Base 64 characters? Bitcoin docx file

morbius55

full member

Activity: 217

Merit: 109

Quote from: HCP on April 05, 2021, 03:38:27 PM

Quote from: morbius55 on March 25, 2021, 04:51:38 PM

As part of an attempt to retrieve a Bitcoin wallet/private key from an old hard drive I have found a docx file labeled Bitcoin. It consists of 3 blocks of characters A-Z, a-z, numbers 1-9 and+/. Each block is about 70 characters long and about 50 lines deep.

Do the 3 blocks all start with the characters "U2F"? Huh

If not, do the 3 blocks all start with the same couple of characters... and if so, what are those characters? Huh

https://imgur.com/s23eGUj This is the majority of the first block of text. There are another 4 of about the same size plus a smaller block. I have to open it in Word with the get text from any file facility as it won't open otherwise. The file is labelled bitcoin_ addresses.docx. There is another one just called bitcoin addresses and when i open that it just has the address i am interested in, in plain text. So i'm a bit stumped on what, if anything i can get from these files.

morbius55

full member

Activity: 217

Merit: 109

Quote from: HCP on April 05, 2021, 04:58:16 PM

Quote from: morbius55 on April 05, 2021, 04:18:06 PM

https://imgur.com/s23eGUj This is the majority of the first block of text.

It certainly looks like Base64 with the +'s and /'s... but it's possible that it is encrypted text/data that has been Base64 encoded... And, obviously, without knowing the details of the encryption method used, if you Base64 decode it, you're just going to get the encrypted data which will look like gibberish Undecided

Someone mentioned that it could be a pgp file?

HCP

legendary

Activity: 2086

Merit: 4361

Quote from: morbius55 on April 05, 2021, 04:18:06 PM

https://imgur.com/s23eGUj This is the majority of the first block of text.

It certainly looks like Base64 with the +'s and /'s... but it's possible that it is encrypted text/data that has been Base64 encoded... And, obviously, without knowing the details of the encryption method used, if you Base64 decode it, you're just going to get the encrypted data which will look like gibberish Undecided

HCP

legendary

Activity: 2086

Merit: 4361

Quote from: morbius55 on March 25, 2021, 04:51:38 PM

As part of an attempt to retrieve a Bitcoin wallet/private key from an old hard drive I have found a docx file labeled Bitcoin. It consists of 3 blocks of characters A-Z, a-z, numbers 1-9 and+/. Each block is about 70 characters long and about 50 lines deep.

Do the 3 blocks all start with the characters "U2F"? Huh

If not, do the 3 blocks all start with the same couple of characters... and if so, what are those characters? Huh

nc50lc

legendary

Activity: 2534

Merit: 6080

Self-proclaimed Genius

Quote from: ?? on ??

Could it be a Blockchain wallet in json format?

Does it look like this? (some lines omitted):

Code:

........"auth_type":0,"real_auth_type":0,"payload":"{\"pbkdf2_iterations\":5000,\"version\":3,\"payload\":\"gTMWA+Y8XtvNqndEaxLGat5vtVvx8..............LONG_BASE64_STRING................kpdRLGwhkrK5xRFuTMj1WMsBUVH7\/zgz0GDkzwq9wSNucrLjag==\"}","symbol_local":{"symbol":"$","code":"USD","symbolAppearsAfter":false,"name":"U.S. dollar","local":true,"conversion":0},"guid":"xxx","payload_checksum":"xxx","war_checksum":"xxxx","language":"en","symbol_btc":{"symbol":"BTC","code":"BTC","symbolAppearsAfter":true,"name":"Bitcoin","local":false,"conversion":100000000.00000000},"sync_pubkeys":false}

An unformatted JSON with long base64 string at the middle part.

If so, you can try to paste it to a .txt file and rename the file into wallet.aes.json including the extension, from ".txt" to ".json" then import it to their recovery page: https://login.blockchain.com/wallet/import-wallet (password required).

NotATether

legendary

Activity: 1568

Merit: 6660

bitcoincleanup.com / bitmixlist.org

Quote from: morbius55 on March 25, 2021, 04:51:38 PM

I have found a docx file labeled Bitcoin.

Something hit me after reading this again - a human had to have pasted the stuff in this file. .docx file format is actually a ZIP archive with various other files inside (open it inside 7-zip or any archiving program if you don't believe me), so there is no way this could have been computer generated by a recovery tool.

Do you remember if you were the one who created this file, or if you have any idea where you pasted the data from? It doesn't look like something you'll find in Bitcoin-Qt.

What is the date of the file's creation? This'll help narrow down the potential sources to software that existed at the time.

KingZee

sr. member

Activity: 938

Merit: 452

Check your coin privilege

Quote from: morbius55 on March 29, 2021, 03:18:11 PM

Quote from: NotATether on March 29, 2021, 08:47:15 AM

You can safely test if you have Base64 input and what it encodes by running the following Python code in your local interpreter.

Code:

import base64
string = input("Input base64 here: ")
string_decode = base64.decodestring(string)
print("Decoded string:")
print(string_decode)

I would avoid using online base64 decoders if you think you might have a private key, since you have no idea if the data is logged server-side.

I assume you already have python installed based on your previous support questions about pywallet.

I might have to send the file to someone trusted to have a look at as I'm not sure what I'm doing. I have got python 2.7 installed but it is a lot of text to enter in a command line. Thanks for your time.

Could you please just provide more clarification on what the text is? I still have no idea how the text looks. Is it 70 character blocks? Or is it 70x50 blocks? Is there a new line after each 70 characters? Did you copy paste these files from somewhere or do you remember if you gnerated them yourself the first time?

morbius55

full member

Activity: 217

Merit: 109

Quote from: NotATether on March 29, 2021, 08:47:15 AM

You can safely test if you have Base64 input and what it encodes by running the following Python code in your local interpreter.

Code:

import base64
string = input("Input base64 here: ")
string_decode = base64.decodestring(string)
print("Decoded string:")
print(string_decode)

I would avoid using online base64 decoders if you think you might have a private key, since you have no idea if the data is logged server-side.

I assume you already have python installed based on your previous support questions about pywallet.

I might have to send the file to someone trusted to have a look at as I'm not sure what I'm doing. I have got python 2.7 installed but it is a lot of text to enter in a command line. Thanks for your time.

NotATether

legendary

Activity: 1568

Merit: 6660

bitcoincleanup.com / bitmixlist.org

You can safely test if you have Base64 input and what it encodes by running the following Python code in your local interpreter.

Code:

import base64
string = input("Input base64 here: ")
string_decode = base64.decodestring(string)
print("Decoded string:")
print(string_decode)

I would avoid using online base64 decoders if you think you might have a private key, since you have no idea if the data is logged server-side.

I assume you already have python installed based on your previous support questions about pywallet.

pooya87

legendary

Activity: 3472

Merit: 10611

Quote from: morbius55 on March 28, 2021, 04:20:17 PM

Quote from: math09183 on March 28, 2021, 03:14:27 PM

Take a look at this:
https://blog.cryptohack.org/twitter-secrets
Maybe you have PEM

Interesting, thanks for that. Wish I had the knowledge to apply it.

If you indeed have a PGP key then it has nothing to do with bitcoin, specially if it is very long that would indicate it is possibly an RSA key then it definitely has nothing to do with bitcoin since we don't use RSA anywhere in bitcoin.
I also have never heard of any wallet that has ever used the DER encoding from ASN.1 standard to encode its private keys which is what that link is describing.

KingZee

sr. member

Activity: 938

Merit: 452

Check your coin privilege

Quote from: morbius55 on March 25, 2021, 04:51:38 PM

Each block is about 70 characters long and about 50 lines deep.

What?

morbius55

full member

Activity: 217

Merit: 109

Quote from: math09183 on March 28, 2021, 03:14:27 PM

Take a look at this:
https://blog.cryptohack.org/twitter-secrets
Maybe you have PEM

Interesting, thanks for that. Wish I had the knowledge to apply it.

math09183

member

Activity: 170

Merit: 58

Take a look at this:
https://blog.cryptohack.org/twitter-secrets
Maybe you have PEM

odolvlobo

legendary

Activity: 4466

Merit: 3391

A base-64 encoding with 50 lines of 70 characters sounds a lot like a PGP key.

Charles-Tim

legendary

Activity: 1512

Merit: 4795

Leading Crypto Sports Betting & Casino Platform

Quote from: ?? on ??

With assumption bitcoin private key length is 256-bit, i can't think it's usual Bitcoin private key. With 70 characters long and each character roughly represent 6 bit, it'll produce about 420 bit character.

With 256 bits, the type of private key will be in hexadecimal format. It consists of 64 characters, each character consists of 4 bits, which makes it to be 256 bits.

But the hexadecimal format is the one in 64 characters and it is the original which is used to derive other private key. Adding 01 to it as a suffix to the end of the hexadecimal format will make the private key to be converted from uncompressed to compressed.

Uncompressed bse58Check (WIF) format consists of 51 characters.
Compressed bse58Check (WIF) format consists of 52 characters.

But, in this case, it is about private key base64 (44 characters), while the OP one consist of 70 characters, this makes it not to be bitcoin private key like you commented, no bitcoin private key also have 70 characters.

Charles-Tim

legendary

Activity: 1512

Merit: 4795

Leading Crypto Sports Betting & Casino Platform

Quote from: o_e_l_e_o on March 26, 2021, 05:55:14 AM

You can look up the same quote here to see that it does indeed say + and / - https://www.oreilly.com/library/view/mastering-bitcoin-2nd/9781491954379/ch04.html

That is true, I have checked it.

Quote

Even more compact, Base64 representation uses 26 lowercase letters, 26 capital letters, 10 numerals, and 2 more characters such as “+” and “/” to transmit binary data over text-based media such as email.

This is what I found out at the other site I mentioned earlier.
https://www.garykessler.net/library/base64.html

But, this is clearly understandable now.

o_e_l_e_o

legendary

Activity: 2268

Merit: 18748

Quote from: Charles-Tim on March 26, 2021, 05:38:08 AM

Which means on master bitcoin, it is indicated that base64 can contain any of these characters along “``” and "/" , but on another site, I saw only /+=

It seems either the copy of Mastering Bitcoin you are reading or maybe your browser has an error. ” is the HTML code for the right quotation mark symbol. It does not mean that Base64 can contain &, #, or ;.

You can look up the same quote here to see that it does indeed say + and / - https://www.oreilly.com/library/view/mastering-bitcoin-2nd/9781491954379/ch04.html

Charles-Tim

legendary

Activity: 1512

Merit: 4795

Leading Crypto Sports Betting & Casino Platform

Quote from: o_e_l_e_o on March 26, 2021, 05:24:33 AM

<...>

I appreciate the correction, but one more thing. I found something that makes me confused on mastering bitcoin which I did not input yet.

Quote

Even more compact, Base64 representation uses 26 lowercase letters, 26 capital letters, 10 numerals, and 2 more characters such as “``” and "/" to transmit binary data over text-based media such as email.

Which means on master bitcoin, it is indicated that base64 can contain any of these characters along “``” and "/" , but on another site, I saw only /+=

o_e_l_e_o

legendary

Activity: 2268

Merit: 18748

Quote from: Charles-Tim on March 25, 2021, 08:02:25 PM

two other characters like /, =, + (but / and = for bitcoin base 64 private key)

No. Base64 private keys, like all Base64 numbers, can contain both + and /, and have = at the end as described by DannyHamilton above. Here is an example private key:

Code:

5J2V9K6xMBRTmK3Jn1XL6gz1esXUydS8oAR6SSYu6NBiHKYDBuz

Which in Base64 is:

Code:

G7M7qL+t8Kr8JtZDUctOAfH0gYK34GL4jYFDrS/SDC0=

OP, do the strings start with "U2FsdGVkX1" by any chance?

Charles-Tim

legendary

Activity: 1512

Merit: 4795

Leading Crypto Sports Betting & Casino Platform

Quote from: DannyHamilton on March 25, 2021, 07:08:12 PM

Charles-Tim ~~is incorrect~~ about it not being base64, though he might be correct about it not being a private key.

I did not mean that, what I meant is that it is not a bitcoin private key. All base 64 bitcoin private keys have base 64 representation, but not all base 64 representation are base 64 bitcoin private key.

Base 64 representation can contain:

any of the 26 uppercase
any of the 26 lowercase
any of the 10 numerals (0-9)
two other characters like /, =, + (but / and = for bitcoin base 64 private key)

Quote from: DannyHamilton on March 25, 2021, 07:08:12 PM

Sounds like it probably is base64, but perhaps not a private key.

Exactly what I meant. It is not base 64 bitcoin private key.

DannyHamilton

legendary

Activity: 3472

Merit: 4801

Charles-Tim is incorrect about it not being base64, though he might be correct about it not being a private key.

Sounds like it probably is base64, but perhaps not a private key. Base64 ONLY has = at the end (never in the middle) of the encoded data. If the data is exactly a multiple of 24 bits, then there will not be an =.

This is because Base64 is a six-bit encoding, and the decoded values are divided into 8-bit octets on a modern computer. Therefore, every four characters of Base64-encoded text (4 sextets = 4*6 = 24 bits) represents three octets of unencoded text or data (3 octets = 3*8 = 24 bits). This means that when the length of the unencoded input is not a multiple of three bytes, the encoded output must have padding added so that its length is a multiple of four. The padding character is =, which indicates that no further bits are needed to fully encode the input.

Also, + IS a base64 character. It represents binary 111110.

Have you tried running the block of data through a base64 decoder to see what the result is? It's possible that it includes some text. It's also possible that it is a private key along with some additional information.

Charles-Tim

legendary

Activity: 1512

Merit: 4795

Leading Crypto Sports Betting & Casino Platform

Base 64 private key will look like this:

Private Key Base64 (44 characters):
cSRchRuIIwpI5MTS0Em6aD2u21R1NZNspw1ed3e/1TI=

If not containing / and =, that means it can not work. Also + should not be included, which also indicates it not to be bitcoin private key.

morbius55

full member

Activity: 217

Merit: 109

As part of an attempt to retrieve a Bitcoin wallet/private key from an old hard drive I have found a docx file labeled Bitcoin. It consists of 3 blocks of characters A-Z, a-z, numbers 1-9 and+/. Each block is about 70 characters long and about 50 lines deep. My question is, is this base 64 as it doesn't contain any = and how could I decode it? Do I need to know the start and finish of a string as It just consists of the large blocks of characters as described. Sorry for my clumsy explanation, but If anyone can give me a clue that would be great.

Topic: Base 64 characters? Bitcoin docx file (Read 533 times)