From 53b99d4395248b0ca2ebc6760ff62b4584ae23d5 Mon Sep 17 00:00:00 2001
From: Justin Bollinger <justin.bollinger@trustedsec.com>
Date: Wed, 18 Mar 2026 20:16:42 -0400
Subject: [PATCH] fix: use raw LZMA2 stream instead of XZ container for hcstat2
 compression

hashcat's Lzma2Decode() expects a raw LZMA2 stream starting with 0xff chunk
headers, not an XZ container format (0xfd 37 7a...). FORMAT_RAW with
FILTER_LZMA2 produces the correct format.
---
 hate_crack/main.py | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/hate_crack/main.py b/hate_crack/main.py
index 947bdf9..e36bc14 100755
--- a/hate_crack/main.py
+++ b/hate_crack/main.py
@@ -2126,8 +2126,12 @@ def hcatMarkovTrain(source_file, hcatHashFile):
     try:
         with open(hcstat2_path, "rb") as f_in:
             uncompressed_data = f_in.read()
-        # Use XZ format which is LZMA2-based
-        compressed_data = lzma.compress(uncompressed_data, format=lzma.FORMAT_XZ, preset=9)
+        # Use raw LZMA2 stream (not XZ container) - hashcat decodes with Lzma2Decode()
+        compressed_data = lzma.compress(
+            uncompressed_data,
+            format=lzma.FORMAT_RAW,
+            filters=[{"id": lzma.FILTER_LZMA2, "preset": 9}],
+        )
         with open(hcstat2_path, "wb") as f_out:
             f_out.write(compressed_data)
     except Exception as e: