Hello. I'm have some broken wallet.dat, restored from raw drive image. Wallet made by Bitcoin core v0.15-0.16 (as I know).
Tested in different restore/brutforce software. All scripts stuck while opening file. Bitcoin Core says that file was broken and sweep isn't possible.
But if I open this file using basic text editor, it's contain addresses in plaintext and all other data looks like normal wallet.dat.

I'm tried to understand raw file structure, but only find some high level tools/libs.

I think it is possible to recover private keys from this file, but I need some tool to check/decrypt raw data from wallet.

Anyone know how in low level does private keys stored and encrypted in this file?

Maybe exist some tool that can test provided data (bitcoin address, encryption password, some raw string) by all encryption methods that used in different versions of Bitcoin Core software? So I can scan all this file, cut it on chunks length of encrypted private key, and test it by this tool.

Maybe not a ready to use tool, but some low level libs.

I make two orders:
28 Nov 2013, 01:00 - 10pcs Prospero X-1 (100Ghash/second)
24 Jan 2014, 17:25 - Rent-Some-Minions - 6 months (starts in May 2014)
Total: $6445.38

14 Jun 2014 I post ticket in they support desk and say that because Russia invaders Ukraine, I move to another town and need to update my shipping information. Sent them my new address. They escalate ticket to supervisor. And then silence. I sent them some comments, but they don't answer. Than I told that If they can't change my shipping address, then I need full refund. And then silence. No mail, no hardware, no refund.

Today (03 Sep 2014) I want to check my ticket at they helpdesk, but system says "Wrong password". Ok, I did the password reset. Trying to login with new password and then the same "Wrong password". Change password to another (simpler one, shorter, only letters), and then the same "Wrong password".

In this case, I conclude: Black Arrow software is SCAM. They stole my $6445.38.