def sign(privkey, nonce, message):
    known_bits = 6
    kbi = int(2 ** known_bits)
    kp = nonce % kbi  # k nonce % kbi

    z = message
    nonceG = nonce * G

    rx = nonceG.x()
    ry = nonceG.y()
    rx = int(rx)
    s = (z + rx * privkey) * modinv(nonce, n) % n

    return rx, s, z , kp

# Example usage
private = 0x12345678901234567890  # Example private key
public_key_point = private * G
public_key = (int(public_key_point.x()), int(public_key_point.y()))  # Get x, y coordinates
print('public_key (x, y):', public_key)
for i in range(1, 5):
    nonce = random.randrange(2 ** 256 - 1)
    message = random.randrange(2 ** 256 - 1)
    r, s, z ,kp = sign(private, nonce, message)
    print("k =", nonce)
    print("kp =", kp)
    print("r =", r)
    print("s =", s)
    print("z =", z)

    print()

import hashlib
import binascii
import pyaes
import os
import random

# Wallet software generates a random 32 byte master key. (How this is done is well documented and is not
# explained here). The master key needs to be encrypted to protect your funds. The one below is made up.
# You can substitute your own key below to try the software but DO NOT publish your own key anywhere.
mkey = binascii.unhexlify("5c5692daff165d3d32e5c05a56dde3b2d0ebc05f133f8d0616941e9abe7e0fb0")

# Wallet software will ask you for a password to encrypt the master key.
# You can change the password below for your own, but don't lose the b in front.
pw_txt = "alberto" #Thank you AlbertoBSD for Keyhunt!
password = b'alberto'

# Also needed is some 'randomness' in the form of a salt and an iteration count. These are generated by the wallet.
# Use the # to comment out the salt and iteration count below if testing your own values.

# create a random 8 byte salt and iteration count.
# salt = os.urandom(8)
# iterationcount = random.randint(2500, 50000)

# Now if you run the program several times, you will see you get different wallet keys for the same password.
# The random salt and iterations help prevent duplicate wallet keys for the same password.
# These two values are saved in wallet.dat so that the wallet key can be recreated (not decrypted) if you know the password.

# here you can substitute your own salt and iteration count from a wallet. Remove the # in front
salt = binascii.unhexlify('a49e804e25740714')
iterationcount = 91705

# Hashing with SHA512. This process generates the wallet key and IV. It is one-way. You cannot go back from
# here to recover the password, which is why it is so important you remember it.
# It is also essential that the password is strong because this is where dictionary attacks can take place.
# Remember the salt & iterations are recoverable from the wallet.dat files!

hash512 = password + salt
i = 0
while i < iterationcount:
    hash512 = hashlib.sha512(hash512).digest()
    i = i + 1

# The wallet key is the first 32 bytes of the hash result.
wallet_key = hash512[0:32]
# The IV (initialization vector) is the next 16 bytes of the hash
iv = hash512[32:48]

# We now have all we need to encrypt the master key
# Encryption with AES-256-CBC
encrypter = pyaes.Encrypter(pyaes.AESModeOfOperationCBC(wallet_key, iv))
ciphertext = encrypter.feed(mkey)
ciphertext += encrypter.feed()
# The cipher text is what you see in the wallet.dat files as Mkey followed by 48 bytes
# There are also Ckey's which hold the private spend keys for each address.
#######################################################################################
# Your master private key is now encrypted!!
#######################################################################################
# Decryption is the reverse process using the same wallet key and IV to process the ciphertext (Mkey)

# Decryption with AES-256-CBC
decrypter = pyaes.Decrypter(pyaes.AESModeOfOperationCBC(wallet_key, iv))
decryptedData = decrypter.feed(ciphertext)
decryptedData += decrypter.feed()
# The master key is now decrypted for all the world to see.
# Before we can spend any funds we need to decrypt the Ckeys which hold the private spend keys to the addresses.
# As you can see with no Ckey's, wallet recovery services cannot access your funds. It is safe to send Mkey ciphertext
# iteration count and salt but not the wallet itself as this has ALL the keys.
# ======================================================================================================================
# Now to decrypt a Ckey which holds the private spend key to an address. Here's one I made earlier.
# public address: 18sGovZjm83NhxXQb1bsxogCqXiYE5nXn7

ckey = binascii.unhexlify("316787cf83a3c9caeca2a2b20f0879edc2a8c60ed127453c00330d1ac009402d78eff292b03e588a3b858410ea2628ed")
public_key = binascii.unhexlify("027a098dbada15a831c66491cb20dee174d4971fdd9766a3b6c3dc64562cbb6524")
# Hash the public key twice
hash1 = hashlib.sha256(public_key).digest()
hash2 = hashlib.sha256(hash1).digest()
# The IV to the private key is the first 16 bytes of the hash result.
pk_iv = hash2[0:16]

# Decrypt the ciphertext Ckey with the master key and IV
decrypter = pyaes.Decrypter(pyaes.AESModeOfOperationCBC(decryptedData, pk_iv))
decryptedckey = decrypter.feed(ckey)

# The plain text 32 byte raw key is now visible to the world!
# You can put the key into one of the online services and see the result is the compressed public address above.


# Display results
def printData(text, data):
    print(text + "(hex)   :" + data.hex())


print("Password      ", pw_txt)
printData("SHA512        ", hash512)
printData("Wallet Key    ", wallet_key)
printData("16 bytes IV   ", iv)
printData("Encrypting    ", mkey)
printData("Ciphertext    ", ciphertext)

# Decrypted data
printData("Master key    ", decryptedData)

# Ckey output
printData("\nCkey               :", ckey)
printData("Public Double hash :", hash2)
printData("PK IV              :", pk_iv)
printData("Private Key        :", decryptedckey)
printData("to public Key      :", public_key)

# If you have found this useful please consider a small BTC tip to bc1qg82720gvdyvnc3jycnun348fhs3qam44nsmeqm

def extended_gcd(aa, bb):
    lastremainder, remainder = abs(aa), abs(bb)
    x, lastx, y, lasty = 0, 1, 1, 0
    while remainder:
        lastremainder, (quotient, remainder) = remainder, divmod(lastremainder, remainder)
        x, lastx = lastx - quotient*x, x
        y, lasty = lasty - quotient*y, y
    return lastremainder, lastx * (-1 if aa < 0 else 1), lasty * (-1 if bb < 0 else 1)


def modinv(a, m):
    g, x, y = extended_gcd(a, m)
    if g != 1:
        raise ValueError
    return x % m


N = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141
# Control
# R = 0x00d47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1
# S = 0x0044e1ff2dfd8102cf7a47c21d5c9fd5701610d04953c6836596b4fe9dd2f53e3e
# Z = 0x00c0e2d0a89a348de88fda08211c70d1d7e52ccef2eb9459911bf977d587784c6e
# X = 0x00c477f9f65c22cce20657faa5b2d1d8122336f851a508a1ed04e479c34985bf96
# K = 0x007a1a7e52797fc8caaa435d2a4dace39158504bf204fbe19f14dbb427faee50ae

R = 0x007e6a9ba2cb33641246c5eb873d4ac35c6c9b0e24414789197e7ab7a1755c03e3
S = 0x00f5e5d215c56968f04f950044f89e056d8f7d637af698671d003e5be5f36c80c8
Z = 0x00a9327aba1cbc6180ef2ccd7263f9cccee589c6470c9bd0be27775e4339917daa

X = 0x00b468ebc8d97677f6fa98a2c5c1b55d5249632b655f1a9ac46736f4cfa7b7c12f
K = 0x0023f930da5ee9fd50a92fbb690803f799819647c800d173ffae062699fe59ae22

# proving R = (((S * K) - Z) / X) % N
print('R ' + hex((((S * K) - Z) * modinv(X, N)) % N))

# proving S = ((Z + (X * R)) / K) % N
print('S ' + hex(((Z + (X * R)) * modinv(K, N)) % N))

# proving Z = ((S * K) - (X * R)) % N
print('Z ' + hex(((S * K) - (X * R)) % N) + '\n')

# proving X = (((S * K) - Z) / R) % N
print('X ' + hex((((S * K) - Z) * modinv(R, N)) % N))

# proving K = ((Z + (X * R)) / S) % N
print('K ' + hex(((Z + (X * R)) * modinv(S, N)) % N) + '\n')

Fixed Nonce bits = 120           Minimum Signature Required = 3
###############################################################################
Pubkey: 02ceb6cbbcdbdf5ef7150682150f4ce2c6f4807b349827dcdbdd1f2efa885a2630
###############################################################################
 Original Matrix
[[115792089237316195423570985008687907852837564279074904382605163141518161494337, 0, 0, 0], [0, 115792089237316195423570985008687907852837564279074904382605163141518161494337, 0, 0], [2467487001254455993260094658069538855875427230575473380664872814242199500527890086092853464270371686385869184249816116248601700397690358585592398162412910, -751681887687496519376062645086290988269867503556637724056603560423474193255164232026755956106024417782854651835316585599337402346461143524154025671989707, 7.52316384526264e-37, 0], [6032443261600613981788543854259123836926830336971803094527945402644254025612712542413636299653573823792930177014767562523084773905042649848397762714980344, 514759699049319332434416455458880129761050389688502952714638126953158121130186708055060830078576096772207625800998356728332240331389528116349768135785841, 0, 87112285931760246646623899502532662132736]]
k= 0x25d46d0bccbc08eafa03912b3f2c206
Generated private key = 0x565ae23651bb5c3141870c7ed367bd270c644ba7227c9975096d16f18ce2f1cd
k= 0x25d46d0bccbc08eafa03912b3f2c206
Generated private key = 0x565ae23651bb5c3141870c7ed367bd270c644ba7227c9975096d16f18ce2f1cd
k= 0x29c9ececdceab18cfba91146e5ded7e
Generated private key = 0x8652756d2bbbf9c014964e0ab7b150fe0b629646426f1172ec2fa2f005ce454d
k= 0x141bf2eb7b3d7b7b5bbf78d4f28bcda
Generated private key = 0x63577c3c016a76d9f81df9606b745bc30be3831923e30ca771f7b25694f9c679