Get encrypted private keys from wallet.dat

[pbies]

Hi All,

I am getting private keys from decrypted wallets by searching the wallet.dat file with keyhunter for b'\x01\x30\x82\x01\x13\x02\x01\x01\x04\x20' bytes.

But what I want to do is dump all encrypted private keys in the same way - search for some magic bytes and then move forward/backward and dump bytes with encrypted private key.
They should be in ckey as I understand.

How can I do that? What bytes to search for and which to dump?

[pbies]

Got it!

Look for "ckey!", before this there are 4 bytes b'\x27\x00\x01\x04' - before that there are 48 bytes of ckey (which consists of encrypted private key).