hashcat

Overview ¶

Package hashcat builds hashcat-crackable hash lines natively, in pure Go.

Wrap-vs-native judgement ¶

Native. The canonical pcap → .hc22000 converter in the ecosystem is hcxpcapngtool (hcxtools), a separate C binary the marauder_handoff_hashcat tool shells out to. The hashcat mode-22000 LINE FORMAT, however, is a short, fully-documented, deterministic text layout — a "*"-delimited record — that needs no external binary to assemble once the operator holds the fields. Reimplementing the PMKID-line format natively removes a third-party dependency for the clientless-PMKID case (the dominant modern WPA2 capture): given the PMKID and the two MACs + ESSID an operator already has (from wifi_eapol_decode, a Marauder sniffpmkid run, or a Proxmark-style capture), it emits the ready-to-crack line offline.

Correctness is anchored on hashcat's own published example hash for mode 22000 (the ESSID field decodes to the ASCII "hashcat-essid", a strong self-consistency check that the example is reproduced exactly).

Covered ¶

• PMKID lines (message type 01): WPA*01*PMKID*AP_MAC*STA_MAC*ESSID***.

Deliberately deferred ¶

• EAPOL 4-way-handshake lines (type 02) require extracting the MIC, nonces, the EAPOL frame bytes, and computing the message-pair byte from a capture — that capture-parsing step is what hcxpcapngtool does and is a separate, larger native-pcapng effort; without a reference vector for those fields it is not added here (a wrong line is worse than none).