Deep Analysis of P2P--BT Seeds

Http://www.cnblogs.com/moonflow/archive/2012/04/21/2461666.html

During the protocol analysis of popular software, I learned from the mentor that the FSP file is a seed file, and its structure is a common BT seed structure (. torrent), we also learned that the current device's rule blocking mainly uses the process of blocking requests ls3.fspcdn.com to download FSP seeds.

After nsfocus, I analyzed a lot of P2P software, such as qvod and the popularity of BitTorrent. Here I am very interested in developing a BT download software (for Linux, and may be developed for win edition ).

I will constantly add the BT log here, and finally complete the software version. In the future, we will have our own reverse analysis articles on these software. This provides a deep understanding of P2P software analysis.

 

The first is BT seed Resolution:

The BT seed file uses a bencoding encoding method to save data.

There are four types of bencoding data: srings (string), integers (integer), lists (list), dictionaries (dictionary)

The encoding rules are as follows:
Strings (string) encoding: <String Length >:< string>
For example, 4: test indicates the string "test"

4: The example is the string "example"

String Length in bytes

No start or end mark

Integers (integer) is encoded as: I <integer> E

Start to mark I, end to Mark E

For example, i1234e indicates an integer of 1234.

I-1234e represents an integer-1234

No integer size limit

I0e is an integer of 0.

Illegal i-0e

The value starting with 0 is invalid. For example, the value of i01234e is invalid.

The lists (list) encoding is: le

Start to L, end to E

The list can contain any bencoding encoding type, including integers, strings, lists, and dictionaries.

For example, L4: test5: abcdee represents two strings ["test", "ABCDE"]

Dictionaries (dictionary) is encoded as de

Mark start as D and end as E

The keyword must be a bencoding string.

The value can be of any bencoding encoding type.

For example, D3: agei20ee indicates

D4: path3: C: filename8: test.txt E: {"path" = "C: \", "FILENAME" = "test.txt "}

The file structure is as follows:

All content must be of the bencoding encoding type.

The entire file is a dictionary structure that contains the following keywords:

Announce: the URL of the tracker server (string)

Announce-List (optional): List of backup tracker servers (list)

Creation date (optional): Specifies the seed creation time. It is a UNIX standard time format. The number of seconds from 00:00:00, January 1, 1970 to the creation time (integer)

Comment (optional): Remarks (string)

Created by (optional): Information of the creator or program (string)

Info: a dictionary structure that contains the main information of a file. There are two types of information: single file structure or multi-file structure.

The structure of a single file is as follows:

Length: file length, in bytes (integer)

Md5sum (optional): MD5 checksum of a 32-character file. BT does not use this value, but it is reserved for compatibility with some programs! (String)

Name: File Name (string)

Piece length: the size of each block, in bytes (integer)

Pieces: The sha1 hash value of 20 bytes for each block (in binary format)

The structure of multiple files is as follows:

Files: a dictionary structure

Length: file length, in bytes (integer)

Md5sum (optional): same as that in the single file structure

Path: the path and name of the file. It is a list structure, for example, \ test \ test.txt. The list is L4: test8test.txt E.

Name: the name of the top-level directory (string)

Piece length: same as in a single file structure

Pieces: same as in the single file structure

Instance:

Use NotePad to open a. torrent file.

D8: announce35: http://www.manfen.net: 7802/announce13: Creation datei000066750000e4: infod6: lengthi17799e4: name62: MICROSOFT.WINDOWS.2000.AND.NT4.SOURCE.CODE-SCENELEADER. tor000012: piece lengthi32768e6: pieces20 :? W? Why? Snapshot row T snapshot EE

It is easy to see

Announce = http://www.manfen.net: 7802/announce

Creation date = 1076675108 seconds (02/13/04 20:25:08)

File name = MICROSOFT.WINDOWS.2000.AND.NT4.SOURCE.CODE-SCENELEADER. torrent

File size = 17799 bytes

File block size = 32768 bytes