Pywallet 2.2: manage your wallet [Update required]

[HCP]

PyWallet works fine as it is... you just need to make sure that you have the appropriate password to be able to decrypt the private keys.

If the wallet is encrypted, there are no modifications that can be made that will allow you to view the private key data without the password. Do you have the wallet password?

[SheriffBass]

I was reading about proper installation of bitcoin core and ran into the necessity of installing GPG on that computer  ( for using and storing trusted keys.......)
Does Jack Jack proper operation require GPG installation? Is it a given inherent part already built into the program? How do I know if I have it installed completely and works properly?

[HCP]

Short Answer: No, you do not need GPG.

Long Answer: Installation of Bitcoin Core does not require GPG... but it is recommended. GPG is used to verify the cryptographic signature of the compiled binary files... this is to help assure the user that the compiled binary files that they downloaded are indeed legitimate (and not fakes/possibly malware). Note that Bitcoin Core will work fine without GPG installed, but the end user cannot be 100% sure they used a legitimate binary installer unless they verified it with GPG first.

Pywallet does not have any such facility. It is written and distrbuted in a scripting language (Python) so you can inspect all the code by simply opening the .py script in a text editor.

To know if you have it installed correctly, you run it and see if it works. Generally something like "python scriptname.py --help" or "python scriptname.py --version" to see the script help and/or version number respectively will tell you if you have Python, the script and any dependencies installed and working OK.

[ashraful1980]

To whom it may concern - I added encrypted wallets support this morning - http://github.com/joric/pywallet
Here is the shorter, more readable version - PoC and simultaneously the unit test.

Code:

#!/usr/bin/env python

# Bitcoin wallet keys AES encryption / decryption (see http://github.com/joric/pywallet)
# Uses pycrypto or libssl or libeay32.dll or aes.py from http://code.google.com/p/slowaes

crypter = None

try:
    from Crypto.Cipher import AES
    crypter = 'pycrypto'
except:
    pass

class Crypter_pycrypto( object ):
    def SetKeyFromPassphrase(self, vKeyData, vSalt, nDerivIterations, nDerivationMethod):
        data = vKeyData + vSalt
        for i in range(nDerivIterations):
            data = hashlib.sha512(data).digest()
        self.SetKey(data[0:32])
        self.SetIV(data[32:32+16])
        return len(data)

    def SetKey(self, key):
        self.chKey = key

    def SetIV(self, iv):
        self.chIV = iv[0:16]

    def Encrypt(self, data):
        return AES.new(self.chKey,AES.MODE_CBC,self.chIV).encrypt(data)[0:32]
 
    def Decrypt(self, data):
        return AES.new(self.chKey,AES.MODE_CBC,self.chIV).decrypt(data)[0:32]

try:
    if not crypter:
        import ctypes
        import ctypes.util
        ssl = ctypes.cdll.LoadLibrary (ctypes.util.find_library ('ssl') or 'libeay32')
        crypter = 'ssl'
except:
    pass

class Crypter_ssl(object):
    def __init__(self):
        self.chKey = ctypes.create_string_buffer (32)
        self.chIV = ctypes.create_string_buffer (16)

    def SetKeyFromPassphrase(self, vKeyData, vSalt, nDerivIterations, nDerivationMethod):
        strKeyData = ctypes.create_string_buffer (vKeyData)
        chSalt = ctypes.create_string_buffer (vSalt)
        return ssl.EVP_BytesToKey(ssl.EVP_aes_256_cbc(), ssl.EVP_sha512(), chSalt, strKeyData,
            len(vKeyData), nDerivIterations, ctypes.byref(self.chKey), ctypes.byref(self.chIV))

    def SetKey(self, key):
        self.chKey = ctypes.create_string_buffer(key)

    def SetIV(self, iv):
        self.chIV = ctypes.create_string_buffer(iv)

    def Encrypt(self, data):
        buf = ctypes.create_string_buffer(len(data) + 16)
        written = ctypes.c_int(0)
        final = ctypes.c_int(0)
        ctx = ssl.EVP_CIPHER_CTX_new()
        ssl.EVP_CIPHER_CTX_init(ctx)
        ssl.EVP_EncryptInit_ex(ctx, ssl.EVP_aes_256_cbc(), None, self.chKey, self.chIV)
        ssl.EVP_EncryptUpdate(ctx, buf, ctypes.byref(written), data, len(data))
        output = buf.raw[:written.value]
        ssl.EVP_EncryptFinal_ex(ctx, buf, ctypes.byref(final))
        output += buf.raw[:final.value]
        return output

    def Decrypt(self, data):
        buf = ctypes.create_string_buffer(len(data) + 16)
        written = ctypes.c_int(0)
        final = ctypes.c_int(0)
        ctx = ssl.EVP_CIPHER_CTX_new()
        ssl.EVP_CIPHER_CTX_init(ctx)
        ssl.EVP_DecryptInit_ex(ctx, ssl.EVP_aes_256_cbc(), None, self.chKey, self.chIV)
        ssl.EVP_DecryptUpdate(ctx, buf, ctypes.byref(written), data, len(data))
        output = buf.raw[:written.value]
        ssl.EVP_DecryptFinal_ex(ctx, buf, ctypes.byref(final))
        output += buf.raw[:final.value]
        return output

try:
    if not crypter:
        from aes import *
        crypter = 'pure'
except:
    pass

class Crypter_pure(object):
    def __init__(self):
        self.m = AESModeOfOperation()
        self.cbc = self.m.modeOfOperation["CBC"]
        self.sz = self.m.aes.keySize["SIZE_256"]

    def SetKeyFromPassphrase(self, vKeyData, vSalt, nDerivIterations, nDerivationMethod):
        data = vKeyData + vSalt
        for i in range(nDerivIterations):
            data = hashlib.sha512(data).digest()
        self.SetKey(data[0:32])
        self.SetIV(data[32:32+16])
        return len(data)

    def SetKey(self, key):
        self.chKey = [ord(i) for i in key]

    def SetIV(self, iv):
        self.chIV = [ord(i) for i in iv]

    def Encrypt(self, data):
        mode, size, cypher = self.m.encrypt(data, self.cbc, self.chKey, self.sz, self.chIV)
        return ''.join(map(chr, cypher))
 
    def Decrypt(self, data):
        chData = [ord(i) for i in data]
        return self.m.decrypt(chData, self.sz, self.cbc, self.chKey, self.sz, self.chIV)

import hashlib

def Hash(data):
    return hashlib.sha256(hashlib.sha256(data).digest()).digest()

def main():

    #address
    addr = '1AJ3vE2NNYW2Jzv3fLwyjKF1LYbZ65Ez64'
    sec = '5JMhGPWc3pkdgPd9jqVZkRtEp3QB3Ze8ihv62TmmvzABmkNzBHw'
    secret = '47510706d76bc74a5d57bdcffc68c9bbbc2d496bef87c91de7f616129ac62b5f'.decode('hex')
    pubkey = '046211d9b7836892c8eef49c4d0cad7797815eff95108e1d30745c03577596c9c00d2cb1ab27c7f95c28771278f89b7ff40da49fe9b4ee834a3f6a88324db837d8'.decode('hex')
    ckey = '0f8c75e4c6ab3c642dd06786af80ca3a93e391637d029f1da919dad77d3c8e477efd479814ddf4c459aeba042420868f'.decode('hex')

    #master key
    crypted_key = '1e1d7ab34d8007f214eb528a1007c6721b9cd1d2c257adb25378ea8e47e3bdd22cfe93a8b6f18dcbe4206fe8c8178ff1'.decode('hex')
    salt = '3f94e3c670b695dd'.decode('hex')
    rounds = 47135
    method = 0
    password = '12345'

    global crypter

    if crypter == 'pycrypto':
        crypter = Crypter_pycrypto()
    elif crypter == 'ssl':
        crypter = Crypter_ssl()
        print "using ssl"
    elif crypter == 'pure':
        crypter = Crypter_pure()
        print "using slowaes"
    else:
        print("Need pycrypto of libssl or libeay32.dll or http://code.google.com/p/slowaes")
        exit(1)

    crypter.SetKeyFromPassphrase(password, salt, rounds, method)
    masterkey = crypter.Decrypt(crypted_key)
    crypter.SetKey(masterkey)
    crypter.SetIV(Hash(pubkey))
    d = crypter.Decrypt(ckey)
    e = crypter.Encrypt(d)

    print "masterkey:", masterkey.encode('hex')
    print 'c:', ckey.encode('hex')
    print 'd:', d.encode('hex')
    print 'e:', e.encode('hex')

if __name__ == '__main__':
    main()

Sir,
It is fantastic program; it is 1000% work for your program.

I have request you that please remove password option & remain published it. Lot of viewer and myself hope that as same script for decrypt old wallet. Thank you for connivance...

[ashraful1980]

Yes, i know, but how i can see the Code? I use otherversion =30, in other forums they said os dogecoin, but the results is the same
Maybe is another code dogecoin?

Are you sure you did it right? What is the commandline you are typing in? I just did this:

Code:

pywallet.py --dumpwallet --datadir=E:\PyTest --otherversion=30 --passphrase=my5uper5ecretP@55w0rd > walletdump.txt

A copy of my dogecoin wallet.dat was in "E:\PyTest" directory... aside from a bunch of "Wallet data not recognized: {'__type__': 'keymeta', '__value__': '" errors dumped at the beginning... walletdump.txt contained all my Dogecoin addresses like this:

        {
            "addr": "DCAA7yVbqr4THDXGQ2tXJecjshSJ2JVrnr",
            "compressed": true,
            "encrypted_privkey": "BIG_LONG_HEX_STRING1",
            "hexsec": "BIG_LONG_HEX_STRING2",
            "label": "",
            "pubkey": "BIG_LONG_HEX_STRING3",
            "reserve": 0,
            "sec": "BIG_LONG_HEX_STRING4",
            "secret": "BIG_LONG_HEX_STRING5"
        },

You can see that the addr value starts with "D" like Dogecoin addresses are supposed to... and it dumped the "sec" (aka the private key) as a "Q" which is the right format for a "compressed" Dogecoin address.

Or are you having issues with the --recover mode?

Dear Sir,
I would like to inform you that as per your command line 100% correct. Could you please advice without passphrase how can recover "secret" key. Any solution yet; if you find the solution I will donate my 50% BTC to your account. So please reply as following email: ashraf.csr@gmail.com

[HCP]

Could you please advice without passphrase how can recover "secret" key.

You've been told several times... This is impossible!

If a passphrase was set, the "secret" wallet data (ie. private keys) has been encrypted using AES-256-CBC. If the passphrase was relatively complex (ie. 10+ 'random' chars using characters+numbers+symbols) and you have no idea what it was, then you can't possibly hope to bruteforce it.

However, if you have "some" idea of what the passphrase may have been (or you know 100% that it was relatively short or "simple"), you could potentially use "hashcat" and try to bruteforce the passphrase...

I would suggest using google to search for "hashcat bitcoin core"... alternatively, contact Dave @ walletrecoveryservices.com. They've been doing that sort of thing for a long time, have had a lot of success and have a good reputation. I believe that their standard fee is 20%. You can read their forum post here: https://bitcointalk.org/index.php?topic=240779.0

[jackjack]

Hi all
I've been away for some time, many things have changed since then and Pywallet doesn't work anymore with wallets that are too recent
Are there still some users and is a fixed version needed?
I also remember that some things were broken or at least ugly, I may tidy things up if the demand is there

[FNT]

I've been away for some time, many things have changed since then and Pywallet doesn't work anymore with wallets that are too recent

Welcome back!!

[Mek]

Hello,
I'd like to dump addresses (not keys) from a wallet.dat file I provide on a command line. The wallet is not encrypted. I don't want to install Bitcoin or download the blockchain.
Pywallet has worked for me in the past, but doesn't now.

Code:

./pywallet.py --dumpwallet --datadir=./w --wallet=wallet.dat
'ecdsa' package is not installed, pywallet won't be able to sign/verify messages
ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.

I see that jackjack-jj/pywallet is now very, very old - last commit 7 years before.
How to install ecdsa package? The obvious "solutions" from google don't work - pip3 or pip is unrecognized command, and I'm not sure which package from apt to install (but I think this will not solve my problem).
Python version:

Code:

Python 2.7.16 (default, Oct 10 2019, 22:02:15)
[GCC 8.3.0] on linux2

Any suggestions?

[HCP]

Hi all
I've been away for some time, many things have changed since then and Pywallet doesn't work anymore with wallets that are too recent
Are there still some users and is a fixed version needed?
I also remember that some things were broken or at least ugly, I may tidy things up if the demand is there

I created a somewhat "hacky" fork here: https://github.com/HardCorePawn/pywallet

It suppresses the "keymeta" output spam... and ignores other errors in more modern wallet.dat files (from the top of my head, "bestblock" and "hdchain" cause issues, there may be others). Fairly sure that it would break the "recovery" feature, but it makes --dumpwallet work

Given the large increase in price of BTC, and the obvious surge of "help I have old wallet.dat, how do I get keys/bitcoins!!" type posts that inevitably accompany a bullrun, it would be useful to have:
- updated Pywallet that works "properly" with newer wallet.dat files and doesn't just suppress/ignore errors
- Python 3 compatibility would be a bonus, as Python 2 is now completely unsupported

[jackjack]

Hello,
I'd like to dump addresses (not keys) from a wallet.dat file I provide on a command line. The wallet is not encrypted. I don't want to install Bitcoin or download the blockchain.
Pywallet has worked for me in the past, but doesn't now.

Code:

./pywallet.py --dumpwallet --datadir=./w --wallet=wallet.dat
'ecdsa' package is not installed, pywallet won't be able to sign/verify messages
ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.

I see that jackjack-jj/pywallet is now very, very old - last commit 7 years before.
How to install ecdsa package? The obvious "solutions" from google don't work - pip3 or pip is unrecognized command, and I'm not sure which package from apt to install (but I think this will not solve my problem).
Python version:

Code:

Python 2.7.16 (default, Oct 10 2019, 22:02:15)
[GCC 8.3.0] on linux2

Any suggestions?

The ecdsa message is only a warning, you don't need to install it
The actual error is this:

ERROR:root:Couldn't open wallet.dat/main

And this should not happen if your wallet file is not corrupted, are you sure bitcoin-core can load it?
Or maybe your client is not bitcoin-core but if pywallet worked for you before then I guess it is

Welcome back!!

Thanks 

I created a somewhat "hacky" fork here: https://github.com/HardCorePawn/pywallet

It suppresses the "keymeta" output spam... and ignores other errors in more modern wallet.dat files (from the top of my head, "bestblock" and "hdchain" cause issues, there may be others). Fairly sure that it would break the "recovery" feature, but it makes --dumpwallet work

Given the large increase in price of BTC, and the obvious surge of "help I have old wallet.dat, how do I get keys/bitcoins!!" type posts that inevitably accompany a bullrun

That's great, I was hoping someone would do this!
All the help needed is actually part of the reason why I'm back, I was getting more and more emails asking for help

it would be useful to have:
- updated Pywallet that works "properly" with newer wallet.dat files and doesn't just suppress/ignore errors
- Python 3 compatibility would be a bonus, as Python 2 is now completely unsupported

These 2 are a must, plus these:
- clean that crazy source code, there's no reason for it to be 5000 lines long and to be that ugly
- change the --datadir and --wallet arguments
- kill (for now) the web interface and remove the twisted dependency (that would help reducing the code by the way)
- be more explicit about ecdsa being only optional

[Mek]

ň
The actual error is this:

ERROR:root:Couldn't open wallet.dat/main

And this should not happen if your wallet file is not corrupted, are you sure bitcoin-core can load it?
Or maybe your client is not bitcoin-core but if pywallet worked for you before then I guess it is

The wallet file is really old, from 2014. Back then, I think there was only the full Bitcoin software with full blockchain, no Bitcoin Core. I haven't tried Bitcoin Core with this wallet, as I think it would download entire blockchain which would take a few weeks or so...

[jackjack]

ň
The actual error is this:

ERROR:root:Couldn't open wallet.dat/main

And this should not happen if your wallet file is not corrupted, are you sure bitcoin-core can load it?
Or maybe your client is not bitcoin-core but if pywallet worked for you before then I guess it is

The wallet file is really old, from 2014. Back then, I think there was only the full Bitcoin software with full blockchain, no Bitcoin Core. I haven't tried Bitcoin Core with this wallet, as I think it would download entire blockchain which would take a few weeks or so...

I thought they were the same, just renamed, isn't that the case?

Can you run this command to be sure it's the correct format?

file path/to/wallet.dat

Should be something like "Berkeley DB"

[Mek]

Yes, output is:

Code:

wallet.dat: Berkeley DB (Btree, version 9, native byte-order)

[jackjack]

Ok do you have __db.00x files in the same folder?
Or are you in a read only folder?
I think I remember those can break things

[Mek]

I am root and performing these commands in my home folder. I have a subfolder named "w" there, and I am passing it as a datadir to pywallet.
After the command mentioned in my first post errors out, I can see three files appeared inside the "w" folder: __db.001 to __db.003
Maybe I can extract the addresses from them without pywallet?

[jackjack]

The __db.00x files are only internal files for Berkeley DB so not helpful
But yeah you can try the db_dump command (db-utils in apt) on your wallet, it should output a bunch of (sensitive!) hexadecimal data without errors
I just tested with an old wallet of mine, maybe from something like 2013, and it worked as expected
If it works for you then try deleting (backup them if you want but they aren't needed) the __db.00x files

[Mek]

Yes, it worked, thank you

Code:

VERSION=3
format=bytevalue
database=main
type=btree
db_pagesize=8192
HEADER=END
...some hexadecimal lines...
DATA=END

no errors. What should I do next?

[jackjack]

Did you try deleting the __db.00x files?
If pywallet still won't work after deleting those then I don't know what's happening

What you can try is downloading an old Bitcoin-Qt/bitcoin-core release like 0.8, 0.9 or 0.10 from what I can see here: https://en.bitcoin.it/wiki/Bitcoin_Core or https://bitcoin.org/en/version-history
https://github.com/bitcoin/bitcoin/releases?after=v0.11.0

[Mek]

Yes, I tried deleting those files and tried the command again, still fails the same (and creates the files again). Now I found out that it behaves the same (and also creates the db files in working folder ) even when I pass a non-existing filename to the --wallet argument.
I see this in the code

Code:

	try:
		r = db.open(walletfile, "main", DB_BTREE, flags)
	except DBError:
		r = True

I don't know python, but is it possible to display any more detailed information about the exception, what exactly failed?