Blockchain.info wallet payload strange format

Question

Our situation: Blockchain.info wallet Password lost/broken after update.

Account(wallet) was created in September 2016 in mobile app on iPhone

We use 2FA

We have:

1. BCI account (wallet) ID

2. Working e-mail and connected phone number

3. Password, we sure (only digits)…

4. Remember of the wallet addresses

5. +Now we have some payload from response of server on login attemp

Have NOT:

1. We haven’t save any Seed recovery phrase and private keys

We make all operations with mobile app, but after on of the iOS (or application) update in April of 2017 BCI application was reset or something else wrong with saved password.. We trying to login and get «error wallet decryption» phone/desktop

While I was trying to log in with desktop, confirm by e-mail and phone, I’v got some part of response with such a payload

{\"pbkdf2_iterations\":5000,\"version\":3,\"payload\":\"AAAAAAAAAAAAAAAAAAAAA(here is numbers and digits)\»}»
          }

It’s very strange payload starting with AAAAAAAAAAAAAAAAAAAAA…

Trying btcrecovery util, but no result (use this response part as wallet.json and some password tokens). (python btcrecover.py --wallet pl.json --tokenlist pass.txt)

May be our password was reconverted some way during the BCI updates, iOS app updates?

May be need change iterations count?

May be old version was initially and 5000 liter v3 is wrong?

What version of the My Wallet was in the beginning of 2016? V2 or V3?

What iterations 5000 or 10000?

Probably, we can try to brute force seed someway as we have one of the wallet addresses?

Experts, please, help us! Probably @ChristopherGurnee can give us some tip?

Answer 1

there is an extra script in btcrecover that allows you to pull the wallet file but you will need to be able to authorize access through your email. I ran the extraction file with a test wallet and then used that wallet file with a token list which to discover the password successfully.

Since then I have extracted the another wallet where I actually lost the password but I am stuck at the brute force phase. my token lists are not finding the password.... :-/

Answer 2

try: https://github.com/openwall/john/blob/bleeding-jumbo/run/blockchain2john.py with adding --json option and then use https://hashcat.net/hashcat/, much more faster than btcrecover.