6.1.1 potfile

[pbies]

Hashcat for Windows, version 6.1.1 is not writing potfile. The file created is empty. No potfile switches used.

Password is found, but not written to potfile.

[royce]

Please post your command line, with any sensitive info replaced with generic info

[pbies]

Code:

hashcat -m 6211 -a 3 -w 3 -i --session=ses ..\test\container.tc ?b?b?b

[philsmd]

the name of the potfile depends on the session name:
if you use --session ses , then your file name of the potfile is: ses.potfile

[pbies]

the name of the potfile depends on the session name:
if you use --session ses , then your file name of the potfile is: ses.potfile

There is no such file created.

The only created file is hashcat.potfile with length of 0 bytes.

[pbies]

Filename of the container is 256.tc so maybe filename with digits only is not accepted?

[royce]

If you delete the empty potfile, is it recreated on the next run?

[pbies]

If you delete the empty potfile, is it recreated on the next run?

Yes.

[pbies]

Guys! This is really a problem!!

6.1.1 is not writing password to potfile after finding one!!

[royce]

@philsmd, I can recreate this - for both TrueCrypt and Veracrypt, it seems, if a session is specified, but a potfile is not, then ses.potfile is not created on the fly that I can find (on Linux, anyway). Running the same command twice causes another crack (rather than skipping it as already having been cracked). And if I explicitly add "--potfile-path=ses.potfile",  it creates a potfile with zero length and nothing is written to it on crack.

Perhaps this is because TrueCrypt and VeraCrypt hashes are read directly from the container/volume? IIRC it used to store the filename in the potfile instead?