Native format of Hashcat password "recovery" utility.
A sample of file for testing can be downloaded from https://web.archive.org/web/20150220013635if_/http://hashcat.net:80/misc/example_hashes/hashcat.hccap
This page hosts a formal specification of Hashcat capture file (old version) using Kaitai Struct. This specification can be automatically translated into a variety of programming languages to get a parsing library.
import kaitai_struct_nim_runtime
import options
type
Hccap* = ref object of KaitaiStruct
`records`*: seq[Hccap_HccapRecord]
`parent`*: KaitaiStruct
Hccap_HccapRecord* = ref object of KaitaiStruct
`essid`*: seq[byte]
`macAp`*: seq[byte]
`macStation`*: seq[byte]
`nonceStation`*: seq[byte]
`nonceAp`*: seq[byte]
`eapolBuffer`*: Hccap_EapolDummy
`lenEapol`*: uint32
`keyver`*: uint32
`keymic`*: seq[byte]
`parent`*: Hccap
`rawEapolBuffer`*: seq[byte]
`eapolInst`: seq[byte]
`eapolInstFlag`: bool
Hccap_EapolDummy* = ref object of KaitaiStruct
`parent`*: Hccap_HccapRecord
proc read*(_: typedesc[Hccap], io: KaitaiStream, root: KaitaiStruct, parent: KaitaiStruct): Hccap
proc read*(_: typedesc[Hccap_HccapRecord], io: KaitaiStream, root: KaitaiStruct, parent: Hccap): Hccap_HccapRecord
proc read*(_: typedesc[Hccap_EapolDummy], io: KaitaiStream, root: KaitaiStruct, parent: Hccap_HccapRecord): Hccap_EapolDummy
proc eapol*(this: Hccap_HccapRecord): seq[byte]
##[
Native format of Hashcat password "recovery" utility.
A sample of file for testing can be downloaded from
<https://web.archive.org/web/20150220013635if_/http://hashcat.net:80/misc/example_hashes/hashcat.hccap>
@see <a href="https://hashcat.net/wiki/doku.php?id=hccap">Source</a>
]##
proc read*(_: typedesc[Hccap], io: KaitaiStream, root: KaitaiStruct, parent: KaitaiStruct): Hccap =
template this: untyped = result
this = new(Hccap)
let root = if root == nil: cast[Hccap](this) else: cast[Hccap](root)
this.io = io
this.root = root
this.parent = parent
block:
var i: int
while not this.io.isEof:
let it = Hccap_HccapRecord.read(this.io, this.root, this)
this.records.add(it)
inc i
proc fromFile*(_: typedesc[Hccap], filename: string): Hccap =
Hccap.read(newKaitaiFileStream(filename), nil, nil)
proc read*(_: typedesc[Hccap_HccapRecord], io: KaitaiStream, root: KaitaiStruct, parent: Hccap): Hccap_HccapRecord =
template this: untyped = result
this = new(Hccap_HccapRecord)
let root = if root == nil: cast[Hccap](this) else: cast[Hccap](root)
this.io = io
this.root = root
this.parent = parent
let essidExpr = this.io.readBytes(int(36))
this.essid = essidExpr
##[
The BSSID (MAC address) of the access point
]##
let macApExpr = this.io.readBytes(int(6))
this.macAp = macApExpr
##[
The MAC address of a client connecting to the access point
]##
let macStationExpr = this.io.readBytes(int(6))
this.macStation = macStationExpr
##[
Nonce (random salt) generated by the client connecting to the access point.
]##
let nonceStationExpr = this.io.readBytes(int(32))
this.nonceStation = nonceStationExpr
##[
Nonce (random salt) generated by the access point.
]##
let nonceApExpr = this.io.readBytes(int(32))
this.nonceAp = nonceApExpr
##[
Buffer for EAPOL data, only first `len_eapol` bytes are used
]##
let rawEapolBufferExpr = this.io.readBytes(int(256))
this.rawEapolBuffer = rawEapolBufferExpr
let rawEapolBufferIo = newKaitaiStream(rawEapolBufferExpr)
let eapolBufferExpr = Hccap_EapolDummy.read(rawEapolBufferIo, this.root, this)
this.eapolBuffer = eapolBufferExpr
##[
Size of EAPOL data
]##
let lenEapolExpr = this.io.readU4le()
this.lenEapol = lenEapolExpr
##[
The flag used to distinguish WPA from WPA2 ciphers. Value of
1 means WPA, other - WPA2.
]##
let keyverExpr = this.io.readU4le()
this.keyver = keyverExpr
##[
The final hash value. MD5 for WPA and SHA-1 for WPA2
(truncated to 128 bit).
]##
let keymicExpr = this.io.readBytes(int(16))
this.keymic = keymicExpr
proc eapol(this: Hccap_HccapRecord): seq[byte] =
if this.eapolInstFlag:
return this.eapolInst
let io = this.eapolBuffer.io
let pos = io.pos()
io.seek(int(0))
let eapolInstExpr = io.readBytes(int(this.lenEapol))
this.eapolInst = eapolInstExpr
io.seek(pos)
this.eapolInstFlag = true
return this.eapolInst
proc fromFile*(_: typedesc[Hccap_HccapRecord], filename: string): Hccap_HccapRecord =
Hccap_HccapRecord.read(newKaitaiFileStream(filename), nil, nil)
proc read*(_: typedesc[Hccap_EapolDummy], io: KaitaiStream, root: KaitaiStruct, parent: Hccap_HccapRecord): Hccap_EapolDummy =
template this: untyped = result
this = new(Hccap_EapolDummy)
let root = if root == nil: cast[Hccap](this) else: cast[Hccap](root)
this.io = io
this.root = root
this.parent = parent
proc fromFile*(_: typedesc[Hccap_EapolDummy], filename: string): Hccap_EapolDummy =
Hccap_EapolDummy.read(newKaitaiFileStream(filename), nil, nil)