change boot to auto usb
good boot run
readflash fone
click reset
result
This release is a big step forward. We have added both, many major and many minor features.
Per-position markov-chains, aka markov-attack/incremental-attack/charset-files
The markov-attack is a statistically based brute-force like attack, but instead of specifying a charset or a mask, we specify a file. This file is once generated by ourself in a previous step. It contains statistical informations which are made out an automated analysis of a given dictionary.
It can fully replace Brute-Force since it covers the full keyspace.
In Brute-Force Attack (or in Mask Attack) we can limit the keyspace by setting a smaller charset in order to reduce the attack-time. In Markov Attack we have something similar, the "threshold". All you do is to specify a number. The higher the number, the higher the threshold to add a new link between two characters on the two-level table on which the markov-attack bases on.
This background is not so important, just remember that the lower the value, the smaller the keyspace and thus the faster the attack is.
Check these threads for more details
http://hashcat.net/forum/thread-1265.html
http://hashcat.net/forum/thread-1285.html
http://hashcat.net/forum/thread-1291.html
Use .ptx ad .llvmir intermediate kernels
The kernels are distributed in an "intermediate" format (aka IL). It cant be reversed to original C code but still its not a binary format that can be used for execution.
The JIT (just-in-time) compilers from both OpenCL and CUDA, which ship with the driver, compile the final byte-code out of the IL. This takes a few seconds per kernel but once its done the byte-code is cached (CUDA does it automatically, OpenCL not but we add a function to do the same as CUDA does).
This has some nice advantages:
Not 32/64 bit specific
Less HDD space
Smaller .7z
Less problems with driver specific problems as we often see with Catalyst
There is no more need to release a new oclHashcat-* in case a new driver optimization has been added. oclHashcat-* caches driver specific. If it recognizes a driver change it will rebuild thge byte-code from the IL, but using the new JIT from the new driver resulting in driver specific optimized byte-code.
Retaining GPU temperature
When I started with oclHashcat-* Hardware mangement support, some people asked me for add support for fan-speed. For a long time I was not interessted in adding fan-speed code to oclHashcat-* since this is the job for the driver or some specialized controling software.
I did not change my mind completly on this, but still we have added some fan-speed controlling code. The new parameters are:
Code:
--gpu-temp-disable Disable temperature and fanspeed readings and triggers
--gpu-temp-abort=NUM Abort session if GPU temperature reaches NUM degrees celsius
--gpu-temp-retain=NUM Try to retain GPU temperature at NUM degrees celsius (AMD only)
So what this thing is doing is: If the temperature configured with the new --gpu-temp-retain parameter is reached, it starts to increase the fan-speed by 1 percent each second. Thats all.
If you imagine a scenario what this means you will come to the conclusion that this feature also enables you to enfore your GPU running always to a very specific temperature.
Some notes:
--gpu-temp-disable you can completly disable all the temperature stuff.
--gpu-temp-retain currently only works for AMD.
--gpu-temp-abort parameter is just the renamed version of the old --gpu-watchdog.
Both parameters accept the 0 value which disables only this specific feature. This means you can step back to the old behavior by specifying --gpu-temp-retain 0.
The default for --gpu-temp-abort is still 90c.
The default for --gpu-temp-retain is 80c.
Built-in benchmarking mode
Code:
* Benchmark:
-b, --benchmark Run benchmark
--benchmark-mode Benchmark-mode, see references below
Nothing much to explain here I think, but some notes to the benchmark mode:
As long as you do not set the --benchmark-mode you can modify all the configuration parameters you always use. Something like -d, -n, --gpu-accel or --runtime.
With --runtime you can specify the duration how long each test lasts.
If you add -m you can limit to a specific hash-type. If you do not set it, it will iterate through all hash-types.
All unneccessary parallel threads like hardware monitor, restore-support and outfile-watch are disabled. Also the quiet mode is enabled.
On NVidia, the hashes based on SHA256, SHA512 and DES are limited to -n 32, otherwise the driver throws the error cuStreamSynchronize() 702.
New Algorithms supported
SHA512
Oracle 7-10g, DES(Oracle)
md4($pass.$salt)
sha256($pass.$salt)
sha512($pass.$salt)
type: feature
file: kernels
desc: added -m 0910 = md4($pass.$salt)
type: feature
file: kernels
desc: added -m 1410 = sha256($pass.$salt)
type: feature
file: kernels
desc: added -m 1700 = SHA512
type: feature
file: kernels
desc: added -m 1710 = sha512($pass.$salt)
type: feature
file: kernels
desc: added -m 3100 = Oracle 7-10g, DES(Oracle)
type: feature
file: kernels
desc: on AMD, switched from .kernel to .llvmir to reduce diskspace
type: feature
file: kernels
desc: on NV, switched from .cubin to .ptx to reduce diskspace
type: feature
file: kernels
desc: added kernel cache to avoid unnecessary recompilation
cred: m4tr1x
type: driver
file: kernels
desc: added support for NVidia CUDA 4.2
type: driver
file: kernels
desc: added support for NVidia sm_30 gpu-architecture [ Kepler ]
type: driver
file: host programs
desc: added support for NVAPI R300
type: driver
file: host programs
desc: added support for NVidia NVML library and got rid of nvidia-smi command
type: driver
file: host programs
desc: added support for AMD ADL v4.0 library
type: feature
file: host programs
desc: splitted --gpu-watchdog to --gpu-temp-disable and --gpu-temp-abort
type: feature
file: kernels
desc: added benchmarking mode
cred: m4tr1x
type: feature
file: host programs
desc: added --gpu-temp-retain to try retain temperature at NUM degrees celsius
cred: m4tr1x
type: feature
file: host programs
desc: workarounded AMD bug in clGetDeviceInfo() CL_DEVICE_MAX_CLOCK_FREQUENCY
cred: m4tr1x
type: feature
file: kernels
desc: added early check for zero-length password hashes
cred: m4tr1x
type: feature
file: host programs
desc: show LM-half as soon as it is cracked
type: feature
file: host programs
desc: added support for charset files and some example charset files
type: feature
file: host programs
desc: added support to read hashes from file
type: feature
file: host programs
desc: implemented base64 parser that would allow for dynamic salt lengths in nsldaps
type: feature
file: host programs
desc: added fan-speeds to status display
type: feature
file: host programs
desc: removed --pw-skip-plain and --pw-limit-plain as they are incompatible to markov
type: bug
file: host programs
desc: fixed bug in status display if ETA calculated > 60 years
cred: arex
type: bug
file: host programs
desc: fixed bug in Oracle 11g hash parsing function, salt length increased to 10 byte
cred: flipit
type: bug
file: host programs
desc: fixed bug in salt-length parser for MyBB1.2 hashes
cred: code841
type: change
file: host programs
desc: changed default charset to the one which passpal outputs running on rockyou.txt
cred: arex
Hello Hashcat-Users,
I am proud to announce version 0.09 of the oclHashcat-lite series.
Download it here: http://hashcat.net/oclhashcat-lite/
The highlights of this release are:
Support for AMD GCN cards (hd7xxx series)
I already wrote some more detailed informations about the integration here: http://hashcat.net/forum/thread-817.html
This card is a true DES killer. I wrote some more detailed informations about this topic here: http://hashcat.net/forum/thread-846.html
Added the LM Algorithm
After so many people requested this algorithm in the feature request section I decided to add it even I had not interesst in it.
However, it turned out it was a good investment of time. I realized how many pentester still have need for it.
See here for discussion: http://hashcat.net/forum/thread-167.html
Vectorized datatype kernels for sm_21 NVidia architecture
This a massive improvement for low- and mid-ranged NVidia GPUs.
The gtx560Ti @ MD5, for example, increased by 23% (1252 Mhash/s -> 1660 Mhash/s).
This improvement can be seen on nearly all algorithms for this architecture.
MD4 based algorithm tuning
To make it short: I found a way to reverse another step in MD4.
Especially the NTLM and DCC algorithm benefit from this code change.
The hd6990 @ NTLM broke the 20000 Mhash/s mark on stock clocks. Average increase is around + 9% (19100 Mhash/s -> 20864 Mhash/s).
Updated EULA
This goes back to a discussion we had HD Moore from Rapid7.
The updated EULA is a lot more relaxed for professional pentesters than before.
See changelog for more details.
Fixed some major issues
On thing that many user complained about in oclHashcat-lite 0.08 was its "instability" and problems with session restore.
This popped in because of a default-settings change in oclHashcat-lite v0.07. It has been set back to oclHashcat-lite v0.06 default.
Discussion can be found here: http://hashcat.net/forum/thread-681.html
Harmonization with oclHashcat-plus
The --help page, the --outfile-format and the -m parameter values, in case of an overlap, are now equal to oclHashcat-plus v0.08.
It will help to avoid confusion, thats why I am planning to do the same change on CPU hashcat in the next version.
* changes v0.05 -> v0.06:
type: performance increase
file: kernels
desc: MD5: AMD 1,07%, NVidia 0,62%
desc: md5($pass.$salt): AMD 1,37%, NVidia 8,10%
desc: md5(md5($pass)): AMD 0,94%, NVidia 0%
desc: vBulletin < v3.8.5: AMD 0,30%, NVidia 0%
desc: SHA1: AMD 11,14%, NVidia 13,62%
desc: sha1($pass.$salt): AMD 16,96%, NVidia 39,10%
desc: MySQL > v4.1: AMD 1,99%, NVidia 7,15%
desc: MD4: AMD 13,46%, NVidia 3,34%
desc: NTLM: AMD 13,16%, NVidia 2,57%
desc: DCC: AMD 34,20%, NVidia 0,89%
desc: MSSQL: AMD 11,23%, NVidia 17,89%
desc: SL3: AMD 12,24%, NVidia 13,48%
desc: Oracle 11G: AMD 16,93%, NVidia 13,53%
type: password length increase
file: kernels
desc: MD5: from 15 to 55
desc: md5($pass.$salt): from 15 to 55
desc: md5(md5($pass)): from 15 to 55
desc: vBulletin < v3.8.5: from 15 to 55
desc: SHA1: from 15 to 55
desc: sha1($pass.$salt): from 15 to 55
desc: MySQL > v4.1: from 15 to 55
desc: MD4: from 15 to 55
desc: NTLM: from 15 to 27
desc: DCC: from 15 to 27
desc: MSSQL: from 15 to 25
desc: SHA256: from 15 to 55
desc: Oracle 11G: from 15 to 45
type: feature
file: kernels
desc: added -m 15 = vBulletin > v3.8.5
cred: chick0n
type: feature
file: kernels
desc: increased salt length for DCC from 7 to 19
cred: Rabbitz
type: feature
file: host programs
desc: hardcoded cpu affinity mask to one (cpu #0) to save energy
cred: randyberger
type: feature
file: host programs
desc: added --pw-skip and --pw-limit parameters for distributed computing
cred: d3ad0ne
type: feature
file: host programs
desc: added status codes on exit, see status_codes.txt for listing
cred: hermix
type: bug
file: host programs
desc: rewritten restore function check from scratch
cred: anonymous
type: bug
file: host programs
desc: fixed multiple instances check
cred: FractalizeR
type: bug
file: host programs
desc: fixed 8 bit characters from russian alphabet
cred: Rolf
Number of Image Files: 3
Processing Image File :
rm911__07.35.mcusw
CMT Type : XG223
CMT Algorithm : XG223_V0 ALG
Secondary Sending Speed : 650000Hz
Algorithm Sending Speed : 6500000Hz
Program Sending Speed : 6500000Hz
Message Reading Speed : 98000Hz
Number of Blocks : 87
Entry Point: 0x037D
Page Format : -1
MAX PAGE : 0x00080000
Processing Image File :
rm911__07.35.ppm_mac
CMT Type : XG223
CMT Algorithm : XG223_V0 ALG
Secondary Sending Speed : 650000Hz
Algorithm Sending Speed : 6500000Hz
Program Sending Speed : 6500000Hz
Message Reading Speed : 98000Hz
Number of Blocks : 16
Entry Point: 0x0371
Page Format : -1
MAX PAGE : 0x00080000
Processing Image File :
rm911__07.35.image_mac_059R7B4
CMT Type : XG223
CMT Algorithm : XG223_V0 ALG
Secondary Sending Speed : 650000Hz
Algorithm Sending Speed : 6500000Hz
Program Sending Speed : 6500000Hz
Message Reading Speed : 98000Hz
Number of Blocks : 89
Entry Point: 0x00B5
Page Format : -1
MAX PAGE : 0x00080000
AUTO SELECTED DEAD USB FLASHING...
If Phone Booting does not Start in 5 Seconds,
Then Perform Steps 1, 2, 3 and 4...
1. Remove USB and Battery...
2. Insert USB.
3. Insert Battery. (Some phones boot automatically)
4. Please Power on phone shortly...
AdvanceFBox SendBootCodeEx
InitialiseBootstrap_DCT5 DIR
BootFlashMode_DCT5
READING BOOTROM
BootFlashModeDCT5Ex Succeeded First Time
SYSTEM_ID_RESPONSE_BB5 (0xC0) - 82 (0x52) bytes returned
Number of Sub Blocks 5 (0x05)
1 SYSTEM_ASIC_ID 01
Block Length : 21 (15)
BB ASIC Index : 0 (00) CMT
ID DWORD 0 : 00000C20
ID DWORD 1 : 16100040
ID DWORD 2 : 49922E09
ID DWORD 3 : B226501C
ID DWORD 4 : C718AC00
2 PUBLIC_ID 12
Block Length : 21 (15)
BB ASIC Index : 0 (00) CMT
ID DWORD 0 : 946D63E9
ID DWORD 1 : B5F4CE97
ID DWORD 2 : 49922E09
ID DWORD 3 : B226501C
ID DWORD 4 : C718AC00
3 ASIC_MODE_ID 13
Block Length : 2 (02)
BB ASIC Index : 0 (00) CMT
Mode Id : 00
4 ROOT_KEY_HASH 14
Block Length : 17 (11)
BB ASIC Index : 0 (00) CMT
Hash : 12 5F C7 26 05 B5 C4 E4 8A 9E 02 25 08 4D 25 79
5 ROM_ID 15
Block Length : 9 (09)
BB ASIC Index : 0 (00) CMT
CRC 0 : 53588225
CRC 1 : 2F54C676
CMT Secondary Loader: C:\AdvanceBox Turbo Flasher\Nokia\BB5_Loader\New\XG223_v11_usb2nd.fg
Secondary Loader Sent....
CMT Algorithm Loader: C:\AdvanceBox Turbo Flasher\Nokia\BB5_Loader\New\XG223_v11_usbalg.fg
Algorithm Loader Sent....
FUR_Control_AddClient_BB5() ASIC_INDEX_CMT (Ready)
FUR control Ok
START READING RPL DATA
IMEI: 354598053968801
Reading : NPC... OK!
Reading : CCC... OK!
Reading : HWC... OK!
Reading : R&D... OK!
NPC CERTIFICATE INFORMATION (CMT):
IMEI 1 : 354598053968801
IMEI 2 : 354598053968819
PRODUCT CODE : 059R7B4
WLAN ID : 4C:25:78:FD:CE:34
BLUETOOTH ID : 4C:25:78:FC:95:B4
PUBLIC_ID : 946D63E9B5F4CE9749922E09B226501CC718AC00
PAPUB_KEYS_HASH: 2ECFC8C8BB6F1E5571C6D30DAA717E19E9E5C31A
CCC CERTIFICATE INFORMATION (CMT):
PRODUCT CODE : 059R7B4
HWC CERTIFICATE INFORMATION (CMT):
PUBLIC_ID : 946D63E9B5F4CE9749922E09B226501CC718AC00
PRODUCT CODE : 059R7B4
RPL Backup was Successful...
Plain RPL saved to:
C:\AdvanceBox Turbo Flasher\Nokia\Backup\354598053968801\354598053968801_114513.rpl
PA PUBLIC KEY Request
PhoneInfoRequest_BB5 (Asic Index 00 )
PHONE_INFO_RESPONSE_BB5
PAPUB_KEYS_HASH_RESP_BB5 2A
BB Asic Index : 00
CMT PAPUBKEYS HASH:
2ECFC8C8BB6F1E5571C6D30DAA717E19E9E5C31A
ImagePath: C:\Program Files\Nokia\Phoenix\Products\RM-911\
ImageFilename: rm911__07.35.mcusw
Read Type : FIASCO_BB5_DO_NOT_READ_CERTIFICATE (01)
Sending STORE_CERTIFICATE_REQUEST_BB5 (CMT 00 only)
Certificate 1
Name : NPC
ASIC Index : CMT 0
Certificate 2
Name : CCC
ASIC Index : CMT 0
Certificate 3
Name : HWC
ASIC Index : CMT 0
Certificate 4
Name : R&D
ASIC Index : CMT 0
STORE_CERTIFICATE_REQUEST_BB5 : 61 04 2B 0D 4E 50 43 00 00 00 00 00 00 00 00 00 00 2B 0D 43 43 43 00 00 00 00 00 00 00 00 00 00 2B 0D 48 57 43 00 00 00 00 00 00 00 00 00 00 2B 0D 52 26 44 00 00 00 00 00 00 00 00 00 00 D3
STORE_CERTIFICATE_REQUEST_BB5 : No Error - 0 (0x00)
StartErase_DCT5...
BlockLength : 0x2E (46)
ERASE Blocks : 0x01 (1)
0 ERASE_AREA_BB5 0x12
Block Length : 0x2B (43)
BB ASIC Index : 0x00 CMT
Device Type : 0x00 NOR
Device Index : 0x00
0 : 40000000-4003FFFF
1 : 47E00000-47E3FFFF
2 : 400A0000-4261FFFF
3 : 42620000-4271FFFF
4 : 47E40000-47F1FFFF
ERASE_REQUEST_BB5 : 5005120B000000400000004003FFFF120B00000047E0000047E3FFFF120B000000400A00004261FFFF120B000000426200004271FFFF120B00000047E4000047F1FFFFF8
Successfully Erased...
Total blocks to write : 87
>> CMT Rootkey Hash CERT : ISSW
>> CMT Rootkey Hash CERT : MEMSET
>> CMT Rootkey Hash CERT : PRIMAPP
>> CMT Rootkey Hash CERT : LOADER
>> CMT Rootkey Hash CERT : PASUBTOC
>> CMT Rootkey Hash CERT : PAPUBKEYS [2ECFC8C8BB6F1E5571C6D30DAA717E19E9E5C31A]
>> CMT Rootkey Hash CERT : UPDAPP
>> CMT Rootkey Hash CERT : MCUSW
ImagePath: C:\Program Files\Nokia\Phoenix\Products\RM-911\
ImageFilename: rm911__07.35.ppm_mac
StartErase_DCT5...
BlockLength : 0x0E (14)
ERASE Blocks : 0x01 (1)
0 ERASE_AREA_BB5 0x12
Block Length : 0x0B (11)
BB ASIC Index : 0x00 CMT
Device Type : 0x00 NOR
Device Index : 0x00
0 : 42720000-42FFFFFF
ERASE_REQUEST_BB5 : 5001120B0000004272000042FFFFFFEE
Successfully Erased...
Total blocks to write : 16
ImagePath: C:\Program Files\Nokia\Phoenix\Products\RM-911\
ImageFilename: rm911__07.35.image_mac_059R7B4
StartErase_DCT5...
BlockLength : 0x0E (14)
ERASE Blocks : 0x01 (1)
0 ERASE_AREA_BB5 0x12
Block Length : 0x0B (11)
BB ASIC Index : 0x00 CMT
Device Type : 0x00 NOR
Device Index : 0x00
0 : 43000000-47DFFFFF
ERASE_REQUEST_BB5 : 5001120B0000004300000047DFFFFF7A
Successfully Erased...
Total blocks to write : 89
ContinueFlash_DCT5 Complete
Continue Flash Complete : : No Error - 0 (0x00)
FlashInfo.RestartMode : Test Mode
Flashing Done...
Total Flashing Time (Erase + Flashing) : 00:00:49
(Booting time is NOT Included)
Waiting for Phone to Start-Up..(Max 150 seconds)
SW: V 07.35 03-02-13 RM-911 (c) Nokia
IMEI: 354598053968801
CONFIG KEY : 0000000000000000
PROVIDER KEY : 2440700000000000
NETWORK NAME : Nokia Default;Finland
LOCK COUNTERS : KEYPRESS 0/3, FBUS 0/10
SIMLOCK TABLE :
Block [1] 1:Open 2:Open 3:Open 4:Open 5:Open
Block [2] 1:Open 2:Open 3:Open 4:Open 5:Open
Block [3] 1:Open 2:Open 3:Open 4:Open 5:Open
Block [4] 1:Open 2:Open 3:Open 4:Open 5:Open
Block [5] 1:Open 2:Open 3:Open 4:Open 5:Open
Block [6] 1:Open 2:Open 3:Open 4:Open 5:Open
Block [7] 1:Open 2:Open 3:Open 4:Open 5:Open
SIMLOCK STATE : Not Locked
SIMLOCK_TEST : PASSED
SECURITY_TEST : PASSED
SUPER_DONGLE_TEST : PASSED
SECURITY_CODE : 12345
================================================
SL3 Phone detected
================================================
* Firmware Version Downgrade will KILL PHONE !!!
* Manual Full Erase WILL KILL PHONE!!!
* Simlocks are in PM 120 Only...
* PM 308 is Write Protected...
FACTORY SET TO : Full Factory Set
OK
FACTORY SET TO : User Data
OK
FACTORY SET TO : Leave Factory
OK
FACTORY SET TO : Service Center
OK
FACTORY SET TO : Software Upgrade
OK
FACTORY SET TO : Production Tune
OK
Life timer data is not yet used...
Life timer: ----:--
Windows Phone 8 Flashing Started
Loading Flash Files Please Wait...
======================================================
Windows Phone 8 Lumia Flasher
======================================================
If the Phone is ALIVE
1. Power On the Phone and Connect it to the USB Port
If the Phone is DEAD
1. Connect Phone to the USB Port
2. Press and Hold the VOLUME DOWN and POWER Buttons
3. Wait until the Phone Vibrates Shortly...
4. Stop Pressing the Buttons...
======================================================
Version: 1.1.1.3
Product Code: 059S184
Module Code: 0205435
Boot Flash Mode Successful...
Phone Info Query Start...
Blocks Returned: 0x07 Blocks
Block ID 0x01 : 00241000
Block ID 0x02 : 00240000
Block ID 0x03 : 00E74000
Block ID 0x05 : Nokia.MSM8227.P6036.1.2
Block ID 0x0D : 0001
Block ID 0x0F : 0301010100000101FF
Block ID 0x10 : 0100030000
Checking SD Card Size...
Card Size: 0x00000000
Checking Platform Security Status...
Platform Secure Boot Status: Active
Secure FFU EFUSE Status: Active
Debug Status: Active
RDC Status: Not Active
Authentication Status: Not Active
UEFI Secure Boot Status: Active
Checking Secure FFU Mode...
Secure FFU Mode : SYNC + ASYNC
Query Flash App Information...
Flash App Information: 02010C011700
UEFI App: FLASH APP
Flash App Protocol Version: 1.12
Flash App Implementation Version: 1.23
Query ROOT KEY HASH...
ROOT_KEY_HASH: F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD
Erasing Data Partition...
Data Partition Erased Successfully
Sending Image Signatures...
Image Signatures Accepted!
Preparing Buffers for DATA LOOP...
Allocating System RAM OK!
Start Sending DATA BLOCKS...
Finished Sending all DATA BLOCKS!
Exiting FLASH Mode via REBOOT...
Exit FLASH Mode Successful!
Flashing Done!
Total Flashing Time : 00:03:38
Copyright @ 2013-2015 Android Mobile Doctor.