4.01 ERROR "Restore value is greater than keyspace" after pause/checkpoint

[Boing]

Hello.
Have error "Restore value is greater than keyspace" after trying to resume session "my". But haven't if make that after 5-10 minutes after first start. If it will work 1-2-3 hours, after that will paused+resumed or checkpointed+resumed, i will get error.


Basic info:

Code:

* Device #1: This hardware has outdated CUDA compute capability (3.0).
            For modern OpenCL performance, upgrade to hardware that supports
            CUDA compute capability version 5.0 (Maxwell) or higher.
nvmlDeviceGetCurrPcieLinkWidth(): Not Supported
nvmlDeviceGetClockInfo(): Not Supported
nvmlDeviceGetClockInfo(): Not Supported
nvmlDeviceGetTemperatureThreshold(): Not Supported
nvmlDeviceGetTemperatureThreshold(): Not Supported
nvmlDeviceGetUtilizationRates(): Not Supported

Code:

OpenCL Platform #1: NVIDIA Corporation
======================================
* Device #1: GeForce GTX 670, 512/2048 MB allocatable, 7MCU

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates

Applicable optimizers:
* Zero-Byte
* Precompute-Final-Permutation
* Not-Iterated
* Single-Hash
* Single-Salt
* Brute-Force

Password length minimum: 0
Password length maximum: 8

Watchdog: Temperature abort trigger set to 90c
Watchdog: Temperature retain trigger set to 75c

Restore value is greater than keyspace.

my start batch:

Code:

hashcat64.exe -a 3 -m 1500 SOme1.1HasHes --session my
pause

my resume batch:

Code:

hashcat64.exe --session my --restore
pause

It was checkpointed on ~10% of 8/8 symbol hashes.  Can somebody explain me what problem and how to resume job? Don't want waste time again.. If you also advise something useful, I will also be grateful. 
Thanks and regards!
(sorry for my English, google translate used)

[philsmd]

Thank you for this report. I can reproduce this.

We probably will need to open a github issue to track this problem.

The problem seems to be that the mask position (see https://hashcat.net/wiki/doku.php?id=restore) is reset from 7 (which actually means mask 7+1 = 8 because the index starts at 0) to 0. This reset is wrong.
After mask pos was reset, hashcat tries to run the first mask with a very high word_cur value, which of course gives the "Restore value is greater than keyspace." error.
So the error is correct, but the reset of the mask pos is not correct. That seems to be a bug.

This line seems to be the culprit:
https://github.com/hashcat/hashcat/blob/...cat.c#L769

I will discuss this with @atom and see if we can find a proper fix for it.

[Boing]

Thank You for reply.
So it will patch between versions or new build of HashCat? It is enough to wait changes here in the topic?

[philsmd]

We already have some good news.

The problem was addressed and fixed with these source code changes: https://github.com/hashcat/hashcat/commi...af2d154a49

The new beta, that you can as always download here https://hashcat.net/beta/ , already ships with the fixed version. Please test it.

In theory you could even modify your old my.restore file with analyze_hc_restore (see https://github.com/philsmd/analyze_hc_restore) to set the masks_pos again to 7 (instead of 0), by using this instructions:

Code:

perl analyze_hc_restore.pl -M 7 my.restore

after that a new file my_mod.restore will be generated, you can replace my.restore with the new version (my_mod.restore) and just continue cracking as usual.

This approach of course is only needed if the .restore file was not correct/corrupted. This problem shouldn't happen in the future thanks to your problem report.

Cheers

[Boing]

Hello.
Thank you for your prompt response.
Firstly i tried to fix my.restore with your instructions, installed latest ActivePerl (windows version). But after executing command, get error:

Code:

T:\hashcat-4.0.1>perl analyze_hc_restore.pl -M 7 my.restore
Bareword found where operator expected at analyze_hc_restore.pl line 30, near "<title>analyze_hc_restore"
       (Missing operator before analyze_hc_restore?)
syntax error at analyze_hc_restore.pl line 10, near "<"
Unrecognized character \xC2; marked by <-- HERE after at master <-- HERE near column 61 at analyze_hc_restore.
pl line 30.

After that i download your fixed version, run other job, save checkpoint and view resume file and saw that at 108h saved mast position and edit it from 00 to 07 at my.resume file. After that resume and get it works.
After i made checkpoint and successfully restarted job.
So all OK.
Thank you for support!
Regards!

[philsmd]

oh. you tried to run the downloaded github project page as a perl file.
This is not how it works.

You need to download the perl script (text file) from https://raw.githubusercontent.com/philsm...restore.pl

The html of github won't run as valid perl code. hehe

[Boing]

lol. Awesome fail) Thx)
(I never used Perl so don't know file format)

[magnum]

Lol! Kudos for faling to run a perl script, yet succeeding in manually hacking a binary file 😆👍