Based on the latest information from the official website and the v1.531 release notes, here is an updated summary of mdxfind as a digital multi-tool, now with GPU acceleration.
MDXfind v1.531: The Swiss Army Knife, Now with a Power Drill
Forget single-purpose tools. MDXfind is the cryptographic equivalent of a Swiss Army knife—a hybrid CPU/GPU brute-force hash searcher that tests a single plaintext candidate against 994+ hash algorithms simultaneously. Version 1.531 (August 2026) transforms it from a hand tool into a power tool.
1. The Blade You Need for Unknown Hashes
Most crackers require you to know the hash type upfront. MDXfind doesn't care.
"ALL" Mode: A single command can identify and crack hashes from a pile of mixed, unidentified dumps, running them against its entire library of algorithms.
Filtering Power: You can pare the search space using boolean operators like -h 'ALL' -h '!salt,!user' to exclude salted or username-based hashes and focus on what matters.
2. The New Power Drill: Full GPU Acceleration
This is the headline feature of v1.531. The tool now leverages OpenCL to offload intensive cracking work to your graphics card.
Massive Parallelism: GPU acceleration dramatically increases candidate testing rates for compute-bound algorithms.
Smarter Work Distribution: The dispatch logic was overhauled. Previously, expensive types like SCRYPT ran on a single core. Now, the gate uses rate / Livesalts instead of raw hashes/sec. Measured improvement: SCRYPT on 1,800 salts went from 1× to 4.3× parallel throughput. Compute-bound types gain even more.
Platform Support: Runs on x86_64, i686, ARM6/7/8, AArch64, ppc64le, FreeBSD, Windows, and macOS with SSE2/SSSE3/NEON runtime dispatch.
3. "Chained" Attacks (The Nested Blade)
It excels at tackling complex, nested hashing constructions that stymie other tools.
Iterations: Need to test md5(md5($pass)) or up to 4 billion iterations? Just tweak the -i parameter.
Exotics: Supports rare chained formats like MD5DECBASE64MD5BASE64MD5 and the newly added SHA1CRYPT ($sha1$, hashcat 15100) and GOST-YESCRYPT ($gy$).
4. The Crowbar: Cracking the Uncrackable (New Types in v1.531)
Four new, difficult hash types were added:
-m e999 [SHA1CRYPT] — NetBSD/Juniper sha1crypt, $sha1$ (ha#1a5fb4shcat 15100). Iterated HMAC-SHA1 with the password as the persistent key. Input is liberal and output is conformant: the 28-character digest field encodes 21 bytes where SHA-1 produces only 20, and NetBSD pads the final group with digest[0] wrapped around. hashcat's published -m 15100 example hash uses 0 for that byte and is therefore nonconformant; mdxfind accepts that spelling and reports the correct NetBSD/corpus one. The wrap convention was confirmed against 8,262 real hashes, 8,262 of 8,262.
-m e998 GOST-YESCRYPT — $gy$. HMAC-Streebog256(HMAC-Streebog256(Streebog256(K), M), yescrypt(K, S)), where the inner HMAC message is the setting without its trailing $. Validated 25 of 25 against libxcrypt 4.4.27 across distinct real salts, plus salt lengths 4/8/12/16 and empty, and against an independently written third-party implementation.
-m e1001 CMIYC — $cmiyc$, a contest-local type recovered from a stripped AIX PowerPC binary. Memory-hard: 64 MiB working set and 9,437,184 SHA-512 operations per candidate per salt. Validated against real hashes with known plaintexts.
-m e884 SCRYPT now also accepts the $7$ crypt spelling in addition to SCRYPT:N:r:p:b64salt:b64hash. The $7$ form packs N/r/p as crypt64 characters and uses the salt as raw ASCII rather than base64, so it is normalised at load into the canonical form; both spellings are emitted on a crack.
-m e1000 7ZIP — 7-Zip AES, $7z$ (hashcat 11600). Verifies by checking the AES zero-padding on the final ciphertext block rather than decrypting and decompressing, so Deflate64 archives crack — hashcat and john both report "exhausted" on those even when the password is in the wordlist, because neither implements a Deflate64 decompressor in its verify path. Stock 7z2john output exceeds mdxfind's line limit — the entire encrypted stream sits in the final field, roughly 113 KB even for a small archive — so tools/7z2mdx.py truncates that field to the two ciphertext blocks stage 1 actually needs.
5. The Bottle Opener: Modular Companion Tools
It doesn't work alone. The distribution includes:
mdsplit – Automatically sorts cracked hashes into per-hashtype files, drastically reducing target list size for other tools.
getpass – Password extractor.
hashpipe – A new companion introduced in v1.531 (exact function detailed in the release notes).
6. The Ergonomic Grip: Real-Time Status & Stability
When dealing with massive wordlists, you need to know if it's working.
Comfort Messages: Outputs status updates every 15 seconds showing candidates/second and "busyness" (w=), so you can tune the attack.
Pausing: Ctrl-Z suspends the process, and fg resumes it without losing progress.
Critical Stability Fixes:
Heap Corruption Fixed: A bug that caused free(): invalid pointer crashes during hash loading was resolved. The code now passes AddressSanitizer on a 55,404-hash corpus.
User-Defined Types: Now have a separate address space from built-in types, preventing accidental aliasing.
Windows Fixes: Hostnames now report correctly (via GetComputerNameA), and debug dumps no longer target the non-existent /tmp directory.
In Short MDXfind v1.531 is no longer just a Swiss Army knife—it's a Swiss Army knife with a built-in power drill.** If your hash list is a black box, this is the one tool you need to pry it open, now at GPU speed.
Release notes: https://github.com/Cynosureprime/mdxfind/releases/tag/v1.531
Github: https://github.com/Cynosureprime/mdxfind
and https://www.mdxfind.com/
