Pywallet 2.2: manage your wallet [Update required]

[SheriffBass]

Hi, I just found an old wallet from August 2011. I've tried using this tool to recover it and it creates the following files:

_db.001 24k
_db.002 64k
_db.003 264k
_db.004 96k
_db.005 512k
_db.006 48k
wallet.txt 0k

I couldn't find any information as to why it comes out as empty nor did I find any fix to this problem. I also tried using Bitcoin Core to recover it but it didn't work, and also tried bitcoin-qt 0.7.0 but it didn't work either. These are both newer than my wallet but I couldn't find any older clients anywhere.

Does this mean it's completely corrupt? Thankful for any help trying to recover this as I haven't found anyone else with this particular problem.

How did you install this for windows 10 if you don't mind me asking?, Thanks. I really really need to run it on a corrupt wallet.dat that I have.

Did u recover it?
Any luck, ideas or advice?
Do u know if the _db files r Bitcoin/ wallet specific??

[1715452936]

1715452936

[1715452936]

1715452936

[1715452936]

1715452936

[HCP]

the _db files are just files that pywallet will create as it is attempting to recover keys etc... I'm not 100% sure if they are bitcoin/wallet specific as such, or if they're just temp data. In any case, what you're looking for after the recover is a "recovered_wallet_xxxxxxxxxx.dat" (where xxxxxxxxxx will be a unix epoch timestamp)

That file will contain any private keys if it finds any... note that it will still create the recovered wallet.dat even if it doesn't find any and it will be able to be read/used by Bitcoin Core, it just won't contain anything.

[ldb68]

So I think I will help everyone with this wallet-extraction thing.  I was the one that found unencrypted keys in the 0.4.0 encrypted wallet, so I'm pretty sure I can find the encrypted keys  And Armory uses a very similar technique for encryption, so I'm basically already set up for this.  A few things I hope someone will be able to answer for me.  

(1)  I need to find nDeriveIterations.  Is there an easy way to find it for a hex-diver like me, or do I actually have to open the DB file with a BDB library to get to it?
(2)  I wish I'd thought of using the public key as the IV... that's pretty smart.  I assume it is the 65-byte private key that you double-sha256, correct?   Then, is it the first 16 bytes that are used for the IV?  AES256 IVs are only 16 bytes...
(3)  Is there any modification to the passphrase before applying X sha512 operations to it?  Is there any PBKDF2 calls somewhere?  (if there is, I'm not as well-prepared as I thought)

If anyone wants to simply use the work I've already done and split any appropriate bounties, I would be up for that  I have a python script which currently goes through the wallet.dat file pulls out every single public key, and then grabs any plaintext private keys nearby.  Of course, they private keys are not plaintext in this situation, but I can spit out the data where I expect the keys to be.  Then using CLI input params, I can actually apply the X sha512 operations and AES256-CBC decryption, provided with X and the passphrase.

I wouldn't mind doing this anyway, because I had planned on creating a wallet-conversion/import tool for Armory, but figured it was too much of a hassle.  Maybe now is a good time to deal with it

Hi! I saw your this post on the bitcontalk. I have a question, do not tell me how to find nDeriveIterations in the wallet.dat file?

[HCP]

I have a question, do not tell me how to find nDeriveIterations in the wallet.dat file?

You're probably better off creating a brand new thread here in Dev & Tech Discussion... the post you are quoting is over 7 1/2 years old and the user that posted it hasn't been active for over 2 years.

Your chances of anyone with the specific technical knowledge you seek reading this particular thread is relatively small. Creating a new thread with just your specific question will likely yield better results.

[marimanga]

I'm trying to dump private key from wallet.dat file is corrupted and no longer access but shows "Warning:root:pycrypto or libssl not found, decryption may be slow"

I've installed pycrypto-2.6.1.tar.gz and extracted files to a folder then moved folder to C:\Python27 , I'm doing something wrong?

Screenshot https://prnt.sc/rufmpy

My topic
https://bitcointalk.org/index.php?topic=5238503.0

[Lexiko]

I'm trying to dump private key from wallet.dat file is corrupted and no longer access but shows "Warning:root:pycrypto or libssl not found, decryption may be slow"

It's not a problem. It's just a warning.  You can ignore it.

[crypture]

When i do

Code:

sudo python2.7 ./pywallet.py --dumpwithbalance --datadir=/path/to/wallet/ --wallet=wallet.dat

It just prints out the readme. What am i doing wrong?

[HCP]

You have forgotten to add the --dumpwallet option to your command. You need to use that and --dumpwithbalance. Try this:

Code:

sudo python2.7 ./pywallet.py --dumpwallet --dumpwithbalance --datadir=/path/to/wallet/ --wallet=wallet.dat

and replace the /path/to/wallet/ with your actual path etc

[ashraful1980]

Pywallet is very old and the wallet.dat file format has changed since Pywallet was last updated (2014).

It looks like the script does not handle some of the new data fields that are now included in the wallet.dat file. It should theoretically be possible to modify the script to either handle or ignore the unknown fields.

If you just want to dump the file and don't care about making a "valid" wallet.dat... you can edit the pywallet.py file:

Change Line #2111 from:

Code:

				d.update(parse_BlockLocator(vds))

to:

Code:

				#d.update(parse_BlockLocator(vds))

Then on Line #2502, change:

Code:

			json_db['bestblock'] = d['hashes'][0][::-1].encode('hex_codec')

to:

Code:

			print("ignored") #json_db['bestblock'] = d['hashes'][0][::-1].encode('hex_codec')

The script will still spit out a whole heap of garbage like this:

Wallet data not recognized: {'__type__': 'keymeta', '__value__': "\n\x00\x00\x00\xa9\xd2\x85Z\x00\x00\x00\x00\x0bm/0'/0'/28'\x0c[\xfd\xe5\xabu\xfe\xf6\x13\xfb\x98p$F\xa6\xc2\xf1\\\xba\x04", '__key__': '\x07keymeta!\x03\xe3k\x94[F\xb4HO5f<b\x84\x88\x9fx\xb5Y~\xba\x01&e}\xcd\xbft\x90k\xdf\xbf\x07'}

but you should get to see all the key stuff printed out:

   "keys": [
        {
            "addr": "1PLXWsEWa3wrZTGo52FDjGiTP85LBbKRpg",
            "compressed": true,
            "hexsec": ".... removed ....",
            "private": "308ffffffffffffffffffffffffffffffffffffffffffffffffffffff73311b4fb36b7bffffffff ffffffffffffffffffffffffffffffffffffffffffffff48ce3d0101022100fffffffffffffffff ffffffffffffffffffffffffffffffffffffffefffffc2f30060fffffffffffffffffffffffffff fffffffffffffffffffffffffff6f81798022100fffffffffffffffffffffffffffffffebaaedce ffffffffffffffffffffffffffffffffffffffffffffffffffffff002067ddfffffffffffffffff fffffffffffffffffffffffffffffffffffff1298b98e",
            "pubkey": "02067dd94367c87da0d59c5f3b1c400239f846073b2b83b87bc15bc3201298b98e",
            "reserve": 1,
            "sec": ".... removed ....",
            "secret": ".... removed ...."
        }

The important one will be "sec"... that will be the WIF private key and should start with "5", "L" or "K"

Dear Sir,
I need to following option from pywallet
    "keys": [
        {
            "addr": "1PLXWsEWa3wrZTGo52FDjGiTP85LBbKRpg",
            "compressed": true,
            "hexsec": ".... removed ....",
            "private": "308ffffffffffffffffffffffffffffffffffffffffffffffffffffff73311b4fb36b7bffffffff ffffffffffffffffffffffffffffffffffffffffffffff48ce3d0101022100fffffffffffffffff ffffffffffffffffffffffffffffffffffffffefffffc2f30060fffffffffffffffffffffffffff fffffffffffffffffffffffffff6f81798022100fffffffffffffffffffffffffffffffebaaedce ffffffffffffffffffffffffffffffffffffffffffffffffffffff002067ddfffffffffffffffff fffffffffffffffffffffffffffffffffffff1298b98e",
            "pubkey": "02067dd94367c87da0d59c5f3b1c400239f846073b2b83b87bc15bc3201298b98e",
            "reserve": 1,
            "sec": ".... removed ....",
            "secret": ".... removed ...."
        }
could you please help me; i am available : ashraf.csr@gmail.com

[ashraful1980]

Donation address for pywallet is in the about page of the WUI, it's 1AQDfx22pKGgXnUZFL1e4UKos3QqvRzNh5. Thank you for making me mention it.

No problem.  Coins sent https://blockchain.info/tx/02f632bea4b192f899108b3706e001e828eed546eac0b19321154278c034c7c3  

Wait nobody has ever donated?  WTF? Soapbox mode engaged.

Public service announcement.  If pywallet has made your life easier (and you know it has), then show some support by sending some coins.  Come on this is a great tools to crack the byzantine mess that is wallet.dat.  Eventually the wallet will move to leveldb which is going to require a significant rewrite of pywallet.  Hint: developers tend not to continually support projects they see no support from the community.

BTW if you are reading this PSA, in the "Pywallet: manage your wallets/addresses/keys/tx's" thread, well the odds are it probably applies to you (otherwise you wouldn't be here).

hexsec is the hexadecimal private key (you must have made a mistake with your copypastings)
secret is hexsec alone if uncompressed address, and hexsec+'\x01' if compressed address
sec is WIF formatted private key

Weird that is not what I am getting.

Here is a unmodifed copy & paste of one key (a heads up to scammers, I removed this unused key from my keypool so nothing to steal)

Code:

E:\bitcoin\pywallet> pywallet.py --passphrase="NotMyPassphrase" --dumpwallet > wallet.decrypted.txt

...
        {
            "addr": "1MM4NpjXnWKohws4KCw9NpVPndmf9jB1Ho", 
            "compressed": true, 
            "encrypted_privkey": "65957014a15092d8329cd661d1a1acc38bf0eaec32b544b9e2fe38390697e2196c93a2b9e3a3d373701e67387ec015c4", 
            "hexsec": "KyFz1DzUkaCB53oM5VJhcp8Qg7aFWn88BuSqPg4rhLimuH3LMFv9", 
            "pubkey": "03ecdbccf53acedc9d283c2bd93b123f1bcd6ec07e5ce65babc81644e60a3e6c80", 
            "reserve": 1, 
            "sec": "KyFz1DzUkaCB53oM5VJhcp8Qg7aFWn88BuSqPg4rhLimuH3LMFv9", 
            "secret": "3cd80f8d99a883b0d48a9f844d94e8e875fbde18c5a6af1489dc9c4a8363c92401"
        }, 
...

This is on pywallet running on Windows, using a wallet exported from v0.8.3 client in case that somehow makes a difference.

Maybe I don't understand, but it's already what is happening when you dump an encrypted wallet without providing the passphrase.

DOH, I never tried.  I assumed passphrase was required for encrypted wallets.  Yeah it does exactly that and that is exactly what I was looking for.  I feel a little stupid that I needed assistance with that, but still glad I asked.  Pure awesome.

Pywallet could not possible as following output:
            "addr": "1MM4NpjXnWKohws4KCw9NpVPndmf9jB1Ho",
            "compressed": true,
            "encrypted_privkey": "65957014a15092d8329cd661d1a1acc38bf0eaec32b544b9e2fe38390697e2196c93a2b9e3a3d37 3701e67387ec015c4",
            "hexsec": "KyFz1DzUkaCB53oM5VJhcp8Qg7aFWn88BuSqPg4rhLimuH3LMFv9",
            "pubkey": "03ecdbccf53acedc9d283c2bd93b123f1bcd6ec07e5ce65babc81644e60a3e6c80",
            "reserve": 1,
            "sec": "KyFz1DzUkaCB53oM5VJhcp8Qg7aFWn88BuSqPg4rhLimuH3LMFv9",
            "secret": "3cd80f8d99a883b0d48a9f844d94e8e875fbde18c5a6af1489dc9c4a8363c92401"

[HCP]

I'm sorry, I still don't understand exactly what the problem is... are you saying that PyWallet is NOT giving you the address/private key data output when you try to use the dumpwallet command?

If so, what output and/or errors are you getting when you try to execute PyWallet?

[ashraful1980]

I'm sorry, I still don't understand exactly what the problem is... are you saying that PyWallet is NOT giving you the address/private key data output when you try to use the dumpwallet command?

If so, what output and/or errors are you getting when you try to execute PyWallet?

Sir,
I have find as following output:
        {
            "addr": "16j1ctvqrWck3NJE8j8hAWTxG1JaL3Pskk",
            "balance": "error code: 1015",
            "compressed": true,
            "encrypted_privkey": "f60916cd8c7bef5c62e60eb030c821c3e3ccdad1c07aefbfb28abd075492a4fe90e168ef9745b9f f692a79032490c2fb",
            "pubkey": "0201dbed4a25ad5e85cc36985faeb053b8562d5b5178f19a14dc16ff57b54feae1",
            "reserve": 1
        },


Could you please any instruction to me from pywallet to the following output:
            "addr": "1MM4NpjXnWKohws4KCw9NpVPndmf9jB1Ho",
            "compressed": true,
            "encrypted_privkey": "65957014a15092d8329cd661d1a1acc38bf0eaec32b544b9e2fe38390697e2196c93a2b9e3a3d37 3701e67387ec015c4",
            "hexsec": "KyFz1DzUkaCB53oM5VJhcp8Qg7aFWn88BuSqPg4rhLimuH3LMFv9",
            "pubkey": "03ecdbccf53acedc9d283c2bd93b123f1bcd6ec07e5ce65babc81644e60a3e6c80",
            "reserve": 1,
            "sec": "KyFz1DzUkaCB53oM5VJhcp8Qg7aFWn88BuSqPg4rhLimuH3LMFv9",
            "secret": "3cd80f8d99a883b0d48a9f844d94e8e875fbde18c5a6af1489dc9c4a8363c92401"

Or any script developed for the same output.

[ashraful1980]

question about "hexsec" and "secret"

consider this dump of an unencrypted wallet: (don't worry, I won't store bitcoins at these keys, I'm just experimenting)

Code:

    {
        "addr": "1EJP1Q1JEQdWtR5PEopCRZdE1F8dgk9Wwp", 
        "compressed": false, 
        "hexsec": "c703063648fd19d64de086064692dd17", 
        "private": "308201130201010420c703063648fd19d64de086064692dd17bd31ef4ebc8b8caa043d1fc7347d6a23a081a53081a2020101302c06072a8648ce3d0101022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f300604010004010704410479be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141020101a1440342000400481a16f118b4efe54b4783f857a9d45c8b5aec6cf03f7bc177ecc1d2faea443d4e94475ac9312cdfde1a30b4e953356c7e93312eabd92ddb070cdcfb981ee5", 
        "pubkey": "0400481a16f118b4efe54b4783f857a9d45c8b5aec6cf03f7bc177ecc1d2faea443d4e94475ac9312cdfde1a30b4e953356c7e93312eabd92ddb070cdcfb981ee5", 
        "reserve": 1, 
        "sec": "5KKw55iWFRmy614626Fo6ckzS7vxNcfhZJHvvo84W3cAzwfRjVo", 
        "secret": "c703063648fd19d64de086064692dd17"
    }

Why are "secret" and "hexsec" only 16 bytes?


This is the same key after loading the wallet with bitcoin 0.9 and encrypting it (and decrypting again with pywallet)

Code:

    {
        "addr": "1EJP1Q1JEQdWtR5PEopCRZdE1F8dgk9Wwp", 
        "compressed": false, 
        "encrypted_privkey": "cb9f081748ed5d42d010b10baa84748535e5588908e6cc70a28c44c550277ecdcaaf0d5e36cc9f919a0cf3471d2832d8", 
        "hexsec": "c703063648fd19d64de086064692dd17bd31ef4ebc8b8caa043d1fc7347d6a23", 
        "pubkey": "0400481a16f118b4efe54b4783f857a9d45c8b5aec6cf03f7bc177ecc1d2faea443d4e94475ac9312cdfde1a30b4e953356c7e93312eabd92ddb070cdcfb981ee5", 
        "reserve": 1, 
        "sec": "5KKw55iWFRmy614626Fo6ckzS7vxNcfhZJHvvo84W3cAzwfRjVo", 
        "secret": "c703063648fd19d64de086064692dd17bd31ef4ebc8b8caa043d1fc7347d6a23"
    }

It almost looks like the first version was just cut off in the middle.

Another question: Is there any documentation about the various elements of the json that is produced with pywallet?

* For example what is the meaning of the "pool" array, its repeating all the addresses but without their keys but seems to contain additional info, what is the rationale behind structuring it that way and not just put all info about a key into one object?
* what is the empty ckey array at the beginning of the dump?

It indeed cut the private key in the middle because of a stupid error. Thank you so much for finding that. It's now fixed.

Json keys doc:

defaultkey: Default address of your wallet
keys: Info about the private keys in the wallet
pool: Addresses inside the pool (bitcoin doc for more info)
tx: Transactions saved inside your wallet
names: Labels of addresses
mkey: Info about the master key when the wallet is encrypted
ckey: Not used

Sir,
How it is possible from pywallet as following; please give me instruction & where i can change from pywallet. Which i will output:
    {
        "addr": "1EJP1Q1JEQdWtR5PEopCRZdE1F8dgk9Wwp",
        "compressed": false,
        "encrypted_privkey": "cb9f081748ed5d42d010b10baa84748535e5588908e6cc70a28c44c550277ecdcaaf0d5e36cc9f9 19a0cf3471d2832d8",
        "hexsec": "c703063648fd19d64de086064692dd17bd31ef4ebc8b8caa043d1fc7347d6a23",
        "pubkey": "0400481a16f118b4efe54b4783f857a9d45c8b5aec6cf03f7bc177ecc1d2faea443d4e94475ac93 12cdfde1a30b4e953356c7e93312eabd92ddb070cdcfb981ee5",
        "reserve": 1,
        "sec": "5KKw55iWFRmy614626Fo6ckzS7vxNcfhZJHvvo84W3cAzwfRjVo",
        "secret": "c703063648fd19d64de086064692dd17bd31ef4ebc8b8caa043d1fc7347d6a23"
    }

OR

    {
        "addr": "1EJP1Q1JEQdWtR5PEopCRZdE1F8dgk9Wwp",
        "compressed": false,
        "hexsec": "c703063648fd19d64de086064692dd17",
        "private": "308201130201010420c703063648fd19d64de086064692dd17bd31ef4ebc8b8caa043d1fc7347d6 a23a081a53081a2020101302c06072a8648ce3d0101022100ffffffffffffffffffffffffffffff fffffffffffffffffffffffffefffffc2f300604010004010704410479be667ef9dcbbac55a0629 5ce870b07029bfcdb2dce28d959f2815b16f81798483ada7726a3c4655da4fbfc0e1108a8fd17b4 48a68554199c47d08ffb10d4b8022100fffffffffffffffffffffffffffffffebaaedce6af48a03 bbfd25e8cd0364141020101a1440342000400481a16f118b4efe54b4783f857a9d45c8b5aec6cf0 3f7bc177ecc1d2faea443d4e94475ac9312cdfde1a30b4e953356c7e93312eabd92ddb070cdcfb9 81ee5",
        "pubkey": "0400481a16f118b4efe54b4783f857a9d45c8b5aec6cf03f7bc177ecc1d2faea443d4e94475ac93 12cdfde1a30b4e953356c7e93312eabd92ddb070cdcfb981ee5",
        "reserve": 1,
        "sec": "5KKw55iWFRmy614626Fo6ckzS7vxNcfhZJHvvo84W3cAzwfRjVo",
        "secret": "c703063648fd19d64de086064692dd17"
    }

However if it is not pywallet; please give me your script as following email id: ashraf.csr@gmail.com

[ashraful1980]

New version 2.1.0b2: http://pastebin.com/raw.php?i=2FtQDj3v


You might want to try

Code:

python pywallet_2.1.0b2.py --clone_watchonly_from /home/jackjack/wallet.dat --clone_watchonly_to /home/jackjack/wallet2.dat

Sir,
The download link of : http://pastebin.com/raw.php?i=2FtQDj3v has been deleted; please send me the script following email: ashraf.csr@gmail.com

[ashraful1980]

RE: documentation about key encryption:

See the comment at the top of crypter.h:

Code:

Private key encryption is done based on a CMasterKey,                                                                                                   
which holds a salt and random encryption key.                                                                                                           
                                                                                                                                                        
CMasterKeys are encrypted using AES-256-CBC using a key                                                                                                 
derived using derivation method nDerivationMethod                                                                                                       
(0 == EVP_sha512()) and derivation iterations nDeriveIterations.                                                                                        
vchOtherDerivationParameters is provided for alternative algorithms                                                                                     
which may require more parameters (such as scrypt).                                                                                                     
                                                                                                                                                        
Wallet Private Keys are then encrypted using AES-256-CBC                                                                                                
with the double-sha256 of the public key as the IV, and the                                                                                             
master key's key as the encryption key (see keystore.[ch]).                                                                                             

The way I think of it:  Take the passphrase and salt and SHA512-hash them nDerivationIterations times.  That gets you an encryption key and initialization vector.

Use those to AES-256-decrypt the encrypted_key master key.

Now you can AES-256-decrypt the private keys, using the master key as the key and the (double-sha256-hash) PUBLIC part of the keypair as the initialization vector.

The "SHA-512-hash them a bunch of times" is actually done by the OpenSSL EVP_BytesToKey routine-- documentation for that is here: http://www.openssl.org/docs/crypto/EVP_BytesToKey.html

I'd been wondering about this for awhile. Thanks for the info.

Glad to see you are working on this again jackjack.  Once I can retire one of my old wallets, I'll send you a donation.

Sir,
I have several time try openssl AES-256-decrypt from encrypted_privkey; which i have find find from the pywallet. It is asking about the password or passphrase; i could not understand it really needed the password or passphrase. I will learn if any instruction about the openssl; please give me as following email address: ashraf.csr@gmail.com

[ashraful1980]

RE: documentation about key encryption:

See the comment at the top of crypter.h:

Code:

Private key encryption is done based on a CMasterKey,                                                                                                   
which holds a salt and random encryption key.                                                                                                           
                                                                                                                                                        
CMasterKeys are encrypted using AES-256-CBC using a key                                                                                                 
derived using derivation method nDerivationMethod                                                                                                       
(0 == EVP_sha512()) and derivation iterations nDeriveIterations.                                                                                        
vchOtherDerivationParameters is provided for alternative algorithms                                                                                     
which may require more parameters (such as scrypt).                                                                                                     
                                                                                                                                                        
Wallet Private Keys are then encrypted using AES-256-CBC                                                                                                
with the double-sha256 of the public key as the IV, and the                                                                                             
master key's key as the encryption key (see keystore.[ch]).                                                                                             

The way I think of it:  Take the passphrase and salt and SHA512-hash them nDerivationIterations times.  That gets you an encryption key and initialization vector.

Use those to AES-256-decrypt the encrypted_key master key.

Now you can AES-256-decrypt the private keys, using the master key as the key and the (double-sha256-hash) PUBLIC part of the keypair as the initialization vector.

The "SHA-512-hash them a bunch of times" is actually done by the OpenSSL EVP_BytesToKey routine-- documentation for that is here: http://www.openssl.org/docs/crypto/EVP_BytesToKey.html

I'd been wondering about this for awhile. Thanks for the info.

Glad to see you are working on this again jackjack.  Once I can retire one of my old wallets, I'll send you a donation.

Any command line or using procedure please....

[ashraful1980]

I'm sorry, I still don't understand exactly what the problem is... are you saying that PyWallet is NOT giving you the address/private key data output when you try to use the dumpwallet command?

If so, what output and/or errors are you getting when you try to execute PyWallet?

Sir,
I have find as following output:
        {
            "addr": "16j1ctvqrWck3NJE8j8hAWTxG1JaL3Pskk",
            "balance": "error code: 1015",
            "compressed": true,
            "encrypted_privkey": "f60916cd8c7bef5c62e60eb030c821c3e3ccdad1c07aefbfb28abd075492a4fe90e168ef9745b9f f692a79032490c2fb",
            "pubkey": "0201dbed4a25ad5e85cc36985faeb053b8562d5b5178f19a14dc16ff57b54feae1",
            "reserve": 1
        },


Could you please any instruction to me from pywallet to the following output:
            "addr": "1MM4NpjXnWKohws4KCw9NpVPndmf9jB1Ho",
            "compressed": true,
            "encrypted_privkey": "65957014a15092d8329cd661d1a1acc38bf0eaec32b544b9e2fe38390697e2196c93a2b9e3a3d37 3701e67387ec015c4",
            "hexsec": "KyFz1DzUkaCB53oM5VJhcp8Qg7aFWn88BuSqPg4rhLimuH3LMFv9",
            "pubkey": "03ecdbccf53acedc9d283c2bd93b123f1bcd6ec07e5ce65babc81644e60a3e6c80",
            "reserve": 1,
            "sec": "KyFz1DzUkaCB53oM5VJhcp8Qg7aFWn88BuSqPg4rhLimuH3LMFv9",
            "secret": "3cd80f8d99a883b0d48a9f844d94e8e875fbde18c5a6af1489dc9c4a8363c92401"

Or any script developed for the same output.

Show arguments from : https://github.com/mikeborghi/pywallet

Dump a wallet.dat located in the current directory:

Command Line is: python pywallet.py --dumpwallet --datadir=./ --wallet=wallet.dat
The output of each address in the wallet has the following fields:
"addr": " ",
"balance": "x", [if --dumpwithbalance is an argument)
"compressed": [true,false],
"hexsec": "[hex priv key]",
"private": "[raw ecdsa privkey]",
"pubkey": " [addr pubkey] ",
"reserve": 1,
"sec": "[base58check privkey]",

I have install windows 10 (64 bit) python2.7.17 (64 bit) & command line is:
python pywallet.py --dumpwallet --datadir=C:\Users\saad\Downloads\pywallet-master --wallet=wallet.dat

The output of each address in the wallet has the following fields:

{
"addr": "1CGZ817MMfEYiyhSwiCab2j8o55HrevdKh",
"compressed": true,
"encrypted_privkey": "db9c0a5fd651473504d1e6167a204e06e2e8813be2df029727e8fbb6795daa3b4874fac1ca7374e f0398ae610e1894a6",
"pubkey": "0200117a297804387e1e24d8b4ab33c4d063fa3e5b7449edcca58fd2d59a24c38e",
"reserve": 1
},

Could you please give me a instruction for more...

[ashraful1980]

RE: documentation about key encryption:

See the comment at the top of crypter.h:

Code:

Private key encryption is done based on a CMasterKey,                                                                                                   
which holds a salt and random encryption key.                                                                                                           
                                                                                                                                                        
CMasterKeys are encrypted using AES-256-CBC using a key                                                                                                 
derived using derivation method nDerivationMethod                                                                                                       
(0 == EVP_sha512()) and derivation iterations nDeriveIterations.                                                                                        
vchOtherDerivationParameters is provided for alternative algorithms                                                                                     
which may require more parameters (such as scrypt).                                                                                                     
                                                                                                                                                        
Wallet Private Keys are then encrypted using AES-256-CBC                                                                                                
with the double-sha256 of the public key as the IV, and the                                                                                             
master key's key as the encryption key (see keystore.[ch]).                                                                                             

The way I think of it:  Take the passphrase and salt and SHA512-hash them nDerivationIterations times.  That gets you an encryption key and initialization vector.

Use those to AES-256-decrypt the encrypted_key master key.

Now you can AES-256-decrypt the private keys, using the master key as the key and the (double-sha256-hash) PUBLIC part of the keypair as the initialization vector.

The "SHA-512-hash them a bunch of times" is actually done by the OpenSSL EVP_BytesToKey routine-- documentation for that is here: http://www.openssl.org/docs/crypto/EVP_BytesToKey.html

I'd been wondering about this for awhile. Thanks for the info.

Glad to see you are working on this again jackjack.  Once I can retire one of my old wallets, I'll send you a donation.

Sir,
It is use "Decrypt With Password Using OpenSSL" or "Decrypt Without Password Using OpenSSL"

[HCP]

The output you are getting is from an "encrypted" wallet... it has a password set... That is why you are getting:

...
            "encrypted_privkey": "f60916cd8c7bef5c62e60eb030c821c3e3ccdad1c07aefbfb28abd075492a4fe90e168ef9745b9f f692a79032490c2fb",
...

Without the wallet password, you will not be able to access the private keys!

If you know what the password is, you can specify it when running pywallet (or enter it when it prompts you).


If you aren't 100% sure what the password is, but you have some idea of what the password might be (ie. number of characters in the password and possible combinations of words/letters/symbols etc) then you might be able to use something like btcrecover or hashcat to try and bruteforce the password.

If you have no idea what the password is, then you have ZERO chance of bruteforcing the password and any bitcoins in that wallet are effectively "lost"

[sumitdadhich]

I'm sorry, I still don't understand exactly what the problem is... are you saying that PyWallet is NOT giving you the address/private key data output when you try to use the dumpwallet command?

If so, what output and/or errors are you getting when you try to execute PyWallet?

can you develop latest pywallet to give address/private key data output (decrypted key) if yes please contact me on sumitdadhich@gmail.com