satoshi.py

import ecdsa
import ecdsa.ellipticcurve as EC

curve = ecdsa.SECP256k1
x = int('11db93e1dcdb8a016b49840f8c53bc1eb68a382e97b1482ecad7b148a6909a5c', 16)
y = int('b2e0eaddfb84ccf9744464f82e160bfa9b8b64f9d4c03f999b8643f656b412a3', 16)
point = EC.Point(curve.curve, x, y)
pubkey = ecdsa.VerifyingKey.from_public_point(point, curve)

hash1 = 90774958364900180671716888080665726921328827653065727390791155349203800699667

r1 = 97921318692748166969765893503724782362221860890089306445657980140065784098104
s1= 17870770544568028453805091504963125490615703388985597936947183001452377396233

sig = ecdsa.ecdsa.Signature(r1, s1)
if pubkey.pubkey.verifies(hash1, sig):
    print("Good")
else:
    print("Bad")

hash1 = 70438975929202441702137589012525894517177874894451752259863210250765743151652

r1 = 67469108926628898148530592947733862172872496318648607111578457920563549925544
s1= 48322980310687297275040392060954045679965067960426297271026705220954611568793

sig = ecdsa.ecdsa.Signature(r1, s1)
if pubkey.pubkey.verifies(hash1, sig):
    print("Good")
else:
    print("Bad")

@gmaxwell do you have a convenient script for generating these? Would be great to share if possible. :-D (Though I might just write one myself)

Ah, here is Greg's Sage script, running online so anyone can pretend to be Satoshi with the click of a button, no installs needed:
Big long link to sagecell.sagemath.org

####
# Code from Greg Maxwell --- https://bitcoin.stackexchange.com/a/81116
####
F = FiniteField (0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F)
C = EllipticCurve ([F (0), F (7)])
G = C.lift_x(0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798)
N = FiniteField (C.order())
P = P=-C.lift_x(0x11db93e1dcdb8a016b49840f8c53bc1eb68a382e97b1482ecad7b148a6909a5c) # block 9 coinbase payout key.
def forge(c, a=-1):  # Create a forged 'ECDSA'  (hashless) signature
    # set a to something other than -1 to be less obvious
    a = N(a)
    R = c*G + int(a)*P
    s = N(int(R.xy()[0]))/a
    m = N(c)*N(int(R.xy()[0]))/a
    print 'hash1 = %d'%m
    print 'r1 = %d'%(int(R.xy()[0]))
    print 's1 = %d'%s 
for c in range(1,10):
    forge(c)

Detailed proof this is a forgery: https://medium.com/@jimmysong/faketoshis-nonsense-signature-8700a44536b5