rar2john producing 6.8gb hash file

[slugger]

So yesterday I was battling to compile john but with that out of the way the rar file that I need to crack is doing some funny things.

When running 'rar2john rarfile.rar > rarfile.hash' : rarfile.hash is bigger than the rarfile.rar. 6.8gb big. rarfile.rar contains a textfile with no data in (0kb) and another file (+-3gb).

When running 'rar2john test.rar > test.hash': it produces one line with a hash that john can use and start cracking. test.hash contains a text file with no data in (0kb) and a text file with some data in.

I thought it could be the 0kb text file seeing as the crc will always match when extracting it and any password will be able to extract it. But that does not seem to be it seeing as test.hash contains a single hash.

Any ideas?

[digininja]

I would expect small files with just hashes in so the second example makes sense. Have you tried other files? Try something a few meg in size and see what that creates.

 

It could be a bug with the convertor, they may not have anticipated files so large as input so you may be overflowing something.

[slugger]

Compressed a song and produced the same result as the test I did.

Could it be that the big file is a disk image (.iso) (well soo i presume I only know what is in it from the file list)

[digininja]

Best asking on their mailing list. I've had a few interactions with it and they've always been helpful.

[slugger]

Will do and get back to the forum when its solved