I'm tracing transactions, which means I need to see the addresses the coins came from; addresses that are empty now, because of those transactions.
When I want to see a list of receiving and change addresses and all I have is the xpub key, I use this code:
var bitcore = require('bitcore-lib');
function showPubKeys(derivedHdPublicKey, n) {
function scanAddressesInternal(change, index) {
var path = "m/" + change + "/" + index;
var derivedPublicKey = derivedHdPublicKey.derive(path).publicKey;
var address = derivedPublicKey.toAddress().toString();
console.log(path, address, derivedPublicKey.toString());
if (index < n)
scanAddressesInternal(change, index+1);
else if (change < 1) {
console.log();
scanAddressesInternal(change + 1, 0);
}
}
scanAddressesInternal(0, 0);
}
showPubKeys(new bitcore.HDPublicKey('xpub6EE1LEbg1qzEG2xbeuCkHaoj2Gjw6fFqwbuEgedA4aPsREfNcX4h4QyPDKTfd9u97YoiJZwRND5KdzucmEdChpHCdk4hXfwqrJzqAnEvk45'), 5);
It produces output like this:
m/0/0 1NqppWsUkWYNLyxDcY7BATBXpwpatTiGSs 033ca772878871c94b3c41dd622c557a527880f4117e4f27e3bce154970416eead
m/0/1 15qwh7PCqyzVzuWWK4cEmiweBC7Bc922EA 0395db6c339db554e52b1879b712a6ecaedbfd924efc5260bf862cc2ec62c01aa1
m/0/2 1KY3KNnegroZXwYQvmvGJnLeiPqibPRdXr 02e39a87bbf7fd25d5ae7690ee4947c7559a21bb02695e3841b68f3be1d3103dcc
m/0/3 1M9cpQUqpkmmgTNVLbBPku8KRFsHAMJp3m 020dda02bc7dfb95bb8cb6ef04eaa1e0b34772a43547d81453bbe0c25bd52488c0
m/0/4 12uJA9VkzqgKRXu9P32gQWLYWsTkdR1zVe 03874b84816d6217719291b2938d4c58ba07f66e06204df5df82b3e13c08b42071
m/0/5 14nJrV8jHDWQvZXTmpTrL3423vHcdZwtNH 03af8229fda029a8420835f35199d867d28bd84cf9fffecead4c80ed602fc0cb8f
m/1/0 17Ua81hyD4LN5HXYMp7j37uu1jgUnPUxqD 02122c95e12b17707daf55e42a02001b7e38ef1f2591a3ecf2e5a3790e8cae4daf
m/1/1 16DP4hGyTVmL1ptynFW2WFMAhkwRKPztcg 023a7cbba6b2547055f90c717aed33233182bfea988c8684203e37c5b80db455c4
m/1/2 17USGbfLDPas8vte9Dcp5Fie59KDyiyBiH 02e964dc39395c81698e02bdd7cdadacdf3e02ea1dd605cfc01c579b50cd3d75e9
m/1/3 1MVq5RPH6qyiNRkWmwGp6dbzaMzdRMnjhY 036d23fbad3ce2046d4e56effd9cd240f851b471e403038533eeb55b0b7948efcb
m/1/4 17a25svx3fY7B2H1QLuyLbZWoBfr4HkBEv 02bf5e9779c1ea7a07b8e654c6dcb0139055babf3accb6d553a321f50a2a0a893c
m/1/5 1Amwk2eU1uYboAyZ91118T3Dzwb1DFv4pZ 020ae7bfcb2f2819502411145f430c5adc67a1fce807ed0ac4a6aacfc5f70ef805
That's the derivation path, the address, and the pubkey.
It uses bitcore from bitpay, which is open source software, available here:
https://bitcore.io/