Derivation path for brute forcing "25th word" on a multisig wallet

[asdfghj]

So I added a 25th word to my seed, forgot it, and am (after 6 months of on and off guessing) relegated to brute force (3rdIteration/btcrecover).

Succinct question: what derivation path should I specify in the --bip32-path argument?

• Hardware: Original Trezor
• Wallet creating software: Electrum in 2017
• Wallet setup: 2o3
• Wallet current software: Electrum in 2021
• the xpubs are known

Electrum 2021 shows:

• script type, p2sh
• cosigner 1 [HW] trezor1 m/45'/0
• cosigner 2 [HW] trezor2 m/45'/0
• cosigner 3 unknown unknown.
• addresses, previous sends, balance (though maybe these are stored and not derived??)

I am trying to crack cosigner 2.

It is possible I copied the xpub from an old wallet so I am questioning the guarentee that m/45'/0 is the correct derivation path.  This is a multisig wallet. In electrum the walletinfo pane lists a derivation path of m/45'/0. Is this a derivation path I can use to crack my xpriv > xpub? Or is this misleading me and is instead a derivation path from xpub x 3 > multisig addresses (in this case my xpriv > xpub path could be anything)?

I've gone through most of the character spaces which I think my passphrase could occupy so I am hoping I am doing something wrong or the transition from 2017 to 2021 electrum has introduced a variation I have missed.

Any tips on what to double check? Notably this[1] post lists m/44'/0/

btcrecover command: python3 btcrecover.py --tokenlist tokenlist2.txt --mpk "xpub69XXX" --bip32-path "m/45'/0" --mnemonic "24 words verified to match my trezor" --bip39

  [1]: https://bitcoin.stackexchange.com/questions/51989/what-bip32-derivation-path-does-electrum-use-for-multisig?rq=1

[o_e_l_e_o]

The derivation paths shown by Electrum for each individual cosigner will be the derivation path for that individual cosigner, and not for the multi-sig wallet as a whole. Whatever xpub is shown for cosigner 2 in Electrum will be at the derivation path that it shows for cosigner 2. m/45'/0 is the standard Electrum derivation path for legacy multi-sig, so it does indeed seem that your cosigner 2 xprv will be at m/45'/0. If the xpub for cosigner 2 had been copied from another wallet and pasted in when creating this multi-sig wallet, then it would display the derivation path as "unknown". The fact that it is showing you m/45'/0 (and that it knows it came from a Trezor) means that this is not the case.

Your btcrecover command looks fine as far as I can see, provided you are sure your seed phrase is correct and your tokenlist is doing what you think it is doing. You can use the --listpass command to check.