PDF mode 10500 slow
#1
Hi, 

This is not a grumble or complaint thread, hashcat is awesome and has been used for several important recoveries at work over the last few years. I appreciated the help with the weird salted algorithm I posted about previously, and was ultimately successfully able to crack passwords with it. I did a substantial amount of searching before posting this as well.

I am running 6.0.1, have the CUDA dev kit installed and compatible driver running this command:

.\hashcat.exe -m 10500 -a 3 -i "c:\temp\hashes.txt" ?a?a?a?a?a?a?a?a -w 3 -D 2

I am running this on a Ryzen 5950x with an RTX 3090, so was expecting a lot more performance than what I'm seeing.

Session..........: hashcat
Status...........: Running
Hash.Name........: PDF 1.4 - 1.6 (Acrobat 5 - 8)
Hash.Target......: c:\temp\hashes.txt
Time.Started.....: Tue Mar 23 17:28:48 2021 (4 hours, 12 mins)
Time.Estimated...: Wed Mar 24 02:25:47 2021 (4 hours, 44 mins)
Guess.Mask.......: ?a?a?a?a?a?a [6]
Guess.Queue......: 6/8 (75.00%)
Speed.#1.........: 71570.6 kH/s (33.21ms) @ Accel:512 Loops:70 Thr:64 Vec:1
Recovered........: 0/3 (0.00%) Digests, 0/3 (0.00%) Salts
Progress.........: 982175711232/2205275671875 (44.54%)
Rejected.........: 0/982175711232 (0.00%)
Restore.Point....: 3444703232/7737809375 (44.52%)
Restore.Sub.#1...: Salt:1 Amplifier:67-68 Iteration:0-70
Candidates.#1....: Ue=NF@ -> U|s[7A
Hardware.Mon.#1..: Temp: 43c Fan: 0% Util: 99% Core:1965MHz Mem:9751MHz Bus:16

I confirmed the hashes in question is for that version of PDF, based on the formatting from the examples page. I am only getting between 66kh/s and 74kh/s and I see examples and screenshots for other newer PDF algorithms showing double and triple digit mh/s. 

Just posting and wondering if there's anything else I should be doing to get better performance. I have no information about what the password is, the employee who encrypted these PDFs left and this version must be recovered for legal reasons.

Cheers and thank you!
Reply
#2
run
hashcat -b -m 10500
and see output, this would be the "perfect" speed you can get with this hashalgorithm

EDIT: running with 2 1050ti

Hashmode: 10500 - PDF 1.4 - 1.6 (Acrobat 5 - 8) (Iterations: 70)

Speed.#1.........:  3144.8 kH/s (91.85ms) @ Accel:1024 Loops:70 Thr:64 Vec:1
Speed.#2.........:  3158.0 kH/s (85.43ms) @ Accel:1024 Loops:70 Thr:64 Vec:1
Speed.#3.........:  473.1 kH/s (79.57ms) @ Accel:32 Loops:70 Thr:64 Vec:4
Speed.#4.........:  380.9 kH/s (73.34ms) @ Accel:32 Loops:70 Thr:64 Vec:4
Speed.#*.........:  7156.7 kH/s

so your 
Speed.#1.........: 71570.6 kH/s (33.21ms) @ Accel:512 Loops:70 Thr:64 Vec:1
seems quite okay, 10 times faster
Reply
#3
(03-25-2021, 05:54 PM)Snoopy Wrote: run
hashcat -b -m 10500
and see output, this would be the "perfect" speed you can get with this hashalgorithm

EDIT: running with 2 1050ti

Hashmode: 10500 - PDF 1.4 - 1.6 (Acrobat 5 - 8) (Iterations: 70)

Speed.#1.........:  3144.8 kH/s (91.85ms) @ Accel:1024 Loops:70 Thr:64 Vec:1
Speed.#2.........:  3158.0 kH/s (85.43ms) @ Accel:1024 Loops:70 Thr:64 Vec:1
Speed.#3.........:  473.1 kH/s (79.57ms) @ Accel:32 Loops:70 Thr:64 Vec:4
Speed.#4.........:  380.9 kH/s (73.34ms) @ Accel:32 Loops:70 Thr:64 Vec:4
Speed.#*.........:  7156.7 kH/s

so your 
Speed.#1.........: 71570.6 kH/s (33.21ms) @ Accel:512 Loops:70 Thr:64 Vec:1
seems quite okay, 10 times faster

Thanks, so this algorithm is just slow. All good.
Reply