Hello everyone, I already posted in one of the threads, but wanted to make a general post about this topic.
I have diagnosed the key derivation/encryption routine for BCVault and am hoping I can help out some of you that have locked up funds - or at least verify with certainty that your password was not mistyped etc. which could help in your understanding of what may have happened. This is a brute-force capability, not a security vulnerability.
If you look at this GitHub repo (
https://github.com/eliaspoliceno/decrypt-bcvault), you will see a user who about 5 years ago posted some test wallets and wanted to figure it out. I added an issue showing him the decrypted wallets. I can allow users to verify this by sending me an encrypted backup binary wallet file
(empty of course), with a password that is not too hard because it would have to be brute-forced. My hope is I can help some of you figure out what happened so you can be more confident that your password/pin do not work etc. or possibly even help you access your funds. Also knowing the structure of the encrypted/decrypted wallet files I would be able to tell you what bytes to carve so that you could securely share data to be analyzed to find matching password/pin (without initially giving that person capability to access your private key). Also, if you don't have access to your backup files for whatever reason still reach out as I have colleagues that access the wallet files from the device, but backup files are much easier and faster obviously.
Thanks and good luck - for now can just send me a message here and I will get in touch when possible. This process involved reverse engineering the firmware files.
You can post the empty binaries here or send them to me directly for a private example.
I understand you may not have an extra BCVault to do this, but if some are out there and want to show a public example feel free to post so others can see.
PdF.
