pyethrecoverAN INDEPENDENT KEYCHAINX RESOURCEmail@keychainx.io ↗

Home / Lab · Python 3

Lab · Python 3

Classify invented Ethereum JSON shapes

A small, locally runnable Python exercise for recognizing format clues without loading wallet data.

By KeychainX · Published 20 September 2026 · See testing limits in the article

What this exercise does

The four examples are intentionally incomplete. They contain no usable address, encrypted seed or private key. The classifier looks for a handful of fields and reports a tentative category. It cannot prove that a file is a wallet or that its contents are valid.

Run the exercise

This is an original KeychainX exercise using invented data. It runs locally with Python 3 and makes no network requests. Download the script, read it, and run it in a folder used for practice.

Download format_clues.py

python format_clues.py
"""Classify invented JSON shapes. No file input, secrets or network requests.
This is an educational clue finder, not a wallet validator.
"""
samples = {
    "presale-shaped": {"encseed": "NOT-REAL", "ethaddr": "NOT-AN-ADDRESS"},
    "v3-shaped": {"version": 3, "crypto": {"cipher": "aes-128-ctr", "kdf": "scrypt"}},
    "validator-shaped": {"version": 4, "crypto": {"kdf": {}, "checksum": {}, "cipher": {}}},
    "unknown": {"notes": "A filename alone does not identify a wallet"},
}
def clue(d):
    c = d.get("crypto", d.get("Crypto", {}))
    if "encseed" in d and "ethaddr" in d:
        return "presale-like fields; inspect origin"
    if d.get("version") == 3 and isinstance(c, dict) and "cipher" in c and "kdf" in c:
        return "V3-like fields; incomplete evidence"
    if d.get("version") == 4 and isinstance(c, dict) and all(k in c for k in ("kdf", "checksum", "cipher")):
        return "validator-like fields; incomplete evidence"
    return "unknown; preserve and investigate"
for name, sample in samples.items():
    print(name + ": " + clue(sample))
assert clue(samples["unknown"]).startswith("unknown")

Interpret the result carefully

Each named sample should receive the corresponding “like” label, while the unknown object remains unknown. An attacker or a damaged export can contain the same labels. Real identification needs more evidence than this toy classifier checks, including origin and the full format requirements.

Try a controlled failure

Change the invented V3 example’s version to 9. It should fall through to unknown. Remove encseed from the presale-shaped object and run again. A useful classification tool should admit uncertainty when its assumptions no longer hold.

Why there is no upload button

The exercise is designed to teach a method without collecting wallet material. It reads only constants inside the script and writes only category descriptions to your terminal. Do not add a real wallet to a public fork, classroom notebook or shared online interpreter. For an actual backup, begin with the identification guide and the original project’s documentation.

Sources & further reading