--limit and --skip usage

[Larrax]

Hello, I would like to ask you about functionality of the --skip and --limit parameters.

Let me show you my problem on an example.

First I checked hashcat-keyspace of 8x ?l mask:

Code:

hashcat64.exe -a 3 --keyspace ?l?l?l?l?l?l?l?l
11881376

OK, so about 12 milion indexes, I tried to search the first half of some testing Office document.

Code:

hashcat64.exe -a 3 -m 9700 -s 0 -l 6000000 xlsTest.hash ?l?l?l?l?l?l?l?l

That took me about 1.5 minute. Let's now finish the second half, skip the first 6mil indexes and...

Code:

hashcat64.exe -a 3 -m 9700 -s 6000000 xlsTest.hash ?l?l?l?l?l?l?l?l

Time remaining: One hour+. 

Could you please clarify what exactly is entered into skip and limit parameters, when not the hashcat-keyspace?

I noticed, for the first limit, 6mil, hashcat tried about 4 bilions passwords. And maximum --skip parameter value hashcat allowed here is much smaller then real keyspace (cosnidering 26^8 = 208 bilion and maximum --skip value here is something about 300 milions), so neither the real keyspace is used in limit nor skip arguments.

Looking forward to your answer!

[philsmd]

your examples above have 2 different masks:

you used ?l?l?l?l?l?l?l?l for the keyspace calculation and ?l?l?l?l?l?l?l? for the actual run.

You should always use the same mask!

Furthermore, you should have also used this command instead:

Code:

hashcat64.exe -a 3 -m 9700 --keyspace ?l?l?l?l?l?l?l?l

The hash type is sometimes important when using --keyspace, so you better always specify it.

BTW: for office documents (of the same type as 9700) there are the collider modes (-m 9710 and -m 9720) which depending on the mask (or password policy etc) should make it even more easier for you to quickly access the data

[Larrax]

Sorry, that was just a typo I did in a post (I will edit it). I ran the computation always with mask ?l?l?l?l?l?l?l?l.

Thanks for the answer, this clarifies everything!