Bug#856932: hashcat dependency problem

[Philipp]

Package: hashcat
Version: 3.30-1
Severity: normal

Dear Maintainer,

Firstly, I just want to let you know that I already tried to contact some
Kali/Debian developers privately (via mail, for instance the dev rhertzog
which seems to be active and somehow related to this package) about this
"problem", but for some reason I didn't get a single reply. Maybe it is not
the correct way to contact somebody via mail about some package issues and
therefore I was just ignored or (also possible) all of the @hashcat.net mails
were blocked/flagged for some unknown reasons.

I hope this official bug report will reach someone and get more replies than I
got with my previous attempts.

Secondly, I really appreciate the work of the maintainers and that there is now
a "hashcat" package such that the user can install hashcat as simple as
"apt-get install hashcat".

I recently tried to use the hashcat package together with Debian (and Kali) and
I want to give you a little feedback and my experience with getting the
"hashcat" package to run properly.

This is why I first tried to communicate with some maintainers privately
because it first seemed that we should discuss this a little bit and we can't
really call this a bug/issue yet ... therefore I first just wanted to know what
you thought about my experience. Currently I think it is worth a bug report
since we get several problem reports regarding this exact problem.

The main reason why I, a hashcat contributor/project member, tried hashcat on
Kali is that we get a lot of user reports on forum/irc/github saying "hashcat
doesn't work on Kali" or something like this.

The users most of the time get one of these error messages:
"clGetDeviceIDs(): CL_DEVICE_NOT_FOUND",
"clBuildProgram(): CL_BUILD_PROGRAM_FAILURE" etc
... even though the hardware is perfectly supported by both hashcat and the
vendor's driver.

This is, for what I've seen until now, also the main cause of most of the
problems which the users experience, i.e. that the dependency list of the
"hashcat" package incorrectly marks the Mesa driver as a dependency for hashcat.

In our experience, Mesa might work as a general driver replacement for the
proprietary drivers in case the user just uses his "desktop" normally, but not
if it comes to running highly-optimized OpenCL code. Mesa even fails to compile
the smallest/easiest GPU kernels, let alone the performance drop if it manages
to compile a standard OpenCL kernel (and the false negatives/bugs). It comes
with a huge speed drop and the user might get a completely wrong picture about
the speeds in regards to hash cracking with hashcat.


In fact, when you start hashcat 3.40 (which was recently released, you might
consider updating the "hashcat" package to 3.40!?) it will display an unmissable
red warning when Mesa is installed
https://github.com/hashcat/hashcat/commit/aa5ed1ca89b0599cfa4a1cfa3539d56dfeeba79a
For good reasons.


My steps:

I decided to download the current stable ISO of Kali from
https://www.kali.org/downloads/
and started a completely fresh install (on physical disk, not virtual machine,
just to be sure). My setup for this test is 1 x NVidia GTX 980ti.

The good thing is that hashcat is pre-installed on Kali Linux, the bad thing is
that (I would say) it currently doesn't work at all!

Furthermore, it is very tedious to get it running properly, at the end it would
be easier to just download the nvidia driver from nvidia.com and hashcat from
hashcat.net. But... that doesn't help much... for the nvidia driver we also need
the Linux headers corresponding to the currently used kernel. It seems Kali
Linux just doesn't provide Linux kernel headers... expect for one single kernel
version and this kernel version is neither the default one, nor is it guaranteed
that it will be correctly updated/loaded with Grub etc. It's a mess, you see.

At the end of the day, a normal Kali user will (and they do, we know that for a
fact!) just give up and say:
"hashcat doesn't work at all. hashcat please fix this!!!" (and yeah, hashcat
isn't really responsible for this, it's the wrong dependencies all over the
place, starting with the hashcat package, but also the nvidia-driver package -
the incorrect dependency on the (virtual) kernel header version etc).

This is how I finally got hashcat to run properly - with a list of as little
steps as possible (it just shows the main problem, not really what a user will
try to mess around) - (the howto guide):

# sha1sum kali-linux-2016.2-amd64.iso
25cc6d53a8bd8886fcb468eb4fbb4cdfac895c65  kali-linux-2016.2-amd64.iso
# # start the "Graphical installation" with CD, after that:
# hashcat -b
# # got the "clBuildProgram(): CL_BUILD_PROGRAM_FAILURE" error, only Mesa seems
# # to be loaded
# apt-get update
# apt-get dist-upgrade
# apt-get autoremove
# reboot

# hashcat -b
# # still not working (this is the time when most of the unexperienced users
# # just blame hashcat and give up!)

# # make sure that kernel 4.9.0-kali2-amd64 is loaded because we need the kernel
# # headers!
# # (4.6.0-kali1-amd64 (default) is not working)
# # make sure kernel 4.9.0-kali2-amd64 is installed
# # update-grub and make sure that the "correct" kernel is selected with grub!
# # (this is not guaranteed unfortunately)
# reboot

# # after several tries finally the "correct"??? kernel was loaded
# # (uname -r saying "4.9.0-kali2-amd64")

# apt-get install nvidia-driver     # this seems to correctly/automatically
# # install the kernel headers, but it only compiles the modules if the
# # "correct kernel" is running
# apt-get install nvidia-opencl-icd # an additional dependency that should be
# # listed by default for the "hashcat" package (besides the corresponding AMD,
# # Intel alternatives)
# reboot # such that the nvidia modules loads correctly

# # after reboot, I saw hashcat working for the first time! Hurray!
# # (but this was very tedious and time consuming)
# hashcat -b

As you can see, the main problem here was that the pre-installed "hashcat"
package (it's actually very nice that it is pre-installed, don't get me wrong
here) didn't work at all without messing around with kernel versions, kernel
headers, finding the missing packages, nvidia driver installation, ICD
installation and a lot of tries-and-errors (before I came up with this guide).

Another question that came up is why do the Kali repositories do not have all
the kernel header packages for all (older and current) kernel versions?
If I run kernel 4.6 I should be able to install the kernel headers for kernel
4.6, if I have the image 4.9.0-kali1-amd64 I should be able to install the
headers for 4.9.0-kali1-amd64.
It seems that the only kernel headers that are currently present are the ones
shipped by 4.9.0-kali2-amd64 and you first have to switch kernel versions and
make sure to load the correct kernel etc. I don't understand why!? It's a mess
and we can't say to the users "hashcat doesn't work because you use the wrong
kernel" (that sounds so wrong, hashcat nor nvidia/AMD drivers have any
limitation like this, as far as I can tell).
If it is the case that you can't ship more kernel headers than the one for
4.9.0-kali2-amd64, than you need to fix all the dependencies to point to kernel
image 4.9.0-kali2-amd64, otherwise installation of the nvidia-driver silently
fails etc etc etc.

We also see many users struggling with this problem a lot. Some end up with
systems that are unbootable, black screens, others struggle with uninstalling
Mesa completely (which I didn't even attempted above, since that would probably
mean that hashcat would be uninstalled because of wrong dependencies), etc etc

I also tested a newer version of Kali (weekly build #8 of 2017) and experienced
almost exactly the same problems (I just wanted to make sure that it's not
related to some "old versions").

This is the guide I came up with:

# sha1sum kali-linux-2017-W08-amd64.iso
1416e96300c719b03b064aff252f5b2e23c5905f  kali-linux-2017-W08-amd64.iso
# apt-get update
# apt-get dist-upgrade
# apt-get autoremove
# reboot

# make sure that kernel 4.9.0-kali2-amd64 is loaded !
# # (4.9.0-kali1-amd64 (default) is not working)
# reboot

# apt-get install nvidia-driver
# apt-get install nvidia-opencl-icd
# reboot # such that the nvidia modules loads correctly

The same might be true for AMD GPUs (with firmware-amd-graphics?).

I did not yet test how easy/difficult it is to get Kali to run hashcat with AMD
GPUs (proprietary driver) since I first wanted to know how much Kali/Debian is
interested to coordinate and find a good solution for the NVidia problem (first).

Additionally, since both NVidia hardware and drivers currently are the better
choice if it comes to hash cracking with hashcat (whenever we compare NVidia to
AMD), the focus of hashcat (currently) is on NVidia graphic cards. This is also
why most of the hashcat's users have new NVidia cards (gtx 980, gtx 980ti, gtx
1080, gtx 1080 ti soon ;) ) and it would be great if hashcat just works
out-of-the-box (or at least with very little need for the user to mess around
the whole system to get it running).

What do you think can be done to resolve these difficulties a Debian/Kali Linux
user faces when he tries to "just run hashcat"? Can we somehow improve the
dependencies and overall reach an user-friendlier install process? It's good
that hashcat is pre-installed, but it is currently not working at all
by-default, because of this incorrect Mesa-dependencies etc.

I am sure there might be some very clever/intuitive solutions to this problem.
Maybe with a wrapper, first-run script or something similar, such that hashcat
can still be pre-installed. I'm not sure what the best option is because I'm not
totally familiar how something like this is normally handled (but I guess there
might exist a lot of projects/packages out there that depend on alternative
packages and a package selection mechanism that depends heavily on the hardware
of the user).

Hashcat developers, including but not limited to atom (the main author), epixoip
(a very active member/contributor/moderator which seems to grasp packages/debs
dependencies and how one should create packages much better than me. Yeah, he
even builds/maintains his own repositories/packages) an myself (philsmd), are
happy to discuss a possible solution for this issue (preferably on #hashcat IRC
- freenode - given that emails seem to not always reach the target or do not get
answered).

Thank you very much
Philipp

-- System Information:
Distributor ID:	Kali
Description:	Kali GNU/Linux Rolling
Release:	kali-rolling
Codename:	kali-rolling
Architecture: x86_64

Kernel: Linux 4.9.0-kali2-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages hashcat depends on:
ii  hashcat-data                    3.30-1
ii  libc6                           2.24-9
ii  mesa-opencl-icd [opencl-icd]    13.0.5-1
ii  nvidia-opencl-icd [opencl-icd]  375.39-1

hashcat recommends no packages.

hashcat suggests no packages.

-- no debconf information