hashcat Forum

dear hashcat-community,

i've been wondering if I'm using mode 6223 not correctly (6223 -> Truecrypt in mode PBKDF2-HMAC-SHA512 + 'XTS 1536 bit all') and after some testing come to the conclusion that something might be broken with hashcat v3.00 as I'm able to successfully crack all test-cases when using v2.01.

in the attached tc-test.7z are 4 testfiles, the names are pretty self-explanatory i guess...:
  1_aes_sha512_512b.dd
  2_aes-twofish_sha512_512b.dd
  3_aes-twofish-serpent_sha512_512b.dd
  4_serpent-twofish-aes_sha512_512b.dd

furthermore, there is 'passwords.txt' included with 3 password-candidates (1 being correct) as well as 'commands.txt' which sums up various test-cases.

in brief, mode 6223 behaves in an unexpected manner such as that it fails for all cascaded truecrypt-ciphers i've tried such as
as stated before, using hashcat v2.01 on the same files succeeds, so i wonder what might be wrong here?
did i possibly misunderstand something about the 1536 bit mode or could anybody maybe verify my results?

i did not test with ripemd-160 or whirpool, sha512 was chosen according to my current use-case.

many thanks in advance and have a nice weekend,
red

ps: tested on a 64bit debian 8 ("jessie", kernel 3.16) machine with a nvidia GTX 970 and nvidia-driver 361.45.11 installed.

EDIT: issue fixed in release 3.10, see issue opened on github for further information.

Seems to be a bug in -m 6223. Other modes work just fine. Here's a full set of example headers for all possible modes: https://hashcat.net/wiki/doku.php?id=example_hashes for testing. Please open an issue on Github.

thanks, i just opened issue on GH as suggested.
-> https://github.com/hashcat/hashcat/issues/456