How to tell which part of the previous tx I need to make the hash to sign for an old given tx?

Question

I have recently been taught (here) how to create the hash to sign for a given "input script" for an existing transaction. I then sought to test my abilities and sought out a difficult transaction to make sense of. Well, I sure found it, and it proves my understanding is woefully inadequate to handle anything with more than a single input script transaction and or with a previous transaction that has more than 1 script.

I found d1cdb8c3828ee74c22677e705539937d039e6acef19e5f2ac0a2779846e4b6c1 which can be found "raw" here. These are the first three "input scripts" of literally dozens:

1

3044022062025a634a2144462cca4b8b0e7b09188b214abb44c8738401bbe03b5df74a59022040fc2c48dc4b940b917c55de3d33861f3d0f21f0807039d5cb683caf6d7472a101

02f32fbdcc91934c8ea17cbe3b1ce8bb34cba9f33b959eb5d2d676181466c849ca

2

3044022079b93499324572f031e873c62d12d0207248d2e3d042781db2e6c009325ff6b6022059f81d40a65933bc8ad5f5125432cb5c156d3f64b12ee13f849c76650c36064501

02f32fbdcc91934c8ea17cbe3b1ce8bb34cba9f33b959eb5d2d676181466c849ca

3

3045022100a9c5705ee0427f976fe6f62bb5ab9e1f08a5550149021ef3f275e3f015326786022052e23f2931b7c6697918149cdb34d39884a321305f087e0a092e2c2c7789dfbc01

02f32fbdcc91934c8ea17cbe3b1ce8bb34cba9f33b959eb5d2d676181466c849ca

Many "input scripts" and each one seems to be sourced in a multi input transaction (I think that's what you call it). The best thing I can do is click the "output" link for each amount shown on the given website to confirm which transaction it came from, but to discern which part of that previous transaction's raw data I'm supposed to take to make the hash to sign for the particular input script from this transaction? I'd be more efficient at banging my head against the wall. Banging my head against the wall would be more pleasant to do as well, by comparison. And that's not even considering what other things I'd have to change to accommodate that piece of data (like do I have to change which input it is in the overall thing before I hash it twice?).

Can someone please walk me through the steps (in relatively layman's terms) on how to create the hash to sign for the first 2-3 input scripts for this transaction? Please show me the work and show me the full thing I'm supposed to get before hashing it twice and what I'm supposed to get after I hash it twice (for the first 2-3 input scripts). Even worst case scenario, if you give me just the full thing (that would just have to be copied and pasted to do the double hash) for the first 2-3 scripts and the resulting hash to sign for the first 2-3 scripts, I will upvote your answer identify it as the correct answer (assuming your numbers are correct).

I frequently find answers I get here are...well...beyond what I can understand and follow. Though I might try, in a jumble of a raw transaction data (especially one such as this transaction, and its previous transactions) I have a difficult time discerning between an "input", a "sighash", a "script sig", an "output", a "dingleberry" or even a "petit point", its all one big skein of numbers to me that I can notice patterns to, but can't untangle.

To show I at least tried, I got 6fa4c7db52edfd1b20f11185283b600e4015d0ef0da7a6f7ffeae53f53a54d42 as the hash to sign for the first input script and I got 4d76fae4618eb086688f50faa2dcfeb5ed7071030cb87be6905c5910a9901ed3 for the second input script and I doubt I'm anywhere close to the right answer as the previous tx's raw transaction data was so convoluted and long and had so many sections, I have no idea what I was supposed to get.

At the very least, please tell me what hashes to sign I'm supposed to get for the first 2-3 inputs please. At least that way I can check my work and try to figure it out on my own even if I don't understand the given explanation if I have those hashes.

This question may be believed to be similar to other questions, however, to contrast, I am asking for a step by step example with this transaction's first few inputs on how to even know which parts I'm supposed to look at of the previous transaction to really show it so I can confirm my understanding of your steps by comparing the results of me taking those steps, to the results you get from taking the same steps.

If you just say, regarding a particular input script or other thing, "well that comes from input 4 from the previous transaction just look at that" well, I don't know where that input is located in that previous tx's raw data! Nor do I know how to figure it out. If you show me, then that will help me identify it so that I can discern some of the nuances thereof and begin to understand how to make sense of it. If you don't tell me what it is, then I can't confirm I understood your instruction.

If you say "remember to notate that in this part". Notate what, I don't know what I'm supposed to notate or how I would notate it even if I did know it if you don't show me (or, please assume I don't know, you probably can't be "too basic" in your description of the steps for me as I am, at best, an amateur programmer and far from any degree a computer engineer).

I know my request for specificity exceeds the norm for the description to the steps, but I think that may help others who aren't as familiar who seek such answers and that's also why I'm also asking just for the copy-and-pastable result I'm supposed to get for the first 2-3 scripts that I need to hash twice, but also their resulting hashes; so that I can take your information and try to figure it out on my own such that I won't bug you guys with 16 comments trying to figure it out, waiting hours for responses (some of which never come) in a futile attempt to understand what it is you're trying to tell me in terms I don't fully understand. Instead, you would be helping me with the tools to figure it out on my own.

Thank you for your help.

Answer 1

Disclaimer: I am going to assume that you are not completely clueless and that you know what an array is, how to count from 0, and how to match brackets, quotes, and colons so that you can read JSON formatted data. If you don't know how to do those things, then please google them first before reading this post.

Also, this post will be very long, and extremely technical. There is simply no layman's terms way of explaining this, but it can be explained to be very easy to follow assuming you know the things I said above. Things that are bolded are things that you should remember as I will use those terms later in the post.

Lastly, these instructions are for transactions which "spend from" Bitcoin addresses that begin with a 1. "Spending from" the other Bitcoin address type makes this process more complicated.

---

The transaction

I will be using a different transaction than the one in your question because that transaction is much too large to easily explain. Instead, I will be using ff8766ec873ff55cc0ac17dee7b379a4efa2a5c83dabdd9a30287c7761ad55d5 which is much smaller.

Blockchain.info does not provide enough information to easily construct the hashes. Instead I will be using the output of the getrawtransaction command from Bitcoin Core which breaks down the transaction in JSON format:

{
  "hex": "0100000003b0c03779c38ddabc044947b164adbcffde8e0ddb3678494f4e8b83f13b37629d010000006b483045022100f3c0f555cd39198caf77f6756256801fc57bcabe4892601b9def52259698f40a0220230262841bff151eb617f7d4cdda6bf06d6fa791230c152e47f68bcdd0e6f64a01210204b3506d8903ca601c97a4abab6548e91004c535a5a45e21299a494b146859caffffffff060eeae54b70d12caddcc15f8897ebc2b6c3011c9a600aba74d49b969991cab3000000006b4830450221009dbeb64ddd4646e1118503c87feaa95c531b5178c6e543be782f6ecb05e8fbe602203945570f8dc56c145617f0283fa4032e0b7895a9cf2a81c7b65665b8ac608cb00121026602a5dc59c30f485b2c457ac8e2f617e27b10a1d2ae76f3231f9b01dff08964ffffffff7f715ba408db0289118f9b8578e54e721f1aee10d09844510793b8b20c87903e010000006b48304502210095e300886ec4df78e39d6d0cf5e5e531ded8f42f00e5730c371d8951867dad5b02203c55f9403f6c2aac444213161a93a86661e7367d4007be74ffb3981387cc1c790121023f0aadfeb71a4964c5087fec8b052c8236051dae838d4747543330c6b266ce6effffffff02d5781100000000001976a914342ab422c9e3ef285efe9882ae54269ed9713dd688ac20a10700000000001976a91488d924f51033b74a895863a5fb57fd545529df7d88ac00000000",
  "txid": "ff8766ec873ff55cc0ac17dee7b379a4efa2a5c83dabdd9a30287c7761ad55d5",
  "hash": "ff8766ec873ff55cc0ac17dee7b379a4efa2a5c83dabdd9a30287c7761ad55d5",
  "version": 1,
  "size": 522,
  "vsize": 522,
  "locktime": 0,
  "vin": [
    {
      "txid": "9d62373bf1838b4e4f497836db0d8edeffbcad64b1474904bcda8dc37937c0b0",
      "vout": 1,
      "scriptSig": {
        "asm": "3045022100f3c0f555cd39198caf77f6756256801fc57bcabe4892601b9def52259698f40a0220230262841bff151eb617f7d4cdda6bf06d6fa791230c152e47f68bcdd0e6f64a[ALL] 0204b3506d8903ca601c97a4abab6548e91004c535a5a45e21299a494b146859ca",
        "hex": "483045022100f3c0f555cd39198caf77f6756256801fc57bcabe4892601b9def52259698f40a0220230262841bff151eb617f7d4cdda6bf06d6fa791230c152e47f68bcdd0e6f64a01210204b3506d8903ca601c97a4abab6548e91004c535a5a45e21299a494b146859ca"
      },
      "sequence": 4294967295
    },
    {
      "txid": "b3ca9199969bd474ba0a609a1c01c3b6c2eb97885fc1dcad2cd1704be5ea0e06",
      "vout": 0,
      "scriptSig": {
        "asm": "30450221009dbeb64ddd4646e1118503c87feaa95c531b5178c6e543be782f6ecb05e8fbe602203945570f8dc56c145617f0283fa4032e0b7895a9cf2a81c7b65665b8ac608cb0[ALL] 026602a5dc59c30f485b2c457ac8e2f617e27b10a1d2ae76f3231f9b01dff08964",
        "hex": "4830450221009dbeb64ddd4646e1118503c87feaa95c531b5178c6e543be782f6ecb05e8fbe602203945570f8dc56c145617f0283fa4032e0b7895a9cf2a81c7b65665b8ac608cb00121026602a5dc59c30f485b2c457ac8e2f617e27b10a1d2ae76f3231f9b01dff08964"
      },
      "sequence": 4294967295
    },
    {
      "txid": "3e90870cb2b89307514498d010ee1a1f724ee578859b8f118902db08a45b717f",
      "vout": 1,
      "scriptSig": {
        "asm": "304502210095e300886ec4df78e39d6d0cf5e5e531ded8f42f00e5730c371d8951867dad5b02203c55f9403f6c2aac444213161a93a86661e7367d4007be74ffb3981387cc1c79[ALL] 023f0aadfeb71a4964c5087fec8b052c8236051dae838d4747543330c6b266ce6e",
        "hex": "48304502210095e300886ec4df78e39d6d0cf5e5e531ded8f42f00e5730c371d8951867dad5b02203c55f9403f6c2aac444213161a93a86661e7367d4007be74ffb3981387cc1c790121023f0aadfeb71a4964c5087fec8b052c8236051dae838d4747543330c6b266ce6e"
      },
      "sequence": 4294967295
    }
  ],
  "vout": [
    {
      "value": 0.01145045,
      "n": 0,
      "scriptPubKey": {
        "asm": "OP_DUP OP_HASH160 342ab422c9e3ef285efe9882ae54269ed9713dd6 OP_EQUALVERIFY OP_CHECKSIG",
        "hex": "76a914342ab422c9e3ef285efe9882ae54269ed9713dd688ac",
        "reqSigs": 1,
        "type": "pubkeyhash",
        "addresses": [
          "15kqJ5UinhstuG1KVCSJDagaUcFJLvhyNx"
        ]
      }
    },
    {
      "value": 0.005,
      "n": 1,
      "scriptPubKey": {
        "asm": "OP_DUP OP_HASH160 88d924f51033b74a895863a5fb57fd545529df7d OP_EQUALVERIFY OP_CHECKSIG",
        "hex": "76a91488d924f51033b74a895863a5fb57fd545529df7d88ac",
        "reqSigs": 1,
        "type": "pubkeyhash",
        "addresses": [
          "1DUb2YYbQA1jjaNYzVXLZ7ZioEhLXtbUru"
        ]
      }
    }
  ],
  "blockhash": "000000000000000000c93a1c73452d4221f8c88a1721072966c38d590b1b34af",
  "confirmations": 1,
  "time": 1502353841,
  "blocktime": 1502353841
}

The full raw transaction itself is the field hex. The inputs that we want to sign for are in an array in the vin field (the array is enclosed by square brackets [ ]). Each input is enclosed by curly braces ({ }).

The general hash preimage

The hash preimage is the data that is actually hashed. The algorithm to produce this preimage is known as the sighashing algorithm. The sighashing algorithm for each input goes like this: take the transaction and make all scriptSigs empty. Then for the input we are signing, place the scriptPubKey of the output being spent, append the sighash type, and hash the whole thing with sha256d.

Signing the inputs

Here I will go into the specifics.

The first thing we want to do is to make all of the scriptSigs of the transaction empty. The easiest way to do this is to take raw transaction and do a find for the hex of the scriptSigs for each of the inputs in the transaction and replace that with 00. Then remove the two characters before the thing you just replaced

For the first input, the scriptSig is

483045022100f3c0f555cd39198caf77f6756256801fc57bcabe4892601b9def52259698f40a0220230262841bff151eb617f7d4cdda6bf06d6fa791230c152e47f68bcdd0e6f64a01210204b3506d8903ca601c97a4abab6548e91004c535a5a45e21299a494b146859ca

For the second input, the scriptSig is

4830450221009dbeb64ddd4646e1118503c87feaa95c531b5178c6e543be782f6ecb05e8fbe602203945570f8dc56c145617f0283fa4032e0b7895a9cf2a81c7b65665b8ac608cb00121026602a5dc59c30f485b2c457ac8e2f617e27b10a1d2ae76f3231f9b01dff08964

For the third input, the scriptSig is

48304502210095e300886ec4df78e39d6d0cf5e5e531ded8f42f00e5730c371d8951867dad5b02203c55f9403f6c2aac444213161a93a86661e7367d4007be74ffb3981387cc1c790121023f0aadfeb71a4964c5087fec8b052c8236051dae838d4747543330c6b266ce6e

After performing the find and replace, the unsigned transaction is

0100000003b0c03779c38ddabc044947b164adbcffde8e0ddb3678494f4e8b83f13b37629d0100000000ffffffff060eeae54b70d12caddcc15f8897ebc2b6c3011c9a600aba74d49b969991cab30000000000ffffffff7f715ba408db0289118f9b8578e54e721f1aee10d09844510793b8b20c87903e0100000000ffffffff02d5781100000000001976a914342ab422c9e3ef285efe9882ae54269ed9713dd688ac20a10700000000001976a91488d924f51033b74a895863a5fb57fd545529df7d88ac00000000

You should also mentally note the position of each of these replacements; you will need those positions later.

Now append 01000000 to the unsigned transaction so that we now have:

0100000003b0c03779c38ddabc044947b164adbcffde8e0ddb3678494f4e8b83f13b37629d0100000000ffffffff060eeae54b70d12caddcc15f8897ebc2b6c3011c9a600aba74d49b969991cab30000000000ffffffff7f715ba408db0289118f9b8578e54e721f1aee10d09844510793b8b20c87903e0100000000ffffffff02d5781100000000001976a914342ab422c9e3ef285efe9882ae54269ed9713dd688ac20a10700000000001976a91488d924f51033b74a895863a5fb57fd545529df7d88ac0000000001000000

Keep this original, unmodified unsigned transaction somewhere, we will need it later.

The first input

The first input is the first element in the vin array of the transaction JSON output:

    {
      "txid": "9d62373bf1838b4e4f497836db0d8edeffbcad64b1474904bcda8dc37937c0b0",
      "vout": 1,
      "scriptSig": {
        "asm": "3045022100f3c0f555cd39198caf77f6756256801fc57bcabe4892601b9def52259698f40a0220230262841bff151eb617f7d4cdda6bf06d6fa791230c152e47f68bcdd0e6f64a[ALL] 0204b3506d8903ca601c97a4abab6548e91004c535a5a45e21299a494b146859ca",
        "hex": "483045022100f3c0f555cd39198caf77f6756256801fc57bcabe4892601b9def52259698f40a0220230262841bff151eb617f7d4cdda6bf06d6fa791230c152e47f68bcdd0e6f64a01210204b3506d8903ca601c97a4abab6548e91004c535a5a45e21299a494b146859ca"
      },
      "sequence": 4294967295
    },

Now we need to get some data from the previous transaction output. So we look up the txid that this input spent from, 9d62373bf1838b4e4f497836db0d8edeffbcad64b1474904bcda8dc37937c0b0, and get its JSON format break down:

{
  "hex": "[removed for space]",
  "txid": "9d62373bf1838b4e4f497836db0d8edeffbcad64b1474904bcda8dc37937c0b0",
  "hash": "9d62373bf1838b4e4f497836db0d8edeffbcad64b1474904bcda8dc37937c0b0",
  "version": 1,
  "size": 373,
  "vsize": 373,
  "locktime": 0,
  "vin": [
    {
      "txid": "86efe44adc45a486c51a641cc83612159dc18f31a14da140a24fb4c5623e511a",
      "vout": 1,
      "scriptSig": {
        "asm": "3045022100cf76ad139adc38ae90fd14e6d29ff9bde62e7b3c3ef9880bc41098775100a1d502205a7dfb6aeacd9c58481f317334d5a6edaf2e734053555409550f6d463d9bf5f0[ALL] 030888863fcb4cdf5b7d33b40e613af35df8f39d576e7972238b0d396cd3fcc3f2",
        "hex": "483045022100cf76ad139adc38ae90fd14e6d29ff9bde62e7b3c3ef9880bc41098775100a1d502205a7dfb6aeacd9c58481f317334d5a6edaf2e734053555409550f6d463d9bf5f00121030888863fcb4cdf5b7d33b40e613af35df8f39d576e7972238b0d396cd3fcc3f2"
      },
      "sequence": 4294967295
    },
    {
      "txid": "897817de401d7245912e7add2da98e6d885a50104e147b785116b3a2a295f386",
      "vout": 0,
      "scriptSig": {
        "asm": "30440220633666024ceb08c4e6d076bc158a0dd013be14238afd8157f2b73b5a00aece6d02202a1da4a6def17cba4ae835c07af2b1ebff87bce0c56d21d6d2458cd234d766f6[ALL] 0395aa52bfe17fa8a06cc6b3216210c7ff3254a2095db322250bd2d9148e5b44cd",
        "hex": "4730440220633666024ceb08c4e6d076bc158a0dd013be14238afd8157f2b73b5a00aece6d02202a1da4a6def17cba4ae835c07af2b1ebff87bce0c56d21d6d2458cd234d766f601210395aa52bfe17fa8a06cc6b3216210c7ff3254a2095db322250bd2d9148e5b44cd"
      },
      "sequence": 4294967295
    }
  ],
  "vout": [
    {
      "value": 0.005,
      "n": 0,
      "scriptPubKey": {
        "asm": "OP_DUP OP_HASH160 52fbbe93faca2c57c6d7ccad877e0da4876ce0c8 OP_EQUALVERIFY OP_CHECKSIG",
        "hex": "76a91452fbbe93faca2c57c6d7ccad877e0da4876ce0c888ac",
        "reqSigs": 1,
        "type": "pubkeyhash",
        "addresses": [
          "18ZmzEy6fzx9afy2LjWhNjttoh2VBpRq84"
        ]
      }
    },
    {
      "value": 0.01001452,
      "n": 1,
      "scriptPubKey": {
        "asm": "OP_DUP OP_HASH160 2c418ec354a1ab688a656d86b16c02abe8f592e9 OP_EQUALVERIFY OP_CHECKSIG",
        "hex": "76a9142c418ec354a1ab688a656d86b16c02abe8f592e988ac",
        "reqSigs": 1,
        "type": "pubkeyhash",
        "addresses": [
          "1531GU6Ypf66HJ8c9ZyF2rwHyRWUxKSXhb"
        ]
      }
    }
  ],
  "blockhash": "00000000000000000083cb57936842737b6b9da889fed3d9beb9661fe9ad458e",
  "confirmations": 8,
  "time": 1502353082,
  "blocktime": 1502353082
}

The vout field of this input specifies that we need the output at index 1 in the output array of the previous transaction. It is important to remember that arrays element indexing begins at 0. The first element has an index of (numbered) 0, the second element is index 1, etc. So, with an output index of 1, we need the second output of this previous transaction, which is:

{
  "value": 0.01001452,
  "n": 1,
  "scriptPubKey": {
    "asm": "OP_DUP OP_HASH160 2c418ec354a1ab688a656d86b16c02abe8f592e9 OP_EQUALVERIFY OP_CHECKSIG",
    "hex": "76a9142c418ec354a1ab688a656d86b16c02abe8f592e988ac",
    "reqSigs": 1,
    "type": "pubkeyhash",
    "addresses": [
      "1531GU6Ypf66HJ8c9ZyF2rwHyRWUxKSXhb"
    ]
  }
}

The only thing we need from this output is the hex of the scriptPubKey, which is

76a9142c418ec354a1ab688a656d86b16c02abe8f592e988ac

We need to prepend the number for the length of this hex in bytes (half of the number of characters in the string). The number must be in hex, and it is 19. So the scriptPubKey that we will be using is

1976a9142c418ec354a1ab688a656d86b16c02abe8f592e988ac

Now make a copy of the unsigned transaction that we made earlier, we will not be modifying the original which we will need for later inputs. Now take the copied unsigned transaction, and move your cursor to the 00 that we replaced this first input's scriptSig with. Replace that 00 with the scriptPubKey that we just modified. So now our copied unsigned transaction looks like

0100000003b0c03779c38ddabc044947b164adbcffde8e0ddb3678494f4e8b83f13b37629d010000001976a9142c418ec354a1ab688a656d86b16c02abe8f592e988acffffffff060eeae54b70d12caddcc15f8897ebc2b6c3011c9a600aba74d49b969991cab30000000000ffffffff7f715ba408db0289118f9b8578e54e721f1aee10d09844510793b8b20c87903e0100000000ffffffff02d5781100000000001976a914342ab422c9e3ef285efe9882ae54269ed9713dd688ac20a10700000000001976a91488d924f51033b74a895863a5fb57fd545529df7d88ac0000000001000000

This is our hash preimage. Now we need to hash it as bytes. The tool I use for hashing these online is http://www.fileformat.info/tool/hash.htm. Copy and paste the hash preimage into the text box for Binary Hash, labeled Hex bytes. Click Hash and scroll down. Copy the string next to the SHA-256 label and paste that into the same textbox and click Hash again. Scroll down again and the string next to SHA-256 is the hash that was signed for the first input of our transaction. This hash is:

0ca51b9a67de27aa35aba665cedea31025f8d40c85669953952b8dcde4242960

The second input

The second input is the second element of the vin array. The JSON for this is:

    {
      "txid": "b3ca9199969bd474ba0a609a1c01c3b6c2eb97885fc1dcad2cd1704be5ea0e06",
      "vout": 0,
      "scriptSig": {
        "asm": "30450221009dbeb64ddd4646e1118503c87feaa95c531b5178c6e543be782f6ecb05e8fbe602203945570f8dc56c145617f0283fa4032e0b7895a9cf2a81c7b65665b8ac608cb0[ALL] 026602a5dc59c30f485b2c457ac8e2f617e27b10a1d2ae76f3231f9b01dff08964",
        "hex": "4830450221009dbeb64ddd4646e1118503c87feaa95c531b5178c6e543be782f6ecb05e8fbe602203945570f8dc56c145617f0283fa4032e0b7895a9cf2a81c7b65665b8ac608cb00121026602a5dc59c30f485b2c457ac8e2f617e27b10a1d2ae76f3231f9b01dff08964"
      },
      "sequence": 4294967295
    },

We will need the information from the previous transaction output, which is the output at index 0 of the transaction b3ca9199969bd474ba0a609a1c01c3b6c2eb97885fc1dcad2cd1704be5ea0e06. This transaction's JSON output is:

{
  "hex": "[removed for space]",
  "txid": "b3ca9199969bd474ba0a609a1c01c3b6c2eb97885fc1dcad2cd1704be5ea0e06",
  "hash": "b3ca9199969bd474ba0a609a1c01c3b6c2eb97885fc1dcad2cd1704be5ea0e06",
  "version": 1,
  "size": 404,
  "vsize": 404,
  "locktime": 0,
  "vin": [
    {
      "txid": "7195945cfe7d0d5b7e49b35dba8a844ee0ce1fd3b2afdc3e5bf0e3be409080ce",
      "vout": 1,
      "scriptSig": {
        "asm": "30440220234ec20a17fced74c34b94b2c34e77bb1cc824a34916661fa164f4dd47ce4992022078176fe355ccee3675684af148d340c6bc5c039d9e60630b71f789f72edce327[ALL] 026602a5dc59c30f485b2c457ac8e2f617e27b10a1d2ae76f3231f9b01dff08964",
        "hex": "4730440220234ec20a17fced74c34b94b2c34e77bb1cc824a34916661fa164f4dd47ce4992022078176fe355ccee3675684af148d340c6bc5c039d9e60630b71f789f72edce3270121026602a5dc59c30f485b2c457ac8e2f617e27b10a1d2ae76f3231f9b01dff08964"
      },
      "sequence": 4294967295
    },
    {
      "txid": "9dfbb913f9e80d99ec162adce1f61662e99c7a864eb38943135f41b56693a17a",
      "vout": 1,
      "scriptSig": {
        "asm": "3045022100d966ddb0d0ef2f5e09fe88f7a9629409e576f929b10cd33b11d5c2da0fd2bcae022014517f6b43b3c12da786bca5d96de39ab804cd134940815b40bfbf5df336880e[ALL] 026602a5dc59c30f485b2c457ac8e2f617e27b10a1d2ae76f3231f9b01dff08964",
        "hex": "483045022100d966ddb0d0ef2f5e09fe88f7a9629409e576f929b10cd33b11d5c2da0fd2bcae022014517f6b43b3c12da786bca5d96de39ab804cd134940815b40bfbf5df336880e0121026602a5dc59c30f485b2c457ac8e2f617e27b10a1d2ae76f3231f9b01dff08964"
      },
      "sequence": 4294967295
    }
  ],
  "vout": [
    {
      "value": 0.00439481,
      "n": 0,
      "scriptPubKey": {
        "asm": "OP_DUP OP_HASH160 58be4e12275e895c797c9bf7533452c5a41e4551 OP_EQUALVERIFY OP_CHECKSIG",
        "hex": "76a91458be4e12275e895c797c9bf7533452c5a41e455188ac",
        "reqSigs": 1,
        "type": "pubkeyhash",
        "addresses": [
          "196ESW77sq7iHzLfJub7KDgTGwvJMZwLs6"
        ]
      }
    },
    {
      "value": 0.00,
      "n": 1,
      "scriptPubKey": {
        "asm": "OP_RETURN 6f6d6e6900000000000000010000000011848ee0",
        "hex": "6a146f6d6e6900000000000000010000000011848ee0",
        "type": "nulldata"
      }
    },
    {
      "value": 0.0000273,
      "n": 2,
      "scriptPubKey": {
        "asm": "OP_DUP OP_HASH160 88d924f51033b74a895863a5fb57fd545529df7d OP_EQUALVERIFY OP_CHECKSIG",
        "hex": "76a91488d924f51033b74a895863a5fb57fd545529df7d88ac",
        "reqSigs": 1,
        "type": "pubkeyhash",
        "addresses": [
          "1DUb2YYbQA1jjaNYzVXLZ7ZioEhLXtbUru"
        ]
      }
    }
  ],
  "blockhash": "000000000000000000c0fd6a8fee9df17e59c7243c9fce359324ee0fffc70be3",
  "confirmations": 8,
  "time": 1502353358,
  "blocktime": 1502353358
}

We want the first output in the vout array here, so our output is:

    {
      "value": 0.00439481,
      "n": 0,
      "scriptPubKey": {
        "asm": "OP_DUP OP_HASH160 58be4e12275e895c797c9bf7533452c5a41e4551 OP_EQUALVERIFY OP_CHECKSIG",
        "hex": "76a91458be4e12275e895c797c9bf7533452c5a41e455188ac",
        "reqSigs": 1,
        "type": "pubkeyhash",
        "addresses": [
          "196ESW77sq7iHzLfJub7KDgTGwvJMZwLs6"
        ]
      }
    },

Like the first input, we only need the hex of the scriptPubKey of this output with its length prepended to it, so we will the below as our scriptPubKey:

1976a91458be4e12275e895c797c9bf7533452c5a41e455188ac

Now we take our original, unmodified unsigned transaction, and copy it. Now go to the position where we removed the scriptSig for the second input. Replace the 00 that we had put there with the scriptPubKey. Our copied unsigned transaction should look like:

0100000003b0c03779c38ddabc044947b164adbcffde8e0ddb3678494f4e8b83f13b37629d0100000000ffffffff060eeae54b70d12caddcc15f8897ebc2b6c3011c9a600aba74d49b969991cab3000000001976a91458be4e12275e895c797c9bf7533452c5a41e455188acffffffff7f715ba408db0289118f9b8578e54e721f1aee10d09844510793b8b20c87903e0100000000ffffffff02d5781100000000001976a914342ab422c9e3ef285efe9882ae54269ed9713dd688ac20a10700000000001976a91488d924f51033b74a895863a5fb57fd545529df7d88ac0000000001000000

This is our hash preimage. Take the hash preimage and hash it like we did for the first input. Your resulting hash should be

46016caa2997dc453420a9af5090cd90c5109a93d525bbc3e9e12f8ec0112d58

The third input

The third input of our transaction is the third element of the vin array. This is its JSON formatted break down:

    {
      "txid": "3e90870cb2b89307514498d010ee1a1f724ee578859b8f118902db08a45b717f",
      "vout": 1,
      "scriptSig": {
        "asm": "304502210095e300886ec4df78e39d6d0cf5e5e531ded8f42f00e5730c371d8951867dad5b02203c55f9403f6c2aac444213161a93a86661e7367d4007be74ffb3981387cc1c79[ALL] 023f0aadfeb71a4964c5087fec8b052c8236051dae838d4747543330c6b266ce6e",
        "hex": "48304502210095e300886ec4df78e39d6d0cf5e5e531ded8f42f00e5730c371d8951867dad5b02203c55f9403f6c2aac444213161a93a86661e7367d4007be74ffb3981387cc1c790121023f0aadfeb71a4964c5087fec8b052c8236051dae838d4747543330c6b266ce6e"
      },
      "sequence": 4294967295
    }

Now we need the output at index 1 of 3e90870cb2b89307514498d010ee1a1f724ee578859b8f118902db08a45b717f. That is the second output of 3e90870cb2b89307514498d010ee1a1f724ee578859b8f118902db08a45b717f. The JSON formatted break down of that transaction is:

{
  "hex": "[removed for space]",
  "txid": "3e90870cb2b89307514498d010ee1a1f724ee578859b8f118902db08a45b717f",
  "hash": "3e90870cb2b89307514498d010ee1a1f724ee578859b8f118902db08a45b717f",
  "version": 1,
  "size": 257,
  "vsize": 257,
  "locktime": 0,
  "vin": [
    {
      "txid": "1037821442fe684bd87ad790b4f9fd6a07c3f56ac85478e98e6b06c665eda281",
      "vout": 1,
      "scriptSig": {
        "asm": "3045022100ec9ab3692830627c4f76687d9f2e0fde9fba6f11b6a6025cc7f3c3708be8d8e1022076769507eeb04e867e98e543d54ec8a3c91e17eb4560ff7ab1dd2f40ca7b3d3d[ALL] 023f0aadfeb71a4964c5087fec8b052c8236051dae838d4747543330c6b266ce6e",
        "hex": "483045022100ec9ab3692830627c4f76687d9f2e0fde9fba6f11b6a6025cc7f3c3708be8d8e1022076769507eeb04e867e98e543d54ec8a3c91e17eb4560ff7ab1dd2f40ca7b3d3d0121023f0aadfeb71a4964c5087fec8b052c8236051dae838d4747543330c6b266ce6e"
      },
      "sequence": 4294967295
    }
  ],
  "vout": [
    {
      "value": 0.00,
      "n": 0,
      "scriptPubKey": {
        "asm": "OP_RETURN 6f6d6e6900000000000000030000000000004066",
        "hex": "6a146f6d6e6900000000000000030000000000004066",
        "type": "nulldata"
      }
    },
    {
      "value": 0.00458772,
      "n": 1,
      "scriptPubKey": {
        "asm": "OP_DUP OP_HASH160 a4c3d2d77c214b4e212cdcc0331d21b2fbd6f328 OP_EQUALVERIFY OP_CHECKSIG",
        "hex": "76a914a4c3d2d77c214b4e212cdcc0331d21b2fbd6f32888ac",
        "reqSigs": 1,
        "type": "pubkeyhash",
        "addresses": [
          "1G2CQXJdzzyyUaStUGcsaKLnN5GjD8TeQe"
        ]
      }
    },
    {
      "value": 0.0000273,
      "n": 2,
      "scriptPubKey": {
        "asm": "OP_DUP OP_HASH160 88d924f51033b74a895863a5fb57fd545529df7d OP_EQUALVERIFY OP_CHECKSIG",
        "hex": "76a91488d924f51033b74a895863a5fb57fd545529df7d88ac",
        "reqSigs": 1,
        "type": "pubkeyhash",
        "addresses": [
          "1DUb2YYbQA1jjaNYzVXLZ7ZioEhLXtbUru"
        ]
      }
    }
  ],
  "blockhash": "000000000000000000c0fd6a8fee9df17e59c7243c9fce359324ee0fffc70be3",
  "confirmations": 9,
  "time": 1502353358,
  "blocktime": 1502353358
}

The second output of that transaction is:

    {
      "value": 0.00458772,
      "n": 1,
      "scriptPubKey": {
        "asm": "OP_DUP OP_HASH160 a4c3d2d77c214b4e212cdcc0331d21b2fbd6f328 OP_EQUALVERIFY OP_CHECKSIG",
        "hex": "76a914a4c3d2d77c214b4e212cdcc0331d21b2fbd6f32888ac",
        "reqSigs": 1,
        "type": "pubkeyhash",
        "addresses": [
          "1G2CQXJdzzyyUaStUGcsaKLnN5GjD8TeQe"
        ]
      }
    },

Like the previous inputs, we need the hex of the scriptPubKey with its length prepended to it, so our scriptPubKey is

1976a914a4c3d2d77c214b4e212cdcc0331d21b2fbd6f32888ac

Now copy the original, unmodified unsigned transaction. Go to the position where you replaced the scriptSig for this input with 00. Replace that 00 with the scriptPubKey. So now we have a copied unsigned transaction that looks like:

0100000003b0c03779c38ddabc044947b164adbcffde8e0ddb3678494f4e8b83f13b37629d0100000000ffffffff060eeae54b70d12caddcc15f8897ebc2b6c3011c9a600aba74d49b969991cab30000000000ffffffff7f715ba408db0289118f9b8578e54e721f1aee10d09844510793b8b20c87903e010000001976a914a4c3d2d77c214b4e212cdcc0331d21b2fbd6f32888acffffffff02d5781100000000001976a914342ab422c9e3ef285efe9882ae54269ed9713dd688ac20a10700000000001976a91488d924f51033b74a895863a5fb57fd545529df7d88ac0000000001000000

Hash the preimage as you did for inputs 1 and 2. The hash you should get is

b85c3c3b91362e3c8047120152d5d9640a850e1db6d867393ada2e13a6ec079a

Conclusion

The hashes that are signed for each input are as follows:

• First input: 0ca51b9a67de27aa35aba665cedea31025f8d40c85669953952b8dcde4242960
• Second input: 46016caa2997dc453420a9af5090cd90c5109a93d525bbc3e9e12f8ec0112d58
• Third input: b85c3c3b91362e3c8047120152d5d9640a850e1db6d867393ada2e13a6ec079a

---

I have ran both of these transactions through a modified version of Bitcoin Core that gives me the sighashes.

For d1cdb8c3828ee74c22677e705539937d039e6acef19e5f2ac0a2779846e4b6c1, the sighashes for each input in order are:

36537e9335b00b9627dd067515b85b2dddb3334e946677f5ca01cf07a8de4945
3b10e1e264162eb8fe3011196a756bfea8798775ee5e6c70a107282f74bfd599
fe269a8d6cc3cd801d5c0e0e41c44a32f6fecc0bb7e4909a905e85da43104cf0
166223356d627392d52cd7def6c45a9b7a18bb6cbc628cc1db0db7a1a6c51b19
b42809cd2075ad304fae2205648384b6ac8558dfb17bafc5e2de838af3f5e3bb
d311ba5115ffdce2c73a0e5007b28baa08885cad1a02e719938469fa0e497ccb
43d0509b98408323f6b7ea4ca07d66ad109c647cb9eee413f88464c400371733
6e22e0963dd860525602ad69ab0c9002054588d05c057f51349414ba11f185ab
07f08a0b60a5ebbbe4220e21d912af8c9cbe20f85cfae1cb21171fed8a4b9870
901832f68d7e10e72b57cc029ef161a4044c6fa2633cccf792eccfe34886f075
c5feb7830c2b2f7bd4a604ea3e7497fc8e3e122955c0bf8bd90b7683dc05eee6
f2e29915224de6eec85d7c5fb21e6333dd289b0bb7d07094f0846ca15cab62a1
6ae401edb4c25f7083e59cb0d6145c65d92e749ef93784214aef5e0eba4b38de
2aefa9852164cf75f7a89fd8b0466bb0f49ef2a3bb49243e951611deeafe556d
90698f761a0c6af1de93990e853cf05d760f2c4afce7bf8dc3fa52e8e5ccfa55
f2637c7489c901ce23e133ed252c8084131b8fbeeb604001fda3b2219ed30adc
8430eb0e3576e3a5e376083e7be45725c8a8f6ca3a5d39d97ab13298f82309cf
8da03f6b4f06fb5da308adbad2678f7c6b6ca1bd15bff9accf5dcb404084b214
a2c96c50371204843d9e97848a4afee884f26f3965940db1092bf860736edc11
7f341abb178bac950acd389ce9aa22c8b7bc9982402002f31a5fdbe10db2acff
a6c81aba4d4e08d19f12d02b2651622e5a288f9fac76cb57b930d990a5c18014
d2363eb97fa94ade230a725576a6af91df6c7da516c568195b54d6e3ab7ac97e
570ab2dbb4b4054162617c8c7f95f747a944f39959dc461ce5efce715cac782e
38f638c00eb4f044568ee4d116ebfa9f355cf81ee77237d909d9b0b519edf736
4861a778ad55393bc670e2b73461eedd52d7370b5f86dca2ff319be44bfcb9ea
ea75ff70f64e2a9b2f184c2408c7e28921ddd3c6952f99d193c56134d714839e
ddf948089894409dab74badfcd64055c79b4ba6511b1863eb42bad35bf22d82c
68d4fc82898fae0b41e26affff0fbf37d8c01ecdd416dad299d4fd6837bdddc5
6d5239c61aec375fcf3a13f6ff36660460ebbe49e1372b99cf0ca001381170c8
75bed4705d44d763b9ba59c4a843ba88cc2c58eca1f1c80a683cb02a45052b98
86a6c9a2f5da74825d930d1bf818a9d8bd3f871bc2cb0d71da27940d1d2130cc
9d9537ebb060d5c1bc6c36fd0695833085d753b2860ee3ba9ff65f977b5ab226
f397fea726ddc5a938544283e1dd265aac5ebb8b6856543df48e285f009b4375
120447a585f30f7bb9411f7888b6fcd96862d1cae34ddaadda6291bc46fa36ed
3760ddfd61b0e5f8902195e2b7285da42400446dfd4fcec1ea979ea78c4b32de
271a878980c9087f7004ed21330cd101dd19706513a629eea4cebae9e5e80a56
33c17e7530d3c184acb222165b49155c2a8283032a7ee96ede30546ee571966a
81de851b46bc42b419cdc9905609cc9a4fda206424cbba12626555bf788ba31a
ee864623021df5a2369174f3b8c90f20b6f3021d33f8c9a1ea75698168005626

For ff8766ec873ff55cc0ac17dee7b379a4efa2a5c83dabdd9a30287c7761ad55d5, the sighashes are:

0ca51b9a67de27aa35aba665cedea31025f8d40c85669953952b8dcde4242960
46016caa2997dc453420a9af5090cd90c5109a93d525bbc3e9e12f8ec0112d58
b85c3c3b91362e3c8047120152d5d9640a850e1db6d867393ada2e13a6ec079a