Very Slow Keepass hash-rate
#1
Hello, I am trying to run hashcat on a hashfile from a keepass database.  The first time I ran it, I was able to start cracking a test database file at 100 kH/s, using the latest hashcat beta software (I am writing this as of April 6, 2020).  I don't know if this is of importance, but at some point, because I forgot to change the time it takes for my computer to go to sleep, it, well, went to sleep.  When I turned my computer on, it was running at a much slower rate, I don't remember the exact rate, but it was in the 100-1000 H/s range.  Any ways, I didn't think much of the low rate, I thought it just had to do with the fact that my computer went to sleep while it was hashing, so I tried with the database that I did want to crack, but it was running at about 300 H/s with -w 3.  Using Windows 10, AMD Radeon RX 5700, driver is latest update to RadeonSoftwareAdrenalin2020.  I've already tried both beta and regular versions of hashcat (the regular version doesn't seem to ever work for some reason), I've tried uninstalling and reinstalling hashcat program, uninstalled and reinstalled the driver for my GPU, used AMD's cleaning software and reinstalled the driver.  Any suggestions that might help?

Here is what it looks like when I run hashcat on the hashfile.

Code:
C:\hashcat-5.1.0>hashcat.exe -a 3 -m 13400 -w 3 etherium.hash
hashcat (v5.1.0-1764-g008072eb) starting...

* Device #2: Unstable OpenCL driver detected!

This OpenCL driver has been marked as likely to fail kernel compilation or to produce false negatives.
You can use --force to override this, but do not report related errors.

ADL_Overdrive5_CurrentActivity_Get(): -8

ADL_Overdrive5_CurrentActivity_Get(): -8

ADL_Overdrive5_CurrentActivity_Get(): -8

ADL_Overdrive5_CurrentActivity_Get(): -8

OpenCL API (OpenCL 2.1 AMD-APP (3004.8)) - Platform #1 [Advanced Micro Devices, Inc.]
=====================================================================================
* Device #1: gfx1010, 8112/8176 MB (4048 MB allocatable), 18MCU

OpenCL API (OpenCL 2.1 ) - Platform #2 [Intel(R) Corporation]
=============================================================
* Device #2: Intel(R) UHD Graphics 630, skipped
* Device #3: Intel(R) Core(TM) i7-8700K CPU @ 3.70GHz, skipped

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates

Applicable optimizers:
* Zero-Byte
* Single-Hash
* Single-Salt
* Brute-Force

Watchdog: Temperature abort trigger set to 90c

Host memory required for this attack: 380 MB


Code:
Session..........: hashcat
Status...........: Running
Hash.Name........: KeePass 1 (AES/Twofish) and KeePass 2 (AES)
Hash.Target......: the hashfile is here, i just don't want to post any bit of the hash ;)
Time.Started.....: Mon Apr 06 18:01:04 2020 (1 sec)
Time.Estimated...: Sat Jul 25 08:42:06 2020 (109 days, 14 hours)
Guess.Mask.......: ?1?2?2?2?2?2 [6]
Guess.Charset....: -1 ?l?d?u, -2 ?l?d, -3 ?l?d*!$@_, -4 Undefined
Guess.Queue......: 6/15 (40.00%)
Speed.#1.........:      396 H/s (84.25ms) @ Accel:512 Loops:256 Thr:64 Vec:1
Recovered........: 0/1 (0.00%) Digests
Progress.........: 0/3748902912 (0.00%)
Rejected.........: 0/0 (0.00%)
Restore.Point....: 0/60466176 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:16384-17408
Candidates.#1....: sarier -> sq6pan
Hardware.Mon.#1..: N/A


One last thing I should say, my GPU is running at 95-99%, so don't think its that.

Thanks!
Reply
#2
It's difficult to say what you are doing in detail, but you should of course keep in mind that these specific hash types are parameterized and therefore can have varying cost factors. The iteration count for instance makes a huge impact and therefore different hashes can run much slower than others, depending on the iteration count/algo etc

See the example hashes from here: https://hashcat.net/wiki/doku.php?id=example_hashes

If you are, instead, really comparing apples to apples (i.e. the same single, one only, hash to the same hash), it could also be a cooling/throttling problem, depending on your setup (you didn't really mention what type of hardware this is... could also be a notebook with no GPU cooling at all etc)
Reply
#3
Kinda don't think that its a cooling/throttling problem, the card has three fans for itself. As for the specs of my graphics card, it is a Radeon RX 5700 Gaming OC 8G/PCI-E 4.0x16/8GB GDDR6/256 bit. Another thing I noticed while messing around, is that the Radeon software that is installed to monitor the GPU is telling me that when I run hashcat, I am utilizing 95% of my gpu and 99% of vram, while Window's task manager is telling me that I'm using almost nothing. And while hashcat is NOT running, Radeon's software is saying that 87% of vram is being used. To be clear, When I run hashcat, I am using the -w 3 command. Any thing that comes to mind that might be the problem would help, because at this point, I'm about to return this card and get a different one.
Thanks!
Reply
#4
The "test database file" probably simply had a lower iteration count.
Reply
#5
Oof, I think it has to do with the fact that the file that I'm trying to crack starts with $keepass$*1*2241024*0* instead of $keepass$*1*50000*. Kinda a long shot, but any idea if there is anything you guys might know that might speed up the process other that -w 3 or 4, the let me know!
Thanks
Reply