Pages:
Author

Topic: Bitcoin-QT Core Problem - Keypool 100 transactions limi - Reward for help: 2 BTC (Read 5261 times)

newbie
Activity: 3
Merit: 0
I knew on the Windows version it prints the keys.  Hoping that BitcoinNewsBR can recover something!!
legendary
Activity: 1176
Merit: 1280
May Bitcoin be touched by his Noodly Appendage
Yes 5862 is the total number of addresses found in the HDD
I think you won't be able to find anything more than these 5862 keys because pywallet uses a loose criterium to find keys
It drops to 965 ("Importing key 965/965") because there are duplicates, maybe you made copies of your wallets
The 13 remaining keys are either from a wallet with a different passphrase (only 13 keys is really odd though), corrupted keys because of rewriting, or not keys at all (false positives)

If you are 100% sure your address isn't in the recovered wallet I think there's not much left to try :-(
You can try the software above but pywallet does the same thing
One last question, does the recovered wallet contains the paying address, 1NJm35r6oFU3ttoUoZnqZ1nnwCH3DEbdVz?

legendary
Activity: 2772
Merit: 2846
If I didn't find the public address using this method, no other way I could get it?



You could try using a hex editor to do a sector-by-sector search of your hard drive for these bytes

01 03 6B 65 79 41 04

For each occurrence of those bytes you can find there is probably a Bitcoin private key nearby.

This is a hex editor with a suitable search function for a Mac. Its sourceforge files also include Windows and Linux versions.

https://sourceforge.net/projects/wxhexeditor/files/wxHexEditor/v0.23%20Beta/wxHexEditor-v0.23-MacIntel.dmg/download

This quote gives more detailed instructions, and the thread it's from might be worth reading.

I have been doing some tinkering around, thinking about other people's wallet disasters, and believe I have come to the following conclusion...

If you have lost your wallet.dat for whatever reason (deleted it, formatted your drive, file corruption, etc.) it's possible that it may still be lurking on your computer.  If so, recovery is no longer purely theoretical.  With a little knowledge of what to search for, you can use a hex editor to potentially find usable remnants of your wallet.dat file and get back your bitcoins, even if the original file isn't fully recoverable.

So here goes...

If you can use a hex-editor to do a sector-by-sector search/edit on your entire hard drive, then search your entire hard drive for occurrences of the following byte sequence:

01 03 6B 65 79 41 04...........

the middle four of these bytes represent the string "keyA" in ASCII.

Each time this byte sequence occurs, a Bitcoin private key is probably stored nearby, about 180 bytes later.  The 32-byte private key is the only thing you need to recover your bitcoins!... as long as you find the right one(s).

Approximately 180 bytes after this sequence, you may find the byte sequence 04 20 (hex).  These two bytes seem to precede every private key (the 0x20 suggests a length of 32 bytes).  If you find this sequence, the thirty-two bytes that come after 04 20 are the private key representing a Bitcoin address and might be the private key that recovers some of your lost bitcoins!  Your wallet will have numerous private keys (at least one hundred, due to the pre-allocation of keys)... get as many as you can find.  Carefully search the sectors adjacent to any sector containing the "keyA" sequence above.  Then yell for help!  (But don't share the private keys in public, unless you want to give away your wallet.)

An example of a hex editor that can scan an entire disk volume for specific byte sequences for Windows is WinHex.  In WinHex, use Tools, Open Disk (F9), and choose the disk you want to scan.  Scanning a full disk can take hours.  WinHex must "run as administrator" to be able to scan a physical disk.  Someone please recommend a good way to do this in Linux, preferably with a known Live CD, if possible.  Also, any time you are scanning a disk for potentially lost data, you should NEVER boot the disk you're searching - always boot from another disk and install the target disk as secondary.
newbie
Activity: 29
Merit: 0
OK so it runs until "DECRYPT-A" then it stops and the terminal waits for another command?
If so, I know which line is the problem but I don't get why it crashes without warning

Download this https://gist.githubusercontent.com/jackjack-jj/d3a9b74cef28d2f79ab113d8f3b96a82/raw/afbaf88b6151d057d9fec138c340617a643d1d95/pywallet_BitcoinNewsBR_1.py
And run it without any argument, ie no "--recover" and such, I just want it to run
Then post the line that begins with "Crypter: XXX" (it should be the first line)


Also re-run the recover command (https://bitcointalksearch.org/topic/m.17610537) using each one of the 3 pywallet versions:
https://gist.githubusercontent.com/jackjack-jj/2a40a7b1101966d9a89e097e5a6c4e0b/raw/10440fd34883aeb099b19a818eb8dbeefe6b2a20/pywallet_BitcoinNewsBR_Crypter_pycrypto.py
https://gist.githubusercontent.com/jackjack-jj/d470ef536e7178ec03b4fd3a67a6cbf2/raw/cc1e52b3ccc35d8e301733a4fa3a6b2283f3ef02/pywallet_BitcoinNewsBR_Crypter_ssl.py
https://gist.githubusercontent.com/jackjack-jj/ea706e1c06f1d98f51a6be4ac86953c4/raw/9f342e0de8ee4329ebac1a743010fc595c526271/pywallet_BitcoinNewsBR_Crypter_pure.py

At least one of them should not crash

Using the version pywallet_BitcoinNewsBR_Crypter_pure.py worked really well! Thanks!

Code:
Using pywallet_BitcoinNewsBR_Crypter_pure.py found 965 but and it shows the right information:

[code]Importing key  965/965:
Address (Bitcoin): XXX
Privkey (Bitcoin): XXX
Hexprivkey: XXX
Hash160: XXX
Pubkey: XXX
Address (Bitcoin): XXX
Privkey (Bitcoin): XXX
Hexprivkey: XXX
Hash160: XXX
Pubkey: XXX

But it didn't find the information I was looking for Sad. The wallet https://blockchain.info/pt/address/1HxeCXGT11wVwy78gsVrzFfkfdijQE9rct is not there.

When I run the command it says:
Code:
Found 12 possible wallets
Found 5862 possible encrypted keys
Found 0 possible unencrypted keys


5862 would be the amount of address? If I didn't find the public address using this method, no other way I could get it?

It also says:
Code:
Private keys not decrypted: 13
Trying all the remaining possibilities (156) might take up to 0 minutes.
Do you want to test them? (y/n): y

Private keys not decrypted: 13
Try another password, check the size of your partition or seek help
The wallet is encrypted and the passphrase is correct


What would be this 13 private keys not decrypted?

Thanks for your attention, Jackjack.[/code]
legendary
Activity: 1176
Merit: 1280
May Bitcoin be touched by his Noodly Appendage
newbie
Activity: 29
Merit: 0
Damn I lost my code-fu I can't put 10 lines of code without an error!

OK, try with this version, it should work this time
https://gist.githubusercontent.com/jackjack-jj/d3a9b74cef28d2f79ab113d8f3b96a82/raw/1d567003d3218e487262a4757cdebf562b725780/pywallet_BitcoinNewsBR_1.py

 Cheesy Cheesy We will get there!

Different return now. This is final return when I execute this file:

Code:
Decrypting...
Possible wallet #1
  len(mkeys)=12
  len(passes)=1
  len(list_of_possible_keys)=241
    with passphrase #1
    DECRYPT-A

Sending the full information via private message! Thanks!
legendary
Activity: 1176
Merit: 1280
May Bitcoin be touched by his Noodly Appendage
newbie
Activity: 29
Merit: 0

Hey, guys.

For future reference, running the last code on OSX with this command:

Code:
 sudo -i /Users/XXX/Downloads/pywallet_BitcoinNewsBR_2.py --recover --recov_device PartialRecoveryFile:/Users/XXX/Documents/sorte/pywallet_partial_recovery_1484372063.dat --recov_size 1024Gio --recov_outputdir /Users/XXX/Documents/sorte


 I'm getting a return as this:

Code:
Possible passphrase:

Starting recovery.

Loaded 1000.2 Go from /dev/rdisk0

Found 12 possible wallets
Found 5862 possible encrypted keys
Found 0 possible unencrypted keys
a
b
c0 XXXXX
ckey XXXXX
ckey XXXXX
ckey XXXXX
ckey XXXXX
ckey XXXXX
d XXXXX
Decrypting...
Traceback (most recent call last):
File "/Users/XXX/Downloads/pywallet_BitcoinNewsBR_2.py", line 4889, in
recoveredKeys=recov(device, passes, size, 10240, options.recov_outputdir)
File "/Users/XXX/Downloads/pywallet_BitcoinNewsBR_2.py", line 1550, in recov
totz=len(mkeys)*len(passes)*len(list_of_possible_keys)
UnboundLocalError: local variable 'list_of_possible_keys' referenced before assignment

I'm sending the full information in private to Jackjack again, as I don't know if this can help I get the coins I will not make it public.


Thanks for your attention, again, JackJack.

legendary
Activity: 1176
Merit: 1280
May Bitcoin be touched by his Noodly Appendage
newbie
Activity: 29
Merit: 0
Damn I'm sorry I missed one bit of the command line (the green part, PartialRecoveryFile:), please do it again :
Quote
sudo -i /Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py --recover --recov_device PartialRecoveryFile:/Users/XXX/Documents/sorte/LASTPYWALLETRECOVERY.dat --recov_size 1024Gio --recov_outputdir /Users/XXX/Documents/sorte

(and don't forget to change all the XXX's to your actual username Wink )




Hey, Jackjack

Getting this error now:

Code:
Possible passphrase: 

Starting recovery.
Traceback (most recent call last):
  File "/Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py", line 4879, in
    recoveredKeys=recov(device, passes, size, 10240, options.recov_outputdir)
  File "/Users/XXXDownloads/pywallet_BitcoinNewsBR_1.py", line 1472, in recov
    f=open(prf, 'r')
IOError: [Errno 2] No such file or directory: '/Users/XXX/Documents/sorte/pywallet_partial_recovery_1485061775.dat'

I'm not using the last file, the one you told for I dont use. Let me know how to proceed.

Thanks!

It seems like one of you is using windows and the other Linux. Just a heads up if you haven't realised.

BitcoinNewsBR, the error you are getting signifies that it cannot find the .Bin file that you tried to reference. Re-chrck the directory and make sure that it exists.

You also didn't change the XXX.

Thanks for pointing my mistake. The command was really wrong on my side, now it worked.

After run this command, it searched only on the .dat file so it worked.

It returned a really long information that I'm not sure If someone can use this to recover the coins for now, so that's the reason I'm not displaying it public here and sending to Jackjack in private.

The information looks like:

Code:
c0 XXXXXXXXXXXXXXX
c1 Looping ckey XXXXXXXXXXXXXXXXXXXX
c2 XXXXXXXXXX
c3 XXXXXXXXXX
c4 XXXXXXXXXX
c1 Looping ckey XXXXXXXXXX
c2 XXXXXXXXXX
c3 XXXXXXXXXX
c4 XXXXXXXXXX
legendary
Activity: 1232
Merit: 1030
give me your cryptos
Damn I'm sorry I missed one bit of the command line (the green part, PartialRecoveryFile:), please do it again :
Quote
sudo -i /Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py --recover --recov_device PartialRecoveryFile:/Users/XXX/Documents/sorte/LASTPYWALLETRECOVERY.dat --recov_size 1024Gio --recov_outputdir /Users/XXX/Documents/sorte

(and don't forget to change all the XXX's to your actual username Wink )




Hey, Jackjack

Getting this error now:

Code:
Possible passphrase: 

Starting recovery.
Traceback (most recent call last):
  File "/Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py", line 4879, in
    recoveredKeys=recov(device, passes, size, 10240, options.recov_outputdir)
  File "/Users/XXXDownloads/pywallet_BitcoinNewsBR_1.py", line 1472, in recov
    f=open(prf, 'r')
IOError: [Errno 2] No such file or directory: '/Users/XXX/Documents/sorte/pywallet_partial_recovery_1485061775.dat'

I'm not using the last file, the one you told for I dont use. Let me know how to proceed.

Thanks!

It seems like one of you is using windows and the other Linux. Just a heads up if you haven't realised.

BitcoinNewsBR, the error you are getting signifies that it cannot find the .Bin file that you tried to reference. Re-chrck the directory and make sure that it exists.

You also didn't change the XXX.
newbie
Activity: 29
Merit: 0
Damn I'm sorry I missed one bit of the command line (the green part, PartialRecoveryFile:), please do it again :
Quote
sudo -i /Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py --recover --recov_device PartialRecoveryFile:/Users/XXX/Documents/sorte/LASTPYWALLETRECOVERY.dat --recov_size 1024Gio --recov_outputdir /Users/XXX/Documents/sorte

(and don't forget to change all the XXX's to your actual username Wink )




Hey, Jackjack

Getting this error now:

Code:
Possible passphrase: 

Starting recovery.
Traceback (most recent call last):
  File "/Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py", line 4879, in
    recoveredKeys=recov(device, passes, size, 10240, options.recov_outputdir)
  File "/Users/XXXDownloads/pywallet_BitcoinNewsBR_1.py", line 1472, in recov
    f=open(prf, 'r')
IOError: [Errno 2] No such file or directory: '/Users/XXX/Documents/sorte/pywallet_partial_recovery_1485061775.dat'

I'm not using the last file, the one you told for I dont use. Let me know how to proceed.

Thanks!
legendary
Activity: 1176
Merit: 1280
May Bitcoin be touched by his Noodly Appendage
Damn I'm sorry I missed one bit of the command line (the green part, PartialRecoveryFile:), please do it again :
Quote
sudo -i /Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py --recover --recov_device PartialRecoveryFile:/Users/XXX/Documents/sorte/LASTPYWALLETRECOVERY.dat --recov_size 1024Gio --recov_outputdir /Users/XXX/Documents/sorte

(and don't forget to change all the XXX's to your actual username Wink )

newbie
Activity: 29
Merit: 0
Ok great
Then instead of
Quote
sudo -i /Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py --recover --recov_device /dev/rdisk0 --recov_size 1024Gio --recov_outputdir /Users/XXX/Documents/sorte
use this
Quote
sudo -i /Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py --recover --recov_device /Users/XXX/Documents/sorte/LASTPYWALLETRECOVERY.dat --recov_size 1024Gio --recov_outputdir /Users/XXX/Documents/sorte
(with quotes if XXX has spaces)

Where LASTPYWALLETRECOVERY.dat is the last pywallet_partial_recovery_*dat you have (it shouldn't matter though as they must all be the same)
Those files contain the place where the last pywallet recovery found keys, so it just uses these instead of reading the whole disk, which means it won't take 5 hours to complete
Please confirm it works and we'll be able to solve that more easily

Hey, Jackjack.

Sorry the delay to answer! I was really not able to test on the right HD until today, traveling...

So, I tested scan directly on the recovered file - the one created by the last time we scanned the HD.   This is the message that I'm receiving:

Code:
Starting recovery.
Traceback (most recent call last):
  File "/Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py", line 4879, in
    recoveredKeys=recov(device, passes, size, 10240, options.recov_outputdir)
  File "/Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py", line 1466, in recov
    f=open(outputdir+'/pywallet_partial_recovery_%d.dat'%ts(), 'w')
IOError: [Errno 2] No such file or directory: '/Users/XXX/Documents/sorte/pywallet_partial_recovery_1485061775.dat

I'm not using the last version of the pywallet code. I'm not using the one you posted on day 16, January because you told not to run this version yet.
I'm using the version you posted before it.

Looks like to scan direct the file didn't work. Should I try the newest version? Let me know how to proceed.

Thanks for your attention!! I really appreciate it and sorry for the time to answer!
legendary
Activity: 1176
Merit: 1280
May Bitcoin be touched by his Noodly Appendage
Ok great
Then instead of
Quote
sudo -i /Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py --recover --recov_device /dev/rdisk0 --recov_size 1024Gio --recov_outputdir /Users/XXX/Documents/sorte
use this
Quote
sudo -i /Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py --recover --recov_device /Users/XXX/Documents/sorte/LASTPYWALLETRECOVERY.dat --recov_size 1024Gio --recov_outputdir /Users/XXX/Documents/sorte
(with quotes if XXX has spaces)

Where LASTPYWALLETRECOVERY.dat is the last pywallet_partial_recovery_*dat you have (it shouldn't matter though as they must all be the same)
Those files contain the place where the last pywallet recovery found keys, so it just uses these instead of reading the whole disk, which means it won't take 5 hours to complete
Please confirm it works and we'll be able to solve that more easily
newbie
Activity: 29
Merit: 0
Hmm OK I still don't know what's happening but we'll figure it out
Do you have 'pywallet_partial_recovery_*dat' files in the output dir you use?

Download the new version but don't run it yet https://gist.githubusercontent.com/jackjack-jj/d3a9b74cef28d2f79ab113d8f3b96a82/raw/167f14db1d8b8233de7966e2f5b5cb794bc3ae0d/pywallet_BitcoinNewsBR_1.py

Yes. All the times I used the code it was generating a pywallet.dat on the output dir. We have like 4-5 pywallet partial recovery there.

The first time I used the code (before you update the code to OSX),  I tried to open the Bitcoin-QT with this file but it was not possible using this file dat. It says "File corrupted."

Sorry the delay to answer, I'm traveling for work, will back on the computer with the HD that we have the problem on next Thursday (19/Jan). Let me know how to proceed then!

Thanks so much for your attention on this matter, jackjack.
legendary
Activity: 1176
Merit: 1280
May Bitcoin be touched by his Noodly Appendage
Hmm OK I still don't know what's happening but we'll figure it out
Do you have 'pywallet_partial_recovery_*dat' files in the output dir you use?

Download the new version but don't run it yet https://gist.githubusercontent.com/jackjack-jj/d3a9b74cef28d2f79ab113d8f3b96a82/raw/167f14db1d8b8233de7966e2f5b5cb794bc3ae0d/pywallet_BitcoinNewsBR_1.py
newbie
Activity: 29
Merit: 0
Sorry for the delay
I see that pywallet does go in the decrypting loop (that starts with "Decrypting...")
Does it really stop after "Possible wallet #1 with passphrase #1"?
Nothing after that? Does it crash/freeze/whatever?

For future reference: end of the spreadsheet BitcoinNewsBR sent me
https://i.gyazo.com/2d9c36935275ff71548f4422a0a17d45.png

Nothing after that. It only shows this. It didn't crashed/freeze. The Terminal back as before I run the command, waiting another command.

Also it generate the .dat on the Folder that I selected on the command.
legendary
Activity: 1176
Merit: 1280
May Bitcoin be touched by his Noodly Appendage
Sorry for the delay
I see that pywallet does go in the decrypting loop (that starts with "Decrypting...")
Does it really stop after "Possible wallet #1 with passphrase #1"?
Nothing after that? Does it crash/freeze/whatever?

For future reference: end of the spreadsheet BitcoinNewsBR sent me
newbie
Activity: 29
Merit: 0
Damn I'm sorry I made a mistake, use this one: https://gist.githubusercontent.com/jackjack-jj/d3a9b74cef28d2f79ab113d8f3b96a82/raw/93f90d6dfac629a692a38e955d7f241f2b9d815b/pywallet_BitcoinNewsBR_1.py
It's lost time but at least it doesn't write on the keys

By the way you can change the 1000Go to something smaller so that it will take less time

Hey, Jackjack.

It printed information as "Looking Ckey". I'm sending you in private, as I'm not sure if this information can recover the coins. Please, take a look on the spreadsheet with the return, then let me know how to proceed. Thanks!
Pages:
Jump to: