Support Keplr v2 wallets

The files of the latest version of the wallet have been updated and therefore the kерlr2john.py script is inactive.
When using it on new files we get the following:

#################################################################################
Users found on the database in the format -> username:$kерlr$saltciphertextmac
#################################################################################
So the script is outdated and not useful at the moment.

The command to execute was completely correct, hash from “john-samples” I received.
python kерlr2john.py “C:\Users\Users\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkkamcknogkgcdfhhbddcghddcghachkejeap”.

We have this in the script:

print('#################################################################################')
print('Users found on the database in the format -> username:$keplr$salt*ciphertext*mac')
print('#################################################################################')
for user in users:
    print(f'{user[0]}:$keplr${user[1]}*{user[2]}*{user[3]}')

Per your report, I assume the users list ends up empty, so only the heading is printed, but no data?

I disagree the script is "not useful at the moment." Perhaps not useful for you, but I guess there are people with older wallets who need password recovery. So I disagree about "obsoleting" the script, and thus have changed the issue's title to be positive.

We're not currently planning to put further effort into Keplr wallet support, so I expect this issue will just hang here documenting the current script's limitations, or in case a new contributor appears later or someone sponsors the effort. That's fine.

Thank you for reporting this!

I'm afraid you need to read some tutorial to help you.

I think this is a misunderstanding. We also had other communication from OP via multiple channels, and it appears that they do have some kind of newer wallet that is not yet supported by us. A confirmation of this would be helpful.

The john-samples sample wallet works fine.

Indeed.

@alainesp

Also tagging @alainesp here, just in case he has comments.

@alainesp

Also tagging @alainesp here, just in case he has comments.

No useful comments, sorry.

hash from “john-samples” I received.

I'm afraid you need to read some tutorial to help you. The john-samples sample wallet works fine.

I downloaded the zip and extracted it to ./john-samples-main/Keplr_Wallet/.

I know that the files from ./john-samples-main/Keplr_Wallet/ work.
I was saying that they won't work with new wallet files. I can provide you with new files to check if you don't believe me.

@akirayamaoka32

@akirayamaoka32 It would be great if you could generate a new empty wallet (that never had any funds in it) and provide us with the files for it, as well as with the known test password. Not because we don't believe, but rather for us to have this recorded as a test case that we can use to test our possible code changes later. Thank you!

@akirayamaoka32

@akirayamaoka32 It would be great if you could generate a new empty wallet (that never had any funds in it) and provide us with the files for it, as well as with the known test password. Not because we don't believe, but rather for us to have this recorded as a test case that we can use to test our possible code changes later. Thank you!

test.zip
Sure

I just took a look. They seem to have merged this v2 stuff from the 2.0/develop branch in one go a year ago. And it looks totally different from what they had before, so we'd need a new extractor script (edit: or implementation of v2 in the same script, just not as a minor change) and a new format. Also, it looks a lot weaker than they had before. Was scrypt at 128 MiB. Now:

https://github.com/chainapsis/keplr-wallet/blob/master/packages/background/src/vault/service.ts

  protected static pbkdf2(
    salt: Uint8Array,
    data: Uint8Array
  ): Promise<Uint8Array> {
    return new Promise<Uint8Array>((resolve, reject) => {
      pbkdf2.pbkdf2(data, salt, 4000, 32, "sha256", (err, derivedKey) => {
        if (err) {
          reject(err);
        } else {
          resolve(new Uint8Array(derivedKey));
        }
      });
    });
  }

if I found the right place, which I'm not sure of. If so, v2 can be efficiently crackable on GPUs, unlike v1.

I am not going to proceed further. Just writing this down for later.

Navigation Menu

Repository navigation

Support Keplr v2 wallets #5481

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Support Keplr v2 wallets #5481

Description

Activity

solardiz commented on May 19, 2024

solardiz commented on May 19, 2024

solardiz commented on May 19, 2024

alainesp commented on May 19, 2024

akirayamaoka32 commented on May 20, 2024

solardiz commented on May 20, 2024

akirayamaoka32 commented on May 20, 2024

solardiz commented on May 21, 2024

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions