The generic attack (-a 8) does not generate candidates itself. It loads a small plugin, called a feed, and the feed generates them. If you can write the code, you can plug your own candidate generator into hashcat without touching hashcat itself.
Every other attack mode has one fixed idea about where candidates come from: a wordlist, a mask, a grammar. -a 8 has no such idea, which is the point of it.
The feed is the first thing after the hash file. Anything after the feed belongs to the feed:
$ hashcat -a 8 -m 500 example500.hash feeds/feed_wordlist.so 1word.dict -r rules/best66.rule
Look in the feeds/ folder:
| feed | what it does |
|---|---|
feed_wordlist.so | reads a wordlist, the same job as -a 0 |
feed_mask.so | generates from a mask, the same job as -a 3 |
feed_hybrid.so | the one behind -a 1, -a 6, -a 7 and -a 12 |
feed_table.so | the one behind -a 5 |
feed_pcfg.so | the one behind -a 4 |
feed_association.so | the one behind -a 9 |
feed_stdin.so | reads candidates from standard input |
feed_random.so | makes random candidates, handy for testing |
Several of the built-in attack modes are feeds themselves. That is not a coincidence. A generator does not need its own attack-mode number to be useful, so hashcat can load any number of feeds, bundled or third-party.
Most attack modes are built to take a small amount of data from the host and amplify it on the graphics card. That keeps the PCIe bus quiet and keeps a fast hash fed.
For a slow hash, the bus is not the problem. The card is busy for a long time on each candidate, so the thing that matters is whether the candidates were worth trying. That is where -a 8 earns its place, because it will happily run a generator that is too clever or too slow to fit the amplification model:
A feed is a shared library with a small interface. You can write one in C, and there are also Python and Rust paths, so you do not have to work in C if you would rather not. hashcat ships rust_random.so as a worked Rust example.
The guides in the hashcat source are:
docs/hashcat-generic-attack-mode.md - what the mode is and how to use itdocs/hashcat-generic-attack-mode-development-guide.md - the interface, in detaildocs/hashcat-python-plugin-quickstart.md and docs/hashcat-rust-plugin-quickstart.md - the shortest route in