qBittorrent 4.5.1

[Annabella]

As of version 4.0.4, this client uses an individual peer_id, so it's okay to run both RatioMaster Plus and qBittorrent at the same time. As of version 4.3.0, anonymous mode has no effect on announce requests for private torrents, so enabling it shouldn't be a detection vector.

This client emulates the following settings, so make sure your real qBittorrent 4.5.1 also uses them:

Encryption mode: Allow encryption
Optional IP address to bind to: All addresses

[anon]

Client file had invalid reserved bytes (0x100005, correct value is 0x180005). The attachment has been fixed.

[Annabella]

Thank you for the correction ! :top:

Very rarely, I would sometimes get an error in the « General Memory Reader » only on the first line. (See Att.)

Most of the time, this detection error for the name was because there was a special character (so special that it was not recognized and displayed as an empty square) in it.

This name was also often a little longer than usual.

For example, « -qB4510-frliYd » was found, but « -qB4510-frliYdF□pp□q » was not.

I thought that this was probably due to the PeerID RegEx [-qB4510-[0-9a-zA-Z-._~!*()]{12}], but I didn't want to change the RegEx. :fear:

I just tested with your correction, it detect a title like this: « -qB4510-frliYdFuppEq »

I suspect that the « Reserved Bytes » simply allows for a few extra bytes to be reserved in the detection of the qBittorrent client...

Again, thank for the correction !

[anon]

Firstly, keep in mind that - and . have special meanings within a regex and must be escaped if you want to catch those actual symbols. However, the expression used by both the client file you originally posted and the corrected version is...


-qB4510-[0-9a-zA-Z\-\._~!*()]{12}


Which does use correct escaping and matches what the real qBittorrent generates.

I don't have an explanation for the problem you describe, since (as per above) qBittorrent should never generate a string with unprintable or encoded characters. Also, a peer_id must always have length 20, so "-qB4510-frliYd" would have been invalid in any case. But let's keep in mind that most programs do not expect to have their memory scanned (which by the way is a privileged operation) and therefore have no reason to arrange their data structures in a way that makes sense to others, possibly leading to what you saw.

The remote memory reader works locally, has a 100% success rate and does not require administrator privileges, which should make it very attractive in this scenario :weirdo:


I suspect that the « Reserved Bytes » simply allows for a few extra bytes to be reserved in the detection of the qBittorrent client...

Not exactly. Reserved bytes are a future-proof way for peers to declare support for specific protocol extensions as early as possible. These are not sent or visible to the tracker and therefore should not affect the memory reader... so basically, just an extra detail that needs to be verified when writing an emulation.

[mmmmm]

@ Annabella
reported before at one of beta test (long time ago and don't remember which one) and fixed next release .