keyhunt

Tool for hunt privatekeys for crypto currencies that use secp256k1 elliptic curve

Post: https://bitcointalk.org/index.php?topic=5322040.0

Work for Bitcoin - address compress or uncompress - hashes rmd160 compress or uncompress - publickeys compress or uncompress

Work for Ethereum - address

TL:DR

• Download and build
• Run against puzzle 66 (address mode)

./keyhunt -m address -f tests/66.txt -b 66 -l compress -R -q -s 10

You need to add -t numberThreads to get better speed

• Run against Puzzle 125 (bsgs mode)

./keyhunt -m bsgs -f tests/125.txt -b 125 -q -s 10 -R

You need to add -t numberThreads and -k factor to get better speed

Free Code

This code is free of charge, see the licence for more details. https://github.com/albertobsd/keyhunt/blob/main/LICENSE

Although this project is a hobby for me, it still involves a considerable amount of work. If you would like to support this project, please consider donating at https://github.com/albertobsd/keyhunt#donations.

Disclaimer

I made this tool as a generic tool for the Puzzles. I recommend to everyone to stay in puzzles

Several of users request me to add support for ethereum and minikeys, I did it. But again i recommend only use this program for puzzles.

For regular users

Please read the CHANGELOG.md to see the new changes

Download and build

This program was made in a linux environment. if you are windows user i strongly recommend to use WSL enviroment on Windows. it is available in the Microsoft store

Please install on your system

• git
• build-essential

for legacy version also you are going to need:

• libssl-dev
• libgmp-dev

On Debian based systems, run this commands to update your current enviroment and install the tools needed to compile it

apt update && apt upgrade
apt install git -y
apt install build-essential -y
apt install libssl-dev -y
apt install libgmp-dev -y

To clone the repository

git clone https://github.com/albertobsd/keyhunt.git

don't forget change to the keyhunt directory (But i'm not here to teach you linux commands)

cd keyhunt

First compile:

make

if you have problems compiling the main version you can compile the legacy version

make legacy

and then execute with -h to see the help

./keyhunt -h

¡Beta!

This version is still a beta version, there are a lot of things that can be fail or improve. This version also could have some bugs. please report it.

Modes

Keyhunt can work in diferent ways at different speeds.

The current availables modes are: - address - rmd160 - xpoint - bsgs

Experimental modes

• minikeys
• pub2rmd

address mode

This is the most basic approach to work, in this mode your text file need to have a list of the publicaddress to be search.

Example of address from solved puzzles, this file is already on the repository tests/1to32.txt

1BgGZ9tcN4rm9KBzDn7KprQz87SZ26SAMH
1CUNEBjYrCn2y1SdiUMohaKUi4wpP326Lb
...

To target that file we need to execute keyhunt with this line

./keyhunt -m address -f tests/1to32.txt -r 1:FFFFFFFF

output:

[+] Version 0.2.230430 Satoshi Quest, developed by AlbertoBSD
[+] Mode address
[+] Setting search for btc adddress
[+] N = 0x100000000
[+] Range
[+] -- from : 0x1
[+] -- to   : 0xffffffff
[+] Allocating memory for 32 elements: 0.00 MB
[+] Bloom filter for 32 elements.
[+] Loading data to the bloomfilter total: 0.03 MB
[+] Sorting data ... done! 32 values were loaded and sorted
Base key: 1
Hit! Private Key: 1
pubkey: 0279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798
Address 1BgGZ9tcN4rm9KBzDn7KprQz87SZ26SAMH
rmd160 751e76e8199196d454941c45d1b3a323f1433bd6

Hit! Private Key: 3
pubkey: 02f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9
Address 1CUNEBjYrCn2y1SdiUMohaKUi4wpP326Lb
rmd160 7dd65592d0ab2fe0d0257d571abf032cd9db93dc

Hit! Private Key: 7
pubkey: 025cbdf0646e5db4eaa398f365f2ea7a0e3d419b7e0330e39ce92bddedcac4f9bc
Address 19ZewH8Kk1PDbSNdJ97FP4EiCjTRaZMZQA
rmd160 5dedfbf9ea599dd4e3ca6a80b333c472fd0b3f69
(Output omitted)

In this mode you can specify to seach only address compressed or uncompressed with -l compress or -l uncompress

Test your luck with the random parameter -R againts the puzzle #66

./keyhunt -m address -f tests/66.txt -b 66 -l compress -R -q -s 10

Please note the change from -r 1:FFFFFFFF to -b 66, with -b you can specify the bit range

output:

[+] Version 0.2.230430 Satoshi Quest, developed by AlbertoBSD
[+] Mode address
[+] Search compress only
[+] Random mode
[+] Quiet thread output
[+] Stats output every 10 seconds
[+] Setting search for btc adddress
[+] N = 0x100000000
[+] Bit Range 66
[+] -- from : 0x20000000000000000
[+] -- to   : 0x40000000000000000
[+] Allocating memory for 1 elements: 0.00 MB
[+] Bloom filter for 1 elements.
[+] Loading data to the bloomfilter total: 0.03 MB
[+] Sorting data ... done! 1 values were loaded and sorted
^C] Total 47634432 keys in 10 seconds: ~4 Mkeys/s (4763443 keys/s)

vanity search.

To search only one vanity address is with 1Good1 or with 1MyKey use the next command

full command

./keyhunt -m vanity -l compress -R -b 256 -v 1Good1 -v 1MyKey

output:

[+] Version 0.2.230430 Satoshi Quest, developed by AlbertoBSD
[+] Mode vanity
[+] Search compress only
[+] Random mode
[+] Added Vanity search : 1Good1
[+] Added Vanity search : 1MyKey
[+] N = 0x100000000
[+] Bit Range 256
[+] -- from : 0x8000000000000000000000000000000000000000000000000000000000000000
[+] -- to   : 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141
[+] Bloom filter for 4 elements.
[+] Loading data to the bloomfilter total: 0.03 MB
Base key: a5247120867e8d57b8908b0d962df84a924cba7f684903e2c942574353520a03
Vanity Private Key: 5adb8edf798172a8476f74f269d207b42862226746ff9c58f69007497c0d7516
pubkey: 0273267f9764b022bb462b359a12917dbb3568e4e6cd3aa2e846b8c1d9cae0363a
Address 1Good1mjxXjNqb8TucvKjyCuZfihMZgFcc
rmd160 ad63f02cb68254ce12982e5e312bd51e8a239a84

command to search multiple vanity addresses from a file -f filename.txt.

./keyhunt -m vanity -f ~/main/keyhunt/vanitytargets.txt -l compress -R -b 256 -e -s 10 -q 

Output:

[+] Version 0.2.230430 Satoshi Quest, developed by AlbertoBSD
[+] Mode vanity
[+] Search compress only
[+] Random mode
[+] Endomorphism enabled
[+] Stats output every 10 seconds
[+] Quiet thread output
[+] N = 0x100000000
[+] Bit Range 256
[+] -- from : 0x8000000000000000000000000000000000000000000000000000000000000000
[+] -- to   : 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141
[+] Bloom filter for 225 elements.
[+] Loading data to the bloomfilter total: 0.03 MB
^C] Total 58202112 keys in 10 seconds: ~5 Mkeys/s (5820211 keys/s)

All the vanity address and his privatekeys will be saved in the file VANITYKEYFOUND.txt of your current directory

rmd160 mode

rmd stands for RIPE Message Digest (see https://en.wikipedia.org/wiki/RIPEMD )

mode rmd160 work in the same way than address, but the diference is that file need to have hash rmd160 instead of addresses.

example file tests/1to32.rmd :

751e76e8199196d454941c45d1b3a323f1433bd6
7dd65592d0ab2fe0d0257d571abf032cd9db93dc
5dedfbf9ea599dd4e3ca6a80b333c472fd0b3f69
9652d86bedf43ad264362e6e6eba6eb764508127
...

to target that file you need to execute the next line:

./keyhunt -m rmd160 -f tests/1to32.rmd -r 1:FFFFFFFF -l compress -s 5

output:

[+] Version 0.2.230430 Satoshi Quest, developed by AlbertoBSD
[+] Mode rmd160
[+] Search compress only
[+] N = 0x100000000
[+] Range
[+] -- from : 0x1
[+] -- to   : 0xffffffff
[+] Allocating memory for 32 elements: 0.00 MB
[+] Bloom filter for 32 elements.
[+] Loading data to the bloomfilter total: 0.03 MB
[+] Sorting data ... done! 32 values were loaded and sorted
Base key: 1
Hit! Private Key: 1
pubkey: 0279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798
Address 1BgGZ9tcN4rm9KBzDn7KprQz87SZ26SAMH
rmd160 751e76e8199196d454941c45d1b3a323f1433bd6

Hit! Private Key: 3
pubkey: 02f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9
Address 1CUNEBjYrCn2y1SdiUMohaKUi4wpP326Lb
rmd160 7dd65592d0ab2fe0d0257d571abf032cd9db93dc
(Output omitted)

test your luck with the next file for the puzzle #66

./keyhunt -m rmd160 -f tests/66.rmd -b 66 -l compress -R -q

Output:

[+] Version 0.2.230430 Satoshi Quest, developed by AlbertoBSD
[+] Mode rmd160
[+] Search compress only
[+] Random mode
[+] Quiet thread output
[+] Stats output every 5 seconds
[+] N = 0x100000000
[+] Bit Range 66
[+] -- from : 0x20000000000000000
[+] -- to   : 0x40000000000000000
[+] Allocating memory for 1 elements: 0.00 MB
[+] Bloom filter for 1 elements.
[+] Loading data to the bloomfilter total: 0.03 MB
[+] Sorting data ... done! 1 values were loaded and sorted
^C] Total 70844416 keys in 15 seconds: ~4 Mkeys/s (4722961 keys/s)

xpoint mode

This method can target the X value of the publickey in the same way that the tool search for address or rmd160 hash, this tool can search for the X values

The speed for this method is better than the speed for address or rmd160

The input file can had one publickey per line compress or uncompress:

• Publickey Compress (66 hexcharacters)
• Publickey Uncompress (130 hexcharacters)

Example input file:

A few substracted values from puzzle 40

034eee474fe724cb631d19f24934e88016e4ef2aee80d086621d87d7f6066ff860 # - 453856235784
0274241b684e7c31e7933510b510aa14de9ac88ec3635bdd35a3bcf1d16da210be # + 453856235784
03abc6aff092b9a64bf69e00f4ec7a8b7ca51cfc6656732cbbc9f5674925b88609 # - 529328067324
034f4fe33b02c202b732d278f90eedc635af6f3be8a93c8d1cb0a01f6399aab2a4 # + 529328067324
03716ff57705e6446ac3e217c8c8bd9e9c8e58547457a6fe93ac254c37fd48afcb # - 14711740067
02ffa0769b0459c64b41f59f93495063ae031de0b846180bee37f921f20e141f60 # + 14711740067
03de1df5d801bbd5e7d86577bf14950f732fd41e586945d06d19e0fdea41a37d62 # - 549755814000
038d3711fd681e26c05b2f0cd423fa596e15054024e40add24a93bfa0c630531f1 # + 549755814000
03a2efa402fd5268400c77c20e574ba86409ededee7c4020e4b9f0edbee53de0d4 # target

Now you can use keyhunt against some thousand values of the puzzle 40:

./keyhunt -m xpoint -f tests/substracted40.txt -n 65536 -t 4 -b 40

Output:

[+] Version 0.2.230430 Satoshi Quest, developed by AlbertoBSD
[+] Mode xpoint
[+] Threads : 4
[+] N = 0x10000
[+] Bit Range 40
[+] -- from : 0x8000000000
[+] -- to   : 0x10000000000
[+] Allocating memory for 6003 elements: 0.11 MB
[+] Bloom filter for 6003 elements.
[+] Loading data to the bloomfilter total: 0.03 MB
[+] Sorting data ... done! 6003 values were loaded and sorted
Base key: 80025b0000
Hit! Private Key: 800258a2ce
pubkey: 0474241b684e7c31e7933510b510aa14de9ac88ec3635bdd35a3bcf1d16da210be7ad946c9b185433fff3a7824ee140b15789d5f12d60cd2814154b0f8f1a4308e
Address 1CMg4mukBGVvid4ocTx5x5LEuCatKoHQRB
rmd160 7c92500fa9d2ecbca5bdd61bb6a14a249669bae4

After the hit we need to search the substracted index and make a simple math operation to get the real privatek:

0274241b684e7c31e7933510b510aa14de9ac88ec3635bdd35a3bcf1d16da210be # + 453856235784

The Operation is 800258a2ce hex (+/-) in this case + 453856235784 decimal equals to E9AE4933D6

This is an easy example, I been trying the puzzle 120 with more than 500 millions of substracted keys and no luck.

Test you luck with the puzzle 120 with xpoint:

./keyhunt -m xpoint -f tests/120.txt -t 4 -b 125 -R -q

Output:

[+] Version 0.2.230430 Satoshi Quest, developed by AlbertoBSD
[+] Mode xpoint
[+] Threads : 4
[+] Random mode
[+] Quiet thread output
[+] N = 0x100000000
[+] Bit Range 125
[+] -- from : 0x10000000000000000000000000000000
[+] -- to   : 0x20000000000000000000000000000000
[+] Allocating memory for 1 elements: 0.00 MB
[+] Bloom filter for 1 elements.
[+] Loading data to the bloomfilter total: 0.03 MB
[+] Sorting data ... done! 1 values were loaded and sorted
^C] Total 462885888 keys in 30 seconds: ~15 Mkeys/s (15429529 keys/s)

Endomorphism

To enable endomorphism use -e

endomorphism is only enabled for address, rdm160 , vanity and xpoint

But what the heck is Endomorphism?

In few words for elliptic curves, an endomorphism is a function that maps points on the curve to other points on the same curve.

One kind of Endomorphism is the Point negation by example the privatekey from puzzle 64

000000000000000000000000000000000000000000000000f7051f27b09112d4 publickey 03100611c54dfef604163b8358f7b7fac13ce478e02cb224ae16d45526b25d9d4d if we negated that private or publickey we get:

fffffffffffffffffffffffffffffffebaaedce6af48a03ac8cd3f651fa52e6d publickey 02100611c54dfef604163b8358f7b7fac13ce478e02cb224ae16d45526b25d9d4d

But if we negated this last value we get again the first value.

There are some special values lambda y beta

lambda = 0x5363ad4cc05c30e0a5261c028812645a122e22ea20816678df02967c1b23bd72
beta = 0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee

For every privatekey K and its Point Q where Q = GK

Q = (x,y)

We can multuply Q by lambda example:

Q * lambda = (x * beta mod p , y)
Q*lambda is a Scalar Multiplication
x*beta is just a Multiplication (Very fast

p is 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F

Example puzzle 64

0x000000000000000000000000000000000000000000000000f7051f27b09112d4 publickey 03100611c54dfef604163b8358f7b7fac13ce478e02c