Author

Topic: unknown wallet.dat format (Read 580 times)

copper member
Activity: 20
Merit: 4
January 05, 2020, 07:30:42 PM
#22
Hey there. I recently made an open source tool that will, among other things, automatically figure out the version prefix from metadata inside the wallet and dump out the contents. You can find it here: https://github.com/jimtje/walletlib

Although if you already know that your public key starts with a W, the version prefix byte is going to be either 72, 73, or 74. Just looking on Github, these may fit the bill, although not sure if they date back to 2014. Basically, the coins on these search results (there are quite a few):

https://github.com/search?o=asc&q=%22base58Prefixes%5BPUBKEY_ADDRESS%5D+%3D+std%3A%3Avector%3Cunsigned+char%3E%281%2C+73%29%3B%3B%22+filename%3Achainparams.cpp+fork%3Atrue&s=indexed&type=Code

https://github.com/search?q=%22base58Prefixes%5BPUBKEY_ADDRESS%5D+%3D+std%3A%3Avector%3Cunsigned+char%3E%281%2C+72%29%3B%3B%22+filename%3Achainparams.cpp+fork%3Atrue&type=Code

https://github.com/search?q=%22base58Prefixes%5BPUBKEY_ADDRESS%5D+%3D+std%3A%3Avector%3Cunsigned+char%3E%281%2C+74%29%3B%3B%22+filename%3Achainparams.cpp+fork%3Atrue&type=Code


staff
Activity: 3458
Merit: 6793
Just writing some code
January 03, 2020, 11:26:48 AM
#21
Yes I know, I tried dumpwallet.py and pywallet.py. This is not about reading the file but rather recognize the coin inside the wallet which I have disclosed earlier.
Download and install Berkeley DB 4.8.3 from https://www.oracle.com/database/technologies/related/berkeleydb-release-history.html

Open up a command prompt in the directory containing your wallet.dat file and do
Code:
db_dump wallet.dat
You will want to copy (or redirect) that output into a text file/editor.

Search for the string 1262657374626c6f636b. Look at the next like, it should be fairly long. Starting at the 10th character, copy the next 64 characters. This is a block hash represented in hex. You will need to byte swap it because it is stored in internal byte order. This means that every two characters at the beginning are swapped with their symmetric two characters from the end. You can then search for that block hash in various block explorers until you find one for the coin that it belongs to.

For example, in my wallet, I have:
Code:
1262657374626c6f636b5f6e6f6d65726b6c65
 bcbe02001f398d305048481ee6b096d2a96ab996ad380c6865e5521f000000000000000000aa01a3461474942498219b371a297489c8e98e0726ca2d00000000000000000009a41bd091b58a66c3086ee87dfffac82f56d8a9cc1520000000000000000000d99c9828fec374230d19c9ce041d18bb0abbd902a1821f00000000000000000036a5f285a97de07dd3a36e8002d284a918c2ac5095ee0000000000000000000010dcd433003dd70a97169db7a03d784cc4c1f9204aa71c00000000000000000047d5c32538d7240af5bc1fcd162c656f4cc0a41b28820800000000000000000056ecc938d227a0d85af190a9b34dac6a5d8fc374adcf0c0000000000000000002690eed687e53530066986945ae7df3d1694be411f320a000000000000000000af828b14fa61f57401754aa5625635c27c96bc93b8261800000000000000000088f53e4684d64ec75e2ace5e4e138effbf838a2d1a4e1200000000000000000041317742072dc3779ed50d11f8f0f81974db61f9f89503000000000000000000deeace08a82d82c12787bdd986b38673bcd37328b79813000000000000000000f75ec406dce3b6933bbb5dbfca0681befe63432b49452a00000000000000000024692509bdb166ae9edf0369763ffef5ed33764d9c0c220000000000000000007f33440c4c65647b2c79a9dcc05db931e81b14d929950800000000000000000020d876aaddb18d93414a0b41c651c0955230acd3cd9203000000000000000000460d02a06510794a5af955984530706dbdce386b6a8711000000000000000000b9944fae9baf038329f1d618d18de8589b1c724184842a000000000000000000aa33e53a7a77f9cb39aab9b9bf229e872633187ede4504000000000000000000f696c443c06a2552f8193b7dc93a3b62f48e6294bb1b1b00000000000000000014f1054a9fc8cdf8893f7634fc0a0afa0f8554cba0b62a000000000000000000f01cc261faa46dae158f5f4372af5e02d5a17c6994772b000000000000000000ae51a37bd455a1d6790d43e133c995988aabb163176a04000000000000000000867af3560bf4aab1cea599889b5830f702d2b9650a5f03000000000000000000d3b00067c837dcbdec5dd1fb5cda597fa03f8c90f12c29000000000000000000ca75b9384b21187013044c74585573b4e46fb9a71207480000000000000000004e504c2b55677b208da3867b4f628db2da6eace0ec834e040000000000000000d85b9f567ff6bbed506960c8b76498bae153c086d56d2e5f0000000000000000726e26f93314df0ed59c2af2c9f891f1f435f3dab0f8e534e336543f000000006fe28c0ab6f1b372c1a6a246ae63f74f931e8365e15a089c68d6190000000000

Skipping the first 10 characters gives me:
Code:
398d305048481ee6b096d2a96ab996ad380c6865e5521f000000000000000000aa01a3461474942498219b371a297489c8e98e0726ca2d00000000000000000009a41bd091b58a66c3086ee87dfffac82f56d8a9cc1520000000000000000000d99c9828fec374230d19c9ce041d18bb0abbd902a1821f00000000000000000036a5f285a97de07dd3a36e8002d284a918c2ac5095ee0000000000000000000010dcd433003dd70a97169db7a03d784cc4c1f9204aa71c00000000000000000047d5c32538d7240af5bc1fcd162c656f4cc0a41b28820800000000000000000056ecc938d227a0d85af190a9b34dac6a5d8fc374adcf0c0000000000000000002690eed687e53530066986945ae7df3d1694be411f320a000000000000000000af828b14fa61f57401754aa5625635c27c96bc93b8261800000000000000000088f53e4684d64ec75e2ace5e4e138effbf838a2d1a4e1200000000000000000041317742072dc3779ed50d11f8f0f81974db61f9f89503000000000000000000deeace08a82d82c12787bdd986b38673bcd37328b79813000000000000000000f75ec406dce3b6933bbb5dbfca0681befe63432b49452a00000000000000000024692509bdb166ae9edf0369763ffef5ed33764d9c0c220000000000000000007f33440c4c65647b2c79a9dcc05db931e81b14d929950800000000000000000020d876aaddb18d93414a0b41c651c0955230acd3cd9203000000000000000000460d02a06510794a5af955984530706dbdce386b6a8711000000000000000000b9944fae9baf038329f1d618d18de8589b1c724184842a000000000000000000aa33e53a7a77f9cb39aab9b9bf229e872633187ede4504000000000000000000f696c443c06a2552f8193b7dc93a3b62f48e6294bb1b1b00000000000000000014f1054a9fc8cdf8893f7634fc0a0afa0f8554cba0b62a000000000000000000f01cc261faa46dae158f5f4372af5e02d5a17c6994772b000000000000000000ae51a37bd455a1d6790d43e133c995988aabb163176a04000000000000000000867af3560bf4aab1cea599889b5830f702d2b9650a5f03000000000000000000d3b00067c837dcbdec5dd1fb5cda597fa03f8c90f12c29000000000000000000ca75b9384b21187013044c74585573b4e46fb9a71207480000000000000000004e504c2b55677b208da3867b4f628db2da6eace0ec834e040000000000000000d85b9f567ff6bbed506960c8b76498bae153c086d56d2e5f0000000000000000726e26f93314df0ed59c2af2c9f891f1f435f3dab0f8e534e336543f000000006fe28c0ab6f1b372c1a6a246ae63f74f931e8365e15a089c68d6190000000000

The 64 characters at the beginning are:
Code:
398d305048481ee6b096d2a96ab996ad380c6865e5521f000000000000000000

Byte swapping that results in the hash:
Code:
0000000000000000001f52e565680c38ad96b96aa9d296b0e61e484850308d39

When looking up that hash in a block explorer, you will see that it is block 564035 in the Bitcoin blockchain.


If you don't find that particular string, try searching for 0962657374626c6f636b instead.
member
Activity: 74
Merit: 10
January 03, 2020, 05:24:53 AM
#20
may it cost to open it through a text editor?

Why not try it.

If it is not encrypted with password you can see your address including xprv or the private key from the wallet.dat file but if it's encrypted you can see some text with boxes or random characters it will look like this below if you open it with notepad++


wallet.dat files are not text files. You will not get a ton of readable text regardless of encryption. Furthermore, you most definitely will not see an xprv, Bitcoin Core does not store or use xprvs.

wallet.dat files are Berkeley DB files. You will need to have a tool specifically designed to read BDB files to really get meaningful information from them.

Yes I know, I tried dumpwallet.py and pywallet.py. This is not about reading the file but rather recognize the coin inside the wallet which I have disclosed earlier.
staff
Activity: 3458
Merit: 6793
Just writing some code
January 03, 2020, 01:19:16 AM
#19
may it cost to open it through a text editor?

Why not try it.

If it is not encrypted with password you can see your address including xprv or the private key from the wallet.dat file but if it's encrypted you can see some text with boxes or random characters it will look like this below if you open it with notepad++


wallet.dat files are not text files. You will not get a ton of readable text regardless of encryption. Furthermore, you most definitely will not see an xprv, Bitcoin Core does not store or use xprvs.

wallet.dat files are Berkeley DB files. You will need to have a tool specifically designed to read BDB files to really get meaningful information from them.
legendary
Activity: 3374
Merit: 3095
Playbet.io - Crypto Casino and Sportsbook
January 02, 2020, 03:36:34 PM
#18
may it cost to open it through a text editor?

Why not try it.

If it is not encrypted with password you can see your address including xprv or the private key from the wallet.dat file but if it's encrypted you can see some text with boxes or random characters it will look like this below if you open it with notepad++

legendary
Activity: 2534
Merit: 6080
Self-proclaimed Genius
January 01, 2020, 11:20:46 PM
#17
Unfortunately none of the above works with my wallet
How about my suggestion above, have you tried to check for the TXID of those transactions and paste them in multi-currency block explorer?
And now that you have the list of addresses from the dump file, you can paste one of the addresses instead of TXID and that site might detect which coin/wallet it belongs.
member
Activity: 74
Merit: 10
January 01, 2020, 06:26:11 PM
#16
Uhh, it starts with 'M' not 'W'  Lips sealed
Did it started with "W" addresses then changed to 'M' just like Bitcurrency?
Ow sorry didn't notice the mic3 but I just search them in google that they are talking about switching the addresses from W address to other addresses.

Just like the Bitcurrency above as you can see they switch from W addresses to B addresses. So I think mic3 also switch from W address to M address.


Thanks for the info guys, can I ask where did you find this info?

I search them in Google using this term below.

Code:
"w address" site:bitcointalk.org

Including double quote and site:bitcointalk.org
Try it and you will find some post that includes with w address. then try to play the search engine and put your keyword inside the double quote.

Unfortunately none of the above works with my wallet

legendary
Activity: 3374
Merit: 3095
Playbet.io - Crypto Casino and Sportsbook
December 29, 2019, 05:39:00 PM
#15
Uhh, it starts with 'M' not 'W'  Lips sealed
Did it started with "W" addresses then changed to 'M' just like Bitcurrency?
Ow sorry didn't notice the mic3 but I just search them in google that they are talking about switching the addresses from W address to other addresses.

Just like the Bitcurrency above as you can see they switch from W addresses to B addresses. So I think mic3 also switch from W address to M address.


Thanks for the info guys, can I ask where did you find this info?

I search them in Google using this term below.

Code:
"w address" site:bitcointalk.org

Including double quote and site:bitcointalk.org
Try it and you will find some post that includes with w address. then try to play the search engine and put your keyword inside the double quote.
hero member
Activity: 2030
Merit: 578
No God or Kings, only BITCOIN.
December 29, 2019, 09:30:22 AM
#14
Uhh, it starts with 'M' not 'W'  Lips sealed
Did it started with "W" addresses then changed to 'M' just like Bitcurrency?
Yeah, It really starts with "M". I presume that is the case as he give that example here.

Thanks for the info guys, can I ask where did you find this info?
Try clicking those links he gave and that will give you a hint. Google provide much info IMHO.
member
Activity: 74
Merit: 10
December 29, 2019, 02:52:52 AM
#13
Public key starts with W
The only one I could find was "Wagerr"... that uses addresses that start with a "W"

Just adding this below.

MIC3 coin address also start with "W" this is a sample of their address "MmJ14UcTvYtQdsURSBDQy94LzK1EXvz9CY"

Their explorer here: https://mic3.magicdevs.pro/address/MmJ14UcTvYtQdsURSBDQy94LzK1EXvz9CY

Bitcurrency also have "W" addresses before the first address before they switch to "B" address.

Check this post https://bitcointalksearch.org/topic/m.10286233
So if your wallet.dat is created in 2014 maybe this is the crypto you are looking for.

Thanks for the info guys, can I ask where did you find this info?
legendary
Activity: 2534
Merit: 6080
Self-proclaimed Genius
December 28, 2019, 10:35:18 PM
#12
MIC3 coin address also start with "W" this is a sample of their address "MmJ14UcTvYtQdsURSBDQy94LzK1EXvz9CY"
Uhh, it starts with 'M' not 'W'  Lips sealed
Did it started with "W" addresses then changed to 'M' just like Bitcurrency?
legendary
Activity: 3374
Merit: 3095
Playbet.io - Crypto Casino and Sportsbook
December 28, 2019, 06:17:27 PM
#11
Public key starts with W
The only one I could find was "Wagerr"... that uses addresses that start with a "W"

Just adding this below.

MIC3 coin address also start with "W" this is a sample of their address "MmJ14UcTvYtQdsURSBDQy94LzK1EXvz9CY"

Their explorer here: https://mic3.magicdevs.pro/address/MmJ14UcTvYtQdsURSBDQy94LzK1EXvz9CY

Bitcurrency also have "W" addresses before the first address before they switch to "B" address.

Check this post https://bitcointalksearch.org/topic/m.10286233
So if your wallet.dat is created in 2014 maybe this is the crypto you are looking for.
HCP
legendary
Activity: 2086
Merit: 4361
December 27, 2019, 03:10:15 PM
#10
Public key starts with W
The only one I could find was "Wagerr"... that uses addresses that start with a "W"

Website: https://wagerr.com/
Github (for "Core" Wallet): https://github.com/wagerr/wagerr/releases

They also have a blockexplorer here: https://explorer.wagerr.com/#/
So you can try putting some of your addresses and/or transaction IDs (if you can see them) into the explorer and see if it matches.

NOTE: I have never heard of, or used, Wagerr... but it seems like it is still in active development/use: https://bitcointalksearch.org/topic/wgrmn-wagerr-the-betting-blockchain-1086-mm-bets-in-wgr-placed-5186141


EDIT: wait... Public Key starts with "W" or those "name" records in the wallet.dat start with "W"? Huh
member
Activity: 74
Merit: 10
December 27, 2019, 02:37:11 PM
#9
Or open wallet.dat directly with text editor and find keyword name

Public key starts with W

I thought you still identify which coins inside your wallet.dat ?

yes, I dont know what coin is W i just followed your suggestion and checked the wallet.dat manually looking for name tag
member
Activity: 74
Merit: 10
December 27, 2019, 01:43:49 PM
#8
This stackexchange link has a couple of options to do it using either pywallet or the gist script mentioned in one of the answers: https://bitcoin.stackexchange.com/questions/19589/how-to-determine-what-type-of-coins-a-wallet-dat-contains

Or open wallet.dat directly with text editor and find keyword name

Public key starts with W

the dumpwallet.py from the stackexchange link cannot read the file and pywallet thinks its Bitcoin by default
legendary
Activity: 2534
Merit: 6080
Self-proclaimed Genius
December 27, 2019, 01:25:40 AM
#7
I have found an old wallet.dat wallet which after scanning show only unconfirmed transactions with unknown addresses.
Can you view the TXID of those unconfirmed transactions?
If so, copy and paste them to a multi-coin blockexplorer and see if you can get a result, try: https://multihash.net/en
hero member
Activity: 1470
Merit: 655
December 27, 2019, 12:38:28 AM
#6
I have found an old wallet.dat wallet

where did you "find" this file?

The transactions are from 2014 and I dont recall which coin it is.

What are you trying to say? If there is nothing you can add to the topic then dont bother fill with insults.

where did you get "insult" from? Shocked
you seem to be so sensitive! knowing where you have gotten this wallet.dat file could help a lot. for example if it was among your backup files or if it was converted by you (maybe changed the name or extension), or if it was recovered using a recovery tool from a hard disk that failed or if you bought it from the someone on the internet saying it has free coins inside.

depending on "where" you have gotten the file, the steps you could take to recover the funds are entirely different.
HCP
legendary
Activity: 2086
Merit: 4361
December 26, 2019, 03:09:03 PM
#5
If the file isn't encrypted... (ie. no wallet password), then there was a method that you could use to scan the wallet.dat file for "names" (it would be the actual addresses in string format, as opposed to public key/hex etc) and you could use the address prefix to work out what sort of coin you were dealing with. ie. 1 = Bitcoin, L = Litecoin, D = Dogecoin etc.

This stackexchange link has a couple of options to do it using either pywallet or the gist script mentioned in one of the answers: https://bitcoin.stackexchange.com/questions/19589/how-to-determine-what-type-of-coins-a-wallet-dat-contains

If the wallet is encrypted, it might be a bit more difficult... although pywallet might still work.


jr. member
Activity: 189
Merit: 1
December 26, 2019, 02:33:32 PM
#4
 How much is in the wallet? Are you using bitcoin core.
member
Activity: 74
Merit: 10
December 26, 2019, 02:23:02 PM
#3
I have found an old wallet.dat wallet

where did you "find" this file?

The transactions are from 2014 and I dont recall which coin it is.

What are you trying to say? If there is nothing you can add to the topic then dont bother fill with insults.
hero member
Activity: 1470
Merit: 655
December 26, 2019, 01:24:42 PM
#2
I have found an old wallet.dat wallet

where did you "find" this file?
member
Activity: 74
Merit: 10
December 26, 2019, 11:57:14 AM
#1
I have found an old wallet.dat wallet which after scanning show only unconfirmed transactions with unknown addresses.

Same wallet scans in litecoin core wallet with unconfirmed transactions.

Is there any other tool than pywallet that could output whats inside the wallet and parse it?

Is there a page with all bitcoin forks that supports wallet.dat format?

thanks in advance
EWA
Jump to: