HCCAP format description

Note: all versions of oclHashcat have been replaced by a unified OpenCL CPU/GPU version, now known simply as hashcat.

Note: The hccap file format has been replaced by hccapx.

The hash modes that read this format are deprecated. hashcat refuses -m 2500, -m 2501, -m 16800 and -m 16801 and tells you to use -m 22000 instead. --deprecated-check-disable forces them to run, but the format itself cannot carry what 22000 carries. Convert your capture with hcxpcapngtool and use the 22000 workflow.

HCCAP is a custom format developed specifically for oclHashcat.

The data is the same as in the usual tcpdump format, but arranged differently.

A valid hashcat capture file (with the .hccap extension) contains one or more instances of the structure documented below. To merge several .hccap files into one file (for example, multi.hccap), concatenate the files:

Attention: currently only oclHashcat supports loading and cracking of multiple networks at once. Multi-hccap support is currently not available in hashcat (CPU-based version). That split between a CPU and a GPU build has not existed since the programs were merged into one hashcat.

Linux:
$ cat single_hccaps/*.hccap > all_in_one/multi.hccap

Windows:
copy /b single_hccaps\*.hccap all_in_one\multi.hccap

or select single ones

copy /b single_hccaps\1.hccap + single_hccaps\2.hccap all_in_one\multi.hccap

cap2hccap may also be able to generate .hccap files containing several networks (that is, more than one structure instance, with multiple networks that may have different ESSIDs).

typedef struct
{
  char          essid[36];
 
  unsigned char mac1[6];
  unsigned char mac2[6];
  unsigned char nonce1[32];
  unsigned char nonce2[32];
 
  unsigned char eapol[256];
  int           eapol_size;
 
  int           keyver;
  unsigned char keymic[16];

} hccap_t;