wallet dump strange format? BITCORE

[yawhoist]

---- Bitcoin Client Software and Version Number:  v26.0.0
---- Operating System: Linux

---- System Hardware Specs:32GB RAM SSD i7

---- Description of Problem: wallet dump not formatted as usual
---- Any Related Addresses:

1L2HJC84hdBhtY3WimfvSZeV2MFnKcqvv3

1LirX9HGFC7X7rDFntDQhnPjZWSbik8j2o

1GynqsMmHYe3hyzDx7p6o5dFvwhWLieHsq

14qt9jiYoEZ5jS4eLzSitazE6oKL5TRjyb


---- Screenshot of the problem: https://imgur.com/a/GcVE0iU  https://imgur.com/a/deghuZl https://imgur.com/a/rDoPky6

---- Log Files from the Bitcoin Client:


I'm willing to donate a few BTC (yes bitcoinS!) to anyone who can help me fix this issue.

to sum it up i had a legacy wallet from around 2013 - 2014, i imported it into the latest version of bitcoin core, it has a balance of bitcoin, and has addresses that are mine, i could not refill keypool to make transactions, when i ran keypool refill command it returns "null", same with dump priv key command, says error cannot dump private key for this address (though address are mine and have balance).

i tried dumping wallet and the format is not as expected, for some reason the what i assume to be private keys are supposed to not look like this :

((example)) randmized a bit as i don't want my keys potentially stolen if they do work somehow :


""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
# Wallet dump created by Bitcoin Core v26.0.0
# * Created on 2024-06-23T10:07:48Z
# * Best block at time of backup was 240215 (00000000000000eab9f1815a2aca3acf829fe8918f1e081c31bba4804a2853d6),
#   mined on 2014-05-07T11:03:28Z


001431760bffc31de7b5d05b5f848d69415ae1ff6e8b 0 script=1 # addr=3Apd9pGc6jpt7k1J9iXh5m2qDSoH8NoobD

""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""

and many more in the same format, i'm not sure what format this is, the wallet is encrypted and i have it's passphrase, i tried importing on several core versions and it returns "null". i even downloaded a legacy core version and tried import, did not work for some reason, i provided screenshots in url in this post


also checked log when i imported the dump to a legacy wallet  and nothing imported:

2024-06-29T23:25:25Z [default wallet] Already have script redacted for privacy, skipping
2024-06-29T23:25:25Z [default wallet] Already have script redacted for privacy by my self again, skipping

[BitMaxz]

I don't know if you are doing it right but according to the first image it seems you are importing a .txt file so would you mind telling us what backup exactly you have?

If you have the exact wallet file "wallet.dat" then you can try to extract the private key using Pywallet since you have the passphrase you should be able to get the exact private key.

Here's the tool below

- https://bitcointalk.org/index.php?topic=34028.0

And use this command

Code:

pywallet.py --dumpwallet  --datadir=. --passphrase=YourPassword

[yawhoist]

is it possible to extract without passphrase? that's why i initially used dumpwallet command for since i got the wallet in an unlocked state :p

[BitMaxz]

is it possible to extract without passphrase? that's why i initially used dumpwallet command for since i got the wallet in an unlocked state :p

Using the tool above you should be able to extract the private keys without the passphrase using the command above by removing the passphrase command or using this command below

Code:

pywallet.py --dumpwallet  --datadir=.

However, if the wallet is encrypted with a passphrase then the result is also encrypted you need the passphrase to be able to decrypt it.

[yawhoist]

got any idea on why the dump looks like that though?

[achow101]

got any idea on why the dump looks like that though?

It looks normal for a wallet that does not contain any private keys.

dumpprivkey doesn't work because you don't have the private keys for those addresses.

The wallet probably has private keys disabled.


Where did this wallet come from? Did you create it or did you get it from someone else?

[nc50lc]

---- Any Related Addresses:

1L2HJC84hdBhtY3WimfvSZeV2MFnKcqvv3

1LirX9HGFC7X7rDFntDQhnPjZWSbik8j2o

1GynqsMmHYe3hyzDx7p6o5dFvwhWLieHsq

14qt9jiYoEZ5jS4eLzSitazE6oKL5TRjyb

Those addresses belong to a "for sale" wallet.dat listed in this site: https://web.archive.org/web/20231107034757/https://allprivatekeys.com/wallet/200.1729BTC (archived)

You can't expect a wallet.dat that's being sold for a fraction of its value to contain the amount that it shows.
Most of the cases, those wallets are altered to display addresses with high balance despite not having the respective private keys.

[yawhoist]

got any idea on why the dump looks like that though?

It looks normal for a wallet that does not contain any private keys.

dumpprivkey doesn't work because you don't have the private keys for those addresses.

The wallet probably has private keys disabled.


Where did this wallet come from? Did you create it or did you get it from someone else?

I'm able to run dump private key but it says unknown for this address, i have it unlocked, in an unlocked state

[LoyceV]

I'm able to run dump private key but it says unknown for this address

You're ignoring the main questions:

Where did this wallet come from? Did you create it or did you get it from someone else?

You can't expect a wallet.dat that's being sold for a fraction of its value to contain the amount that it shows.

If you bought a fake wallet, you're wasting everyone's time.

[BitMaxz]

Those addresses belong to a "for sale" wallet.dat listed in this site: https://web.archive.org/web/20231107034757/https://allprivatekeys.com/wallet/200.1729BTC (archived)

The archive seems does not work. Anyway, I directly accessed the site and all the addresses posted above are the same so there's no doubt this is a fake wallet.dat file.

@OP I just checked all the addresses you mentioned above if these are the addresses you want to dump private keys you're just wasting your time if you check them directly to any block explorer all of them have 0 balances except to the first address but still it's not worth recovering because it only has 10k sats.
Unless you are planning to get help here until decide to sell it to someone interested here?

[LoyceV]

@OP I just checked all the addresses you mentioned above if these are the addresses you want to dump private keys you're just wasting your time if you check them directly to any block explorer all of them have 0 balances except to the first address but still it's not worth recovering because it only has 10k sats.

Those addresses were used to mine 50 BTC each, and received "send to pubkey" transactions. Mempool.space doesn't show them, but Blockchair.com does. It's debatable which block explorer is technically correct, but in my opinion showing the transactions is the most useful option.

[nc50lc]

Those addresses belong to a "for sale" wallet.dat listed in this site: https://web.archive.org/web/20231107034757/https://allprivatekeys.com/wallet/200.1729BTC (archived)

The archive seems does not work. Anyway, I directly accessed the site and all the addresses posted above are the same so there's no doubt this is a fake wallet.dat file.

Weird, it's working at my end with a few backend sources missing like fiat rate and CSS styling that aren't included to the archive.
If the whole website isn't accessible, probably, archive.org banned your IP address since they seems to be aggressive on banning IP addresses.

[Forsyth Jones]

I don't know if you are doing it right but according to the first image it seems you are importing a .txt file so would you mind telling us what backup exactly you have?

If you have the exact wallet file "wallet.dat" then you can try to extract the private key using Pywallet since you have the passphrase you should be able to get the exact private key.

Here's the tool below

- https://bitcointalk.org/index.php?topic=34028.0

And use this command

Code:

pywallet.py --dumpwallet  --datadir=. --passphrase=YourPassword

I was curious and tried to install this tool, but I was in doubt, in this link you mentioned, the OP says he is working on another project with no name yet.

Does this same command work on the new pywallet or should I download the old one?

It seems that the installation instructions on github are not clear enough for setup, could you mention how to install?

In the meantime, I'll try to install it here and test, see if I can.

Edit: Furthermore, there are several projects on github with the same name... is this the real one?

[BitMaxz]

I was curious and tried to install this tool, but I was in doubt, in this link you mentioned, the OP says he is working on another project with no name yet.

Does this same command work on the new pywallet or should I download the old one?

It seems that the installation instructions on github are not clear enough for setup, could you mention how to install?

In the meantime, I'll try to install it here and test, see if I can.

Edit: Furthermore, there are several projects on github with the same name... is this the real one?

If you talking about the pywallet from joric then that's the oldest one the jackjack pywallet is the most recent one.

Do you get some error when trying to use my command above? it works on Windows unless you are using Linux?

You don't need to install it you just need to download the pywallet and install the Python 2.7 in your system go to the folder where the pywallet is saved and open the command prompt there and apply the command above make sure to put the wallet.dat file on the same folder.

[Forsyth Jones]

I was curious and tried to install this tool, but I was in doubt, in this link you mentioned, the OP says he is working on another project with no name yet.

Does this same command work on the new pywallet or should I download the old one?

It seems that the installation instructions on github are not clear enough for setup, could you mention how to install?

In the meantime, I'll try to install it here and test, see if I can.

Edit: Furthermore, there are several projects on github with the same name... is this the real one?

If you talking about the pywallet from joric then that's the oldest one the jackjack pywallet is the most recent one.

Do you get some error when trying to use my command above? it works on Windows unless you are using Linux?

You don't need to install it you just need to download the pywallet and install the Python 2.7 in your system go to the folder where the pywallet is saved and open the command prompt there and apply the command above make sure to put the wallet.dat file on the same folder.

I did everything you suggested before, installed Python27 and it gave me this error:

I searched for similar problems, but no solution.

Furthermore, whenever I was testing, another error also came up:



There is a 'bsddb' component missing, but from what I heard, this is already included in the python27 package, so I installed python2.7.3 and nothing happened

I tested both: joric and jackjack-jj

[BitMaxz]

I did everything you suggested before, installed Python27 and it gave me this error:

I searched for similar problems, but no solution.

Furthermore, whenever I was testing, another error also came up:



There is a 'bsddb' component missing, but from what I heard, this is already included in the python27 package, so I installed python2.7.3 and nothing happened

I tested both: joric and jackjack-jj

I have similar issue before I just can't remember where I got the solution would you mind to paste the whole error and put it into insert code tag let me try to find the solution for you.

Can you also try to check the python version via command?
Use this command

Code:

python --version

If the result have some error I think you forgot to check the add python.exe to the path which is why you get some unrecognized errors.
Try this solution https://datatofish.com/add-python-to-windows-path/

[Forsyth Jones]

-

Code:

python --version

If the result have some error I think you forgot to check the add python.exe to the path which is why you get some unrecognized errors.
Try this solution https://datatofish.com/add-python-to-windows-path/

Python 3.10.1
but I installed python 2.7 and it is in the directory: C:\Python27

I can't find the python 2 script path, I intend to continue another day when I have more time. But I'm really looking forward to seeing what's inside wallet.dat, I like these things.

(2) The Python Scripts path. The Scripts folder should be located within the Python application path.

Previously we could dump the bip32 root key and child keys with dumpwallet "filename", but unfortunately this command no longer works for descriptor wallets.

edit: I tried other ways, but it didn't work either and they were all caused by the same error.
remembering that my wallet.dat is passphrase protected, so I add: --passphrase=dump123

[nc50lc]

That's a syntax error in Python from Pywallet's code and not specifically caused by the arguments you've used.

And Jackjack's pywallet doesn't have that code in line 810, only joric's version.
Joric's: https://github.com/joric/pywallet/blob/3f6b782f7ad6470780ce18b04e4b387eabb1da7a/pywallet.py#L810
JackJack's: https://github.com/jackjack-jj/pywallet/blob/62913db537a42976b15260258e9c27642c3e0a41/pywallet.py#L810
Are you sure that you've pasted the correct pywallet in "C:\python27" directory?

But neither version shows that error at my end.
And these conversation may be off-topic to the original post, you might need to create your own thread.

[Mushai]

Error code -4 means : Unspecified problem with wallet (key not found etc.)

Wallet is probably a watch address only wallet, and therefore doesn't contain any private keys.

As mentioned before, this is a wallet that has been for sale on "lost" wallet sites.

eg:
https://allprivatekeys.com/wallet/200.1729BTC
https://satoshidisk.com/pay/CCLIag
https://wallet-dat.net/bitcoin-core-wallet-dat/bitcoin-core-wallet-dat-200-btc/

[nc50lc]

Wallet is probably a watch address only wallet, and therefore doesn't contain any private keys.

It's a "tampered" legacy wallet with those addresses somehow imported not as watch-only but doesn't contain the correct private key.
Otherwise, seeing a watch-only indicator in the transactions might not fool even the most gullible individuals.
Typical of those for sale fake wallets.

Here's the takeaway:
It's a legacy wallet which can import both private keys and addresses since dumpprivkey command is compatible with it.
Since he's using v26.0 and it's a legacy wallet, the transactions should've an "eye" icon before the date if the associated address is known by the wallet as watch-only.
The screenshots show otherwise.