hashcat Forum

yeah, change it back to 1

and change 09, 10 and 11 to the values that are for instance used by the example hash:
$112$98$f3bc2a88062c419a25acd40c0c2d75421cf23263f69c51b13f9b1aada41a8a09f9adeae45d67c60b56aad338f20c0dcc5eb811c7a61128ee0746f922cdb9c59096869f341c7a9cb1ac7bb7d771f546b82cf4e6f11a5ecd4b61751e4d8de66dd6e2dfb5b7d1022d2211e2d66ea1703f96

This means that the encrypted data is 112 bytes, the decrypted version of this data should be 98 bytes and of course field 11, the data, must be 224 bytes long (i.e 112 * 2 because of hex)
You should leave all the other fields unchanged (both before and after the fields 9,10 and 11)

(03-19-2018, 11:07 PM)philsmd Wrote: [ -> ]yeah, change it back to 1

and change 09, 10 and 11 to the values that are for instance used by the example hash:
$112$98$f3bc2a88062c419a25acd40c0c2d75421cf23263f69c51b13f9b1aada41a8a09f9adeae45d67c60b56aad338f20c0dcc5eb811c7a61128ee0746f922cdb9c59096869f341c7a9cb1ac7bb7d771f546b82cf4e6f11a5ecd4b61751e4d8de66dd6e2dfb5b7d1022d2211e2d66ea1703f96

This means that the encrypted data is 112 bytes, the decrypted version of this data should be 98 bytes and of course field 11, the data, must be 224 bytes long (i.e 112 * 2 because of hex)
You should leave all the other fields unchanged (both before and after the fields 9,10 and 11)

Ok, so, oddly my hash actually has a 12 and 13th value as well.

Here are the outcomes of my testing:

 - Substitute the data in the 09, 10, and 11th position, and removed 12th and 13th position:


 - Substitute the data in the 09, 10, and 11th position, and add empty 12th and 13th position ($$):


 - Substitute the data in the 09, 10, and 11th position, and add original 12th and 13th position:


I'm sorry I didn't mention the 12th and 13th positions before, I never noticed them among the mountain of 11th position data.

I don't think we are able to understand this problem like this, we have 2 ways to better troubleshoot this:
1. you try to understand the parser function seven_zip_parse_hash () within src/interface.c of the hashcat source code and analyze why the original hash fails to load (of course you need to understand C code to do this) or...
2. you PM me (or any other hashcat dev you trust) the hash (or even the 7zip file) to analyze it for you

Considering I don't know "C", I have PM'd you the hash.

If you can find anything, please let me know.

Thank you!

for your interest, the problem was identified: https://github.com/hashcat/hashcat/pull/1549