Search content
Sort by

Showing 4 of 4 results by ketubi
Post
Topic
Board Bitcoin Technical Support
Re: Help me to recover 33.54 BTC from a corrupt wallet.dat, I'll pay you a Reward!
by
ketubi
on 25/11/2020, 16:15:54 UTC
H guys! I'm getting back with this post. I was kinda frustrated because I tried so many things.

Now, I became a software engineer with Sr level python experience. So, if you have any Python script that maybe help I'll try it. Or, if you have any procedure I'll listen to you and try it. But, I'll not give you the .dat file. Also, I'll try only the source code provided, for security reasons.




Thanks for the response, i tried to dump my wallet and i get "error un dump page". See the image

https://drive.google.com/file/d/1VriRG4hyGxcqBNRL5QL7x7Wzl4QR185X/view?usp=sharing

You can't dump a corrupt wallet to json as it won't have the correct format.
I quickly wrote a small Python script for parsing a wallet and dumping the private keys from it (run with Python 2):

Code:
import sys
import struct
from bsddb.db import *
from hashlib import sha256

# Dumps the private keys from a wallet.dat file.
# Inspired by pywallet.
# Credits: https://bitcoin.stackexchange.com/questions/13681/opening-wallet-dat-in-python-using-bsddb3

B58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"

if not len(sys.argv) == 2:
    print("Usage: %s <wallet_file>" % sys.argv[2])
    sys.exit(1)

def read_size(buffer, offset):
    size = ord(buffer[offset])
    offset += 1

    if size == 0xfd:
        size = struct.unpack_from("<H", buffer, offset)[0]
        offset += 2
    if size == 0xfe:
        size = struct.unpack_from("<I", buffer, offset)[0]
        offset += 4
    if size == 0xff:
        size = struct.unpack_from("<Q", buffer, offset)[0]
        offset += 8

    return offset, size

def read_string(buffer, offset):
    offset, string_len = read_size(buffer, offset)
    return offset + string_len, buffer[offset: offset + string_len]

def b58_encode(d):
    out = ""
    p = 0
    x = 0

    while ord(d[0]) == 0:
        out += "1"
        d = d[1:]

    for i, v in enumerate(d[::-1]):
        x += ord(v)*(256**i)

    while x > 58**(p+1):
        p += 1

    while p >= 0:
        a, x = divmod(x, 58**p)
        out += B58[a]
        p -= 1

    return out

def b58check_encode(d):
    checksum = sha256(sha256(d).digest()).digest()[:4]
    return b58_encode(d + checksum)


db = DB()
db.open(sys.argv[1], "main", DB_BTREE, DB_RDONLY)

items = db.items()

for item in items:
    k, v = item
    koff, voff = 0, 0
    koff, item_type = read_string(k, koff)

    if item_type == "key":
        koff, pubkey = read_string(k, koff)
        voff, privkey = read_string(v, voff)

        if len(privkey) == 279:
            secret = privkey[9:9+32]
        else:
            secret = privkey[8:8+32]

        if pubkey[0] != "\x04":
            secret += "\x01"

        print(b58check_encode("\x80" + secret))
db.close()

It's very simple, and outputs a bunch of WIF private keys (you can paste them into Electrum's Sweep dialog for example, but if there's many of them, it's going to take a while to check their balances, so be patient.
NOTE: the method of working with the database used here is different from pywallet's. It may work better on corrupted wallets.
A pip install of the bsddb may be required.

You might also be able to get bitcointools to turn a private key from one of the mentioned scripts and convert it to an address to scan for a balance on blockchain.info's API.
The user jackjack here wrote pywallet (you can search for it on githum and it should appear under the name jackjack-jj/pywallet).

What drive was the file on before it became corrupted? Was it in amongst other files or on its own on the drive - can you get that drive professionally recovered, have you?

Thanks for the response, my client doesn't have the original drive where the wallet was not corrupted.
How do you know this is your exact wallet.dat? Do you just think it's for bitcoin or had you put it on a specific drive to back it up which it got corrupted on. Do you have any backups of the corrupted wallet also as in if you did a full system backup at the time that you still have a copy of?
Post
Topic
Board Bitcoin Technical Support
Re: Help me to recover 33.54 BTC from a corrupt wallet.dat, I'll pay you a Reward!
by
ketubi
on 16/12/2017, 07:44:37 UTC
The user jackjack here wrote pywallet (you can search for it on githum and it should appear under the name jackjack-jj/pywallet).

What drive was the file on before it became corrupted? Was it in amongst other files or on its own on the drive - can you get that drive professionally recovered, have you?

Thanks for the response, my client doesn't have the original drive where the wallet was not corrupted.
Post
Topic
Board Bitcoin Technical Support
Re: Help me to recover 33.54 BTC from a corrupt wallet.dat, I'll pay you a Reward!
by
ketubi
on 16/12/2017, 07:36:09 UTC
Thanks for the response, i tried to dump my wallet and i get "error un dump page". See the image

https://drive.google.com/file/d/1VriRG4hyGxcqBNRL5QL7x7Wzl4QR185X/view?usp=sharing
Post
Topic
Board Bitcoin Technical Support
Help me to recover 33.54 BTC from a corrupt wallet.dat, I'll pay you a Reward!
by
ketubi
on 16/12/2017, 01:03:34 UTC

Hi folks! I have a Old corrupt wallet.dat from a client. I tried some things to recover those 33.54 BTC, since July 16. This is the wallet:

https://blockchain.info/address/1KYYVUwWSMrNkje41jzvubSRsjABu3EUt6

Next, a short summary of the history of this wallet:

*) This wallet comes from a old version of bitcoin-qt (2011), my client said "0.3.24 Beta version", but that is not sure. He remember, he could mining with that client of bitcoin-qt. In fact, he did a "copy & paste" of the wallet.dat when the client was mining and updating. Then, he put that file in a USB drive, and stored for years. When he tried to recover the wallet.dat with a new client of bitcoin-qt, bit he never had success.

*) He said, "the wallet is not encrypted with a password".

*) The size of the wallet.dat file is 112kb

What i tried, with no success :

1) I downloaded the bitcoin-qt client 0.3.24beta, and i tried to open the client with the wallet.dat loadded. i had this messagge:

https://drive.google.com/file/d/1feAvAHdS8t7e2bY3pGVRPZOtMcUgkasj/view?usp=sharing

2) I downloaded the new version of bitcoin-qt client 0.12.1 (i did in July 16), and i tried to open with the same method above.

3) I tried commands from the bitcoin-qt client 0.12.1, like "salvagewallet" and "upgradewallet".

4) I tried bitcointools.

5) Then i started to open the wallet with a HEX editor and looking for a pattern like "KeyA", "key!" or any other kind.

6) Also i tried this script: https://gist.github.com/msm595/7595164. I got 0 privkey.

7)I modified the script above, changing the line 17, with other kinds of REGEX patterns. I tried:

What i need:

*)Any Kind of help, I don't rule out that I could have tried badly some previously mentioned method.

*)Don't Waste your time, requesting the wallet.dat file. I'll not pass it on.

*)You can pass me, open source scripts writed for you, with the following steps to make it work.

*)I am a Python Developer, so i'll prefer scripts writed in that lenguage.

If your recover method, helps me to recover the wallet.dat i'll pay you a reward (We can negociate it)