Discussion! Don't BUY FAKE! "wallet.dat" files with lost passwords.

[Spawnx]

Just made a simple test to se the differences in the bitcoin2john outputs. Below are 3 hashes:

test: new wallet with password 12aVP18cd5XsbcGQy8u6eywQ6UuA6Q319s

test2: the same wallet but with password 1

test3: the same wallet back with the password 12aVP18cd5XsbcGQy8u6eywQ6UuA6Q319s

Results:

C:\Users\mrc\Desktop\test wallet>python bitcoin2john_r.py test.dat
$bitcoin$96$a1e8d2b8ee3e95495e2e860a28c1ba0b78a0ff9bc9be43730d246b0b23fe18ec43d24fc9ba55441 cdb60c04a1120e738$16$a782de2216ac5636$277777$96$775421c1db2bc628932d3c480ce3f5b669359c5a73dac7726d59e2ba7154d48fe7ff468dc14c16c 5d2acef18bc4dda93$66$03ffee576a1930d9891832fd90b98c510537cb09e5e934d33b8ec75cf883a43778

C:\Users\mrc\Desktop\test wallet>python bitcoin2john_r.py test2.dat
$bitcoin$96$f001c37f1ff094dfcb05092a9047d6332a88333b636d6ff13cc71c38d39e737eab565ca9a09f12e b8e823a3213ff1920$16$a782de2216ac5636$281999$96$775421c1db2bc628932d3c480ce3f5b669359c5a73dac7726d59e2ba7154d48fe7ff468dc14c16c 5d2acef18bc4dda93$66$03ffee576a1930d9891832fd90b98c510537cb09e5e934d33b8ec75cf883a43778

C:\Users\mrc\Desktop\test wallet>python bitcoin2john_r.py test3.dat
$bitcoin$96$b016c42c35bbd3924a2b2aa1f5a99b0cd434ce7f805fe7d670ab98ce262d9b38045500ba9934f24 f1b01257b923de915$16$a782de2216ac5636$277823$96$775421c1db2bc628932d3c480ce3f5b669359c5a73dac7726d59e2ba7154d48fe7ff468dc14c16c 5d2acef18bc4dda93$66$03ffee576a1930d9891832fd90b98c510537cb09e5e934d33b8ec75cf883a43778

The first and last test have the same password and the same PUBkey and wallet version, any thoughts 

[Antoni4EVA1984]

Just made a simple test to se the differences in the bitcoin2john outputs. Below are 3 hashes:

test: new wallet with password 12aVP18cd5XsbcGQy8u6eywQ6UuA6Q319s

test2: the same wallet but with password 1

test3: the same wallet back with the password 12aVP18cd5XsbcGQy8u6eywQ6UuA6Q319s

Results:

C:\Users\mrc\Desktop\test wallet>python bitcoin2john_r.py test.dat
$bitcoin$96$a1e8d2b8ee3e95495e2e860a28c1ba0b78a0ff9bc9be43730d246b0b23fe18ec43d24fc9ba55441 cdb60c04a1120e738$16$a782de2216ac5636$277777$96$775421c1db2bc628932d3c480ce3f5b669359c5a73dac7726d59e2ba7154d48fe7ff468dc14c16c 5d2acef18bc4dda93$66$03ffee576a1930d9891832fd90b98c510537cb09e5e934d33b8ec75cf883a43778

C:\Users\mrc\Desktop\test wallet>python bitcoin2john_r.py test2.dat
$bitcoin$96$f001c37f1ff094dfcb05092a9047d6332a88333b636d6ff13cc71c38d39e737eab565ca9a09f12e b8e823a3213ff1920$16$a782de2216ac5636$281999$96$775421c1db2bc628932d3c480ce3f5b669359c5a73dac7726d59e2ba7154d48fe7ff468dc14c16c 5d2acef18bc4dda93$66$03ffee576a1930d9891832fd90b98c510537cb09e5e934d33b8ec75cf883a43778

C:\Users\mrc\Desktop\test wallet>python bitcoin2john_r.py test3.dat
$bitcoin$96$b016c42c35bbd3924a2b2aa1f5a99b0cd434ce7f805fe7d670ab98ce262d9b38045500ba9934f24 f1b01257b923de915$16$a782de2216ac5636$277823$96$775421c1db2bc628932d3c480ce3f5b669359c5a73dac7726d59e2ba7154d48fe7ff468dc14c16c 5d2acef18bc4dda93$66$03ffee576a1930d9891832fd90b98c510537cb09e5e934d33b8ec75cf883a43778

The first and last test have the same password and the same PUBkey and wallet version, any thoughts  

Yes, the wallets that have the same iteration are simply the same wallet hex edited over and over again with what ever public view key they desire on the same wallet they have made. Not changed in bitcoin core to give new string like you have done above.

Edit: The ones I show that are recurring would not surprise me if they all have the same password, my suspicions are that it is the same encrypted wallet but hex edited with different public keys and junk to show bank in them. This would not be done in the Core Wallet but in a hex editor.

[Spawnx]

Yes, the wallets that have the same iteration are simply the same wallet hex edited over and over again with what ever public view key they desire on the same wallet they have made. Not changed in bitcoin core to give new string like you have done above.

Edit: The ones I show that are recurring would not surprise me if they all have the same password, my suspicions are that it is the same encrypted wallet but hex edited with different public keys and junk to show bank in them. This would not be done in the Core Wallet but in a hex editor.

Some wallets have never spend coins in them, soo the pubkey is not published in the blockchain, the old bitcoin2john scrypt decodes also the pub key from the wallet file, soo we could compare if the pubkey is the same in the wallets with the same iteration. Or somehow try to decode the pubkey from the hash

[Antoni4EVA1984]

Yes, the wallets that have the same iteration are simply the same wallet hex edited over and over again with what ever public view key they desire on the same wallet they have made. Not changed in bitcoin core to give new string like you have done above.

Edit: The ones I show that are recurring would not surprise me if they all have the same password, my suspicions are that it is the same encrypted wallet but hex edited with different public keys and junk to show bank in them. This would not be done in the Core Wallet but in a hex editor.

Some wallets have never spend coins in them, soo the pubkey is not published in the blockchain, the old bitcoin2john scrypt decodes also the pub key from the wallet file, soo we could compare if the pubkey is the same in the wallets with the same iteration. Or somehow try to decode the pubkey from the hash

I like this idea too, have you got a link to the older version of the bitcoin2john scrypt? or you can paste it in here as a comment buddy

[Spawnx]

Yes, the wallets that have the same iteration are simply the same wallet hex edited over and over again with what ever public view key they desire on the same wallet they have made. Not changed in bitcoin core to give new string like you have done above.

Edit: The ones I show that are recurring would not surprise me if they all have the same password, my suspicions are that it is the same encrypted wallet but hex edited with different public keys and junk to show bank in them. This would not be done in the Core Wallet but in a hex editor.

Some wallets have never spend coins in them, soo the pubkey is not published in the blockchain, the old bitcoin2john scrypt decodes also the pub key from the wallet file, soo we could compare if the pubkey is the same in the wallets with the same iteration. Or somehow try to decode the pubkey from the hash

I like this idea too, have you got a link to the older version of the bitcoin2john scrypt? or you can paste it in here as a comment buddy

If You have the 4000btc.dat wallet and this is not a watch only file, please send it to me

[Antoni4EVA1984]

#!/usr/bin/env python

# jackjack's pywallet.py
# https://github.com/jackjack-jj/pywallet
# forked from Joric's pywallet.py

Do you want to upload and share the link here as it does not seem to be working when I copy and paste this, here https://dropmefiles.com/

What version of hashcat are you using and what version of python?

[Antoni4EVA1984]

If You have the 4000btc.dat wallet and this is not a watch only file, please send it to me

Personally looks dodgy to me, I think it is the same wallet hex edited 100%

Wallet 4000 BTC
$bitcoin$64$ff4eb1d017921e0c7023da7e17aa72bd5f11f9025c844865665932125f79f465$16$6b8207637fc796a0$37698$2$00$2$00

10 BTC - 1MB28otoAQFpP9ywiA8CbYVSKHpSTBH1z6                                                                                      
$bitcoin$64$6942834a1cdda69705d2cf9ebc3a204d5bfa64ff40d81db0bac6ccf63b3aff8f$16$00aa7d8b96e6174d$37698$2$00$2$00

3 BTC - 1DGNFJ6i4wvTAafLNux67w598bKREF5LwY
$bitcoin$64$226093b84d6c3d0eeeb96e3ccece44068769410cb5968b16430a0d1158a6d071$16$4c9e8811f730201c$37698$2$00$2$00

Wallet 2.007 BTC                                                                                                                                                    
$bitcoin$64$64668bf6d05f12989ac6e9c290948a87a550b057dafc19e8e0647356b10075a6$16$803496cf5f4a82bc$37698$2$00$2$00

Wallet 9.81 BTC                                                                                                                                                    
$bitcoin$64$f3fd430597ae77731bcec4dd52738858eccdb7f264b96c8745a0f2acb585d742$16$f68294cbf6eb24b7$37698$2$00$2$00

[Spawnx]

#!/usr/bin/env python

# jackjack's pywallet.py
# https://github.com/jackjack-jj/pywallet
# forked from Joric's pywallet.py

Do you want to upload and share the link here as it does not seem to be working when I copy and paste this, here https://dropmefiles.com/

What version of hashcat are you using and what version of python?

Forgot to tell it works witch pyton 2.7

[badazz77]

If You have the 4000btc.dat wallet and this is not a watch only file, please send it to me

Personally looks dodgy to me, I think it is the same wallet hex edited 100%

Wallet 4000 BTC
$bitcoin$64$ff4eb1d017921e0c7023da7e17aa72bd5f11f9025c844865665932125f79f465$16$6b8207637fc796a0$37698$2$00$2$00

10 BTC - 1MB28otoAQFpP9ywiA8CbYVSKHpSTBH1z6                                                                                      
$bitcoin$64$6942834a1cdda69705d2cf9ebc3a204d5bfa64ff40d81db0bac6ccf63b3aff8f$16$00aa7d8b96e6174d$37698$2$00$2$00

3 BTC - 1DGNFJ6i4wvTAafLNux67w598bKREF5LwY
$bitcoin$64$226093b84d6c3d0eeeb96e3ccece44068769410cb5968b16430a0d1158a6d071$16$4c9e8811f730201c$37698$2$00$2$00

Wallet 2.007 BTC                                                                                                                                                    
$bitcoin$64$64668bf6d05f12989ac6e9c290948a87a550b057dafc19e8e0647356b10075a6$16$803496cf5f4a82bc$37698$2$00$2$00

Wallet 9.81 BTC                                                                                                                                                    
$bitcoin$64$f3fd430597ae77731bcec4dd52738858eccdb7f264b96c8745a0f2acb585d742$16$f68294cbf6eb24b7$37698$2$00$2$00

4000 wallet shows a balance and has a public key, public address and encrypted privkey, i think it has to be real

[Antoni4EVA1984]

4000 wallet shows a balance and has a public key, public address and encrypted privkey, i think it has to be real

No, yes a private key that does not match with the public key. It is Hex edited I guarantee but good luck any how's.

[Antoni4EVA1984]

Another one that is similar to many other wallets I have checked so far, has an unknown receiving address & transaction with missing details

This is the first of many examples.

8.5BTC-1KDUcZh5Z6H1of4Pwoy5ojJtkQxcQBHhnH
$bitcoin$64$ff134f9f03da571e5b256dec561730aaa674ff37d8a698d3c2c5e66fdbb07335$16$125d64b2bab4c437$136217$2$00$2$00


What's that you tell me?................... But...But it has it's own public address and encrypted private key so it must be real as it has balance

[hspr1371]

I really need a real review.
Someone tell me: I have a question outside of all the specialized topics you raise.
1) Can someone really help in recovering a wallet backup file? Real
2) How and where can a real and correct file be prepared?
Thank you for not failing to answer me

Hamid spr == hamid.spr.2021@gmail.com

[Antoni4EVA1984]

I really need a real review.
Someone tell me: I have a question outside of all the specialized topics you raise.
1) Can someone really help in recovering a wallet backup file? Real
2) How and where can a real and correct file be prepared?
Thank you for not failing to answer me

Hamid spr == hamid.spr.2021@gmail.com

I replied to you in an earlier post here if it is actually your wallet and if you have any idea how long the password is and any idea's of what you might of used. If it is a wallet you found online more then likely not.

[Spawnx]

I really need a real review.
Someone tell me: I have a question outside of all the specialized topics you raise.
1) Can someone really help in recovering a wallet backup file? Real
2) How and where can a real and correct file be prepared?
Thank you for not failing to answer me

Hamid spr == hamid.spr.2021@gmail.com

If You want it to be safe (If You really have problems accesing Your wallet) i advaise You to keep the discussion public to avoid any scamers that will steal Your coins, describe the problem You have

[Spawnx]

Not because I don't trust this collection. Not . But I'm more interested in working with someone in a private place. I'm really in trouble. And I am in great need. Because I am a father and my child has cancer. I sold my whole life. But I need more money. No one could help me anywhere. I just want to beg here. If anyone can contact me. Because surely no one needs  more than me.
Thanks and sorry for the irrelevant discussion

Write me an email with Your problem, i assure this group that when i will recognize this is a scam i will notify this here

[hspr1371]

Not because I don't trust this collection. Not . But I'm more interested in working with someone in a private place. I'm really in trouble. And I am in great need. Because I am a father and my child has cancer. I sold my whole life. But I need more money. No one could help me anywhere. I just want to beg here. If anyone can contact me. Because surely no one needs  more than me.
Thanks and sorry for the irrelevant discussion

Write me an email with Your problem, i assure this group that when i will recognize this is a scam i will notify this here

I do not have your email.
Please email me: hamid.spr.2021@gmail.com

[Spawnx]

Not because I don't trust this collection. Not . But I'm more interested in working with someone in a private place. I'm really in trouble. And I am in great need. Because I am a father and my child has cancer. I sold my whole life. But I need more money. No one could help me anywhere. I just want to beg here. If anyone can contact me. Because surely no one needs  more than me.
Thanks and sorry for the irrelevant discussion

Write me an email with Your problem, i assure this group that when i will recognize this is a scam i will notify this here

I do not have your email.
Please email me: hamid.spr.2021@gmail.com

Andariel77@protonmail.com

[Antoni4EVA1984]

Write me an email with Your problem, i assure this group that when i will recognize this is a scam i will notify this here

This is clearly not his wallet. I would not entertain the story.

[Antoni4EVA1984]

Not because I don't trust this collection. Not . But I'm more interested in working with someone in a private place. I'm really in trouble. And I am in great need. Because I am a father and my child has cancer. I sold my whole life. But I need more money. No one could help me anywhere. I just want to beg here. If anyone can contact me. Because surely no one needs  more than me.
Thanks and sorry for the irrelevant discussion

This thread is not for this.

[hspr1371]

Write me an email with Your problem, i assure this group that when i will recognize this is a scam i will notify this here

This is clearly not his wallet. I would not entertain the story.

that's very kind of you . You judge everyone very easily and perfectly.
thank you
I ask others to ignore my message.
Of course I will clean.
I wish we could all have as much humanity as our expertise.