Precomputation using internal graphics #23
Comments
|
It's actually using both GPUs. But the built-in Intel is so much
slower, so the NVIDIA is just waiting around doing nothing most of the time.
I can perhaps get a special build for you to try. What OS are you on?
Windows? Or Linux?
…On 10/1/20 4:18 AM, chriswcohen wrote:
Hi, I've the following two Devices being seen in my laptop:
Device #0:
Vendor: NVIDIA Corporation
Name: GeForce GTX 1650
Version: OpenCL 1.2 CUDA
Driver: 419.71
Max compute units: 16
Max work group size: 1024
Global memory size: 4294967296
Device #1 <#1>:
Vendor: Intel(R) Corporation
Name: Intel(R) UHD Graphics 630
Version: OpenCL 2.1 NEO
Driver: 26.20.100.7985
Max compute units: 24
Max work group size: 256
Global memory size: 13626322944
When I run crackalack_lookup over a file containing multiple hashes,
each precomutation it reports to takes 3 minutes.
Looking at my Task Manager I can see that my Internal Graphics card
"Intel(R) UHD Graphics 630" is maxed out at 100%, with blips down
between precomputations, while my GTX 1650 is sitting idle.
The same appears to happen after precomputation, when I use just one
hash and it's searching the tables the internal GPU is spiking
regularly, which the GTX 1650 appears not to be doing anything.
Any help to get the program to favor the better of the two graphic
devices would be appreciated. Thanks in advance.
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#23>, or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAWYA65KWKMTUOR42Q36SJTSIQ3PHANCNFSM4SADEUVA>.
--
Joseph S. Testa II
Founder & Principal Security Consultant
Positron Security
|
|
That makes sense. Wow - that would be amazing, I'm on Windows. |
|
Here you go! I don't have a system to test this on, but the patch was fairly straightforward. You should see a message that says "Found system with Intel + NVIDIA/AMD mix. Disabling Intel GPU at X." Then your NVIDIA GPU should be busy and your Intel GPU should be idle. Please let me know if it works! Here's the special build: https://www.rainbowcrackalack.com/Rainbow_Crackalack_Win64_v1.2-intel_skip_0.zip |
|
That worked! Amazing. Precomputation now takes 20 seconds or so per hash. It did give a warning saying the issues of running it on Windows 7 (it wasn't) but otherwie works as expected. Thank you. Though I have now run into another problem, it crashes out when searching after precomputing if more than a small amount of hashes are checked at a single time, i.e. from a file. It worked with 2 hashes, but wouldn't work with 5. The error says that the host has run out of memory, though I've got 32 Gb and it's doesn't seem to be running out, perhaps its the graphics cards memory? |
|
Well, that's great that we got past the first issue!
The Windows 7 warning got included by mistake. I made a quick build for
you on an older machine, which doesn't have the checks for newer
versions of Windows available.
Can you please provide a the full output of the program? Everything
from the start up until the crash would be helpful to see.
Can you also double-check that you have the latest NVIDIA drivers installed?
…On 10/1/20 2:51 PM, chriswcohen wrote:
That worked! Amazing. Precomputation now takes 20 seconds or so per
hash. It did give a warning saying the issues of running it on Windows 7
(it wasn't) but otherwie works as expected. Thank you.
Though I have now run into another problem, it crashes out when
searching after precomputing if more than a small amount of hashes are
checked at a single time, i.e. from a file. It worked with 2 hashes, but
wouldn't work with 5. The error says that the host has run out of
memory, though I've got 32 Gb and it's doesn't seem to be running out,
perhaps its the graphics cards memory?
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
<#23 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAWYA67YLEGVRJK66AAZSLTSITFTPANCNFSM4SADEUVA>.
--
Joseph S. Testa II
Founder & Principal Security Consultant
Positron Security
|
|
I just checked NVIDIA's website. The latest driver version for your GTX
1650 is 456.55. The output you posted originally shows that you have
419.71.
Try updating the driver, rebooting, and running it again. If it still
crashes, then copy/paste the full output.
…On 10/1/20 2:51 PM, chriswcohen wrote:
That worked! Amazing. Precomputation now takes 20 seconds or so per
hash. It did give a warning saying the issues of running it on Windows 7
(it wasn't) but otherwie works as expected. Thank you.
Though I have now run into another problem, it crashes out when
searching after precomputing if more than a small amount of hashes are
checked at a single time, i.e. from a file. It worked with 2 hashes, but
wouldn't work with 5. The error says that the host has run out of
memory, though I've got 32 Gb and it's doesn't seem to be running out,
perhaps its the graphics cards memory?
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
<#23 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAWYA67YLEGVRJK66AAZSLTSITFTPANCNFSM4SADEUVA>.
--
Joseph S. Testa II
Founder & Principal Security Consultant
Positron Security
|
|
That's worked - amazing, thank you. I've been able to complete the process completely with 10 hashes. I'm now running a file with 350 hashes (using just the ntlm8 tables) and it appears to be taking much longer (12 hours apposed to a couple of hours) and appears to be maxing out my CPU when 'searching table for matching endpoint'. It something I didn't notice when doing it with fewer hashes - just wondering if this is expected behavior? |
|
Great!!
And yes, it is expected that the CPU be used during the process. The
binary searching step is done by the CPU instead of GPU (see issue #12).
If I had more time, I'd love to experiment with porting it over.
Furthermore, since you're cracking on a laptop, heat becomes a real
issue (running a computational load on a GPU on full blast for even just
a few minutes will make it HOT). The hardware & OS will ease off the
power to control it. So your limiting factor is how well your laptop
case can vent heat.
Using laptops isn't ideal, but it still beats nothing if you don't have
a better option!
…On 10/2/20 7:52 AM, chriswcohen wrote:
That's worked - amazing, thank you. I've been able to complete the
process completely with 10 hashes. I'm now running a file with 350
hashes (using just the ntlm8 tables) and it appears to be taking much
longer (12 hours apposed to a couple of hours) and appears to be maxing
out my CPU when 'searching table for matching endpoint'. It something I
didn't notice when doing it with fewer hashes - just wondering if this
is expected behavior?
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
<#23 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAWYA6ZDT2FC7H2RQGN3AELSIW5G5ANCNFSM4SADEUVA>.
--
Joseph S. Testa II
Founder & Principal Security Consultant
Positron Security
|
|
350 hashes
Oh, and this is a factor as well. Rainbow table cracking doesn't scale
well with larger sets of hashes. Hence, you'd want to use rules-based
attacks for large sets, but use tables for high-privilege hashes (like
for Domain Administrators).
The point at which the hashes becomes "too many" is very much
hardware-dependent. You can experiment with hashcat to find where that
point is for you. But in nearly all cases, running tables against a
couple dozen domain admin hashes will always result in a huge time savings.
…--
Joseph S. Testa II
Founder & Principal Security Consultant
Positron Security
|
|
Well it completed - cracked 25 of them, which is not too bad at all as the 350 were what was left uncracked after extensive dictionary/rules and masks attacks. Fantastic - thank you very much for all your help. |
|
Sure thing!
…On 10/3/20 8:35 AM, chriswcohen wrote:
Well it completed - cracked 25 of them, which is not too bad at all as
the 350 were what was left uncracked after extensive dictionary/rules
and masks attacks. Fantastic - thank you very much for all your help.
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
<#23 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAWYA67Y6O76JMD2SMRYDKLSI4K7NANCNFSM4SADEUVA>.
--
Joseph S. Testa II
Founder & Principal Security Consultant
Positron Security
|
Hi, I've the following two Devices being seen in my laptop:
Device #0:
Vendor: NVIDIA Corporation
Name: GeForce GTX 1650
Version: OpenCL 1.2 CUDA
Driver: 419.71
Max compute units: 16
Max work group size: 1024
Global memory size: 4294967296
Device #1:
Vendor: Intel(R) Corporation
Name: Intel(R) UHD Graphics 630
Version: OpenCL 2.1 NEO
Driver: 26.20.100.7985
Max compute units: 24
Max work group size: 256
Global memory size: 13626322944
When I run crackalack_lookup over a file containing multiple hashes, each precomutation it reports to takes 3 minutes.
Looking at my Task Manager I can see that my Internal Graphics card "Intel(R) UHD Graphics 630" is maxed out at 100%, with blips down between precomputations, while my GTX 1650 is sitting idle.
The same appears to happen after precomputation, when I use just one hash and it's searching the tables the internal GPU is spiking regularly, which the GTX 1650 appears not to be doing anything.
Any help to get the program to favor the better of the two graphic devices would be appreciated. Thanks in advance.
The text was updated successfully, but these errors were encountered: