I'm really starting to think this comes from openssl
http://pastebin.com/raw.php?i=1QyNB5Af
Topic: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive - page 2. (Read 7906 times)
July 21, 2013, 03:28:57 PM
July 21, 2013, 03:20:07 PM
Code:
Possible wallet #1
with passphrase #1 a
b
SKFP params: fdas �m�����* 58001 0
za
zc
zd
ze
[manjaro@manjaro Downloads]$
with passphrase #1 a
b
SKFP params: fdas �m�����* 58001 0
za
zc
zd
ze
[manjaro@manjaro Downloads]$
July 21, 2013, 02:35:41 PM
Good idea posting the openssl version. I have 1.0.1c but I highly doubt this comes from that. I'll check though.
About the error, please delete these two lines and try again:
line 769: print strKeyData.encode('hex')
line 772: print chSalt.encode('hex')
About the error, please delete these two lines and try again:
line 769: print strKeyData.encode('hex')
line 772: print chSalt.encode('hex')
July 21, 2013, 02:26:11 PM
Different error this time - with the latest pastebin:
July 21, 2013, 02:22:17 PM
Thank you for the information. I will try the other file now.
I did not compil SSL myself. I'm using a LiveCD of Manjaro which is a version of the rolling-release Arch distribution.
Here's verbose information output on SSL version:
I did not compil SSL myself. I'm using a LiveCD of Manjaro which is a version of the rolling-release Arch distribution.
Here's verbose information output on SSL version:
Code:
[manjaro@manjaro Downloads]$ openssl version -a
OpenSSL 1.0.1e 11 Feb 2013
built on: Sun Feb 17 13:43:48 CET 2013
platform: linux-x86_64
options: bn(64,64) md2(int) rc4(8x,int) des(idx,cisc,16,int) idea(int) blowfish(idx)
compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack -march=x86-64 -mtune=generic -O2 -pipe -fstack-protector --param=ssp-buffer-size=4 -D_FORTIFY_SOURCE=2 -m64 -DL_ENDIAN -DTERMIO -O3 -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
OPENSSLDIR: "/etc/ssl"
[manjaro@manjaro Downloads]$
OpenSSL 1.0.1e 11 Feb 2013
built on: Sun Feb 17 13:43:48 CET 2013
platform: linux-x86_64
options: bn(64,64) md2(int) rc4(8x,int) des(idx,cisc,16,int) idea(int) blowfish(idx)
compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack -march=x86-64 -mtune=generic -O2 -pipe -fstack-protector --param=ssp-buffer-size=4 -D_FORTIFY_SOURCE=2 -m64 -DL_ENDIAN -DTERMIO -O3 -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
OPENSSLDIR: "/etc/ssl"
[manjaro@manjaro Downloads]$
July 21, 2013, 02:15:13 PM
This seems desperately normal...
This one? http://pastebin.com/raw.php?i=PgXbLpdL
Ok I'll tell you what I'm doing, that would be less annoying for you. I found the function that crashes but I don't understand why it crashes without printing any error as it should. Also I don't even understand why it is crashing at all.
The last version prints something after each line within that function so that I'll know which one crashed.
Did you compile ssl yourself?
This one? http://pastebin.com/raw.php?i=PgXbLpdL
Ok I'll tell you what I'm doing, that would be less annoying for you. I found the function that crashes but I don't understand why it crashes without printing any error as it should. Also I don't even understand why it is crashing at all.
The last version prints something after each line within that function so that I'll know which one crashed.
Did you compile ssl yourself?
July 21, 2013, 02:04:19 PM
It is I who am sorry for all these complications and deeply thankful for your help.
I attach a picture because I'm worried copy/paste wouldn't reproduce the strange characters it outputs:
I attach a picture because I'm worried copy/paste wouldn't reproduce the strange characters it outputs:
July 21, 2013, 01:47:34 PM
Try this one and post the lines beginning with "crypter" and "skfp": http://pastebin.com/raw.php?i=0SMbAwat (with random passphrases too as it will print the passphrase you entered)
I'm sorry to make you try files so many times...
I'm sorry to make you try files so many times...
July 21, 2013, 01:35:24 PM
Code:
[manjaro@manjaro Documents]$ sudo python2 ../Downloads/pywallet.py --recover --recov_device=PartialRecoveryFile:./pywallet_partial_recovery_1374430501.dat --recov_outputdir /home/manjaro/Documents/ --recov_size 640.1Gio
Enter the passphrase for the wallet that will contain all the recovered keys: asdf
Enter the possible passphrases used in your deleted wallets.
Possible passphrase: fdsa
Possible passphrase:
Starting recovery.
Loaded 640.1 Go from /dev/sda
Found 46 possible wallets
Found 8414 possible encrypted keys
Found 5443 possible unencrypted keys
Possible wallet #1
with passphrase #1 a
b
[manjaro@manjaro Documents]$
Enter the passphrase for the wallet that will contain all the recovered keys: asdf
Enter the possible passphrases used in your deleted wallets.
Possible passphrase: fdsa
Possible passphrase:
Starting recovery.
Loaded 640.1 Go from /dev/sda
Found 46 possible wallets
Found 8414 possible encrypted keys
Found 5443 possible unencrypted keys
Possible wallet #1
with passphrase #1 a
b
[manjaro@manjaro Documents]$
July 21, 2013, 09:42:30 AM
I can't reproduce it
Try with random passphrases containing only alphanumeric characters
Does it crash too?
I'll try other things when I'm back home in a few hours
Try with random passphrases containing only alphanumeric characters
Does it crash too?
but now that I think of it, when I encrypted the passwords, I was using a Slovenian keyboard / encoding, which is basically like American plus a few extra characters... and the keys are placed a bit differently
could that be the reason? (even though I did not use those special Slovenian characters in the passwords)
Maybe but not likely if there is no Slovenian character in the passphrasecould that be the reason? (even though I did not use those special Slovenian characters in the passwords)
I'll try other things when I'm back home in a few hours
July 21, 2013, 09:09:14 AM
Odd
Do you have strange/UTF8 characters in your passphrase?
Do you have strange/UTF8 characters in your passphrase?
only alphanumeric mixed with few symbols such as ! , # , % , & , ...
but now that I think of it, when I encrypted the passwords, I was using a Slovenian keyboard / encoding, which is basically like American plus a few extra characters... and the keys are placed a bit differently
could that be the reason? (even though I did not use those special Slovenian characters in the passwords)
July 21, 2013, 08:10:10 AM
Odd
Do you have strange/UTF8 characters in your passphrase?
Do you have strange/UTF8 characters in your passphrase?
July 20, 2013, 06:46:50 PM
I ran it with the file, not /dev/sda, like you said:
Code:
Possible passphrase:
Starting recovery.
Loaded 640.1 Go from /dev/sda
Found 46 possible wallets
Found 8414 possible encrypted keys
Found 5443 possible unencrypted keys
Possible wallet #1
with passphrase #1 a
b
[manjaro@manjaro ~]$
Starting recovery.
Loaded 640.1 Go from /dev/sda
Found 46 possible wallets
Found 8414 possible encrypted keys
Found 5443 possible unencrypted keys
Possible wallet #1
with passphrase #1 a
b
[manjaro@manjaro ~]$
July 20, 2013, 04:05:56 PM
This file is not a wallet at all, it's just the list of the places where pywallet found keys.
Thus this avoid to read the disk again: pywallet just has to look around these places.
So you don't have to wait 3 hours each time you try the recovery
For now I didn't try any fix so it's normal it crashes like before. The goal was only to create this intermediate file.
Try this (using the partialrecoveryfile:, as you will always do from now on) and post all the output
2.1.0b6
http://pastebin.com/raw.php?i=UeavfR1a
Thus this avoid to read the disk again: pywallet just has to look around these places.
So you don't have to wait 3 hours each time you try the recovery
For now I didn't try any fix so it's normal it crashes like before. The goal was only to create this intermediate file.
Try this (using the partialrecoveryfile:, as you will always do from now on) and post all the output
2.1.0b6
http://pastebin.com/raw.php?i=UeavfR1a
July 20, 2013, 02:53:45 PM
Yay, I have a pywallet_partial_recovery_timestamp.dat file now.
If I load it in, say, Worldcoin, it gives me an error. I think I should run pywallet ON this file now to extract the crypted keys from it somehow? If I just put -recov_device as the file instead of /dev/sda like you said, it still crashes like before
If I load it in, say, Worldcoin, it gives me an error. I think I should run pywallet ON this file now to extract the crypted keys from it somehow? If I just put -recov_device as the file instead of /dev/sda like you said, it still crashes like before
July 20, 2013, 12:04:40 PM
For now I really don't see what could make it crash
Also you'll have to scan all the drive again the next time you'll run the recovery I'm sorry for that...
Good news though, I just coded the creation of a partial file that keeps useful offsets before the crash, so you'll have to run the long disk reading only once more (you should do it now)
You don't have anything special to do: run the same command and pywallet will save 'pywallet_partial_recovery_timestamp.dat' in the outputdir before crashing
Next time you run a recovery, change
to
2.1.0b5
http://pastebin.com/raw.php?i=xi4ivsCH
Also you'll have to scan all the drive again the next time you'll run the recovery I'm sorry for that...
Good news though, I just coded the creation of a partial file that keeps useful offsets before the crash, so you'll have to run the long disk reading only once more (you should do it now)
You don't have anything special to do: run the same command and pywallet will save 'pywallet_partial_recovery_timestamp.dat' in the outputdir before crashing
Next time you run a recovery, change
Code:
--recov_device=c:\
Code:
--recov_device=PartialRecoveryFile:c:\path\to\pywallet_partial_recovery_timestamp.dat
2.1.0b5
http://pastebin.com/raw.php?i=xi4ivsCH
July 20, 2013, 11:50:04 AM
Looks as if it finds all keys/wallets, even the encrpyted ones, but then it should go into phase 2 - applying the passwords - but there it just quits the program, if I understand correctly.
That's exactly what I was about to ask you: did it stop just after "Possible wallet #1 with passphrase #1 "? Nothing printed after this?If so, it definitely crashed
I'll try to see what could have happened and report here
Yes. If there's any other information I can give, let me know. Anything that could help.
Sadly my Python skills don't go a lot further than a hello world program.
July 20, 2013, 11:02:52 AM
Looks as if it finds all keys/wallets, even the encrpyted ones, but then it should go into phase 2 - applying the passwords - but there it just quits the program, if I understand correctly.
That's exactly what I was about to ask you: did it stop just after "Possible wallet #1 with passphrase #1 "? Nothing printed after this?If so, it definitely crashed
I'll try to see what could have happened and report here
July 20, 2013, 11:00:17 AM
Looks as if it finds all keys/wallets, even the encrpyted ones, but then it should go into phase 2 - applying the passwords - but there it just quits the program, if I understand correctly.
July 20, 2013, 10:55:59 AM
I think these might be some great news :
So, it works! Even for encrpyted wallets!
As far as I know pywallet is now the only program that can do this
Problem is, I can't find the output wallet.
This was my parameter in the command line:
The folder exists and I ran it as root so there is write access.
But the file isn't there after it finished.
Sorry for nagging you so much
Code:
640.00 Go read
640.10 Go read
Found 46 possible wallets
Found 8414 possible encrypted keys
Found 5443 possible unencrypted keys
Possible wallet #1
with passphrase #1
[manjaro@manjaro ~]$
So, it works! Even for encrpyted wallets!
As far as I know pywallet is now the only program that can do this
Problem is, I can't find the output wallet.
This was my parameter in the command line:
Code:
--recov_outputdir /home/manjaro/Documents/
The folder exists and I ran it as root so there is write access.
But the file isn't there after it finished.
Sorry for nagging you so much
Jump to: