1

I backed up my wallet.dat using the command as mentioned in the api ref:

bitcoin-cli -rpcport=18332 -rpcuser=user -rpcpassword=password backupwallet "/bitcoin/backup.dat"

I would like to view the backed-up db file using 'DB browser for sqlite' (or any other sqlite browser). However when opening the db file it prompts for the password / key to decrypt the wallet file.

Which password / key is it referring to? When creating the backup I didnt specify any password or key..

enter image description here

leo_cape
  • 43
  • 6
  • Is there any reason you don't use `db_dump` from the Berkeley `db-utils` package? I've used that under Windows-10 by using WSL (Ubuntu) - It can definitely dump an unencrypted Bitcoin `wallet.dat` file. I imagine it might even be easier to install and use `db-utils` under OSX - if that's your operating system. – RedGrittyBrick Mar 08 '21 at 13:49
  • Well the wallet.dat is from an Ubuntu server running Bitcoin-core that I am then opening on the OSX machine after the backup.. I hadn't known about the Berkeley `db-utils` package, can the `db_dump` util be safely run against a live running node? Or could it be run against the already backed up wallet.dat file? – leo_cape Mar 08 '21 at 14:05
  • I ran it against a backed up wallet.dat - not one that was being actively used. – RedGrittyBrick Mar 08 '21 at 14:10
  • Thanks @RedGrittyBrick works well, didn't know this package existed! I guess the wallet.dat is just made up of a 'main' db/schema and the keys inside it, I was hoping to see visually what else was contained in it, but it looks like only keys and some meta – leo_cape Mar 08 '21 at 14:12
  • OK I'll post my comment as an answer – RedGrittyBrick Mar 08 '21 at 14:19
  • wallets only use SQLite in limited circumstances. To make an SQLite wallet run Bitcoin Core version v0.21 or v22.0 then create a new descriptor wallet; https://github.com/bitcoin/bitcoin/blob/9a42b5e/doc/release-notes/release-notes-0.21.0.md#sqlite-database-backend – Dan Nov 22 '21 at 18:59

1 Answers1

1

db_dump

You can use db_dump from the Berkeley db-utils package.

I've used that under Windows-10 by using WSL (Ubuntu) - It can definitely dump an unencrypted Bitcoin wallet.dat file.

The Berkeley DB libraries used by Bitcoin core for the wallet.dat are a key-value store - and the keys used appear to be words like "key" and "keymeta".

As far as I know, the structure (if not simple data types) of the key and value are not known to the DB libraries. I believe applications such as Bitcoin core will often be storing blobs whose contents cannot be dissected by general tools which lack knowledge of the applications' schema. The same observations are likely to apply to sqlite browser

However db_dump output is a worthwhile step up from a hex dump! The -p or -da options may be useful.

SQLite

https://github.com/bitcoin/bitcoin/pull/19077 says

This PR adds a new class SQLiteDatabase which is a subclass of WalletDatabase. This provides access to a SQLite database that is used to store the wallet records. To keep compatibility with BDB and to complexity of the change down, we don't make use of many SQLite's features. We use it strictly as a key-value store. We create a table main which has two columns, key and value both with the type blob.

...

We keep the name wallet.dat for SQLite wallets. We are able to determine which database type to use by searching for specific magic bytes in the wallet.dat file. SQLite begins it's files with a null terminated string SQLite format 3. BDB has 0x00053162 at byte 12 (note that the byte order of this integer depends on the system endianness). So when we see that there is a wallet.dat file that we want to open, we check for the magic bytes to determine which database system to use.

I'm using current Bitcoin core 0.21.0, but the wallet I examined was first generated in 2018 and has the Berkeley DB (BDB) signature. Bitcoin core has not rewritten the file in a newer/different format.

https://github.com/bitcoin/bitcoin/issues/20160 provides a timeline for the phasing out of Berkely DB (which obviously affects the contents of this answer)

Wallet.dat

My brief examination of a wallet.dat backup using a hex-dump suggested that the wallet mostly contains private keys, addresses generated and some sparse metadata about each.

See also

wallet.dat contains your private keys, your address book, a copy of the transactions that send coins from or to one of your addresses, accounts, reserve keys, personal settings, and a pointer to the current best block.

(Note: Bitcoin core's "accounts" feature was deprecated some years ago)

RedGrittyBrick
  • 24,039
  • 3
  • 23
  • 47
  • New wallets are using SQLite, since the OP mentioned it they probably using that so i doubt a Berkeley DB tool would work for their use case – Antoine Poinsot Mar 08 '21 at 14:31
  • @darosier, AIUI Bitcoin core uses different libraries for the wallet file than for the other files. https://github.com/bitcoin/bitcoin/issues/20160 – RedGrittyBrick Mar 08 '21 at 14:33
  • I ran `db_dump` on the already backed up wallet.dat (sqlite) and it did dump some interesting info ie. I the name of the db 'main' and the keys. I guess thats pretty much all there is in the wallet..? Was hoping to see a visual depiction of the db. I haven't marked this answer as correct yet as I still would like to know which password / key the browser is wanting – leo_cape Mar 08 '21 at 14:35
  • @leo: I'd guess it *needs* the password used to encrypt the key values (if you protected the wallet.dat with a password) But I don't know if Bitcoin Core uses some global encryption provided by the DB library or whether it applies its own encryption to the relevant value contents only (I thought it was the latter but don't actually know for sure). I surmise SQlite might be asking for a global DB password which doesn't apply, might be doing so because it is confused or might be doing so because it wants you to decide if one is needed. I'm not familiar with SQlite – RedGrittyBrick Mar 08 '21 at 14:43