0

I have a simple bitcoin packet which contains TX message.

in a TX message, one of it's Transaction input hex data was like this:

8b3e6cc50fd114f8f40f4223dcf3150448ffc1dc5587f1ca5de6d65f1972f46101000000232200203fff89bc822618068e248c92163cd1f3d0c4f1c7e71f0baf172f4b31438fb423ffffffff

when i open this pcap file with wireshark, it show's previous output equal to:

8b3e6cc50fd114f8f40f4223dcf3150448ffc1dc5587f1ca5de6d65f1972f46101000000

after that i see script length which is 0x23(35). so signature script of this packet is equal to:

2200203fff89bc822618068e248c92163cd1f3d0c4f1c7e71f0baf172f4b31438fb423

.

can anybody explain to me how to extract source address which is generated from signature script in the above?

Improve this question

1 Answer 1

Reset to default
1

You can't.

If all you have is a capture of the wire traffic for a single tx, you can't (always) compute the actual address.

In a certain subset of cases, such as for standardized scripts such as P2PKH or P2SH multisig, you might be able to assume the script sig to correspond to one of them, if it has the right data.

The scriptsig mentioned is for a segwit address, and is commonly put as the redeem script for P2SH wrapped segwit addresses.

However, note that just because a script sig matches the expected form for an address does not mean that the actual output corresponds to that address. For example, a P2PKH address would have a script sig with two pushes (one for the signature, one for the public key) - If you were so inclined, you could build an output script that simply consumes the top two elements of the stack, and create an output that will accept a P2PKH script sig as valid, while having absolutely no relation to the P2PKH address.

In general, if you want to know the source address, look up the transaction being spent, and use the locking script from that vout.

Improve this answer
3
  • 2
    You also can't just blindly search pcaps for "addresses", I can construct data to send over the bitcoin network that looks like a valid transaction to you, but isn't to anybody else. You'd be colossally silly to rely on this having any meaning without the context of a validating node.
    – Claris
    Commented Jun 16, 2019 at 14:04
  • @Anonymous I know that my scriptsig is for a segwit address and I calculate it's output address correctly before. My main question is which is the relation between public key which inserted in scriptsig and source address? in other words how we can evaluate the validity of trasnaction and ensure that sender have enough credit to send a specific bitcoin to an output address? i want to find a relation beween output address and source address from this scriptsig.
    – Aristo
    Commented Jun 17, 2019 at 5:23
  • 1
    You can’t. The idea is silly. Run a validating node, don’t try to parse the information from packet dumps.
    – Claris
    Commented Jun 17, 2019 at 5:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.