes longer) in order for a checkpoint to occur for a shutdown.

One example is the 2611 hash type (vBulletin < v3.8.5).  It has sometimes taken a full day to shut down hashcat with a checkpoint with this hash type.

I don't know which hash type is the slowest to shut down when issuing a checkpoint, but this could be worth researching.

Maybe there can be a community effort to build a chart that tracks average shutdown times for different hash types when shutting down with a checkpoint.

> If possible: For slow hashes try to hold the amplifier around 50-500 amplifier and for fast hashes 500-5000. Shift more data to the base than to the amplifier.

Atom: Is this a general rule or only for those using checkpoints?

This is a balance act!

The more amplifiers (rules) the longer it takes to reach a checkpoint.
The more salts you have the longer it takes to reach a checkpoint.
If you use too less amplifiers, you get a speed penalty.