Hashcat exiting with no error message

[-=bb=-]

Hi all,

I'm experiencing a new issue with hashcat and was wondering if anyone else had experienced anything similar and may be able to help.

I have done a fresh install of the latest nVidia drivers, made the registry change for the kernel timeout, downloaded the latest version of hashcat. I am running it under Windows 10 on a laptop (yes, I know).

The only other thing I see which is odd is that I always get :

Code:

Driver temperature threshold met on GPU #2. Expect reduced performance.
Driver temperature threshold met on GPU #2. Expect reduced performance.
Driver temperature threshold met on GPU #2. Expect reduced performance.

GPU 2 is

Code:

OpenCL Platform #2: NVIDIA Corporation
======================================
* Device #2: GeForce GTX 1050, 1024/4096 MB allocatable, 5MCU

However hashcat reports

Code:

Hardware.Mon.#2..: Temp: 47c Util: 41% Core:1784MHz Mem:2504MHz Bus:16

and

Code:

C:\Program Files\NVIDIA Corporation\NVSMI>nvidia-smi.exe -q -d temperature

==============NVSMI LOG==============

Timestamp                           : Thu Nov 29 10:47:13 2018
Driver Version                      : 417.01
CUDA Version                        : 10.0

Attached GPUs                       : 1
GPU 00000000:01:00.0
    Temperature
        GPU Current Temp            : 42 C
        GPU Shutdown Temp           : 102 C
        GPU Slowdown Temp           : 97 C
        GPU Max Operating Temp      : 78 C
        Memory Current Temp         : N/A
        Memory Max Operating Temp   : N/A

So not quite sure why I am getting a warning. I thought it might be aborting due to excessive temp but the abort temp is set to 90deg.

As for the exit with no error message, I'm not sure what I can post that will help troubleshoot it. It will happen quite happily on it's own. Sometimes when building the dictionary cache. Sometimes when cracking. The best way I can almost replicate it is to press s for status. Sometimes I will get a status, sometimes I will get a command prompt back.

FWIW - this is what it looks like :

Code:

hashcat (v5.0.0) starting...

* Device #3: Intel's OpenCL runtime (GPU only) is currently broken.
             We are waiting for updated OpenCL drivers from Intel.
             You can use --force to override, but do not report related errors.
nvmlDeviceGetFanSpeed(): Not Supported

OpenCL Platform #1: Intel(R) Corporation
========================================
* Device #1: Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz, skipped.

OpenCL Platform #2: NVIDIA Corporation
======================================
* Device #2: GeForce GTX 1050, 1024/4096 MB allocatable, 5MCU

OpenCL Platform #3: Intel(R) Corporation
========================================
* Device #3: Intel(R) HD Graphics 630, skipped.
* Device #4: Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz, skipped.

Hashes: 17 digests; 17 unique digests, 17 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Applicable optimizers:
* Optimized-Kernel
* Zero-Byte
* Not-Iterated

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 27

Watchdog: Temperature abort trigger set to 90c

Dictionary cache built:
* Filename..: ..\HashCat\DeDuped.Dic
* Passwords.: 384149228
* Bytes.....: 4073171254
* Keyspace..: 384148480
* Runtime...: 31 secs

Driver temperature threshold met on GPU #2. Expect reduced performance.
Driver temperature threshold met on GPU #2. Expect reduced performance.
Driver temperature threshold met on GPU #2. Expect reduced performance.

Cracking performance lower than expected?

* Append -w 3 to the commandline.
  This can cause your screen to lag.

*
C:\Users\xxxxx\Desktop\HashCat5.0>

or

Code:

hashcat (v5.0.0) starting...

* Device #3: Intel's OpenCL runtime (GPU only) is currently broken.
             We are waiting for updated OpenCL drivers from Intel.
             You can use --force to override, but do not report related errors.
nvmlDeviceGetFanSpeed(): Not Supported

OpenCL Platform #1: Intel(R) Corporation
========================================
* Device #1: Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz, skipped.

OpenCL Platform #2: NVIDIA Corporation
======================================
* Device #2: GeForce GTX 1050, 1024/4096 MB allocatable, 5MCU

OpenCL Platform #3: Intel(R) Corporation
========================================
* Device #3: Intel(R) HD Graphics 630, skipped.
* Device #4: Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz, skipped.

Hashes: 17 digests; 17 unique digests, 17 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Applicable optimizers:
* Optimized-Kernel
* Zero-Byte
* Not-Iterated

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 27

Watchdog: Temperature abort trigger set to 90c

Dictionary cache built:
* Filename..: ..\HashCat\DeDuped.Dic
* Passwords.: 384149228
* Bytes.....: 4073171254
* Keyspace..: 384148480
* Runtime...: 24 secs

Driver temperature threshold met on GPU #2. Expect reduced performance.
Driver temperature threshold met on GPU #2. Expect reduced performance.
Driver temperature threshold met on GPU #2. Expect reduced performance.

Cracking performance lower than expected?

* Append -w 3 to the commandline.
  This can cause your screen to lag.

* Update your OpenCL runtime / driver the right way:
  https://hashcat.net/faq/wrongdriver

* Create more work items to make use of your parallelization power:
  https://hashcat.net/faq/morework

[s]tatus [p]ause [b]ypass [c]heckpoint [q]uit =>

Session..........: hashcat
Status...........: Running
Hash.Type........: NetNTLMv2
Hash.Target......: hashes.txt
Time.Started.....: Thu Nov 29 10:52:02 2018 (11 secs)
Time.Estimated...: Thu Nov 29 10:53:12 2018 (59 secs)
Guess.Base.......: File (..\HashCat\DeDuped.Dic)
Guess.Queue......: 1/1 (100.00%)
Speed.#2.........: 93142.2 kH/s (5.15ms) @ Accel:1024 Loops:1 Thr:256 Vec:1
Recovered........: 0/17 (0.00%) Digests, 0/17 (0.00%) Salts
Progress.........: 1017924402/6530524160 (15.59%)
Rejected.........: 15223602/1017924402 (1.50%)
Restore.Point....: 59829308/384148480 (15.57%)
Restore.Sub.#2...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidates.#2....: 6818180 -> 6sophie10
Hardware.Mon.#2..: Temp: 57c Util: 54% Core:1759MHz Mem:2504MHz Bus:16

[s]tatus [p]ause [b]ypass [c]heckpoint [q]uit =>

Session..........: hashcat
Status...........: Running
Hash.Type........: NetNTLMv2
Hash.Target......: hashes.txt
Time.Started.....: Thu Nov 29 10:52:02 2018 (29 secs)
Time.Estimated...: Thu Nov 29 10:53:11 2018 (40 secs)
Guess.Base.......: File (..\HashCat\DeDuped.Dic)
Guess.Queue......: 1/1 (100.00%)
Speed.#2.........: 93680.5 kH/s (5.16ms) @ Accel:1024 Loops:1 Thr:256 Vec:1
Recovered........: 0/17 (0.00%) Digests, 0/17 (0.00%) Salts
Progress.........: 2732031665/6530524160 (41.83%)
Rejected.........: 35880625/2732031665 (1.31%)
Restore.Point....: 160697767/384148480 (41.83%)
Restore.Sub.#2...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidates.#2....: fengfeng613 -> filamer99
Hardware.Mon.#2..: Temp: 61c Util: 35% Core:1746MHz Mem:2504MHz Bus:16

[s]tatus [p]ause [b]ypass [c]heckpoint [q]uit =>
C:\Users\xxxxxx\Desktop\HashCat5.0>

I can't seem to find a verbose mode or get any debug output that will help me figure out what is going on.

Many thanks in advance

[-=bb=-]

Quick Update

Checking the errorlevel by using 'echo %errorlevel%' gave me an errorlevel of 9009.

Apparently 9009 can mean a file not found error, so I ran ProcMon to see if I could figure out what the missing file was. Whilst I couldn't see a missing file, I did notice that WerFault.exe was being called.

Checking the Event Viewer (which I have no idea why I didn't do sooner) showed me the following error

Code:

Faulting application name: hashcat64.exe, version: 0.0.0.0, time stamp: 0x5bd5e68a
Faulting module name: igdrcl64.dll, version: 21.20.16.4664, time stamp: 0x58fa2e54
Exception code: 0xc0000005
Fault offset: 0x00000000004609c0
Faulting process ID: 0x8ec
Faulting application start time: 0x01d487e9e95cad36
Faulting application path: C:\Users\xxxxx\Desktop\HashCat5.0\hashcat64.exe
Faulting module path: C:\WINDOWS\System32\DriverStore\FileRepository\ki122581.inf_amd64_39d9112bbe77f060\igdrcl64.dll
Report ID: c059468e-ef4c-4d9a-89df-07ad67bc27c2
Faulting package full name:
Faulting package-relative application ID:

idgrcl64.dll is the Intel Graphics Driver. The DriverStore version was old so a reinstall of the Intel HD Graphics driver appears to have solved the problem.

Lessons learnt :

1. Check Event Viewer when troubleshooting
2. Just because you're running hashcat on the nVidia chipset, the Intel one can still ruin your day

Hopefully the troubleshooting steps outlined may help someone else but we can mark this as solved now.

Happy cracking!

[royce]

Nice walkthrough!

[atom]

You can use afterburner to find out what this threshold is exactly (and change it).