Hashcat exiting with no error message

[-=bb=-]

Hi all,

I'm experiencing a new issue with hashcat and was wondering if anyone else had experienced anything similar and may be able to help.

I have done a fresh install of the latest nVidia drivers, made the registry change for the kernel timeout, downloaded the latest version of hashcat. I am running it under Windows 10 on a laptop (yes, I know).

The only other thing I see which is odd is that I always get :

Code:

Driver temperature threshold met on GPU #2. Expect reduced performance. Driver temperature threshold met on GPU #2. Expect reduced performance. Driver temperature threshold met on GPU #2. Expect reduced performance.

GPU 2 is

Code:

OpenCL Platform #2: NVIDIA Corporation ====================================== * Device #2: GeForce GTX 1050, 1024/4096 MB allocatable, 5MCU

However hashcat reports

Code:

Hardware.Mon.#2..: Temp: 47c Util: 41% Core:1784MHz Mem:2504MHz Bus:16

and

Code:

C:\Program Files\NVIDIA Corporation\NVSMI>nvidia-smi.exe -q -d temperature ==============NVSMI LOG============== Timestamp                           : Thu Nov 29 10:47:13 2018 Driver Version                      : 417.01 CUDA Version                        : 10.0 Attached GPUs                       : 1 GPU 00000000:01:00.0     Temperature         GPU Current Temp            : 42 C         GPU Shutdown Temp           : 102 C         GPU Slowdown Temp           : 97 C         GPU Max Operating Temp      : 78 C         Memory Current Temp         : N/A         Memory Max Operating Temp   : N/A

So not quite sure why I am getting a warning. I thought it might be aborting due to excessive temp but the abort temp is set to 90deg.

As for the exit with no error message, I'm not sure what I can post that will help troubleshoot it. It will happen quite happily on it's own. Sometimes when building the dictionary cache. Sometimes when cracking. The best way I can almost replicate it is to press s for status. Sometimes I will get a status, sometimes I will get a command prompt back.

FWIW - this is what it looks like :

Code:

hashcat (v5.0.0) starting... * Device #3: Intel's OpenCL runtime (GPU only) is currently broken.              We are waiting for updated OpenCL drivers from Intel.              You can use --force to override, but do not report related errors. nvmlDeviceGetFanSpeed(): Not Supported OpenCL Platform #1: Intel(R) Corporation ======================================== * Device #1: Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz, skipped. OpenCL Platform #2: NVIDIA Corporation ====================================== * Device #2: GeForce GTX 1050, 1024/4096 MB allocatable, 5MCU OpenCL Platform #3: Intel(R) Corporation ======================================== * Device #3: Intel(R) HD Graphics 630, skipped. * Device #4: Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz, skipped. Hashes: 17 digests; 17 unique digests, 17 unique salts Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates Rules: 1 Applicable optimizers: * Optimized-Kernel * Zero-Byte * Not-Iterated Minimum password length supported by kernel: 0 Maximum password length supported by kernel: 27 Watchdog: Temperature abort trigger set to 90c Dictionary cache built: * Filename..: ..\HashCat\DeDuped.Dic * Passwords.: 384149228 * Bytes.....: 4073171254 * Keyspace..: 384148480 * Runtime...: 31 secs Driver temperature threshold met on GPU #2. Expect reduced performance. Driver temperature threshold met on GPU #2. Expect reduced performance. Driver temperature threshold met on GPU #2. Expect reduced performance. Cracking performance lower than expected? * Append -w 3 to the commandline.   This can cause your screen to lag. * C:\Users\xxxxx\Desktop\HashCat5.0>

or

Code:

hashcat (v5.0.0) starting... * Device #3: Intel's OpenCL runtime (GPU only) is currently broken.              We are waiting for updated OpenCL drivers from Intel.              You can use --force to override, but do not report related errors. nvmlDeviceGetFanSpeed(): Not Supported OpenCL Platform #1: Intel(R) Corporation ======================================== * Device #1: Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz, skipped. OpenCL Platform #2: NVIDIA Corporation ====================================== * Device #2: GeForce GTX 1050, 1024/4096 MB allocatable, 5MCU OpenCL Platform #3: Intel(R) Corporation ======================================== * Device #3: Intel(R) HD Graphics 630, skipped. * Device #4: Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz, skipped. Hashes: 17 digests; 17 unique digests, 17 unique salts Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates Rules: 1 Applicable optimizers: * Optimized-Kernel * Zero-Byte * Not-Iterated Minimum password length supported by kernel: 0 Maximum password length supported by kernel: 27 Watchdog: Temperature abort trigger set to 90c Dictionary cache built: * Filename..: ..\HashCat\DeDuped.Dic * Passwords.: 384149228 * Bytes.....: 4073171254 * Keyspace..: 384148480 * Runtime...: 24 secs Driver temperature threshold met on GPU #2. Expect reduced performance. Driver temperature threshold met on GPU #2. Expect reduced performance. Driver temperature threshold met on GPU #2. Expect reduced performance. Cracking performance lower than expected? * Append -w 3 to the commandline.   This can cause your screen to lag. * Update your OpenCL runtime / driver the right way:   https://hashcat.net/faq/wrongdriver * Create more work items to make use of your parallelization power:   https://hashcat.net/faq/morework [s]tatus [p]ause [b]ypass [c]heckpoint [q]uit => Session..........: hashcat Status...........: Running Hash.Type........: NetNTLMv2 Hash.Target......: hashes.txt Time.Started.....: Thu Nov 29 10:52:02 2018 (11 secs) Time.Estimated...: Thu Nov 29 10:53:12 2018 (59 secs) Guess.Base.......: File (..\HashCat\DeDuped.Dic) Guess.Queue......: 1/1 (100.00%) Speed.#2.........: 93142.2 kH/s (5.15ms) @ Accel:1024 Loops:1 Thr:256 Vec:1 Recovered........: 0/17 (0.00%) Digests, 0/17 (0.00%) Salts Progress.........: 1017924402/6530524160 (15.59%) Rejected.........: 15223602/1017924402 (1.50%) Restore.Point....: 59829308/384148480 (15.57%) Restore.Sub.#2...: Salt:0 Amplifier:0-1 Iteration:0-1 Candidates.#2....: 6818180 -> 6sophie10 Hardware.Mon.#2..: Temp: 57c Util: 54% Core:1759MHz Mem:2504MHz Bus:16 [s]tatus [p]ause [b]ypass [c]heckpoint [q]uit => Session..........: hashcat Status...........: Running Hash.Type........: NetNTLMv2 Hash.Target......: hashes.txt Time.Started.....: Thu Nov 29 10:52:02 2018 (29 secs) Time.Estimated...: Thu Nov 29 10:53:11 2018 (40 secs) Guess.Base.......: File (..\HashCat\DeDuped.Dic) Guess.Queue......: 1/1 (100.00%) Speed.#2.........: 93680.5 kH/s (5.16ms) @ Accel:1024 Loops:1 Thr:256 Vec:1 Recovered........: 0/17 (0.00%) Digests, 0/17 (0.00%) Salts Progress.........: 2732031665/6530524160 (41.83%) Rejected.........: 35880625/2732031665 (1.31%) Restore.Point....: 160697767/384148480 (41.83%) Restore.Sub.#2...: Salt:0 Amplifier:0-1 Iteration:0-1 Candidates.#2....: fengfeng613 -> filamer99 Hardware.Mon.#2..: Temp: 61c Util: 35% Core:1746MHz Mem:2504MHz Bus:16 [s]tatus [p]ause [b]ypass [c]heckpoint [q]uit => C:\Users\xxxxxx\Desktop\HashCat5.0>

I can't seem to find a verbose mode or get any debug output that will help me figure out what is going on.

Many thanks in advance

[-=bb=-]

Quick Update

Checking the errorlevel by using 'echo %errorlevel%' gave me an errorlevel of 9009.

Apparently 9009 can mean a file not found error, so I ran ProcMon to see if I could figure out what the missing file was. Whilst I couldn't see a missing file, I did notice that WerFault.exe was being called.

Checking the Event Viewer (which I have no idea why I didn't do sooner) showed me the following error

Code:

Faulting application name: hashcat64.exe, version: 0.0.0.0, time stamp: 0x5bd5e68a Faulting module name: igdrcl64.dll, version: 21.20.16.4664, time stamp: 0x58fa2e54 Exception code: 0xc0000005 Fault offset: 0x00000000004609c0 Faulting process ID: 0x8ec Faulting application start time: 0x01d487e9e95cad36 Faulting application path: C:\Users\xxxxx\Desktop\HashCat5.0\hashcat64.exe Faulting module path: C:\WINDOWS\System32\DriverStore\FileRepository\ki122581.inf_amd64_39d9112bbe77f060\igdrcl64.dll Report ID: c059468e-ef4c-4d9a-89df-07ad67bc27c2 Faulting package full name: Faulting package-relative application ID:

idgrcl64.dll is the Intel Graphics Driver. The DriverStore version was old so a reinstall of the Intel HD Graphics driver appears to have solved the problem.

Lessons learnt :

1. Check Event Viewer when troubleshooting
2. Just because you're running hashcat on the nVidia chipset, the Intel one can still ruin your day

Hopefully the troubleshooting steps outlined may help someone else but we can mark this as solved now.

Happy cracking!

[royce]

Nice walkthrough!

[atom]

You can use afterburner to find out what this threshold is exactly (and change it).