<p>Each entry in the new 0.15 format is defined as <code>outpoint:coin</code>, and has the following structure:</p>

<p><strong>Outpoint</strong> is formed by: <code>key | tx_hash | index</code>.</p>

<p>Where the <code>key</code> corresponds to <code>b'C'</code>, or <code>43</code> in hex. The <code>transaction hash</code> in encoded in Little endian, and the <code>index</code>
    is a <code>base128 varint</code>. The corresponding Bitcoin Core source code can be found <a href="https://github.com/bitcoin/bitcoin/blob/ea729d55b4dbd17a53ced474a8457d4759cfb5a5/src/txdb.cpp#L40-L53" rel="nofollow noreferrer">here</a>.</p>

<p>On the other hand, a <strong>coin</strong> is formed by: <code>code | value | out_type | script</code>.</p>

<p>Where <code>code</code> encodes the block height and whether the transaction is coinbase or not, as <code>2*height + coinbase</code>, the <code>value</code> is a <code>txout compressed base128 varint</code>, the <code>out_type</code> is also a <code>base128 varint</code>, and the <code>script</code> is the remaining data. The corresponding Bitcoin Core source code can be found <a href="https://github.com/bitcoin/bitcoin/blob/6c4fecfaf7beefad0d1c3f8520bf50bb515a0716/src/coins.h#L58-L64" rel="nofollow noreferrer">here</a>.</p>

<p>Version 0.15 still used an obfuscation key to avoid triggering anti-virus software, you can check <a href="https://bitcoin.stackexchange.com/a/52167/30668">this answer</a> to know how it is stored in the database and how to use it to de-obfuscate you data.</p>

<p>Finally, if you need a decoder for both versions 0.14 (0.8-0.14) and the new 0.15 format, you can check this <a href="https://github.com/sr-gi/bitcoin_tools/tree/dev" rel="nofollow noreferrer">GitHub repo</a> (particularly functions <code>decode_utxo</code> and <code>decode_utxo_v08_v014</code> from <a href="https://github.com/sr-gi/bitcoin_tools/blob/dev/bitcoin_tools/analysis/status/utils.py" rel="nofollow noreferrer">utils.py</a>).</p>

<p>Disclaimer: I'm the author of the repo.</p>

CC BY-SA 3.0
2017-11-04T10:51:41.010Z
I parsed **Key**, But with **Value** i have a problem. Question updated
Ninazu
CC BY-SA 3.0
2017-11-04T15:25:17.290Z
What's the problem?
sr_gi
CC BY-SA 3.0
2017-11-04T15:53:04.370Z
There can be still something? Data does not converge. In question i try parse example from db. I get txhash and index from **outpoint**. https://blockchain.info/tx/e5183c857cc18a9d009aba93432ae5ac93ea07dedb53daf3293a71f3dc000000?format=json. But any other fields in **coin** invalid. The simplest field is the script, since it remains unchanged. I cant find any part of script in transaction
Ninazu
CC BY-SA 3.0
2017-11-04T15:54:51.993Z
For what I see, the coin and the outpoint you are giving as example do not match. The corresponding coin for '43000000dcf3713a29f3da53dbde07ea93ace52a4393ba9a009d8ac17c853c18e500' is 'bafe78849575007b8268c6115b707d17cccfdf9be636467a80f9e4'. Either way, the data you have decoded in your updated question match with the coin you provided, but since the coin seems not to be correct, the parsing goes wrong at the end.
sr_gi
CC BY-SA 3.0
2017-11-04T17:14:36.660Z
Very strange. I wait full synced of my wallet and double checked value for **43000000dcf3713a29f3da53dbde07ea93ace52a4393ba9a009d8ac17c8‌** in two different leveldb driver https://github.com/syndtr/goleveldb and https://github.com/golang/leveldb and my value still is **D42ADE0DFD6A93B6ECBC6098336FEEDAA21B79128E29D5B7EE2D42**. Data is somehow compressed, encrypted? Is the database unique for each node?
Ninazu
CC BY-SA 3.0
2017-11-04T17:31:00.630Z
I've update the answer with information about the obfuscation key and links to a repo with tools for utxo set decoding.
sr_gi
CC BY-SA 3.0
2017-11-05T13:41:48.520Z
Thx! Obfuscation key - i confused. What's the point in this? This is simply XOR who stored in this db.
Ninazu
CC BY-SA 3.0
2017-11-05T14:33:42.987Z
The chainstate use to trigger some anti-virus software in windows systems, by XORing the information the signature of the data changes and there is no more false positive with AV.
sr_gi
CC BY-SA 3.0
2017-11-13T13:53:12.580Z
I followed your instructions and successfully decoded all but the script part:
`TxID: e5183c857cc18a9d009aba93432ae5ac93ea07dedb53daf3293a71f3dc000000
DecodedValue: bafe78849575007bba135794915ad83d8f25cbd406b9c92b52963a
Code: 983032
Height: 491516
Amount: 942800 (84853)
OutType: 0 (P2PKH)
Script: 7bba135794915ad83d8f25cbd406b9c92b52963a`
The actual hash160 must be 7b8268c6115b707d17cccfdf9be636467a80f9e4
Is the script encoded somehow?
Andrey Dzhukov
CC BY-SA 3.0
2017-11-13T17:32:43.290Z
How are you getting `7bba135794915ad83d8f25cbd406b9c92b52963a`? That's the response I'm getting: `{'coinbase': 0, 'tx_id': '000000dcf3713a29f3da53dbde07ea93ace52a4393ba9a009d8ac17c853c18e5', 'height': 491516, 'outs': [{'amount': 942800, 'out_type': 0, 'data': '7b8268c6115b707d17cccfdf9be636467a80f9e4'}], 'index': 0}`
sr_gi
CC BY-SA 3.0
2017-11-03T21:12:37.150Z
2017-11-04T17:29:42.643Z
2017-11-04T17:29:42.643Z
sr_gi
<p>After update Bitcoin Core to version 0.15, chainstate database changed format of data. </p>

<p>Old prefix of key has been <strong>0x63</strong>, now <strong>0x43</strong>, and key/value are different</p>

<p>Where is the new format described, or can someone have work on this?</p>

<p><em>UPDATED</em></p>

<p><strong>Sample</strong></p>

<p>Key:</p>

<pre><code>43000000dcf3713a29f3da53dbde07ea93ace52a4393ba9a009d8ac17c853c18e500
</code></pre>

<p>Value:</p>

<pre><code>d42ade0dfd6a93b6ecbc6098336feedaa21b79128e29d5b7ee2d42
</code></pre>

<hr>

<p>Prefix BYTE:</p>

<pre><code>0x43
</code></pre>

<p>TransactionId:</p>

<pre><code>e5183c857cc18a9d009aba93432ae5ac93ea07dedb53daf3293a71f3dc000000
</code></pre>

<p>Index VARINT:</p>

<pre><code>0x00 -&gt; 0x00(0)
</code></pre>

<hr>

<p>Code VARINT:</p>

<pre><code>0xD42A -&gt; 0x2AAA(10922)
</code></pre>

<hr>

<p>Block Height:</p>

<pre><code>Code &gt;&gt; 1 = 0x1555(5461)
</code></pre>

<p>Is Coinbase:</p>

<pre><code>Code &amp; 1 = 0x00(0)
</code></pre>

<hr>

<p>Value VARINT:</p>

<pre><code>0xDE0D -&gt; 0x2F8D(12173) -&gt; decompressMSB128 -&gt; 0x21084(135300)
</code></pre>

<p>Type VARINT:</p>

<pre><code>0xFD6A -&gt; 0x3F6A(16234)
</code></pre>

CC BY-SA 3.0
2017-12-29T05:17:14.610Z
If you want to find UTXOs, I find scanning the blockchain to be a better option: https://bitcoin.stackexchange.com/a/65083/2075
Jus12
<bitcoin-core><database><raw-data>
UXTO DB structure
Ninazu
# UXTO DB structure

(Asked by: username_0 on 2017-11-03)

After update Bitcoin Core to version 0.15, chainstate database changed format of data.

Old prefix of key has been **0x63**, now **0x43**, and key/value are different

Where is the new format described, or can someone have work on this?

*UPDATED*

**Sample**

Key:

```
43000000dcf3713a29f3da53dbde07ea93ace52a4393ba9a009d8ac17c853c18e500

```

Value:

```
d42ade0dfd6a93b6ecbc6098336feedaa21b79128e29d5b7ee2d42

```

---

Prefix BYTE:

```
0x43

```

TransactionId:

```
e5183c857cc18a9d009aba93432ae5ac93ea07dedb53daf3293a71f3dc000000

```

Index VARINT:

```
0x00 -> 0x00(0)

```

---

Code VARINT:

```
0xD42A -> 0x2AAA(10922)

```

---

Block Height:

```
Code >> 1 = 0x1555(5461)

```

Is Coinbase:

```
Code & 1 = 0x00(0)

```

---

Value VARINT:

```
0xDE0D -> 0x2F8D(12173) -> decompressMSB128 -> 0x21084(135300)

```

Type VARINT:

```
0xFD6A -> 0x3F6A(16234)

```

**Tags:** bitcoin-core, database, raw-data

> **Comments:**
> **username_1**: If you want to find UTXOs, I find scanning the blockchain to be a better option: https://bitcoin.stackexchange.com/a/65083/2075  

---

## 1 answers

### Answer by username_2 on 2017-11-03. Score: 6 | Accepted answer

Each entry in the new 0.15 format is defined as `outpoint:coin`, and has the following structure:

**Outpoint** is formed by: `key | tx_hash | index`.

Where the `key` corresponds to `b'C'`, or `43` in hex. The `transaction hash` in encoded in Little endian, and the `index`
is a `base128 varint`. The corresponding Bitcoin Core source code can be found [here](https://github.com/bitcoin/bitcoin/blob/ea729d55b4dbd17a53ced474a8457d4759cfb5a5/src/txdb.cpp#L40-L53).

On the other hand, a **coin** is formed by: `code | value | out_type | script`.

Where `code` encodes the block height and whether the transaction is coinbase or not, as `2*height + coinbase`, the `value` is a `txout compressed base128 varint`, the `out_type` is also a `base128 varint`, and the `script` is the remaining data. The corresponding Bitcoin Core source code can be found [here](https://github.com/bitcoin/bitcoin/blob/6c4fecfaf7beefad0d1c3f8520bf50bb515a0716/src/coins.h#L58-L64).

Version 0.15 still used an obfuscation key to avoid triggering anti-virus software, you can check [this answer](https://bitcoin.stackexchange.com/a/52167/30668) to know how it is stored in the database and how to use it to de-obfuscate you data.

Finally, if you need a decoder for both versions 0.14 (0.8-0.14) and the new 0.15 format, you can check this [GitHub repo](https://github.com/username_2/bitcoin_tools/tree/dev) (particularly functions `decode_utxo` and `decode_utxo_v08_v014` from [utils.py](https://github.com/username_2/bitcoin_tools/blob/dev/bitcoin_tools/analysis/status/utils.py)).

Disclaimer: I'm the author of the repo.

> **Comments:**
> **username_0**: I parsed **Key**, But with **Value** i have a problem. Question updated  
> **username_2**: What's the problem?  
> **username_0**: There can be still something? Data does not converge. In question i try parse example from db. I get txhash and index from **outpoint**. https://blockchain.info/tx/e5183c857cc18a9d009aba93432ae5ac93ea07dedb53daf3293a71f3dc000000?format=json. But any other fields in **coin** invalid. The simplest field is the script, since it remains unchanged. I cant find any part of script in transaction  
> **username_2**: For what I see, the coin and the outpoint you are giving as example do not match. The corresponding coin for '43000000dcf3713a29f3da53dbde07ea93ace52a4393ba9a009d8ac17c853c18e500' is 'bafe78849575007b8268c6115b707d17cccfdf9be636467a80f9e4'. Either way, the data you have decoded in your updated question match with the coin you provided, but since the coin seems not to be correct, the parsing goes wrong at the end.  
> **username_0**: Very strange. I wait full synced of my wallet and double checked value for **43000000dcf3713a29f3da53dbde07ea93ace52a4393ba9a009d8ac17c8‌** in two different leveldb driver https://github.com/syndtr/goleveldb and https://github.com/golang/leveldb and my value still is **D42ADE0DFD6A93B6ECBC6098336FEEDAA21B79128E29D5B7EE2D42**. Data is somehow compressed, encrypted? Is the database unique for each node?  
> **username_2**: I've update the answer with information about the obfuscation key and links to a repo with tools for utxo set decoding.  
> **username_0**: Thx! Obfuscation key - i confused. What's the point in this? This is simply XOR who stored in this db.  
> **username_2**: The chainstate use to trigger some anti-virus software in windows systems, by XORing the information the signature of the data changes and there is no more false positive with AV.  
> **username_3**: I followed your instructions and successfully decoded all but the script part: `TxID: e5183c857cc18a9d009aba93432ae5ac93ea07dedb53daf3293a71f3dc000000 DecodedValue: bafe78849575007bba135794915ad83d8f25cbd406b9c92b52963a Code: 983032 Height: 491516 Amount: 942800 (84853) OutType: 0 (P2PKH) Script: 7bba135794915ad83d8f25cbd406b9c92b52963a` The actual hash160 must be 7b8268c6115b707d17cccfdf9be636467a80f9e4 Is the script encoded somehow?  
> **username_2**: How are you getting `7bba135794915ad83d8f25cbd406b9c92b52963a`? That's the response I'm getting: `{'coinbase': 0, 'tx_id': '000000dcf3713a29f3da53dbde07ea93ace52a4393ba9a009d8ac17c853c18e5', 'height': 491516, 'outs': [{'amount': 942800, 'out_type': 0, 'data': '7b8268c6115b707d17cccfdf9be636467a80f9e4'}], 'index': 0}`  

---

