Pywallet 2.2: manage your wallet [Update required]

[Drawn23s]

a recovered_wallet.dat may or may not open with Bitcoin Core... theoretically, it should be compatible, so you should be able to open it directly... but it's possible that pywallet is not creating it in a format that Bitcoin Core can handle.

In which case, dumping the private keys out of it, then importing those into the wallet of your choice would be a viable solution.


Note that Electrum would enable you to import and scan the keys in a matter of minutes, whereas rescanning in Bitcoin Core could take hours. Neither guarantees that the "keys" found are actually going to contain any coins.

So i use the --dumpwallet command on the recoveredwallet into wallet.txt? and then how do i import those into a wallet of my choice. I have bitcoincore installed. almost done dling the blockchain


or should i just try opening the wallet in bitcoin core first. the old wallets were from 2013

[HCP]

So i use the --dumpwallet command on the recoveredwallet into wallet.txt?

I'd try Bitcoin Core first... nothing to lose, easiest way to go about it. Just make a copy of the .dat file... then try opening it with Bitcoin Core... just be prepared to wait while it rescans the blockchain looking for transactions. Note this is NOT redownloading the blocks (assuming your node is NOT pruned), it just has to scan the block data.

and then how do i import those into a wallet of my choice.

Really depends on what wallet you want to import it too... But the --dumpwallet command should give you the private keys in WIF format... assuming that you include the --passphrase parameter when dumping the wallet.


For Bitcoin Core, you just use the importprivkey command on the console in Bitcoin Core (make sure to set rescan to false until you import the last key, otherwise it will run rescan every. single. time. )

Or you can look up one of the many many many guides on how to import private keys into Electrum... Like this one: https://bitcoinelectrum.com/importing-your-private-keys-into-electrum/

Google is your friend.

[Drawn23s]

So i use the --dumpwallet command on the recoveredwallet into wallet.txt?

I'd try Bitcoin Core first... nothing to lose, easiest way to go about it. Just make a copy of the .dat file... then try opening it with Bitcoin Core... just be prepared to wait while it rescans the blockchain looking for transactions. Note this is NOT redownloading the blocks (assuming your node is NOT pruned), it just has to scan the block data.

and then how do i import those into a wallet of my choice.

Really depends on what wallet you want to import it too... But the --dumpwallet command should give you the private keys in WIF format... assuming that you include the --passphrase parameter when dumping the wallet.


For Bitcoin Core, you just use the importprivkey command on the console in Bitcoin Core (make sure to set rescan to false until you import the last key, otherwise it will run rescan every. single. time. )

Or you can look up one of the many many many guides on how to import private keys into Electrum... Like this one: https://bitcoinelectrum.com/importing-your-private-keys-into-electrum/

Google is your friend.

ty i try to google when I can, just was confused on a few things that you set straight. Appreciate it.

[wallet.duh]

I saw the post that datadir has been removed and im getting that message when i try to follow old guides to dump a wallet.dat file i have.

What would be the up to date command to run to get the contents of this file assuming i have that file and pywallet in the same folder and have a command window open from that directory already.


Error i get when trying to dump wallet

Depreacation
  The --datadir option has been deprecated, now the full path of the wallet file should go to --wallet
  If you're not sure what to do, concatenating the old --datadir content, then a directory separator, then the old --wallet should do the trick
  If not, ask for help in the Pywallet thread: https://bitcointalk.org/index.php?topic=34028
A mandatory option is missing

|I appreciate any guidance you can provide.

[nc50lc]

What would be the up to date command to run to get the contents of this file assuming i have that file and pywallet in the same folder and have a command window open from that directory already.

In that case, do not use --datadir and put ".\" before "wallet.dat";
that will tell pywallet to look for the wallet.dat file in the working directory:

Code:

python pywallet.py --dumpwallet --wallet=.\wallet.dat

[wallet.duh]

What would be the up to date command to run to get the contents of this file assuming i have that file and pywallet in the same folder and have a command window open from that directory already.

In that case, do not use --datadir and put ".\" before "wallet.dat";
that will tell pywallet to look for the wallet.dat file in the working directory:

Code:

python pywallet.py --dumpwallet --wallet=.\wallet.dat

Im one step closer thank you.

Now getting this error message when running that code

C:\Python27>pywallet.py --dumpwallet --wallet=.\wallet.dat
Warning: 'ecdsa' package is not installed, so you won't be able to sign/verify m
essages but everything else will work fine
(22, 'Invalid argument -- C:\\Python27\\wallet.dat: unexpected file type or form
at')
ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this
again.

I tried to open this file with Bitcoin core before using pywallet and got a similar "data is not in recognized format" error.

Wondering if im SOL

[nc50lc]

Im one step closer thank you.

Now getting this error message when running that code

C:\Python27>pywallet.py --dumpwallet --wallet=.\wallet.dat
Warning: 'ecdsa' package is not installed, so you won't be able to sign/verify m
essages but everything else will work fine

This is just for the mentioned features;
but if you wish to get rid of the error, just install ecdsa package through pip: pypi.org/project/ecdsa

(22, 'Invalid argument -- C:\\Python27\\wallet.dat: unexpected file type or form
at')
ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this
again.

I tried to open this file with Bitcoin core before using pywallet and got a similar "data is not in recognized format" error.

Wondering if im SOL

That indicates that the wallet.dat may be corrupted, also Bitcoin Core throws a similar error so that should confirm it.

I think you need to start your own thread in Bitcoin Technical Support board for corrupted wallet.dat recovery options.
Link to the board: http://bitcointalk.org/index.php?board=4.0

[ApproximateSunlight]

I have an old wallet.dat. I don't know which coin it is about.
I'm trying to scan it with this python script. I'm on Windows, that's what I tried for now:

Downloaded PWI_0.0.3.exe
Installed in Download folder
Once I go into the Download folder directory, there is an install.bat file, but I've already installed it (it runned automatically)
Now I got this GnuWin32 folder

What's the next step? Can't find any pywallet.bat file

[HCP]

I have an old wallet.dat. I don't know which coin it is about.

If you have a look through the wallet.dat in a normal text editor... you should be able to find various "name" fields. These will be followed by the address in plain text... here is an example of a Dogecoin wallet:


You can see the addresses start with a "D", which is a clue that it is a dogecoin wallet.dat.

So, try opening the file in a text editor and see if you can find some addresses to see what coin it is... It may not be worth your while attempting to recover the contents if it's a dead or worthless coin.


NOTE: as always, make sure you have backups of the original wallet.dat file, and only work on copies... you don't want to take the chance of accidentally corrupting the original wallet.dat!

[walletrecovery]

For example I create new wallet in version 12 BTC Core and no password yet setup, I see this:

    "names": {
        "1A25wzkhegudPKb7rXhxCBu63R89vwfsHA": ""
    },
    "pool": [
        {
            "addr": "13DKzYCvn82UKTc2pExz9x3FnNsxvjwszD",
            "n": 2,
            "nTime": 1645911646,
            "nVersion": 120100,
            "public_key_hex": "0394ab2c6c28a5cee86236768532bebfd6b616b3c27525033e162260e03b802870"

1645911646 - after Run Timestamp To Date Converter I see this: 2/27/2022, 12:40:46 AM


after setup password I see this:

"names": {
        "1A25wzkhegudPKb7rXhxCBu63R89vwfsHA": ""
    },
    "pool": [
        {
            "addr": "1HTScVXbtXinEeqs3kcDaQBh58FJpzLsty",
            "n": 1,
            "nTime": 1645911925,
            "nVersion": 120100,
            "public_key_hex": "029b96cc029808b21f424fd8bb1fbecafcbf81233d9122051755e994411569843a"

1645911925 - after Run Timestamp To Date Converter I see this: 2/27/2022, 12:45:25 AM


These experiments mean that even if the wallet does not have a password,
then "Timestamp" is still there and it means the date and time the wallet was created,
but if the password is set, then "Timestamp" means the date and time the password was set?

[nc50lc]

These experiments mean that even if the wallet does not have a password,
then "Timestamp" is still there and it means the date and time the wallet was created,
but if the password is set, then "Timestamp" means the date and time the password was set?

I can only guess based from Bitcoin Core's behavior in generating the keypool.

Those timestamps are date & time of each individual keys in your wallet.dat.
Upon creation of the wallet, it will immediately preload thousands of keys for receiving and change addresses to the wallet.dat,
Thus, all those keys' timestamp should be the similar (may differ in a few seconds) so your hypothesis may be correct about the "timestamp" of the unencrypted wallet.

After setting a passphrase, Core will drop the unused keys from the wallet, create a new 'HDSeed' and derive a new keypool from it.
Thus, the new keypool has an updated timestamp based from when the wallet is encrypted;
However, if you just changed the passphrase of an already-encrypted wallet, the 'HDSeed' will remain the same so the timestamp will stay the same for the already-derived keys.

[walletrecovery]

Those timestamps are date & time of each individual keys in your wallet.dat.
Upon creation of the wallet, it will immediately preload thousands of keys for receiving and change addresses to the wallet.dat,
Thus, all those keys' timestamp should be the similar (may differ in a few seconds) so your hypothesis may be correct about the "timestamp" of the unencrypted wallet.

After setting a passphrase, Core will drop the unused keys from the wallet, create a new 'HDSeed' and derive a new keypool from it.
Thus, the new keypool has an updated timestamp based from when the wallet is encrypted;
However, if you just changed the passphrase of an already-encrypted wallet, the 'HDSeed' will remain the same so the timestamp will stay the same for the already-derived keys.

Yes, I figured out this problem, now I understand everything, thanks everyone for the help!

[minor-transgression]

I've installed pywallet on Debian bookworm
You may need to do this :

attempting to install python-dev causes lots of problems

install build-essential python2-dev python-bsddb3

edit #!/usr/bin/env python to #!/usr/bin/env python3

$ pywallet needs 'bsddb' package to run, please install it

install python3-bsddb3

$ ./pywallet.py --version
./pywallet.py:22: UserWarning: Python 3 support is still experimental, you may encounter bugs
version says pywallet.py 1.1
(or is it 22?)

EDIT : pywallet complains if the wallet version is > 81000

[nc50lc]

EDIT : pywallet complains if the wallet version is > 81000

Any chance that the wallet is created by later versions of Bitcoin Core?
Because if so, pywallet doesn't support "descriptor" wallet.dat which is the new default.

$ ./pywallet.py --version
./pywallet.py:22: UserWarning: Python 3 support is still experimental, you may encounter bugs
version says pywallet.py 1.1
(or is it 22?)

Version is '1.1'
The number '22' belongs to the error message.

[AzizLeG]

Hi, I found an old corrupted wallet.dat (LTC) and was trying to recover it. I have tried to import it in most wallets like Electrum-LTC, LTC Core and BTC Recover but no success nothing can be dumped off the platforms because it's corrupted. I have in my hand, the wallet.dat (Corrupted) and the valid and verified passphrase. I have started using pywallet to try to recover or dump the privkey but it got into a sticky situation. The option I used was directly dumping the data from the wallet.dat file and successfully got a dump file the HexSec, Sec, Encrypted Key etc. Thing is, the hexsec value after conversion does not link properly to the right address (I verified with liteaddress.org offline). I verified the other wallets in the list, converted random hexsec values from other data in the list and the conversion goes well, the address and pubkey is the right one for other addresses. Now that is what I don't understand, the main wallet I tried to recover, the hexsec doesn't convert correctly and the pubkey doesn't match so that means the hexsec is not valid. I find myself confused. Any help is appreciated. PS: I tried to dump recovered wallet files as well, but nothing of importance is dumped on recovered files only on the original wallet.

I used this version of pywallet: https://github.com/jackjack-jj/pywallet

Command line used: python pywallet.py --dumpwallet --otherversion=ltc,0x30,0x05,0x36,ltc --wallet=wallet.dat --passphrase=password > dump.txt


This is the format I get from the successful dump of the original .dat file: (Empty and Not Relevant Data)
       
            "addr": "LWKGCUr8wkrnsrJSaZ6f5vQwqWcG9VsxEL",
            "compressed": true,
            "encrypted_privkey": "14534d57630494bf2f0c0282a2f0d7ad2dcac4df7941e89b613c881e29df29c31bed8fb819cf5e4 f4a69a92449fa93d1",
            "hexsec": "38145142896de4e60da72cbc86119126ab2c041a4406b47fb6967e732e6293a2",
            "pubkey": "02a8cb41f246ffd774dec89e74d57bfddf9cd149d95d20a78ea2d830b542030010",
            "reserve": 1,
            "sec": "92C4WaMgc4DzbtkGaS9qvAbgqKqdtTgHZVkS2oEPhU5AEBj6JCKY",
            "secret": "38145142896de4e60da72cbc86119126ab2c041a4406b47fb6967e732e6293a201"


Regards,

AzizLeBG

[nc50lc]

This is the format I get from the successful dump of the original .dat file: (Empty and Not Relevant Data)
       
            "addr": "LWKGCUr8wkrnsrJSaZ6f5vQwqWcG9VsxEL",
            "compressed": true,
            "encrypted_privkey": "14534d57630494bf2f0c0282a2f0d7ad2dcac4df7941e89b613c881e29df29c31bed8fb819cf5e4 f4a69a92449fa93d1",
            "hexsec": -snip-
            "pubkey": "02a8cb41f246ffd774dec89e74d57bfddf9cd149d95d20a78ea2d830b542030010",
            "reserve": 1,
            "sec": -snip-
            "secret": -snip-

You might want to snip-out the secret part of the contents of your dump.txt file since the private key and WIF private key are in there.
Even if it's empty, it's not a good idea to share your old wallet's keys and addresses.

For some reason, the WIF private key isn't formatted correctly for Litecoin;
perhaps there's something wrong with your --otherversion arg or it doesn't support LTC.

The workaround is to use "hexsec" which is your ECDSA Private key and encode it into WIF using encoding tools.
For example, the "Wallet Details" tab of liteaddress.org can convert it into WIF (but only use it offline).
Source Code: https://github.com/litecoin-project/liteaddress.org

[icynote_original]

is it possible if using a pywallet can open a wallet without a passphrase?
there are several wallet.dat without password, but I open them with pywallet and they can't. Please give me all your experiences. 

[yangxin325]

C:\Users\YX\OneDrive\Desktop\test>python pywallet.py --dumpwallet --wallet=.\wallet.dat>wallet.log
Traceback (most recent call last):
  File "pywallet.py", line 2290, in parse_wallet
    d['txIn'].append(parse_TxIn(vds))
  File "pywallet.py", line 2257, in parse_TxIn
    d['prevout_n'] = vds.read_uint32()
  File "pywallet.py", line 2183, in read_uint32
    def read_uint32(self): return self._read_num('<I')
  File "pywallet.py", line 2222, in _read_num
    (i,) = struct.unpack_from(format, self.input, self.read_cursor)
error: unpack_from requires a buffer of at least 4 bytes


Prompt this, what should I do?

[witcher_sense]

C:\Users\YX\OneDrive\Desktop\test>python pywallet.py --dumpwallet --wallet=.\wallet.dat>wallet.log
Traceback (most recent call last):
  File "pywallet.py", line 2290, in parse_wallet
    d['txIn'].append(parse_TxIn(vds))
  File "pywallet.py", line 2257, in parse_TxIn
    d['prevout_n'] = vds.read_uint32()
  File "pywallet.py", line 2183, in read_uint32
    def read_uint32(self): return self._read_num('<I')
  File "pywallet.py", line 2222, in _read_num
    (i,) = struct.unpack_from(format, self.input, self.read_cursor)
error: unpack_from requires a buffer of at least 4 bytes


Prompt this, what should I do?

It looks like a problem with one of the transaction inputs, the wallet tries to parse it with its internal algorithm defined in read_uint32 function but fails to do so. Try putting this part of the code in a try-catch block and see what happens, maybe it will skip problematic addresses and parse everything else successfully. Or maybe, you need to install an earlier version of Python.

[Borislee]

News: August 2014
My boring professional life made me stay away from bitcoin for far too long but I'm now back in business
Pywallet won't be fixed anymore except for critical bugs
Instead I'll finish its successor (that still has no name)


News: September 2013
I'm rebuilding pywallet from scratch:

• I need a new name for this project, propose one if you want
• See the progress here: https://bitcointalk.org/index.php?topic=294439

This thread
First of all, I'd like to thank Joric for the first version of pywallet he made, this thread is about my fork.
Pywallet is a python script that deals with wallet.dat. It allows you to do plenty of things inside it.
You can post here whatever you want about pywallet: critics, asking for improvements/changes, telling me it helped you, pointing out errors/bugs, etc.


Pywallet 2: 22nd March 2013
Pywallet has been discontinued for around a year but is now actively developed again.
Look at the end of the 7th page for updates: encrypted wallet support, exporting/importing to/from files, merging wallets, etc.


Instructions (see also here)
Currently you can:

• Dump your wallet, see your pubkeys, privkeys, their labels, etc
  • Under "Dump your wallet:"
  • Fill version with 0 for bitcoin, 52 for namecoin, 111 for testnets
  
  
• Dump your transactions to a json file
  • Under "Dump your transactions to a file:"
  • Fill Output file with the full path to the file where you want the transactions to be written, this file must not exist
  
  
• Import a key/address into your wallet, with a label, or as a reserve key
  • Under "Import a key into your wallet:"
  • Key is the private key to import, in base58 or in hexadecimal chars
  • Label is the name you want to see in the Address Book of the client
  • Check Reserve if you want your address NOT to show in the Address Book
  • Version = 0 for bitcoin, 52 for namecoin, 111 for testnets
  • Format of the private key: Hexadecimal if you see only digits, a, b, c, d, e and f, otherwise chose Regular
  
  
• Import a transaction into your wallet
  • Under "Import a transaction into your wallet:"
  • Txk is the tx_k value you see in the wallet dump
  • Txv is the tx_v value you see in the wallet dump
  
  
• Import transactions from a json file
  • Under "Import a transaction into your wallet:"
  • Txk = "file" (without quotes)
  • Txv = full path to the transactions dump file
  
  
• Delete addresses from your wallet
  • Under "Delete a key from your wallet:"
  • Key is a Bitcoin address, not a priv key
  • Type: Bitcoin Address
  
  
• Delete transactions from your wallet
  • Under "Delete a key from your wallet:"
  • Key is the hash of the transaction you want to delete (type "all" to delete them all)
  • Type: Transaction
  
  
• Get info about a privkey, i.e. see address, base58 privkey, hexprivkey, pubkey and hash160, using the network you want
  • Under "Get some info about one key[and sign/verify messages]:"
  • Key is a private key
  • Leave Msg, Sig and Pubkey empty
  • Version = 0 for bitcoin, 52 for namecoin, 111 for testnets
  • Format of the private key: Hexadecimal if you see only digits, a, b, c, d, e and f, otherwise chose Regular
  
  
• Sign and verify string, files, and binary string
  • Under "Get some info about one key and sign/verify messages:"
  • Key is the private key you want to sign the message/file with (only for signing)
  • Message is the message you want to sign/verify
    • If it is a string, just type it
    • If it is a binary string, type "Hex:" just before its hexadecimal representation
    • If it is a file, type "File:" just before its full path
    
    
  • Signature is the signature of your message (only for verifying)
  • Pubkey is the pubkey used to sign the message (only for verifying)
  
  
• Read a device to find deleted keys (CLI only)
  • Assuming that:
    • The device you want to read is /dev/sda3
    • The size of /dev/sda3 is 30.1Gio
    • You want pywallet to write the new wallet containing the found keys in /home/jackjack/recovered_wallets
  • Run "sudo ./pywallet.py --recover --recov_device /dev/sda3 --recov_size 30.1Gio --recov_outputdir /home/jackjack/recovered_wallets"
  • Then replace your wallet (back it up before) with the recovered wallet and run "bitcoin -rescan"
  
  
• Print the balance of a bitcoin address, read from blockexplorer

Installation:

• Linux/OSX: See README file
• Windows:
  
  • Download https[Suspicious link removed] (SHA256: 645a4d092733ad6685de730a38b210c6594e44a15690a87a231859477deca316)
  • Run it
  • Click about a thousand times on Yes/Next/I Agree/OK
  • Go to the directory where you extracted it and run pywallet.bat
  • http://localhost:8989

How to run it:
 Download it there: https://github.com/jackjack-jj/pywallet
 Run './pywallet.py --web' then open 'http://localhost:8989' in your brower

Requirements:
 Python 2.5-2.7, with bsddb package
 ÃƒÆ’ƒÆ’Æ’Æ’Æ’ÃÆ’¢â‚¬Å¡ twisted package is necessary if you want to use the web interface
 ÃƒÆ’ƒÆ’Æ’Æ’Æ’ÃÆ’¢â‚¬Å¡ ecdsa package is necessary if you want to sign and verify messages

Confirmed to work on:
 Ubuntu 32bit(me)
 Windows 32bit(me), 64bit(ctoon6)
 OSX(defxor)

Pywallet can be used to:
 Import Vanitygen keys
 Delete 0/unconfirmed transactions
 Recover Namecoins (and testnetcoins) sent to Bitcoin addresses
 Create a deterministic wallet (using a passphrase)
 Create a deterministic wallet (using a file)
 Broadcast offline transactions
 Create a Bitcoin/*coin address from scratch
 Recover a wallet/deleted keys

can you help me please

The mkey in the document I received from my 2010 wallet with dump wallet seems to be problematic, all attempts with AES are unsuccessful..
I guess it's a special character problem;
TypeError: decrypt_wallet_dat() got an unexpected keybord argument 'encrypted_mkey'

my wallet.dat

    "minversion": 60000,
    "mkey": {
        "encrypted_key": "8224e5e670b7cc942f9bdace796bad4af83d2763f238d5fde0e182e20686ff85cb92bb0737da211 e2e39fd61b828bf6c",
        "nDerivationIterations": 135310,
        "nDerivationMethod": 0,
        "nID": 1,
        "otherParams": "",
        "salt": "adfcc9cfa83e3cf6"
    },

Original information has been slightly changed for security reasons.

As far as I noticed; salt >>> mkey is found again in a mixed form at the end