Known pitfalls and edge cases. Referenced from AGENTS.md.
- Hashcat
event_log_warningandevent_log_advicego to stdout, not stderr -- onlyevent_log_errorgoes to stderr. Hash parse errors are warnings, so they appear on stdout. --status-jsononly structures the periodic status display -- errors/warnings remain plain text regardless of output mode.- v7.x changed per-hash error prefix from
Hashfile '...'toHash parsing error in hashfile: '...'-- patterns must match both. - Machine-readable error format (
<file>:<line>:<hash>:<error>) uses colons as delimiters, but many hash types also contain colons. Regex uses non-greedy(.+?)for the file path capture.
unsafe_codeis forbidden -- nounsafeblocks allowed anywhere.unwrap_usedis denied -- use?withanyhow/thiserror, or handle the error explicitly.panicis denied -- usebail!or returnErrinstead.expect_usedis warned -- prefercontext()from anyhow.
- Resources (wordlists, masklists, rulelists) can exceed 100 GB. All download pipelines stream to disk -- never buffer fully in memory.
- Use atomic writes (temp file +
fs::rename) for crash safety on large downloads.
- Hashcat session file location varies by OS:
~/.local/share/hashcat/sessions/(Linux),~/.hashcat/sessions/(legacy), or next to the binary (Windows). os.Symlinkequivalents require elevated privileges on Windows -- test helpers should skip symlink tests on Windows.
- Hashcat negative exit codes (e.g., -11) arrive as unsigned 8-bit on Unix (e.g., 245).
normalize_exit_codeinhashcat/exit_code.rsconverts 245-255 back to -11 through -1 before classification.