Find better pad size

[magnumripper]

7z2hashcat tries to find "shortest file" for attacking. I think we should include "padding size" in the equation when applicable: In case we can find a larger file but with better padding, it might well be worth it!

[magnumripper]

It seems when adding many files at once to an archive, it automagically becomes "solid", perhaps that means we can't use padding attack except on very first file (if even that)?

Or maybe we can, but only if we pick the first file/stream. If the latter is true AND there is usable padding, maybe we shouldn't search for a smaller file.

The other scenario is adding a file at a time to an archive. Then it may end up as non-solid - and we can compare all padding sizes and consider them when comparing data sizes, as in OP.

[0x0OZ]

I used 7z2hashcat.exe against a 9 year old 7z archive I think its size was 12GB and got a 3MB hash file
txt.txt
This file is 6MB but it will become 3MB if converted to UTF8.
I also tried 7z2john and got the same large hash file

[zhaoxishm]

我使用 7z2hashcat.exe 处理了一个 9 年前的 7z 档案，我认为它的大小是 12GB，并得到了一个 3MB 的哈希文件 txt.txt。 该文件为 6MB，但如果转换为 UTF8，它将变成 3MB。 我也尝试了 7z2john，得到了同样大的哈希文件

Yes, the same thing happened to me.