hashgen.go

package main

import (
	"bufio"
	"bytes"
	"crypto/hmac"
	"crypto/md5"
	"crypto/rand"
	"crypto/sha1"
	"crypto/sha256"
	"crypto/sha512"
	"encoding/base32"
	"encoding/base64"
	"encoding/binary"
	"encoding/hex"
	"flag"
	"fmt"
	"hash/crc32"
	"hash/crc64"
	"io"
	"log"
	"math/bits"
	"os"
	"runtime"
	"sync"
	"sync/atomic"
	"time"
	"unicode/utf16"
	"unicode/utf8"

	"github.com/cyclone-github/base58"
	"github.com/cyclone-github/md6"
	"github.com/ebfe/keccak" // keccak 224/384
	"github.com/emmansun/gmsm/sm3"
	"github.com/openwall/yescrypt-go"
	"github.com/tarantool/go-gostcrypto/streebog"
	"golang.org/x/crypto/argon2"
	"golang.org/x/crypto/bcrypt"
	"golang.org/x/crypto/blake2b"
	"golang.org/x/crypto/blake2s"
	"golang.org/x/crypto/md4"
	"golang.org/x/crypto/pbkdf2"
	"golang.org/x/crypto/ripemd160"
	"golang.org/x/crypto/scrypt"
	"golang.org/x/crypto/sha3"
)

/*
hashgen is a CLI hash generator which can be cross-compiled for Linux, Raspberry Pi, Windows & Mac
https://github.com/cyclone-github/hashgen
written by cyclone

GNU General Public License v2.0
https://github.com/cyclone-github/hashgen/blob/main/LICENSE

full changelog
https://github.com/cyclone-github/hashgen/blob/main/CHANGELOG.md

latest changelog
v1.3.0; 2026-04-11
	added scrypt mode: -m 8900
	added PBKDF2 modes: -m 10900, 11900, 12000, 12100
	added BLAKE2 modes: -m 600, 610, 620, 31000, 34800, 34810, 34820, 33300
	added HMAC modes: -m 50, 60, 150, 160, 1450, 1460, 1750, 1760, 6050, 6060
	added UTF-16LE modes: -m 30, 40, 70, 130, 140, 170, 1430, 1440, 1470, 1730, 1740, 1770
	optimized salt RNG for fewer syscalls on salted hash modes
	added sanity check on invalid -m mode before opening stdin/wordlist
	compiled with Go v1.26.2
v1.3.1; 2026-04-13
	add modes: MD6-128, MD6-224, MD6-256, MD6-384, MD6-512
v1.3.2; 2026-08-18
	add mode: gost-yescrypt
	add mode: SSHA -m 111
	add mode: sha1crypt -m 15100
	add mode: sm3crypt -m 35100
	add mode: cmiyc (KoreLogic CMIYC 2026 contest algorithm)
	add modes: Streebog/GOST 2012 -m 11700, 11750, 11760, 11800, 11850, 11860
	add modes: SHA-384 UTF-16LE -m 10830, 10840, 10870
	add modes: LDAP SHA/SSHA -m 101, 1411, 1711
	add modes: -m 3500, 4300, 4400, 4700, 18500, 18501, 20800, 32800, 34400, 34500, 35900
	refactor modes: -m 2600 and 4500
	add bcrypt prehash modes: -m 25600, 25800, 28400, 30600
	add hashcat alias: wpbcrypt -m 35500
*/

func versionFunc() {
	fmt.Fprintln(os.Stderr, "hashgen v1.3.2; 2026-08-18\nhttps://github.com/cyclone-github/hashgen")
}

// help function
func helpFunc() {
	versionFunc()
	str := "\nExample Usage:\n" +
		"\n./hashgen -m md5 -w wordlist.txt -o output.txt\n" +
		"./hashgen -m bcrypt -cost 8 -w wordlist.txt\n" +
		"./hashgen -m 10900 -i 2000 -w wordlist.txt\n" +
		"cat wordlist | ./hashgen -m md5 -hashplain\n" +
		"\nAll Supported Options:\n-m {mode}\n-w {wordlist input}\n-t {cpu threads}\n-o {wordlist output}\n-b {benchmark mode}\n-cost {bcrypt only; default 10}\n-i {PBKDF2 iterations for 10900-12100; 0 means 1000; invalid with other modes}\n-hashplain {hash:plain output}\n-help {this text}\n-version {version string}\n" +
		"\nIf -w is not specified, defaults to stdin\n" +
		"If -o is not specified, defaults to stdout\n" +
		"If -t is not specified, defaults to max available CPU threads\n" +
		"\nModes:\t\t\tHashcat Mode (notes):\n" +
		"plaintext/dehex		99999 (decode $HEX[])\n" +
		"hex			(encode to $HEX[])\n" +
		"base32decode\n" +
		"base32encode\n" +
		"base58decode\n" +
		"base58encode\n" +
		"base64decode\n" +
		"base64encode\n" +
		"morsecode		(ITU-R M.1677-1)\n" +
		"morsedecode		(ITU-R M.1677-1)\n" +
		"\n" +
		"crc32\n" +
		"11500			(CRC32 Hashcat format)\n" +
		"crc64\n" +
		"\n" +
		"md4			900\n" +
		"md5			0\n" +
		"halfmd5			5100\n" +
		"md5passsalt		10\n" +
		"md5saltpass		20\n" +
		"md5utf16passsalt	30\n" +
		"md5utf16saltpass	40\n" +
		"hmacmd5pass		50\n" +
		"hmacmd5salt		60\n" +
		"md5utf16le		70\n" +
		"md5md5			2600\n" +
		"3500			(md5(md5(md5($pass))))\n" +
		"4300			(md5(strtoupper(md5($pass))))\n" +
		"4400			(md5(sha1($pass)))\n" +
		"32800			(md5(sha1(md5($pass))))\n" +
		"\n" +
		"md6128\n" +
		"md6224\n" +
		"md6256			34600\n" +
		"md6384\n" +
		"md6512\n" +
		"\n" +
		"sha1			100\n" +
		"ldapsha			101 (Netscape LDAP {SHA})\n" +
		"sha1passsalt		110\n" +
		"ssha			111 (NSLDAPS SSHA-1)\n" +
		"sha1saltpass		120\n" +
		"sha1utf16passsalt	130\n" +
		"sha1utf16saltpass	140\n" +
		"hmacsha1pass		150\n" +
		"hmacsha1salt		160\n" +
		"sha1utf16le		170\n" +
		"sha1sha1		4500\n" +
		"4700			(sha1(md5($pass)))\n" +
		"18500			(sha1(md5(md5($pass))))\n" +
		"18501			(sha1(md5(sha1($pass))))\n" +
		"\n" +
		"sha224			1300\n" +
		"sha224passsalt		1310\n" +
		"sha224saltpass		1320\n" +
		"34400			(sha224(sha224($pass)))\n" +
		"34500			(sha224(sha1($pass)))\n" +
		"sha256			1400\n" +
		"sha256passsalt		1410\n" +
		"ssha256			1411 (LDAP {SSHA256})\n" +
		"sha256saltpass		1420\n" +
		"sha256utf16passsalt	1430\n" +
		"sha256utf16saltpass	1440\n" +
		"hmacsha256pass		1450\n" +
		"hmacsha256salt		1460\n" +
		"sha256utf16le		1470\n" +
		"20800			(sha256(md5($pass)))\n" +
		"35900			(sha256(sha1($pass)))\n" +
		"sha384			10800\n" +
		"sha384passsalt		10810\n" +
		"sha384saltpass		10820\n" +
		"sha384utf16passsalt	10830\n" +
		"sha384utf16saltpass	10840\n" +
		"sha384utf16le		10870\n" +
		"sha512			1700\n" +
		"sha512passsalt		1710\n" +
		"ssha512			1711 (LDAP {SSHA512})\n" +
		"sha512saltpass		1720\n" +
		"sha512utf16passsalt	1730\n" +
		"sha512utf16saltpass	1740\n" +
		"hmacsha512pass		1750\n" +
		"hmacsha512salt		1760\n" +
		"sha512utf16le		1770\n" +
		"sha512224\n" +
		"sha512256\n" +
		"\n" +
		"sha3224			17300\n" +
		"sha3256			17400\n" +
		"sha3384			17500\n" +
		"sha3512			17600\n" +
		"\n" +
		"keccak224		17700\n" +
		"keccak256		17800\n" +
		"keccak384		17900\n" +
		"keccak512		18000\n" +
		"\n" +
		"blake2s256\n" +
		"31000			(BLAKE2s-256 $BLAKE2$ format)\n" +
		"hmacblake2spass		33300\n" +
		"blake2b256\n" +
		"34800			(BLAKE2b-256 $BLAKE2$ format)\n" +
		"blake2b256passsalt	34810\n" +
		"blake2b256saltpass	34820\n" +
		"blake2b384\n" +
		"blake2b512\n" +
		"600			(BLAKE2b-512 $BLAKE2$ format)\n" +
		"blake2b512passsalt	610\n" +
		"blake2b512saltpass	620\n" +
		"\n" +
		"ntlm			1000 (Windows NT)\n" +
		"mysql4/mysql5		300\n" +
		"ripemd160		6000\n" +
		"hmacripemd160pass	6050\n" +
		"hmacripemd160salt	6060\n" +
		"\n" +
		"streebog256		11700\n" +
		"hmacstreebog256pass	11750\n" +
		"hmacstreebog256salt	11760\n" +
		"streebog512		11800\n" +
		"hmacstreebog512pass	11850\n" +
		"hmacstreebog512salt	11860\n" +
		"\n" +
		"argon2id		34000\n" +
		"bcrypt			3200\n" +
		"bcryptmd5		25600\n" +
		"bcryptsha1		25800\n" +
		"bcryptsha512		28400\n" +
		"bcryptsha256		30600\n" +
		"wpbcrypt		35500 (WordPress bcrypt-HMAC-SHA384)\n" +
		"md5crypt		500 (Linux shadow $1$)\n" +
		"sha1crypt		15100 (NetBSD/Juniper SHA1 crypt)\n" +
		"sha256crypt		7400 (Linux shadow $5$)\n" +
		"sha512crypt		1800 (Linux shadow $6$)\n" +
		"sm3crypt		35100 (Unix $sm3$)\n" +
		"phpass/phpbb3		400 ($P$ / $H$)\n" +
		"scrypt			8900\n" +
		"pbkdf2sha256		10900\n" +
		"pbkdf2md5		11900\n" +
		"pbkdf2sha1		12000\n" +
		"pbkdf2sha512		12100\n" +
		"yescrypt		(Linux shadow $y$)\n" +
		"gostyescrypt		(Linux shadow $gy$)\n" +
		"cmiyc			(KoreLogic CMIYC 2026 contest algorithm)"
	fmt.Fprintln(os.Stderr, str)
	os.Exit(0)
}

var (
	cryptBase64 = []byte("./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz")
)

// pbkdf2 iteration count from -i for 10900-12100, default 1000
var pbkdf2IterCount = 1000

// set during -m probe so heavy modes return without hashing
var modeProbe bool

func isPBKDF2Mode(m string) bool {
	switch m {
	case "10900", "pbkdf2sha256", "pbkdf2-sha256", "11900", "pbkdf2md5", "pbkdf2-md5", "12000", "pbkdf2sha1", "pbkdf2-sha1", "12100", "pbkdf2sha512", "pbkdf2-sha512":
		return true
	default:
		return false
	}
}

// pooled scratch to batch crypto/rand reads
const cryptoRandChunk = 256

type cryptoRandBuf struct {
	b   [cryptoRandChunk]byte
	off int
}

// pool buffer starts drained so first read is real random not zeros
var cryptoRandPool = sync.Pool{
	New: func() any { return &cryptoRandBuf{off: cryptoRandChunk} },
}

// fill p from pooled crypto/rand, one buffer per call
func readRand(p []byte) bool {
	if len(p) == 0 {
		return true
	}
	buf := cryptoRandPool.Get().(*cryptoRandBuf)
	defer cryptoRandPool.Put(buf)
	for len(p) > 0 {
		if buf.off >= len(buf.b) {
			if _, err := rand.Read(buf.b[:]); err != nil {
				fmt.Fprintln(os.Stderr, "random read error:", err)
				return false
			}
			buf.off = 0
		}
		n := copy(p, buf.b[buf.off:])
		buf.off += n
		p = p[n:]
	}
	return true
}

// 8 random bytes as 16 hex chars into dst
func fillSaltHex8(dst []byte) bool {
	if len(dst) < 16 {
		return false
	}
	var raw [8]byte
	if !readRand(raw[:]) {
		return false
	}
	hex.Encode(dst, raw[:])
	return true
}

// utf-16le from utf-8 password, same validity rules as ntlm
func utf16LEPassStrict(data []byte) ([]byte, bool) {
	var rs []rune
	for i := 0; i < len(data); {
		r, sz := utf8.DecodeRune(data[i:])
		if r == utf8.RuneError && sz == 1 {
			return nil, false
		}
		if r >= 0xD800 && r <= 0xDFFF {
			return nil, false
		}
		rs = append(rs, r)
		i += sz
	}
	u16 := utf16.Encode(rs)
	out := make([]byte, 2*len(u16))
	for i, c := range u16 {
		out[2*i] = byte(c)
		out[2*i+1] = byte(c >> 8)
	}
	return out, true
}

// hash composition helpers return lowercase hex text for the next stage
func md5HexBytes(data []byte) [32]byte {
	sum := md5.Sum(data)
	var out [32]byte
	hex.Encode(out[:], sum[:])
	return out
}

func sha1HexBytes(data []byte) [40]byte {
	sum := sha1.Sum(data)
	var out [40]byte
	hex.Encode(out[:], sum[:])
	return out
}

func sha224HexBytes(data []byte) [56]byte {
	sum := sha256.Sum224(data)
	var out [56]byte
	hex.Encode(out[:], sum[:])
	return out
}

func sha256HexBytes(data []byte) [64]byte {
	sum := sha256.Sum256(data)
	var out [64]byte
	hex.Encode(out[:], sum[:])
	return out
}

func sha512HexBytes(data []byte) [128]byte {
	sum := sha512.Sum512(data)
	var out [128]byte
	hex.Encode(out[:], sum[:])
	return out
}

// LDAP SHA/SSHA family -m 101 / 111 / 1411 / 1711
func ldapSHA(password []byte, mode string, saltRaw []byte) string {
	if mode == "101" || mode == "ldapsha" || mode == "ldap-sha" {
		digest := sha1.Sum(password)
		return "{SHA}" + base64.StdEncoding.EncodeToString(digest[:])
	}

	salt := saltRaw
	if salt == nil {
		salt = make([]byte, 8)
		if !readRand(salt) {
			return ""
		}
	}

	var prefix string
	var digest []byte

	switch mode {
	case "111", "ssha":
		prefix = "{SSHA}"
		h := sha1.New()
		_, _ = h.Write(password)
		_, _ = h.Write(salt)
		digest = h.Sum(nil)
	case "1411", "ssha256":
		prefix = "{SSHA256}"
		h := sha256.New()
		_, _ = h.Write(password)
		_, _ = h.Write(salt)
		digest = h.Sum(nil)
	case "1711", "ssha512":
		prefix = "{SSHA512}"
		h := sha512.New()
		_, _ = h.Write(password)
		_, _ = h.Write(salt)
		digest = h.Sum(nil)
	default:
		return ""
	}

	payload := make([]byte, 0, len(digest)+len(salt))
	payload = append(payload, digest...)
	payload = append(payload, salt...)

	return prefix + base64.StdEncoding.EncodeToString(payload)
}

// sha384 UTF-16LE family -m 10830 / 10840 / 10870
func sha384UTF16(password []byte, mode string, saltRaw []byte) string {
	pwU16, ok := utf16LEPassStrict(password)
	if !ok {
		return ""
	}

	if mode == "10870" || mode == "sha384utf16le" {
		h := sha512.New384()
		h.Write(pwU16)
		return hex.EncodeToString(h.Sum(nil))
	}

	salt := saltRaw
	if salt == nil {
		salt = make([]byte, 16)
		if !fillSaltHex8(salt) {
			return ""
		}
	}

	h := sha512.New384()
	if mode == "10840" || mode == "sha384utf16saltpass" {
		h.Write(salt)
		h.Write(pwU16)
	} else {
		h.Write(pwU16)
		h.Write(salt)
	}

	sum := h.Sum(nil)
	out := make([]byte, 96+1+len(salt))
	hex.Encode(out[:96], sum)
	out[96] = ':'
	copy(out[97:], salt)
	return string(out)
}

// hashcat hmac line as hex(digest):salt
func hexMACLineDigest(digest []byte, salt []byte) string {
	n := hex.EncodedLen(len(digest))
	out := make([]byte, n+1+len(salt))
	hex.Encode(out[:n], digest)
	out[n] = ':'
	copy(out[n+1:], salt)
	return string(out)
}

// reverse digest byte order for hashcat big-endian Streebog modes
func reverseBytes(b []byte) {
	for i, j := 0, len(b)-1; i < j; i, j = i+1, j-1 {
		b[i], b[j] = b[j], b[i]
	}
}

// hashcat blake2s_hmac for mode 33300
func blake2sHMACHashcat(key, msg []byte) []byte {
	const block = 64
	var kpad [block]byte
	if len(key) > block {
		s := blake2s.Sum256(key)
		copy(kpad[:], s[:])
	} else {
		copy(kpad[:], key)
	}
	var ipadBlock, opadBlock [block]byte
	for i := 0; i < block; i++ {
		ipadBlock[i] = kpad[i] ^ 0x36
		opadBlock[i] = kpad[i] ^ 0x5c
	}
	ih, _ := blake2s.New256(nil)
	_, _ = ih.Write(ipadBlock[:])
	_, _ = ih.Write(msg)
	inner := ih.Sum(nil)
	oh, _ := blake2s.New256(nil)
	_, _ = oh.Write(opadBlock[:])
	_, _ = oh.Write(inner)
	return oh.Sum(nil)
}

// dehex wordlist line
/* note:
the checkForHex() function below gives a best effort in decoding all HEX strings and applies error correction when needed
if your wordlist contains HEX strings that resemble alphabet soup, don't be surprised if you find "garbage in" still means "garbage out"
the best way to fix HEX decoding issues is to correctly parse your wordlists so you don't end up with foobar HEX strings
if you have suggestions on how to better handle HEX decoding errors, contact me on github
*/
func checkForHex(line []byte) ([]byte, []byte, int) {
	// check if line is in $HEX[] format
	const prefix = "$HEX["
	if len(line) >= len(prefix) && bytes.HasPrefix(line, []byte(prefix)) {
		// attempt to correct improperly formatted $HEX[] entries
		// if it doesn't end with "]", add the missing bracket
		var hexErrorDetected int
		hasClose := bytes.HasSuffix(line, []byte("]"))
		if !hasClose {
			hexErrorDetected = 1 // mark as error since the format was corrected
		}

		// find first '[' and last ']'
		startIdx := bytes.IndexByte(line, '[')
		endIdx := bytes.LastIndexByte(line, ']')
		if endIdx == -1 {
			endIdx = len(line) // pretend ']' is at end
		}
		hexContent := line[startIdx+1 : endIdx]

		// decode hex content into bytes
		var decodedBytes []byte
		if n := len(hexContent); n > 0 && (n&1) == 0 {
			decodedBytes = make([]byte, n/2)
			if _, err := hex.Decode(decodedBytes, hexContent); err == nil {
				disp := make([]byte, 5+len(hexContent)+1) // "$HEX[" + hex + "]"
				copy(disp, prefix)
				copy(disp[5:], hexContent)
				disp[len(disp)-1] = ']'
				return decodedBytes, disp, hexErrorDetected
			}
			hexErrorDetected = 1
		} else {
			hexErrorDetected = 1
		}

		// error handling: remove invalid hex chars
		clean := make([]byte, 0, len(hexContent))
		for _, c := range hexContent {
			lc := c | 0x20
			if (c >= '0' && c <= '9') || (lc >= 'a' && lc <= 'f') {
				clean = append(clean, c)
			}
		}
		// if hex has an odd length, add a zero nibble to make it even
		if len(clean)%2 != 0 {
			clean = append([]byte{'0'}, clean...)
		}

		decodedBytes = make([]byte, len(clean)/2)
		if len(clean) == 0 || func() bool {
			_, err := hex.Decode(decodedBytes, clean)
			return err != nil
		}() {
			log.Printf("Error decoding $HEX[] content")
			// if decoding still fails, return original line as bytes
			disp := make([]byte, 5+len(hexContent)+1)
			copy(disp, prefix)
			copy(disp[5:], hexContent)
			disp[len(disp)-1] = ']'
			return line, disp, hexErrorDetected
		}

		// return decoded bytes and formatted hex content
		disp := make([]byte, 5+len(hexContent)+1)
		copy(disp, prefix)
		copy(disp[5:], hexContent)
		disp[len(disp)-1] = ']'
		return decodedBytes, disp, hexErrorDetected
	}
	// return original line as bytes if not in $HEX[] format
	return line, line, 0
}

// ITU-R M.1677-1 standard morse code mapping
// https://www.itu.int/dms_pubrec/itu-r/rec/m/R-REC-M.1677-1-200910-I!!PDF-E.pdf
// both upper and lowercase alpha were included due to using byte arrays for speed optimization
var morseCodeMap = map[byte]string{
	// lowercase alpha
	'a': ".-", 'b': "-...", 'c': "-.-.", 'd': "-..", 'e': ".",
	'f': "..-.", 'g': "--.", 'h': "....", 'i': "..", 'j': ".---",
	'k': "-.-", 'l': ".-..", 'm': "--", 'n': "-.", 'o': "---",
	'p': ".--.", 'q': "--.-", 'r': ".-.", 's': "...", 't': "-",
	'u': "..-", 'v': "...-", 'w': ".--", 'x': "-..-", 'y': "-.--",
	'z': "--..",
	// uppercase alpha
	'A': ".-", 'B': "-...", 'C': "-.-.", 'D': "-..", 'E': ".",
	'F': "..-.", 'G': "--.", 'H': "....", 'I': "..", 'J': ".---",
	'K': "-.-", 'L': ".-..", 'M': "--", 'N': "-.", 'O': "---",
	'P': ".--.", 'Q': "--.-", 'R': ".-.", 'S': "...", 'T': "-",
	'U': "..-", 'V': "...-", 'W': ".--", 'X': "-..-", 'Y': "-.--",
	'Z': "--..",
	// digits
	'0': "-----", '1': ".----", '2': "..---", '3': "...--", '4': "....-",
	'5': ".....", '6': "-....", '7': "--...", '8': "---..", '9': "----.",
	// special char
	'.': ".-.-.-", ',': "--..--", '?': "..--..", '\'': ".----.", '!': "-.-.--",
	'/': "-..-.", '(': "-.--.", ')': "-.--.-", '&': ".-...", ':': "---...",
	';': "-.-.-.", '=': "-...-", '+': ".-.-.", '-': "-....-", '_': "..--.-",
	'"': ".-..-.", '$': "...-..-", '@': ".--.-.", ' ': " ",
	// procedural signs were intentionally omitted
}

// encode byte slice to Morse Code
func encodeToMorseBytes(input []byte) []byte {
	var encoded bytes.Buffer
	for _, char := range input {
		if code, exists := morseCodeMap[char]; exists {
			encoded.WriteString(code)
			encoded.WriteByte(' ') // add space after each Morse Code sequence
		}
	}

	// remove trailing space
	result := encoded.Bytes()
	if len(result) > 0 && result[len(result)-1] == ' ' {
		return result[:len(result)-1]
	}
	return result
}

/*
decode Morse Code to bytes
rules:
- single space between codes -> next character
- 3 or more spaces           -> word separator (space - matches -m morsecode encoder style)
*/
func decodeMorseBytes(input []byte) []byte {
	var out bytes.Buffer
	var token bytes.Buffer
	spaces := 0

	flushToken := func() {
		if token.Len() == 0 {
			return
		}
		code := token.String()
		if ch, ok := morseDecodeMap[code]; ok {
			out.WriteByte(ch)
		}
		token.Reset()
	}

	for _, b := range input {
		if b == ' ' || b == '\t' {
			spaces++
			continue
		}

		// non-space
		if spaces > 0 {
			flushToken()
			if spaces >= 3 {
				out.WriteByte(' ') // word separator
			}
			spaces = 0
		}
		token.WriteByte(b)
	}

	flushToken()
	return out.Bytes()
}

// reverse lookup for Morse Code -> byte (prefer uppercase letters)
var morseDecodeMap = func() map[string]byte {
	m := make(map[string]byte)
	for ch, code := range morseCodeMap {
		if code == " " {
			continue
		}
		// store as uppercase
		up := ch
		if up >= 'a' && up <= 'z' {
			up -= 32
		}
		m[code] = up
	}
	return m
}()

// phpassMD5 -m 400
func phpassMD5(password []byte, mode string, countLog2 int, saltRaw []byte) string {
	prefix := byte('P')
	if mode == "phpbb3" {
		prefix = 'H'
	}
	if countLog2 <= 0 {
		countLog2 = 11
	}
	if len(saltRaw) < 6 {
		saltRaw = make([]byte, 6)
		if !readRand(saltRaw) {
			return ""
		}
	} else if len(saltRaw) > 6 {
		saltRaw = saltRaw[:6]
	}
	encode64 := func(src []byte, outLen int) []byte {
		dst := make([]byte, 0, outLen)
		for i := 0; i < len(src); {
			var v uint32 = uint32(src[i])
			i++
			dst = append(dst, cryptBase64[v&0x3f])
			if i < len(src) {
				v |= uint32(src[i]) << 8
			}
			dst = append(dst, cryptBase64[(v>>6)&0x3f])
			if i >= len(src) {
				break
			}
			i++
			if i < len(src) {
				v |= uint32(src[i]) << 16
			}
			dst = append(dst, cryptBase64[(v>>12)&0x3f])
			if i >= len(src) {
				break
			}
			i++
			dst = append(dst, cryptBase64[(v>>18)&0x3f])
			if len(dst) >= outLen {
				break
			}
		}
		if len(dst) > outLen {
			return dst[:outLen]
		}
		return dst
	}
	saltEnc := encode64(saltRaw, 8)
	h := md5.New()
	h.Write(saltEnc)
	h.Write(password)
	sum := h.Sum(nil)
	rounds := 1 << countLog2
	for i := 0; i < rounds; i++ {
		h.Reset()
		h.Write(sum)
		h.Write(password)
		sum = h.Sum(nil)
	}
	digestEnc := encode64(sum, 22)
	out := make([]byte, 3+1+8+22)
	out[0], out[1], out[2] = '$', prefix, '$'
	out[3] = cryptBase64[countLog2]
	copy(out[4:12], saltEnc)
	copy(out[12:], digestEnc)
	return string(out)
}

// md5crypt - Linux shadow "$1$<salt>$<hash>"
func md5crypt(password []byte) string {
	const magic = "$1$"
	salt := make([]byte, 8)
	rb := make([]byte, 8)
	if !readRand(rb) {
		for i := 0; i < 8; i++ {
			salt[i] = cryptBase64[(i*37+13)&0x3f]
		}
	} else {
		for i := 0; i < 8; i++ {
			salt[i] = cryptBase64[int(rb[i])&0x3f]
		}
	}

	a := md5.New()
	a.Write(password)
	a.Write([]byte(magic))
	a.Write(salt)

	alt := md5.New()
	alt.Write(password)
	alt.Write(salt)
	alt.Write(password)
	altSum := alt.Sum(nil)

	pwLen := len(password)
	for n := pwLen; n > 0; n -= 16 {
		if n > 16 {
			a.Write(altSum)
		} else {
			a.Write(altSum[:n])
		}
	}

	for n := pwLen; n > 0; n >>= 1 {
		if (n & 1) == 1 {
			a.Write([]byte{0})
		} else if pwLen > 0 {
			a.Write(password[:1])
		} else {
			a.Write([]byte{0})
		}
	}

	final := a.Sum(nil)

	for i := 0; i < 1000; i++ {
		ri := md5.New()
		if (i & 1) == 1 {
			ri.Write(password)
		} else {
			ri.Write(final)
		}
		if i%3 != 0 {
			ri.Write(salt)
		}
		if i%7 != 0 {
			ri.Write(password)
		}
		if (i & 1) == 1 {
			ri.Write(final)
		} else {
			ri.Write(password)
		}
		final = ri.Sum(nil)
	}

	out := make([]byte, 0, 3+1+8+1+22)
	out = append(out, magic...)
	out = append(out, salt...)
	out = append(out, '$')

	var v uint32

	v = uint32(final[0])<<16 | uint32(final[6])<<8 | uint32(final[12])
	for j := 0; j < 4; j++ {
		out = append(out, cryptBase64[v&0x3f])
		v >>= 6
	}

	v = uint32(final[1])<<16 | uint32(final[7])<<8 | uint32(final[13])
	for j := 0; j < 4; j++ {
		out = append(out, cryptBase64[v&0x3f])
		v >>= 6
	}

	v = uint32(final[2])<<16 | uint32(final[8])<<8 | uint32(final[14])
	for j := 0; j < 4; j++ {
		out = append(out, cryptBase64[v&0x3f])
		v >>= 6
	}

	v = uint32(final[3])<<16 | uint32(final[9])<<8 | uint32(final[15])
	for j := 0; j < 4; j++ {
		out = append(out, cryptBase64[v&0x3f])
		v >>= 6
	}

	v = uint32(final[4])<<16 | uint32(final[10])<<8 | uint32(final[5])
	for j := 0; j < 4; j++ {
		out = append(out, cryptBase64[v&0x3f])
		v >>= 6
	}

	v = uint32(0)<<16 | uint32(0)<<8 | uint32(final[11])
	for j := 0; j < 2; j++ {
		out = append(out, cryptBase64[v&0x3f])
		v >>= 6
	}

	return string(out)
}

// sha256crypt - Linux shadow $5$[rounds=R$]<salt>$<hash>
func sha256crypt(password []byte) string {
	const magic = "$5$"
	rounds := 5000
	salt := make([]byte, 16)
	rb := make([]byte, 16)
	if !readRand(rb) {
		for i := 0; i < 16; i++ {
			salt[i] = cryptBase64[(i*37+13)&0x3f]
		}
	} else {
		for i := 0; i < 16; i++ {
			salt[i] = cryptBase64[int(rb[i])&0x3f]
		}
	}

	a := sha256.New()
	a.Write(password)
	a.Write(salt)

	alt := sha256.New()
	alt.Write(password)
	alt.Write(salt)
	alt.Write(password)
	altSum := alt.Sum(nil)

	pwLen := len(password)
	for n := pwLen; n > 0; n -= 32 {
		if n > 32 {
			a.Write(altSum)
		} else {
			a.Write(altSum[:n])
		}
	}

	for n := pwLen; n > 0; n >>= 1 {
		if (n & 1) == 1 {
			a.Write(altSum)
		} else {
			a.Write(password)
		}
	}
	adigest := a.Sum(nil)

	dp := sha256.New()
	for i := 0; i < pwLen; i++ {
		dp.Write(password)
	}
	dpSum := dp.Sum(nil)
	P := make([]byte, pwLen)
	for i := 0; i < pwLen; i += 32 {
		end := i + 32
		if end > pwLen {
			end = pwLen
		}
		copy(P[i:end], dpSum[:end-i])
	}

	ds := sha256.New()
	for i := 0; i < 16+int(adigest[0]); i++ {
		ds.Write(salt)
	}
	dsSum := ds.Sum(nil)
	S := make([]byte, len(salt))
	copy(S, dsSum[:len(salt)])

	digest := adigest
	for i := 0; i < rounds; i++ {
		c := sha256.New()
		if (i & 1) == 1 {
			c.Write(P)
		} else {
			c.Write(digest)
		}
		if i%3 != 0 {
			c.Write(S)
		}
		if i%7 != 0 {
			c.Write(P)
		}
		if (i & 1) == 1 {
			c.Write(digest)
		} else {
			c.Write(P)
		}
		digest = c.Sum(nil)
	}

	out := make([]byte, 0, len(magic)+len(salt)+1+43)
	out = append(out, magic...)
	out = append(out, salt...)
	out = append(out, '$')

	enc := func(b2, b1, b0 byte, n int) {
		v := uint32(b2)<<16 | uint32(b1)<<8 | uint32(b0)
		for j := 0; j < n; j++ {
			out = append(out, cryptBase64[v&0x3f])
			v >>= 6
		}
	}

	enc(digest[0], digest[10], digest[20], 4)
	enc(digest[21], digest[1], digest[11], 4)
	enc(digest[12], digest[22], digest[2], 4)
	enc(digest[3], digest[13], digest[23], 4)
	enc(digest[24], digest[4], digest[14], 4)
	enc(digest[15], digest[25], digest[5], 4)
	enc(digest[6], digest[16], digest[26], 4)
	enc(digest[27], digest[7], digest[17], 4)
	enc(digest[18], digest[28], digest[8], 4)
	enc(digest[9], digest[19], digest[29], 4)
	enc(0, digest[31], digest[30], 3)

	return string(out)
}

// sha512crypt - Linux shadow ($6$)
func sha512crypt(password []byte) string {
	const magic = "$6$"
	const rounds = 5000
	salt := make([]byte, 16)
	{
		var rb [16]byte
		if !readRand(rb[:]) {
			return ""
		}
		for i := 0; i < 16; i++ {
			salt[i] = cryptBase64[rb[i]&0x3f]
		}
	}

	saltBytes := salt
	keyLen := len(password)
	saltLen := len(saltBytes)

	a := sha512.New()
	a.Write(password)
	a.Write(saltBytes)

	alt := sha512.New()
	alt.Write(password)
	alt.Write(saltBytes)
	alt.Write(password)
	altSum := alt.Sum(nil)

	if keyLen > 0 {
		n := keyLen / 64
		for i := 0; i < n; i++ {
			a.Write(altSum)
		}
		a.Write(altSum[:keyLen%64])
	}

	for cnt := keyLen; cnt > 0; cnt >>= 1 {
		if (cnt & 1) != 0 {
			a.Write(altSum)
		} else {
			a.Write(password)
		}
	}
	final := a.Sum(nil)

	dp := sha512.New()
	for i := 0; i < keyLen; i++ {
		dp.Write(password)
	}
	dpSum := dp.Sum(nil)
	P := make([]byte, keyLen)
	for i := 0; i+64 <= keyLen; i += 64 {
		copy(P[i:i+64], dpSum)
	}
	copy(P[(keyLen/64)*64:], dpSum[:keyLen%64])

	ds := sha512.New()
	reps := 16 + int(final[0])
	for i := 0; i < reps; i++ {
		ds.Write(saltBytes)
	}
	dsSum := ds.Sum(nil)
	S := make([]byte, saltLen)
	for i := 0; i+64 <= saltLen; i += 64 {
		copy(S[i:i+64], dsSum)
	}
	copy(S[(saltLen/64)*64:], dsSum[:saltLen%64])

	for i := 0; i < rounds; i++ {
		c := sha512.New()
		if (i & 1) != 0 {
			c.Write(P)
		} else {
			c.Write(final)
		}
		if i%3 != 0 {
			c.Write(S)
		}
		if i%7 != 0 {
			c.Write(P)
		}
		if (i & 1) != 0 {
			c.Write(final)
		} else {
			c.Write(P)
		}
		final = c.Sum(nil)
	}

	enc := func(dst *[]byte, b2, b1, b0 byte, n int) {
		w := uint32(b2)<<16 | uint32(b1)<<8 | uint32(b0)
		for i := 0; i < n; i++ {
			*dst = append(*dst, cryptBase64[w&0x3f])
			w >>= 6
		}
	}

	buf := make([]byte, 0, len(magic)+saltLen+1+86)
	buf = append(buf, magic...)
	buf = append(buf, saltBytes...)
	buf = append(buf, '$')

	enc(&buf, final[0], final[21], final[42], 4)
	enc(&buf, final[22], final[43], final[1], 4)
	enc(&buf, final[44], final[2], final[23], 4)
	enc(&buf, final[3], final[24], final[45], 4)
	enc(&buf, final[25], final[46], final[4], 4)
	enc(&buf, final[47], final[5], final[26], 4)
	enc(&buf, final[6], final[27], final[48], 4)
	enc(&buf, final[28], final[49], final[7], 4)
	enc(&buf, final[50], final[8], final[29], 4)
	enc(&buf, final[9], final[30], final[51], 4)
	enc(&buf, final[31], final[52], final[10], 4)
	enc(&buf, final[53], final[11], final[32], 4)
	enc(&buf, final[12], final[33], final[54], 4)
	enc(&buf, final[34], final[55], final[13], 4)
	enc(&buf, final[56], final[14], final[35], 4)
	enc(&buf, final[15], final[36], final[57], 4)
	enc(&buf, final[37], final[58], final[16], 4)
	enc(&buf, final[59], final[17], final[38], 4)
	enc(&buf, final[18], final[39], final[60], 4)
	enc(&buf, final[40], final[61], final[19], 4)
	enc(&buf, final[62], final[20], final[41], 4)
	enc(&buf, 0, 0, final[63], 2)

	return string(buf)
}

// sha1crypt -m 15100
func sha1crypt(password []byte, saltRaw []byte) string {
	const rounds = 20000 // TODO use -i to set iterations
	const saltLen = 8

	var salt [saltLen]byte
	if len(saltRaw) >= saltLen {
		copy(salt[:], saltRaw[:saltLen])
	} else {
		var rb [saltLen]byte
		if !readRand(rb[:]) {
			return ""
		}
		for i := 0; i < saltLen; i++ {
			salt[i] = cryptBase64[rb[i]&0x3f]
		}
	}

	msg := make([]byte, 0, saltLen+len("$sha1$")+5)
	msg = append(msg, salt[:]...)
	msg = append(msg, "$sha1$20000"...)

	mac := hmac.New(sha1.New, password)
	_, _ = mac.Write(msg)

	var digest [sha1.Size]byte
	_ = mac.Sum(digest[:0])

	for i := 1; i < rounds; i++ {
		mac.Reset()
		_, _ = mac.Write(digest[:])
		_ = mac.Sum(digest[:0])
	}

	enc := func(dst *[]byte, b2, b1, b0 byte) {
		v := uint32(b2)<<16 | uint32(b1)<<8 | uint32(b0)
		for i := 0; i < 4; i++ {
			*dst = append(*dst, cryptBase64[v&0x3f])
			v >>= 6
		}
	}

	out := make([]byte, 0, len("$sha1$20000$")+saltLen+1+28)
	out = append(out, "$sha1$20000$"...)
	out = append(out, salt[:]...)
	out = append(out, '$')

	for i := 0; i < 18; i += 3 {
		enc(&out, digest[i], digest[i+1], digest[i+2])
	}
	enc(&out, digest[18], digest[19], digest[0])

	return string(out)
}

// sm3crypt -m 35100
func sm3crypt(password []byte, saltRaw []byte) string {
	const magic = "$sm3$"
	const rounds = 5000
	const saltLen = 16

	var salt []byte
	if len(saltRaw) > 0 {
		n := len(saltRaw)
		if n > saltLen {
			n = saltLen
		}
		salt = make([]byte, n)
		copy(salt, saltRaw[:n])
	} else {
		salt = make([]byte, saltLen)
		var rb [saltLen]byte
		if !readRand(rb[:]) {
			return ""
		}
		for i := 0; i < saltLen; i++ {
			salt[i] = cryptBase64[rb[i]&0x3f]
		}
	}

	a := sm3.New()
	a.Write(password)
	a.Write(salt)

	alt := sm3.New()
	alt.Write(password)
	alt.Write(salt)
	alt.Write(password)
	altSum := alt.Sum(nil)

	pwLen := len(password)
	for n := pwLen; n > 0; n -= sm3.Size {
		if n > sm3.Size {
			a.Write(altSum)
		} else {
			a.Write(altSum[:n])
		}
	}

	for n := pwLen; n > 0; n >>= 1 {
		if (n & 1) == 1 {
			a.Write(altSum)
		} else {
			a.Write(password)
		}
	}
	adigest := a.Sum(nil)

	dp := sm3.New()
	for i := 0; i < pwLen; i++ {
		dp.Write(password)
	}
	dpSum := dp.Sum(nil)
	P := make([]byte, pwLen)
	for i := 0; i < pwLen; i += sm3.Size {
		end := i + sm3.Size
		if end > pwLen {
			end = pwLen
		}
		copy(P[i:end], dpSum[:end-i])
	}

	ds := sm3.New()
	for i := 0; i < 16+int(adigest[0]); i++ {
		ds.Write(salt)
	}
	dsSum := ds.Sum(nil)
	S := make([]byte, len(salt))
	copy(S, dsSum[:len(salt)])

	digest := adigest
	for i := 0; i < rounds; i++ {
		c := sm3.New()
		if (i & 1) == 1 {
			c.Write(P)
		} else {
			c.Write(digest)
		}
		if i%3 != 0 {
			c.Write(S)
		}
		if i%7 != 0 {
			c.Write(P)
		}
		if (i & 1) == 1 {
			c.Write(digest)
		} else {
			c.Write(P)
		}
		digest = c.Sum(nil)
	}

	out := make([]byte, 0, len(magic)+len(salt)+1+43)
	out = append(out, magic...)
	out = append(out, salt...)
	out = append(out, '$')

	enc := func(b2, b1, b0 byte, n int) {
		v := uint32(b2)<<16 | uint32(b1)<<8 | uint32(b0)
		for j := 0; j < n; j++ {
			out = append(out, cryptBase64[v&0x3f])
			v >>= 6
		}
	}

	enc(digest[0], digest[10], digest[20], 4)
	enc(digest[21], digest[1], digest[11], 4)
	enc(digest[12], digest[22], digest[2], 4)
	enc(digest[3], digest[13], digest[23], 4)
	enc(digest[24], digest[4], digest[14], 4)
	enc(digest[15], digest[25], digest[5], 4)
	enc(digest[6], digest[16], digest[26], 4)
	enc(digest[27], digest[7], digest[17], 4)
	enc(digest[18], digest[28], digest[8], 4)
	enc(digest[9], digest[19], digest[29], 4)
	enc(0, digest[31], digest[30], 3)

	return string(out)
}

const (
	cmiycRounds  = uint32(4)
	cmiycMemLog  = uint32(16)
	cmiycMemSize = 64 << cmiycMemLog
)

var cmiycMemPool = sync.Pool{New: func() any { return make([]byte, cmiycMemSize) }}

// cmiyc 2026 contest algorithm - memory-hard SHA-512 KDF
func cmiyc(password []byte, saltRaw []byte) string {
	var salt [16]byte
	if len(saltRaw) >= len(salt) {
		copy(salt[:], saltRaw[:len(salt)])
	} else if !readRand(salt[:]) {
		return ""
	}

	mem := cmiycMemPool.Get().([]byte)
	defer cmiycMemPool.Put(mem)

	mac := hmac.New(sha512.New, salt[:])
	_, _ = mac.Write(password)
	var params [8]byte
	binary.LittleEndian.PutUint32(params[:4], cmiycRounds)
	binary.LittleEndian.PutUint32(params[4:], cmiycMemLog)
	_, _ = mac.Write(params[:])
	seed := mac.Sum(nil)

	const n = 1 << cmiycMemLog
	const mask = n - 1

	var fill [82]byte
	copy(fill[:64], seed)
	copy(fill[64:74], "cmiyc-fill")
	for i := 0; i < n; i++ {
		if i > 0 {
			copy(fill[:64], mem[(i-1)*64:i*64])
		}
		binary.LittleEndian.PutUint64(fill[74:], uint64(i))
		sum := sha512.Sum512(fill[:])
		copy(mem[i*64:(i+1)*64], sum[:])
	}

	var mix [145]byte
	for r := uint64(1); r <= uint64(cmiycRounds); r++ {
		binary.LittleEndian.PutUint64(mix[128:136], r)
		mix[144] = 'A'
		for i := 0; i < n; i++ {
			off := i * 64
			j := int(binary.LittleEndian.Uint64(mem[off:off+8])&mask) * 64
			copy(mix[:64], mem[off:off+64])
			copy(mix[64:128], mem[j:j+64])
			binary.LittleEndian.PutUint64(mix[136:144], uint64(i))
			sum := sha512.Sum512(mix[:])
			copy(mem[off:off+64], sum[:])
		}

		mix[144] = 'B'
		for i := n; i > 0; i-- {
			idx := i - 1
			off := idx * 64
			j := int(binary.LittleEndian.Uint64(mem[off+8:off+16])&mask) * 64
			copy(mix[:64], mem[off:off+64])
			copy(mix[64:128], mem[j:j+64])
			binary.LittleEndian.PutUint64(mix[136:144], uint64(idx))
			sum := sha512.Sum512(mix[:])
			copy(mem[off:off+64], sum[:])
		}
	}

	var x [64]byte
	for i := 0; i < n; i++ {
		off := i * 64
		for j := range x {
			x[j] ^= mem[off+j]
		}
	}
	final := sha512.Sum512(x[:])

	enc := base64.RawURLEncoding
	return fmt.Sprintf("$cmiyc$2026$%d$%d$%s$%s",
		cmiycRounds, cmiycMemLog, enc.EncodeToString(salt[:]), enc.EncodeToString(final[:32]))
}

func bcryptHash(password []byte, cost int) string {
	hashed, err := bcrypt.GenerateFromPassword(password, cost)
	if err != nil {
		fmt.Fprintln(os.Stderr, "bcrypt error:", err)
		return ""
	}
	return string(hashed)
}

// WordPress bcrypt: $wp$2y$10$<22-salt><31-hash>
// bcrypt(base64(HMAC-SHA384(key="wp-sha384",$password)))
func wpbcrypt(password []byte, cost int) string {
	const (
		wpPrefix     = "$wp$"
		bcryptPrefix = "$2y$"
	)

	mac := hmac.New(sha512.New384, []byte("wp-sha384"))
	mac.Write(password)
	tag := mac.Sum(nil)

	b64 := make([]byte, base64.StdEncoding.EncodedLen(len(tag)))
	base64.StdEncoding.Encode(b64, tag)

	bh, err := bcrypt.GenerateFromPassword(b64, cost)
	if err != nil {
		fmt.Fprintln(os.Stderr, "wpbcrypt error:", err)
		return ""
	}
	s := string(bh)

	if len(s) < 4 || s[0] != '$' {
		fmt.Fprintln(os.Stderr, "wpbcrypt: unexpected bcrypt format")
		return ""
	}
	s = bcryptPrefix + s[4:]

	return wpPrefix + s[1:]
}

// yescrypt, using Debian/libxcrypt defaults
func yescryptHash(pass []byte) string {
	// Debian/libxcrypt defaults: N=4096, r=32, p=1, keyLen=32, 128-bit salt
	const N = 4096
	const r = 32
	const p = 1
	const keyLen = 32
	const saltLen = 16

	// salt
	salt := make([]byte, saltLen)
	if !readRand(salt) {
		fmt.Fprintln(os.Stderr, "yescrypt: salt error")
		return ""
	}

	// derive
	key, err := yescrypt.Key(pass, salt, N, r, p, keyLen)
	if err != nil {
		fmt.Fprintln(os.Stderr, "yescrypt:", err)
		return ""
	}

	// crypt-base64 encoder (./0-9A-Za-z)
	encode64 := func(src []byte) string {
		var dst []byte
		var v uint32
		bitsAcc := 0
		for i := 0; i < len(src); i++ {
			v |= uint32(src[i]) << bitsAcc
			bitsAcc += 8
			for bitsAcc >= 6 {
				dst = append(dst, cryptBase64[v&0x3f])
				v >>= 6
				bitsAcc -= 6
			}
		}
		if bitsAcc > 0 {
			dst = append(dst, cryptBase64[v&0x3f])
		}
		return string(dst)
	}

	// params field:
	// flags 'j' (YESCRYPT_DEFAULTS), then log2(N) and r, both encoded 1-based in crypt-base64
	ln := bits.TrailingZeros(uint(N)) // N must be power of two
	if 1<<ln != N || r <= 0 {
		fmt.Fprintln(os.Stderr, "yescrypt: invalid N/r")
		return ""
	}
	params := []byte{'j', cryptBase64[(ln-1)&0x3f], cryptBase64[(r-1)&0x3f]}

	// assemble
	return "$y$" + string(params) + "$" + encode64(salt) + "$" + encode64(key)
}

// gost-yescrypt, using Debian/libxcrypt defaults
func gostYescryptHash(pass []byte) string {
	const N = 4096
	const r = 32
	const p = 1
	const keyLen = 32
	const saltLen = 16

	salt := make([]byte, saltLen)
	if !readRand(salt) {
		fmt.Fprintln(os.Stderr, "gost-yescrypt: salt error")
		return ""
	}

	key, err := yescrypt.Key(pass, salt, N, r, p, keyLen)
	if err != nil {
		fmt.Fprintln(os.Stderr, "gost-yescrypt:", err)
		return ""
	}

	encode64 := func(src []byte) string {
		var dst []byte
		var v uint32
		bitsAcc := 0
		for i := 0; i < len(src); i++ {
			v |= uint32(src[i]) << bitsAcc
			bitsAcc += 8
			for bitsAcc >= 6 {
				dst = append(dst, cryptBase64[v&0x3f])
				v >>= 6
				bitsAcc -= 6
			}
		}
		if bitsAcc > 0 {
			dst = append(dst, cryptBase64[v&0x3f])
		}
		return string(dst)
	}

	ln := bits.TrailingZeros(uint(N))
	if 1<<ln != N || r <= 0 {
		fmt.Fprintln(os.Stderr, "gost-yescrypt: invalid N/r")
		return ""
	}
	params := []byte{'j', cryptBase64[(ln-1)&0x3f], cryptBase64[(r-1)&0x3f]}
	setting := "$gy$" + string(params) + "$" + encode64(salt)

	hk := streebog.Sum256(pass)
	mac := hmac.New(streebog.New256, hk[:])
	_, _ = mac.Write([]byte(setting))
	interm := mac.Sum(nil)

	mac = hmac.New(streebog.New256, interm)
	_, _ = mac.Write(key)
	digest := mac.Sum(nil)

	return setting + "$" + encode64(digest)
}

func isBcryptMode(mode string) bool {
	switch mode {
	case "bcrypt", "3200", "bcryptmd5", "25600", "bcryptsha1", "25800", "bcryptsha512", "28400", "bcryptsha256", "30600", "wpbcrypt", "35500":
		return true
	default:
		return false
	}
}

// supported hash algorithms / modes
func hashBytesDispatch(hashFunc string, data []byte, cost int) (string, bool) {
	if modeProbe {
		if isBcryptMode(hashFunc) {
			return "", true
		}
		switch hashFunc {
		case "argon2id", "34000", "yescrypt", "gostyescrypt", "gost-yescrypt",
			"8900", "scrypt",
			"10900", "pbkdf2sha256", "pbkdf2-sha256", "11900", "pbkdf2md5", "pbkdf2-md5", "12000", "pbkdf2sha1", "pbkdf2-sha1", "12100", "pbkdf2sha512", "pbkdf2-sha512",
			"md5crypt", "500", "sha1crypt", "15100", "sha256crypt", "7400", "sha512crypt", "1800", "sm3crypt", "35100", "cmiyc",
			"phpass", "phpbb3", "400":
			return "", true
		}
	}
	switch hashFunc {

	// Plaintext & Encoding
	// plaintext, dehex, -m 99999
	case "plaintext", "dehex", "99999":
		// passthrough & run checkForHex
		return string(data), true

	// $HEX[]
	case "hex":
		buf := make([]byte, 5+hex.EncodedLen(len(data))+1) // "$HEX[" + hex + "]"
		copy(buf, "$HEX[")
		hex.Encode(buf[5:], data)
		buf[len(buf)-1] = ']'
		return string(buf), true

	// base64 encode
	case "base64encode", "base64e":
		return base64.StdEncoding.EncodeToString(data), true

	// base64 decode
	case "base64decode", "base64d":
		trimmedData := bytes.TrimSpace(data)
		decodedBytes := make([]byte, base64.StdEncoding.DecodedLen(len(trimmedData)))
		n, err := base64.StdEncoding.Decode(decodedBytes, trimmedData)
		if err != nil {
			fmt.Fprintln(os.Stderr, "Invalid Base64 string")
			return "", true
		}
		return string(decodedBytes[:n]), true

	// base58 encode
	case "base58encode", "base58e":
		return base58.StdEncoding.EncodeToString(data), true

	// base58 decode
	case "base58decode", "base58d":
		trimmedData := bytes.TrimSpace(data)
		decodedBytes := make([]byte, len(trimmedData))
		n, err := base58.StdEncoding.Decode(decodedBytes, trimmedData)
		if err != nil {
			fmt.Fprintln(os.Stderr, "Invalid Base58 string:", err)
			return "", true
		}
		return string(decodedBytes[:n]), true

	// base32 encode
	case "base32encode", "base32e":
		return base32.StdEncoding.EncodeToString(data), true

	// base32 decode
	case "base32decode", "base32d":
		trimmedData := bytes.TrimSpace(data)
		decodedBytes := make([]byte, base32.StdEncoding.DecodedLen(len(trimmedData)))
		n, err := base32.StdEncoding.Decode(decodedBytes, trimmedData)
		if err != nil {
			fmt.Fprintln(os.Stderr, "Invalid Base32 string")
			return "", true
		}
		return string(decodedBytes[:n]), true

	// morsecode
	case "morsecode", "morse":
		return string(encodeToMorseBytes(data)), true

	// morsecode decode
	case "morsedecode", "morsed":
		return string(decodeMorseBytes(data)), true

	// Checksums

	// crc32 (standard, non-hashcat compatible)
	case "crc32":
		h := crc32.ChecksumIEEE(data)
		b := make([]byte, 4)
		binary.BigEndian.PutUint32(b, h)
		return hex.EncodeToString(b), true

	// crc32 -m 11500
	case "11500": // hashcat compatible crc32 mode
		const hcCRCPad = ":00000000"
		h := crc32.ChecksumIEEE(data)
		b := make([]byte, 4)
		binary.BigEndian.PutUint32(b, h)
		hashString := hex.EncodeToString(b)
		return hashString + hcCRCPad, true

	// crc64
	case "crc64":
		table := crc64.MakeTable(crc64.ECMA)
		h := crc64.Checksum(data, table)
		b := make([]byte, 8)
		binary.BigEndian.PutUint64(b, h)
		return hex.EncodeToString(b), true

	// MDx

	// md4 -m 900
	case "md4", "900":
		h := md4.New()
		h.Write(data)
		return hex.EncodeToString(h.Sum(nil)), true

	// md5 -m 0
	case "md5", "0":
		h := md5.Sum(data)
		return hex.EncodeToString(h[:]), true

	// halfmd5 -m 5100
	case "halfmd5", "5100":
		h := md5.Sum(data)
		return hex.EncodeToString(h[:8]), true

	// -m 10 md5(pass.salt), -m 20 md5(salt.pass)
	case "10", "md5passsalt", "20", "md5saltpass":
		var saltBuf [16]byte
		if !fillSaltHex8(saltBuf[:]) {
			return "", true
		}
		salt := saltBuf[:]
		h := md5.New()
		if hashFunc == "20" || hashFunc == "md5saltpass" {
			h.Write(salt) // salt first
			h.Write(data) // then pass
		} else {
			h.Write(data) // pass first
			h.Write(salt) // then salt
		}
		sum := h.Sum(nil)
		sumHexLen := hex.EncodedLen(len(sum))
		out := make([]byte, sumHexLen+1+len(salt)) // hex(sum) + ":" + saltHex
		hex.Encode(out[:sumHexLen], sum)
		out[sumHexLen] = ':'
		copy(out[sumHexLen+1:], salt)
		return string(out), true

	// utf16le($pass) + salt / salt + utf16le($pass) — hashcat -m 30 / 40 (salt = ASCII hex, same as -m 10/20)
	case "30", "md5utf16passsalt", "40", "md5utf16saltpass":
		pwU16, ok := utf16LEPassStrict(data)
		if !ok {
			return "", true
		}
		var saltBuf [16]byte
		if !fillSaltHex8(saltBuf[:]) {
			return "", true
		}
		salt := saltBuf[:]
		h := md5.New()
		if hashFunc == "40" || hashFunc == "md5utf16saltpass" {
			h.Write(salt)
			h.Write(pwU16)
		} else {
			h.Write(pwU16)
			h.Write(salt)
		}
		sum := h.Sum(nil)
		sumHexLen := hex.EncodedLen(len(sum))
		out := make([]byte, sumHexLen+1+len(salt))
		hex.Encode(out[:sumHexLen], sum)
		out[sumHexLen] = ':'
		copy(out[sumHexLen+1:], salt)
		return string(out), true

	// md5(utf16le($pass)) — hashcat -m 70
	case "70", "md5utf16le":
		pwU16, ok := utf16LEPassStrict(data)
		if !ok {
			return "", true
		}
		s := md5.Sum(pwU16)
		return hex.EncodeToString(s[:]), true

	// -m 2600 md5(md5($pass))
	case "md5md5", "2600":
		inner := md5HexBytes(data)
		outer := md5HexBytes(inner[:])
		return string(outer[:]), true

	// -m 3500 md5(md5(md5($pass)))
	case "3500":
		inner := md5HexBytes(data)
		middle := md5HexBytes(inner[:])
		outer := md5HexBytes(middle[:])
		return string(outer[:]), true

	// -m 4300 md5(strtoupper(md5($pass)))
	case "4300":
		inner := md5HexBytes(data)
		for i := range inner {
			if inner[i] >= 'a' && inner[i] <= 'f' {
				inner[i] -= 'a' - 'A'
			}
		}
		outer := md5HexBytes(inner[:])
		return string(outer[:]), true

	// -m 4400 md5(sha1($pass))
	case "4400":
		inner := sha1HexBytes(data)
		outer := md5HexBytes(inner[:])
		return string(outer[:]), true

	// -m 32800 md5(sha1(md5($pass)))
	case "32800":
		inner := md5HexBytes(data)
		middle := sha1HexBytes(inner[:])
		outer := md5HexBytes(middle[:])
		return string(outer[:]), true

	// MD6

	// md6-128
	case "md6-128", "md6128":
		h := md6.Sum(128, data)
		return hex.EncodeToString(h), true

	// md6-224
	case "md6-224", "md6224":
		h := md6.Sum(224, data)
		return hex.EncodeToString(h), true

	// md6-256
	case "md6", "md6-256", "md6256", "34600":
		h := md6.Sum256(data)
		return hex.EncodeToString(h[:]), true

	// md6-384
	case "md6-384", "md6384":
		h := md6.Sum(384, data)
		return hex.EncodeToString(h), true

	// md6-512
	case "md6-512", "md6512":
		h := md6.Sum512(data)
		return hex.EncodeToString(h[:]), true

	// SHA1

	// sha1 -m 100
	case "sha1", "100":
		h := sha1.Sum(data)
		return hex.EncodeToString(h[:]), true

	// LDAP SHA/SSHA -m 101 / 111 / 1411 / 1711
	case "ldapsha", "ldap-sha", "101", "ssha", "111", "ssha256", "1411", "ssha512", "1711":
		return ldapSHA(data, hashFunc, nil), true

	// -m 110 sha1(pass.salt), -m 120 sha1(salt.pass)
	case "110", "sha1passsalt", "120", "sha1saltpass":
		var saltBuf [16]byte
		if !fillSaltHex8(saltBuf[:]) {
			return "", true
		}
		salt := saltBuf[:]
		h := sha1.New()
		if hashFunc == "120" || hashFunc == "sha1saltpass" {
			h.Write(salt) // salt first
			h.Write(data) // then pass
		} else {
			h.Write(data) // pass first
			h.Write(salt) // then salt
		}
		sum := h.Sum(nil)
		// 20-byte SHA1 -> 40 hex chars
		out := make([]byte, 40+1+len(salt)) // hex(sum) + ":" + saltHex
		hex.Encode(out[:40], sum)
		out[40] = ':'
		copy(out[41:], salt)
		return string(out), true

	// sha1 utf16le + salt — hashcat -m 130 / 140
	case "130", "sha1utf16passsalt", "140", "sha1utf16saltpass":
		pwU16, ok := utf16LEPassStrict(data)
		if !ok {
			return "", true
		}
		var saltBuf [16]byte
		if !fillSaltHex8(saltBuf[:]) {
			return "", true
		}
		salt := saltBuf[:]
		h := sha1.New()
		if hashFunc == "140" || hashFunc == "sha1utf16saltpass" {
			h.Write(salt)
			h.Write(pwU16)
		} else {
			h.Write(pwU16)
			h.Write(salt)
		}
		sum := h.Sum(nil)
		out := make([]byte, 40+1+len(salt))
		hex.Encode(out[:40], sum)
		out[40] = ':'
		copy(out[41:], salt)
		return string(out), true

	// sha1(utf16le($pass)) — hashcat -m 170
	case "170", "sha1utf16le":
		pwU16, ok := utf16LEPassStrict(data)
		if !ok {
			return "", true
		}
		sum := sha1.Sum(pwU16)
		return hex.EncodeToString(sum[:]), true

	// -m 4500 sha1(sha1($pass))
	case "sha1sha1", "4500":
		inner := sha1HexBytes(data)
		outer := sha1HexBytes(inner[:])
		return string(outer[:]), true

	// -m 4700 sha1(md5($pass))
	case "4700":
		inner := md5HexBytes(data)
		outer := sha1HexBytes(inner[:])
		return string(outer[:]), true

	// -m 18500 sha1(md5(md5($pass)))
	case "18500":
		inner := md5HexBytes(data)
		middle := md5HexBytes(inner[:])
		outer := sha1HexBytes(middle[:])
		return string(outer[:]), true

	// -m 18501 sha1(md5(sha1($pass)))
	case "18501":
		inner := sha1HexBytes(data)
		middle := md5HexBytes(inner[:])
		outer := sha1HexBytes(middle[:])
		return string(outer[:]), true

	// SHA2

	// sha2-224 -m 1300
	case "sha2-224", "sha224", "1300":
		h := sha256.New224()
		h.Write(data)
		return hex.EncodeToString(h.Sum(nil)), true

	// -m 1310 sha224(pass.salt), -m 1320 sha224(salt.pass)
	case "1310", "sha224passsalt", "1320", "sha224saltpass":
		var saltBuf [16]byte
		if !fillSaltHex8(saltBuf[:]) {
			return "", true
		}
		salt := saltBuf[:]
		h := sha256.New224()
		if hashFunc == "1320" || hashFunc == "sha224saltpass" {
			h.Write(salt) // salt first
			h.Write(data) // then pass
		} else {
			h.Write(data) // pass first
			h.Write(salt) // then salt
		}
		sum := h.Sum(nil)
		// SHA-224 = 28 bytes -> 56 hex chars
		out := make([]byte, 56+1+len(salt)) // hex(sum) + ":" + saltHex
		hex.Encode(out[:56], sum)
		out[56] = ':'
		copy(out[57:], salt)
		return string(out), true

	// -m 34400 sha224(sha224($pass))
	case "34400":
		inner := sha224HexBytes(data)
		outer := sha224HexBytes(inner[:])
		return string(outer[:]), true

	// -m 34500 sha224(sha1($pass))
	case "34500":
		inner := sha1HexBytes(data)
		outer := sha224HexBytes(inner[:])
		return string(outer[:]), true

	// sha2-256 -m 1400
	case "sha2-256", "sha256", "1400":
		h := sha256.Sum256(data)
		return hex.EncodeToString(h[:]), true

	// -m 20800 sha256(md5($pass))
	case "20800":
		inner := md5HexBytes(data)
		outer := sha256HexBytes(inner[:])
		return string(outer[:]), true

	// -m 35900 sha256(sha1($pass))
	case "35900":
		inner := sha1HexBytes(data)
		outer := sha256HexBytes(inner[:])
		return string(outer[:]), true

	// -m 1410 sha256(pass.salt), -m 1420 sha256(salt.pass)
	case "1410", "sha256passsalt", "1420", "sha256saltpass":
		var saltBuf [16]byte
		if !fillSaltHex8(saltBuf[:]) {
			return "", true
		}
		salt := saltBuf[:]
		h := sha256.New()
		if hashFunc == "1420" || hashFunc == "sha256saltpass" {
			h.Write(salt) // salt first
			h.Write(data) // then pass
		} else {
			h.Write(data) // pass first
			h.Write(salt) // then salt
		}
		sum := h.Sum(nil)
		// 32-byte SHA-256 -> 64 hex chars
		out := make([]byte, 64+1+len(salt)) // hex(sum) + ":" + saltHex
		hex.Encode(out[:64], sum)
		out[64] = ':'
		copy(out[65:], salt)
		return string(out), true

	// sha256 utf16le + salt — hashcat -m 1430 / 1440
	case "1430", "sha256utf16passsalt", "1440", "sha256utf16saltpass":
		pwU16, ok := utf16LEPassStrict(data)
		if !ok {
			return "", true
		}
		var saltBuf [16]byte
		if !fillSaltHex8(saltBuf[:]) {
			return "", true
		}
		salt := saltBuf[:]
		h := sha256.New()
		if hashFunc == "1440" || hashFunc == "sha256utf16saltpass" {
			h.Write(salt)
			h.Write(pwU16)
		} else {
			h.Write(pwU16)
			h.Write(salt)
		}
		sum := h.Sum(nil)
		out := make([]byte, 64+1+len(salt))
		hex.Encode(out[:64], sum)
		out[64] = ':'
		copy(out[65:], salt)
		return string(out), true

	// sha256(utf16le($pass)) — hashcat -m 1470
	case "1470", "sha256utf16le":
		pwU16, ok := utf16LEPassStrict(data)
		if !ok {
			return "", true
		}
		sum := sha256.Sum256(pwU16)
		return hex.EncodeToString(sum[:]), true

	// sha2-384 -m 10800
	case "sha2-384", "sha384", "10800":
		h := sha512.New384()
		h.Write(data)
		return hex.EncodeToString(h.Sum(nil)), true

	// -m 10810 sha384(pass.salt), -m 10820 sha384(salt.pass)
	case "10810", "sha384passsalt", "10820", "sha384saltpass":
		var saltBuf [16]byte
		if !fillSaltHex8(saltBuf[:]) {
			return "", true
		}
		salt := saltBuf[:]
		h := sha512.New384()
		if hashFunc == "10820" || hashFunc == "sha384saltpass" {
			h.Write(salt) // salt first
			h.Write(data) // then pass
		} else {
			h.Write(data) // pass first
			h.Write(salt) // then salt
		}
		sum := h.Sum(nil)

		// SHA-384 = 48 bytes -> 96 hex chars
		out := make([]byte, 96+1+len(salt)) // hex(sum) + ":" + saltHex
		hex.Encode(out[:96], sum)
		out[96] = ':'
		copy(out[97:], salt)
		return string(out), true

	// sha384 UTF-16LE - hashcat -m 10830 / 10840 / 10870
	case "10830", "sha384utf16passsalt", "10840", "sha384utf16saltpass", "10870", "sha384utf16le":
		return sha384UTF16(data, hashFunc, nil), true

	// sha2-512 -m 1700
	case "sha2-512", "sha512", "1700":
		h := sha512.Sum512(data)
		return hex.EncodeToString(h[:]), true

	// -m 1710 sha512(pass.salt), -m 1720 sha512(salt.pass)
	case "1710", "sha512passsalt", "1720", "sha512saltpass":
		var saltBuf [16]byte
		if !fillSaltHex8(saltBuf[:]) {
			return "", true
		}
		salt := saltBuf[:]
		h := sha512.New()
		if hashFunc == "1720" || hashFunc == "sha512saltpass" {
			h.Write(salt) // salt first
			h.Write(data) // then pass
		} else {
			h.Write(data) // pass first
			h.Write(salt) // then salt
		}
		sum := h.Sum(nil)

		// 64-byte SHA-512 -> 128 hex chars
		out := make([]byte, 128+1+len(salt)) // hex(sum) + ":" + saltHex
		hex.Encode(out[:128], sum)
		out[128] = ':'
		copy(out[129:], salt)
		return string(out), true

	// sha512 utf16le + salt — hashcat -m 1730 / 1740
	case "1730", "sha512utf16passsalt", "1740", "sha512utf16saltpass":
		pwU16, ok := utf16LEPassStrict(data)
		if !ok {
			return "", true
		}
		var saltBuf [16]byte
		if !fillSaltHex8(saltBuf[:]) {
			return "", true
		}
		salt := saltBuf[:]
		h := sha512.New()
		if hashFunc == "1740" || hashFunc == "sha512utf16saltpass" {
			h.Write(salt)
			h.Write(pwU16)
		} else {
			h.Write(pwU16)
			h.Write(salt)
		}
		sum := h.Sum(nil)
		out := make([]byte, 128+1+len(salt))
		hex.Encode(out[:128], sum)
		out[128] = ':'
		copy(out[129:], salt)
		return string(out), true

	// sha512(utf16le($pass)) — hashcat -m 1770
	case "1770", "sha512utf16le":
		pwU16, ok := utf16LEPassStrict(data)
		if !ok {
			return "", true
		}
		sum := sha512.Sum512(pwU16)
		return hex.EncodeToString(sum[:]), true

	// sha2-512-224
	case "sha2-512-224", "sha512-224", "sha512224":
		h := sha512.New512_224()
		h.Write(data)
		return hex.EncodeToString(h.Sum(nil)), true

	// sha2-512-256
	case "sha2-512-256", "sha512-256", "sha512256":
		h := sha512.New512_256()
		h.Write(data)
		return hex.EncodeToString(h.Sum(nil)), true

	// SHA3

	// sha3-224 -m 17300
	case "sha3-224", "sha3224", "17300":
		h := sha3.New224()
		h.Write(data)
		return hex.EncodeToString(h.Sum(nil)), true

	// sha3-256 -m 17400
	case "sha3-256", "sha3256", "17400":
		h := sha3.New256()
		h.Write(data)
		return hex.EncodeToString(h.Sum(nil)), true

	// sha3-384 -m 17500
	case "sha3-384", "sha3384", "17500":
		h := sha3.New384()
		h.Write(data)
		return hex.EncodeToString(h.Sum(nil)), true

	// sha3-512 -m 17600
	case "sha3-512", "sha3512", "17600":
		h := sha3.New512()
		h.Write(data)
		return hex.EncodeToString(h.Sum(nil)), true

	// Keccak

	// keccak-224 -m 17700 (raw hex)
	case "keccak-224", "keccak224", "17700":
		h := keccak.New224()
		h.Write(data)
		return hex.EncodeToString(h.Sum(nil)), true

	// keccak-256 -m 17800
	case "keccak-256", "keccak256", "17800":
		h := sha3.NewLegacyKeccak256()
		h.Write(data)
		return hex.EncodeToString(h.Sum(nil)), true

	// keccak-384 -m 17900 (raw hex)
	case "keccak-384", "keccak384", "17900":
		h := keccak.New384()
		h.Write(data)
		return hex.EncodeToString(h.Sum(nil)), true

	// keccak-512 -m 18000
	case "keccak-512", "keccak512", "18000":
		h := sha3.NewLegacyKeccak512()
		h.Write(data)
		return hex.EncodeToString(h.Sum(nil)), true

	// Streebog / GOST R 34.11-2012, big-endian
	case "streebog-256", "streebog256", "11700":
		sum := streebog.Sum256(data)
		reverseBytes(sum[:])
		return hex.EncodeToString(sum[:]), true

	case "streebog-512", "streebog512", "11800":
		sum := streebog.Sum512(data)
		reverseBytes(sum[:])
		return hex.EncodeToString(sum[:]), true

	// HMAC (hashcat: hex_digest : salt)

	case "50", "hmacmd5pass", "hmac-md5-pass", "60", "hmacmd5salt", "hmac-md5-salt":
		var saltBuf [16]byte
		if !fillSaltHex8(saltBuf[:]) {
			return "", true
		}
		salt := saltBuf[:]
		var m []byte
		if hashFunc == "50" || hashFunc == "hmacmd5pass" || hashFunc == "hmac-md5-pass" {
			h := hmac.New(md5.New, data)
			h.Write(salt)
			m = h.Sum(nil)
		} else {
			h := hmac.New(md5.New, salt)
			h.Write(data)
			m = h.Sum(nil)
		}
		return hexMACLineDigest(m, salt), true

	case "150", "hmacsha1pass", "hmac-sha1-pass", "160", "hmacsha1salt", "hmac-sha1-salt":
		var saltBuf [16]byte
		if !fillSaltHex8(saltBuf[:]) {
			return "", true
		}
		salt := saltBuf[:]
		var m []byte
		if hashFunc == "150" || hashFunc == "hmacsha1pass" || hashFunc == "hmac-sha1-pass" {
			h := hmac.New(sha1.New, data)
			h.Write(salt)
			m = h.Sum(nil)
		} else {
			h := hmac.New(sha1.New, salt)
			h.Write(data)
			m = h.Sum(nil)
		}
		return hexMACLineDigest(m, salt), true

	case "1450", "hmacsha256pass", "hmac-sha256-pass", "1460", "hmacsha256salt", "hmac-sha256-salt":
		var saltBuf [16]byte
		if !fillSaltHex8(saltBuf[:]) {
			return "", true
		}
		salt := saltBuf[:]
		var m []byte
		if hashFunc == "1450" || hashFunc == "hmacsha256pass" || hashFunc == "hmac-sha256-pass" {
			h := hmac.New(sha256.New, data)
			h.Write(salt)
			m = h.Sum(nil)
		} else {
			h := hmac.New(sha256.New, salt)
			h.Write(data)
			m = h.Sum(nil)
		}
		return hexMACLineDigest(m, salt), true

	case "1750", "hmacsha512pass", "hmac-sha512-pass", "1760", "hmacsha512salt", "hmac-sha512-salt":
		var saltBuf [16]byte
		if !fillSaltHex8(saltBuf[:]) {
			return "", true
		}
		salt := saltBuf[:]
		var m []byte
		if hashFunc == "1750" || hashFunc == "hmacsha512pass" || hashFunc == "hmac-sha512-pass" {
			h := hmac.New(sha512.New, data)
			h.Write(salt)
			m = h.Sum(nil)
		} else {
			h := hmac.New(sha512.New, salt)
			h.Write(data)
			m = h.Sum(nil)
		}
		return hexMACLineDigest(m, salt), true

	case "6050", "hmacripemd160pass", "hmac-ripemd160-pass", "6060", "hmacripemd160salt", "hmac-ripemd160-salt":
		var saltBuf [16]byte
		if !fillSaltHex8(saltBuf[:]) {
			return "", true
		}
		salt := saltBuf[:]
		var m []byte
		if hashFunc == "6050" || hashFunc == "hmacripemd160pass" || hashFunc == "hmac-ripemd160-pass" {
			h := hmac.New(ripemd160.New, data)
			h.Write(salt)
			m = h.Sum(nil)
		} else {
			h := hmac.New(ripemd160.New, salt)
			h.Write(data)
			m = h.Sum(nil)
		}
		return hexMACLineDigest(m, salt), true

	case "11750", "hmacstreebog256pass", "hmac-streebog256-pass", "11760", "hmacstreebog256salt", "hmac-streebog256-salt":
		var saltBuf [16]byte
		if !fillSaltHex8(saltBuf[:]) {
			return "", true
		}
		salt := saltBuf[:]
		var m []byte
		if hashFunc == "11750" || hashFunc == "hmacstreebog256pass" || hashFunc == "hmac-streebog256-pass" {
			h := hmac.New(streebog.New256, data)
			h.Write(salt)
			m = h.Sum(nil)
		} else {
			h := hmac.New(streebog.New256, salt)
			h.Write(data)
			m = h.Sum(nil)
		}
		reverseBytes(m)
		return hexMACLineDigest(m, salt), true

	case "11850", "hmacstreebog512pass", "hmac-streebog512-pass", "11860", "hmacstreebog512salt", "hmac-streebog512-salt":
		var saltBuf [16]byte
		if !fillSaltHex8(saltBuf[:]) {
			return "", true
		}
		salt := saltBuf[:]
		var m []byte
		if hashFunc == "11850" || hashFunc == "hmacstreebog512pass" || hashFunc == "hmac-streebog512-pass" {
			h := hmac.New(streebog.New512, data)
			h.Write(salt)
			m = h.Sum(nil)
		} else {
			h := hmac.New(streebog.New512, salt)
			h.Write(data)
			m = h.Sum(nil)
		}
		reverseBytes(m)
		return hexMACLineDigest(m, salt), true

	// BLAKE2

	// blake2b-256 (raw hex)
	case "blake2b-256", "blake2b256":
		h := blake2b.Sum256(data)
		return hex.EncodeToString(h[:]), true

	// blake2b-384 (raw hex)
	case "blake2b-384", "blake2b384":
		h := blake2b.Sum384(data)
		return hex.EncodeToString(h[:]), true

	// blake2b-512 (raw hex)
	case "blake2b-512", "blake2b512":
		h := blake2b.Sum512(data)
		return hex.EncodeToString(h[:]), true

	// hashcat mode -m 600 BLAKE2b-512, $BLAKE2$<hex>
	case "600":
		h := blake2b.Sum512(data)
		const pB = "$BLAKE2$"
		buf := make([]byte, len(pB)+hex.EncodedLen(len(h)))
		copy(buf, pB)
		hex.Encode(buf[len(pB):], h[:])
		return string(buf), true

	// hashcat -m 610 BLAKE2b-512($pass.$salt), -m 620 BLAKE2b-512($salt.$pass)
	case "610", "blake2b512passsalt", "620", "blake2b512saltpass":
		var saltBuf [16]byte
		if !fillSaltHex8(saltBuf[:]) {
			return "", true
		}
		salt := saltBuf[:]
		var msg []byte
		if hashFunc == "620" || hashFunc == "blake2b512saltpass" {
			msg = append(append(msg, salt...), data...)
		} else {
			msg = append(append(msg, data...), salt...)
		}
		h := blake2b.Sum512(msg)
		const pB = "$BLAKE2$"
		buf := make([]byte, len(pB)+hex.EncodedLen(len(h))+1+len(salt))
		copy(buf, pB)
		hex.Encode(buf[len(pB):len(pB)+hex.EncodedLen(len(h))], h[:])
		i := len(pB) + hex.EncodedLen(len(h))
		buf[i] = ':'
		copy(buf[i+1:], salt)
		return string(buf), true

	// hashcat -m 34800 BLAKE2b-256 $BLAKE2$<hex> (hashcat-compatible; not raw hex)
	case "34800":
		h := blake2b.Sum256(data)
		const pB = "$BLAKE2$"
		buf := make([]byte, len(pB)+hex.EncodedLen(len(h)))
		copy(buf, pB)
		hex.Encode(buf[len(pB):], h[:])
		return string(buf), true

	// hashcat -m 34810 / 34820 BLAKE2b-256 salted
	case "34810", "blake2b256passsalt", "34820", "blake2b256saltpass":
		var saltBuf [16]byte
		if !fillSaltHex8(saltBuf[:]) {
			return "", true
		}
		salt := saltBuf[:]
		var msg []byte
		if hashFunc == "34820" || hashFunc == "blake2b256saltpass" {
			msg = append(append(msg, salt...), data...)
		} else {
			msg = append(append(msg, data...), salt...)
		}
		h := blake2b.Sum256(msg)
		const pB = "$BLAKE2$"
		buf := make([]byte, len(pB)+hex.EncodedLen(len(h))+1+len(salt))
		copy(buf, pB)
		hex.Encode(buf[len(pB):len(pB)+hex.EncodedLen(len(h))], h[:])
		i := len(pB) + hex.EncodedLen(len(h))
		buf[i] = ':'
		copy(buf[i+1:], salt)
		return string(buf), true

	// blake2s-256 (raw hex)
	case "blake2s-256", "blake2s256":
		h := blake2s.Sum256(data)
		return hex.EncodeToString(h[:]), true

	// hashcat mode -m 31000 BLAKE2s-256, $BLAKE2$<hex>
	case "31000":
		h := blake2s.Sum256(data)
		const pS = "$BLAKE2$"
		buf := make([]byte, len(pS)+hex.EncodedLen(len(h)))
		copy(buf, pS)
		hex.Encode(buf[len(pS):], h[:])
		return string(buf), true

	// hashcat -m 33300 HMAC-BLAKE2s (key = $pass)
	case "33300", "hmacblake2spass", "hmac-blake2s-pass":
		var saltBuf [16]byte
		if !fillSaltHex8(saltBuf[:]) {
			return "", true
		}
		salt := saltBuf[:]
		sum := blake2sHMACHashcat(data, salt)
		return hexMACLineDigest(sum, salt), true

	// Other Hashes

	// ripemd-160 -m 6000
	case "ripemd-160", "ripemd160", "6000":
		h := ripemd160.New()
		h.Write(data)
		return hex.EncodeToString(h.Sum(nil)), true

	// mysql4/mysql5 -m 300
	case "mysql4", "mysql5", "300":
		first := sha1.Sum(data)
		second := sha1.Sum(first[:])
		buf := make([]byte, 1+hex.EncodedLen(len(second)))
		buf[0] = '*'
		hex.Encode(buf[1:], second[:])
		for i := 1; i < len(buf); i++ {
			if buf[i] >= 'a' && buf[i] <= 'f' {
				buf[i] -= 32
			}
		}
		return string(buf), true

	// ntlm -m 1000 (strict: skip invalid UTF-8 / UTF-16)
	case "ntlm", "1000":
		var rs []rune
		for i := 0; i < len(data); {
			r, sz := utf8.DecodeRune(data[i:])
			if r == utf8.RuneError && sz == 1 {
				return "", true
			}
			if r >= 0xD800 && r <= 0xDFFF {
				return "", true
			}
			rs = append(rs, r)
			i += sz
		}
		u16 := utf16.Encode(rs)
		h := md4.New()
		_ = binary.Write(h, binary.LittleEndian, u16)
		return hex.EncodeToString(h.Sum(nil)), true

	// Crypt / KDF

	// PBKDF2-HMAC-SHA256 -m 10900
	case "10900", "pbkdf2sha256", "pbkdf2-sha256":
		var salt [8]byte
		if !readRand(salt[:]) {
			return "", true
		}
		dk := pbkdf2.Key(data, salt[:], pbkdf2IterCount, 24, sha256.New)
		return fmt.Sprintf("sha256:%d:%s:%s", pbkdf2IterCount, base64.StdEncoding.EncodeToString(salt[:]), base64.StdEncoding.EncodeToString(dk)), true

	// PBKDF2-HMAC-MD5 -m 11900
	case "11900", "pbkdf2md5", "pbkdf2-md5":
		var salt [8]byte
		if !readRand(salt[:]) {
			return "", true
		}
		dk := pbkdf2.Key(data, salt[:], pbkdf2IterCount, 32, md5.New)
		return fmt.Sprintf("md5:%d:%s:%s", pbkdf2IterCount, base64.StdEncoding.EncodeToString(salt[:]), base64.StdEncoding.EncodeToString(dk)), true

	// PBKDF2-HMAC-SHA1 -m 12000
	case "12000", "pbkdf2sha1", "pbkdf2-sha1":
		var salt [8]byte
		if !readRand(salt[:]) {
			return "", true
		}
		dk := pbkdf2.Key(data, salt[:], pbkdf2IterCount, 16, sha1.New)
		return fmt.Sprintf("sha1:%d:%s:%s", pbkdf2IterCount, base64.StdEncoding.EncodeToString(salt[:]), base64.StdEncoding.EncodeToString(dk)), true

	// PBKDF2-HMAC-SHA512 -m 12100
	case "12100", "pbkdf2sha512", "pbkdf2-sha512":
		var salt [8]byte
		if !readRand(salt[:]) {
			return "", true
		}
		dk := pbkdf2.Key(data, salt[:], pbkdf2IterCount, 16, sha512.New)
		return fmt.Sprintf("sha512:%d:%s:%s", pbkdf2IterCount, base64.StdEncoding.EncodeToString(salt[:]), base64.StdEncoding.EncodeToString(dk)), true

	// scrypt -m 8900 (hashcat self-test parameters N=16384 r=8 p=1, dkLen=32)
	case "8900", "scrypt":
		var salt [8]byte
		if !readRand(salt[:]) {
			return "", true
		}
		const (
			scryptN = 16384
			scryptR = 8
			scryptP = 1
			scryptK = 32
		)
		dk, err := scrypt.Key(data, salt[:], scryptN, scryptR, scryptP, scryptK)
		if err != nil {
			fmt.Fprintln(os.Stderr, "scrypt:", err)
			return "", true
		}
		return fmt.Sprintf("SCRYPT:%d:%d:%d:%s:%s", scryptN, scryptR, scryptP, base64.StdEncoding.EncodeToString(salt[:]), base64.StdEncoding.EncodeToString(dk)), true

	// argon2id
	case "argon2id", "34000":
		var salt [16]byte // random 16-byte salt
		if !readRand(salt[:]) {
			return "", true
		}
		// use default argon2id parameters
		t := uint32(4)       // time (iterations)
		m := uint32(65536)   // memory cost in KiB
		p := uint8(1)        // parallelism (number of threads)
		keyLen := uint32(16) // key length in bytes
		key := argon2.IDKey(data, salt[:], t, m, p, keyLen)
		saltB64 := base64.RawStdEncoding.EncodeToString(salt[:])
		keyB64 := base64.RawStdEncoding.EncodeToString(key)
		return fmt.Sprintf("$argon2id$v=19$m=%d,t=%d,p=%d$%s$%s", m, t, p, saltB64, keyB64), true

	// bcrypt -m 3200
	case "bcrypt", "3200":
		return bcryptHash(data, cost), true

	// bcrypt prehash modes
	case "bcryptmd5", "25600": // bcrypt(md5($pass))
		prehash := md5HexBytes(data)
		return bcryptHash(prehash[:], cost), true
	case "bcryptsha1", "25800": // bcrypt(sha1($pass))
		prehash := sha1HexBytes(data)
		return bcryptHash(prehash[:], cost), true
	case "bcryptsha512", "28400": // bcrypt(sha512($pass))
		prehash := sha512HexBytes(data)
		// bcrypt uses at most 72 password bytes; Hashcat mode 28400 does the same.
		return bcryptHash(prehash[:72], cost), true
	case "bcryptsha256", "30600": // bcrypt(sha256($pass))
		prehash := sha256HexBytes(data)
		return bcryptHash(prehash[:], cost), true

	// WordPress bcrypt -m 35500
	case "wpbcrypt", "35500":
		return wpbcrypt(data, cost), true

	// md5crypt -m 500
	case "md5crypt", "500":
		return md5crypt(data), true

	// sha1crypt -m 15100
	case "sha1crypt", "15100":
		return sha1crypt(data, nil), true

	// sm3crypt -m 35100
	case "sm3crypt", "35100":
		return sm3crypt(data, nil), true

	// CMIYC 2026
	case "cmiyc":
		return cmiyc(data, nil), true

	// sha256crypt ($5$) -m 7400
	case "sha256crypt", "7400":
		return sha256crypt(data), true

	// sha512crypt ($6$) -m 1800
	case "sha512crypt", "1800":
		return sha512crypt(data), true

	// phpass -m 400
	case "phpass", "phpbb3", "400": // phpass = $P$, phpbb3 = $H$
		return phpassMD5(data, hashFunc, 11, nil), true

	// yescrypt
	case "yescrypt":
		return yescryptHash(data), true

	// gost-yescrypt
	case "gostyescrypt", "gost-yescrypt":
		return gostYescryptHash(data), true

	default:
		return "", false
	}
}

func hashBytes(hashFunc string, data []byte, cost int) string {
	s, ok := hashBytesDispatch(hashFunc, data, cost)
	if !ok {
		log.Printf("--> Invalid hash function: %s <--\n", hashFunc)
		return ""
	}
	return s
}

// process wordlist chunks
func processChunk(chunk []byte, count *int64, hexErrorCount *int64, hashFunc string, writer *bufio.Writer, hashPlainOutput bool, cost int) {
	reader := bytes.NewReader(chunk)
	scanner := bufio.NewScanner(reader)
	for scanner.Scan() {
		lineBytes := scanner.Bytes()
		decodedBytes, hexContent, hexErrCount := checkForHex(lineBytes)
		hash := hashBytes(hashFunc, decodedBytes, cost)
		if hash == "" {
			continue
		} // skip empty lines
		writer.WriteString(hash)
		if hashPlainOutput {
			_ = writer.WriteByte(':')
			_, _ = writer.Write(hexContent)
		}
		_ = writer.WriteByte('\n')
		atomic.AddInt64(count, 1)                          // line count
		atomic.AddInt64(hexErrorCount, int64(hexErrCount)) // hex error count
	}
	_ = writer.Flush()
}

// process logic
func startProc(hashFunc string, inputFile string, outputPath string, hashPlainOutput bool, numGoroutines int, cost int) {
	//var readBufferSize = 1024 * 1024 // read buffer
	var readBufferSize = numGoroutines + 16*32*1024 // variable read buffer

	// lower read buffer for slow(ish) algorithms
	{
		bufFixed := map[string]bool{
			"phpass": true, "phpbb3": true, "400": true,
			"md5crypt": true, "500": true,
			"sha1crypt": true, "15100": true,
			"sm3crypt": true, "35100": true,
			"sha256crypt": true, "7400": true,
			"sha512crypt": true, "1800": true,
			"10900": true, "pbkdf2sha256": true, "pbkdf2-sha256": true,
			"11900": true, "pbkdf2md5": true, "pbkdf2-md5": true,
			"12000": true, "pbkdf2sha1": true, "pbkdf2-sha1": true,
			"12100": true, "pbkdf2sha512": true, "pbkdf2-sha512": true,
		}
		if bufFixed[hashFunc] {
			readBufferSize = numGoroutines + 16*32
		}
	}

	// lower read buffer for bcrypt-family (scale by cost)
	if isBcryptMode(hashFunc) {
		readBufferSize = numGoroutines/cost + 32*2
	}

	// lower read buffer for argon2id, yescrypt, gost-yescrypt, scrypt, cmiyc
	{
		bufSlow := map[string]bool{
			"argon2id": true, "34000": true,
			"yescrypt": true, "gostyescrypt": true, "gost-yescrypt": true,
			"cmiyc": true,
			"8900":  true, "scrypt": true,
		}
		if bufSlow[hashFunc] {
			readBufferSize = numGoroutines + 8*2
		}
	}

	var writeBufferSize = 2 * readBufferSize // write buffer (larger than read buffer)

	var linesHashed int64 = 0
	var procWg sync.WaitGroup
	var readWg sync.WaitGroup
	var writeWg sync.WaitGroup
	var hexDecodeErrors int64 = 0 // hex error counter

	type chunk struct {
		index int
		data  []byte
	}
	type writeItem struct {
		index int
		data  string
	}

	readChunks := make(chan chunk, 1000)    // channel for reading chunks of data
	writeData := make(chan writeItem, 1000) // channel for writing processed data

	// determine input source
	var file *os.File
	var err error
	if inputFile == "" {
		file = os.Stdin // default to stdin if no input flag is provided
	} else {
		file, err = os.Open(inputFile)
		if err != nil {
			log.Printf("Error opening file: %v\n", err)
			return
		}
		defer file.Close()
	}

	// print start stats
	log.Println("Starting...")
	if inputFile != "" {
		log.Println("Processing file:", inputFile)
	} else {
		log.Println("Reading from stdin...")
	}
	log.Println("Hash function:", hashFunc)
	log.Println("CPU Threads:", numGoroutines)

	startTime := time.Now()

	// read goroutine
	readWg.Add(1)
	go func() {
		defer readWg.Done()
		var remainder []byte
		reader := bufio.NewReaderSize(file, readBufferSize)
		chunkIndex := 0
		for {
			chunkBuf := make([]byte, readBufferSize)
			n, err := reader.Read(chunkBuf)
			if err == io.EOF {
				break
			}
			if err != nil {
				fmt.Fprintln(os.Stderr, "Error reading chunk:", err)
				return
			}
			// logic to split chunks properly
			chunkBuf = chunkBuf[:n]
			chunkBuf = append(remainder, chunkBuf...)

			lastNewline := bytes.LastIndexByte(chunkBuf, '\n')
			if lastNewline == -1 {
				remainder = chunkBuf
			} else {
				readChunks <- chunk{index: chunkIndex, data: chunkBuf[:lastNewline+1]}
				chunkIndex++
				remainder = chunkBuf[lastNewline+1:]
			}
		}
		if len(remainder) > 0 {
			readChunks <- chunk{index: chunkIndex, data: remainder}
		}
		close(readChunks)
	}()

	// processing goroutine
	for i := 0; i < numGoroutines; i++ {
		procWg.Add(1)
		go func() {
			defer procWg.Done()
			for chunk := range readChunks {
				localBuffer := bytes.NewBuffer(nil)
				writer := bufio.NewWriterSize(localBuffer, writeBufferSize)
				processChunk(chunk.data, &linesHashed, &hexDecodeErrors, hashFunc, writer, hashPlainOutput, cost)
				writer.Flush()
				writeData <- writeItem{index: chunk.index, data: localBuffer.String()}
			}
		}()
	}

	// write goroutine
	writeWg.Add(1)
	go func() {
		defer writeWg.Done()
		var writer *bufio.Writer
		if outputPath != "" {
			outFile, err := os.Create(outputPath)
			if err != nil {
				fmt.Fprintln(os.Stderr, "Error creating output file:", err)
				return
			}
			defer outFile.Close()
			writer = bufio.NewWriterSize(outFile, writeBufferSize)
		} else {
			writer = bufio.NewWriterSize(os.Stdout, writeBufferSize)
		}

		pending := make(map[int]string)
		next := 0
		for item := range writeData {
			pending[item.index] = item.data
			for {
				data, ok := pending[next]
				if !ok {
					break
				}
				writer.WriteString(data)
				writer.Flush() // flush after each write
				delete(pending, next)
				next++
			}
		}

		for {
			data, ok := pending[next]
			if !ok {
				break
			}
			writer.WriteString(data)
			writer.Flush()
			delete(pending, next)
			next++
		}
	}()

	// wait for sync.waitgroups to finish
	procWg.Wait()
	readWg.Wait()
	close(writeData)
	writeWg.Wait()

	// print stats
	elapsedTime := time.Since(startTime)
	runTime := elapsedTime.Seconds()

	lps := float64(linesHashed) / runTime // raw lines/sec

	unit := ""    // < 1 K (oh, so slow)
	scaled := lps // lines per second
	switch {
	case lps >= 1e12: // Trillion (not likely!)
		unit = "T"
		scaled = lps / 1e12
	case lps >= 1e9: // Billion (what CPU is this?)
		unit = "B"
		scaled = lps / 1e9
	case lps >= 1e6: // Million (yep)
		unit = "M"
		scaled = lps / 1e6
	case lps >= 1e3: // Thousand (still so slow)
		unit = "K"
		scaled = lps / 1e3
	}

	if hexDecodeErrors > 0 {
		log.Printf("HEX decode errors: %d\n", hexDecodeErrors)
	}

	if unit == "" {
		log.Printf("Finished processing %d lines in %.3f sec (%.3f lines/sec)\n", linesHashed, runTime, scaled) // < 1 K
	} else {
		log.Printf("Finished processing %d lines in %.3f sec (%.3f %s lines/sec)\n", linesHashed, runTime, scaled, unit) // K +
	}
}

// main func
func main() {
	hashFunc := flag.String("m", "", "Hash function to use")
	inputFile := flag.String("w", "", "Input file to process (use 'stdin' to read from standard input)")
	outputFile := flag.String("o", "", "Output file to write hashes to (use 'stdout' to print to console)")
	hashPlainOutput := flag.Bool("hashplain", false, "Enable hashplain output (hash:plain)")
	benchmark := flag.Bool("b", false, "Benchmark mode (disables output)")
	threads := flag.Int("t", 0, "Number of CPU threads to use")
	costFlag := flag.Int("cost", 10, "Bcrypt cost (4-31)")
	iterFlag := flag.Int("i", 0, "PBKDF2 iteration count (modes 10900, 11900, 12000, 12100)")
	version := flag.Bool("version", false, "Program version:")
	cyclone := flag.Bool("cyclone", false, "hashgen")
	help := flag.Bool("help", false, "Prints help:")
	flag.Parse()

	// run sanity checks for special flags
	if *version {
		versionFunc()
		os.Exit(0)
	}
	if *cyclone {
		decodedStr, err := base64.StdEncoding.DecodeString("Q29kZWQgYnkgY3ljbG9uZSA7KQo=")
		if err != nil {
			fmt.Fprintln(os.Stderr, "--> Cannot decode base64 string. <--")
			os.Exit(1)
		}
		fmt.Fprintln(os.Stderr, string(decodedStr))
		os.Exit(0)
	}
	if *help {
		helpFunc()
	}

	// run sanity checks on mode input (-m)
	if *hashFunc == "" {
		log.Fatalf("--> missing '-m mode' <--")
	}
	modeProbe = true
	_, ok := hashBytesDispatch(*hashFunc, nil, *costFlag)
	modeProbe = false
	if !ok {
		fmt.Fprintf(os.Stderr, "--> invalid -m mode %q (see -help for supported modes) <--\n", *hashFunc)
		os.Exit(1)
	}

	if *iterFlag < 0 || *iterFlag > 100000000 {
		log.Fatalf("Error: -i must be between 0 and 100000000")
	}
	if *iterFlag > 0 {
		if !isPBKDF2Mode(*hashFunc) {
			log.Fatalf("Error: -i is only valid with PBKDF2 modes (10900, 11900, 12000, 12100)")
		}
		pbkdf2IterCount = *iterFlag
	}

	// block output flags when benchmarking
	if *benchmark {
		if *outputFile != "" {
			log.Fatalf("Error: -o flag cannot be used with -b (benchmark mode)")
		}
		// force discard output
		*outputFile = os.DevNull
	}

	// run sanity check for bcrypt / cost
	costProvided := *costFlag != 10
	if costProvided && !isBcryptMode(*hashFunc) {
		log.Fatalf("Error: -cost flag is only allowed for bcrypt modes")
	}
	if isBcryptMode(*hashFunc) {
		if *costFlag < bcrypt.MinCost || *costFlag > bcrypt.MaxCost {
			log.Fatalf("Invalid bcrypt cost: must be between %d and %d", bcrypt.MinCost, bcrypt.MaxCost)
		}
	}

	// determine CPU threads to use
	numThreads := *threads
	maxThreads := runtime.NumCPU()

	// thread sanity check (can't use <= 0 or > available CPU threads)
	if numThreads <= 0 {
		numThreads = maxThreads
	} else if numThreads > maxThreads {
		numThreads = maxThreads
	}

	runtime.GOMAXPROCS(numThreads) // set CPU threads

	// start main logic (startProc)
	startProc(*hashFunc, *inputFile, *outputFile, *hashPlainOutput, numThreads, *costFlag)
}

// end code