token length on 10500 pdf with *9
#1
I'm getting a token length error on the following pdf hash:

$pdf$2*3*128*-1028*1*16*ff0a0849645292a28ba5066345b9fb2a*32*8f9257b13ff3cd1fc4f2e368c03af0ed00000000000000000000000000000000*9*a76b969c5b72cc1b71

my commands have been:

hashcat64.exe -m 10500  -a 3 --increment --increment-min 4 --show  ytrhome.hashcat ?a?a?a?a?a?a?a?a
hashcat64.exe -m 10500  -a 3 --increment --increment-min 4 --show  ytrhome.hashcat ?l?l?l?l?d?d?d?d

The second command was taken from feedback on the thread: 
https://hashcat.net/forum/thread-7728.ht...+exception

Mode 10500 matches the example hash. I compared the generated hashes from hashcat and JTR. 

Here is the command output:
y:\hashcat-5.1.0>hashcat64.exe -m 10500  -a 3 --increment --increment-min 4 --show ytrhome.hashcat ?a?a?a?a?a?a?a?a
Hashfile 'ytrhome.hashcat' on line 1 ($pdf$2...00000000000*9*a76b969c5b72cc1b71): Token length exception
No hashes loaded.

y:\hashcat-5.1.0>type ytrhome.hashcat
$pdf$2*3*128*-1028*1*16*ff0a0849645292a28ba5066345b9fb2a*32*8f9257b13ff3cd1fc4f2e368c03af0ed00000000000000000000000000000000*9*a76b969c5b72cc1b71

y:\hashcat-5.1.0>

I have tried version 6.1.1 with the same result. 

Does anyone have any corrections?
Reply