[<prev] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20251108201246.GA25211@openwall.com>
Date: Sat, 8 Nov 2025 21:12:46 +0100
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: 2 questions about cracking 233 million NTLM passwords
Hi Jeff,
On Sat, Nov 08, 2025 at 07:10:30AM -0800, jeff wrote:
> I am cracking a lot of NTLM passwords.
> I am using a windows 11 machine with 64 cores and 256gb of ram.
> I am using a version of john compiled in 2025,
> john_jumbo_2025_winX64_1_JtR.7z
>
> I am using the --fork option. I am currently running 14 threads, due to
> limited memory.
> Each fork process uses about 16gb of ram.
> Is there any way to reduce the memory usage, so I can run more threads?
As I suggested in:
https://www.openwall.com/lists/john-users/2025/06/10/1
you could try the --keep-guessing option, so that the processes share
more of the memory between each other. You will get some duplicates in
the pot file, which you'll then probably want to de-dupe separately
(e.g., with the bundled "unique" program), but it may be an acceptable
price to pay for being able to use all CPU cores earlier.
I am not entirely sure this will help on Windows, though. It depends on
how exactly fork() is emulated.
Also, you could use --format=nt-opencl, on GPU or on CPU, instead of
--fork. You'll need to have an appropriate OpenCL backend installed and
you'll need to use --mask, as I previously explained in:
https://www.openwall.com/lists/john-users/2024/11/17/1
> I have a basic understanding of how john works.
> A candidate hash is generated, and then compared to the list of unknown
> hashes.
> I suspect that john may sort the list of unknown hashes.
> For a small list of unknown hashes, I would guess that a linear search
> would be efficient.
> However, with a large number of unknown hashes (like 233 million) I
> would guess that
> something like a binary search would be far faster.
> I was wondering if john does use a binary search comparing a candidate
> hash against
> the list of unknown hashes?
Please see this slide (and the rest of the presentation):
https://www.openwall.com/presentations/OffensiveCon2024-Password-Cracking/slide-24.html
In your current usage, a sparse bitmap is used first, followed by a
(regular) hash table. With --format=nt-opencl, a perfect hash table is
used. These algorithms are generally quicker than a binary search, but
they require more memory.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
