gurnec / btcrecover

An open source Bitcoin wallet password and seed recovery tool designed for the case where you already know most of your password/seed, but need assistance in trying different possible combinations.
GNU General Public License v2.0
1.23k stars 657 forks source link

BIP39 Seed recovery #349

Open AlexFisun opened 4 years ago

AlexFisun commented 4 years ago

I have splitted bip-39 seed phrase like bundle damp XXXX XXXX field hungry include unaware confirm banana XXXX poet

I know its unencrypted so I can recover keys by guessing the seed.

Is there any way to do it with the tool?

It seems like I need to post guesses for missed words for seedrecover, and --bip39 for btcrecover will only try to crack the passphrase.

is it possible to do something like seedrecover --tokenlist?

I can also pregenerate all seed phrases with possible missing words, what method from extract scripts or btcrecover should I use to get result then?

3rdIteration commented 4 years ago

Yes, recovering 3 words is quite straight foward if you have used the wallet with mainstream currencies and know the position of the missing words.

I have a bunch of playlists here: https://www.youtube.com/playlist?list=PL7rfJxwogDzmd1IanPrmlTg3ewAIq-BZJ

They look at how to use it for seed recovery.

The command that you want will probably look something like: python seedrecover.py --no-dupchecks --addr-limit 1 --bip32-path "m/49'/0'/0'/0" --big-typos 3 --mnemonic-length 12

You will need to change the derivation path based on what currency and wallet type you want. If you want to use Segwit or Native-Segwit address formats, an addressDB (if you don't know any addresses you are looking for) or use a currency that BTCrecover doesn't support, you will need to use my fork that can be found here: https://github.com/3rdIteration/btcrecover

The command above also assume that you only have a 12 word phrase as per your example.

AlexFisun commented 4 years ago

Thanks for your answer! That almost worked for my case. The problem is in words positions. So if I have 3 words missed, without dublicates it would be 1015^3 combinations of different 3 words in the specific phrase on specific positions. (which is 1B tries only, should recover in 1 day on a PC)

However when I tried your command - it said, it should be more than 200BLN combos and weeks of time.

So the question is: is there a way to tell the algorithm specific words positions? or positions of missed words? just like how it works with "--tokenlist" command for btc-recover? Have not found this feature for seedrecovery.py

3rdIteration commented 4 years ago

The best way to use it if you know where the gaps are is to substitute the missing words with a non-valid BIP39 word when prompted for your recovery phrase.

Eg: For the example command I gave, when prompted for a seed where the 3 last words were missing, you might enter something like "opera tiger stove bus note machine body venue fox X X X" Generally speaking it will take a day or two for current "normal" type of CPU to work through this for the 3 missing words.

I've also got an issue open, and some "proof of concept" code that extends the use of a tokenlist for the seed words themselves, though it's extremely rough and there are a few tasks that are still ahead of that in terms of prioritising the time I can spend working on this.

Best of luck :)

AlexFisun commented 4 years ago

Great! putting X in the posiible seed worked for 1 missed word test. The number of possible options got lowered during ETA calculations. Will try on 3 typos.

AlexFisun commented 4 years ago

Best of luck :)

That didn't work, but I believe its something related to the derivation path or electrum in general. The algorithm is flawlessly works if I test it with iancoleman.io/bip39/ generated seed

BTC recover found missed words during the test.

But somehow if I test my Electrum generated seed, compare iancoleman.io/bip39/ it generates completely different set of addresses.

And sometimes, my test seed from Electrum doesn't match the iancoleman.io/bip39/ requirements

For example for "army conduct above spoon throw sun bind maximum chase prepare retire pattern" it says Invalid mnemonic.

I believe there should be something tiny I missed completely.

Electrum version 3+

Tried seedrecover with Electrum 2.8 option and with Trezor/Jaxx options - no luck.

Any hint?

3rdIteration commented 4 years ago

Riteo, there are a few things at play here.

Firstly, it sounds like the command you are using has an issue if it is generating more than ~8.5 billion possibilities for 3 missing words. Do you mind pasting the command you are using to run seedrecover? (minus any seeds, addresses, etc)

Secondly, Electrum doesn't use standard BIP39 seeds, but rather its own standard. When you are adding a BIP39 seed to Electrum, you need to make sure you select that it is a BIP39 seed. My fork of BTCRecover can handle segwit and native segwit addresses for BIP39 wallets, but I hadn't gotten around to adding that for Electrum segwit wallets. So yea, I guess the question is where did your seed originate, Electrum or from some other BIP39 wallet?

AlexFisun commented 4 years ago

1) Its generating ~8.5BLN everithing is ok with that 2) Originally it is Electrum, should be version 2.8+ or 3+ (the wallet file is fully encrypted) 3) Legacy addresses with 1... (not SegWit)

I knew only BIP39 standard, thought Electrum used the same, but then I discovered other BIPs, deriviation path's etc etc.

So my problems probably are Custom derivation path for Electrum? (I remember there was an opportunity to do that, but cant remember if I used it for this wallet) Electrum fork as a software? Duplicates in seed phrase?

Definitely not: Custom word or symbol in the seed phrase

AlexFisun commented 4 years ago

The only option I have not tried its Electrum 1.x That makes sense since the software on my laptop may be updated.

In case if the standart is different this might work.

AlexFisun commented 4 years ago

Well tried couple things still no luck, I believe the thing is in the derivation path for sure. however, I found a hint on what "m" address might be. Tried --bip32-path"m", doesn't work, is it possible to check "m" address somehow? In this case, other derivation paths don't matter.

Or I would need to check every possible derivation path like m/0, m/0', m/0'/0 and so on. Is there any way to turn on hardened addresses as well?

kfa496 commented 4 years ago

Can I change bip39 list to custom list with reduced words. I have my 2 wallet seed of 24 words each but mixed up in my text file. I just want to search the seed from that 48 words only and not the complete list. Pl advise. I m using windows 10 64bit version

3rdIteration commented 4 years ago

This functionality will be added to the Python3 branch of my fork in the next week or so. The issue that you want to follow is the one here: https://github.com/3rdIteration/btcrecover/issues/5