I am writing a C++ application to scour large files (typically disk images) for wallet.dat files, with the intention of recovering the private keys.

At the moment I am struggling the data contained in the ‘mkey’ (Master Key) section of an encrypted wallet.dat file.

From Googling and pouring over the source code for Bitcoin and various other utilities that do what I want to do (such as pywallet) I have deduced the that data layout of mkey data is:

  • mkey - a size prefixed string denoting the start of the master key data.
  • nID - an integer whose purpose I have been unable to determine.
  • encrypted_key - a size prefixed buffer containing the encrypted master key.
  • salt - a size prefixed buffer containing the salt data used when encrypting the key.
  • derivation_method - an integer containing either 0 or 1 for the method used to encrypt the master key using the wallet password.
  • derivation_rounds – an integer containing the number of rounds used to encrypt the master key.
  • other_derivation_parameters

However, having examined my wallet.dat file with a hex editor (screenshot attached) I cannot seem to get the data it contains to correlate with the above.

enter image description here

Can someone point me in the right direction or tell me what I have missed.

  • With which version Bitcoin Core and bdb was this file created? Aug 18 '16 at 13:44
  • 0.12.1 The latest version Aug 19 '16 at 7:50
  • Berkeley DB was 4.8 the standard one used with Bitcoin. I am running a Windows binary that I downloaded from the Website. Aug 19 '16 at 8:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.