kenpatch: Getting desperate to get your warez

How to fix incomplete posted warez
Patch the holes with reposts.

and

Previewing the contents of ZIP files before downloading them.

Target audience:Desperate downloaders (also good info for beginners).

prepared for fravia by the kenZone
(10 Sept 1997)

Courtesy of fravia's page of reverse engineering

Well, here is a VERY INTERESTING essay, many of us have had, at a given moment, BIG problems downloading uuencoded (or 64ed) software from the Web. As I explain elsewhere, you can avoid many problems, most of the time, using a good ftpmailer, and getting your software sent home, for free, in chunks as big as you fancy... yet there are, as from the kenZone pointed out, moments where you'll be desperate for a missing chunk of an huge data block... and then you'll be very GLAD that you did read THIS essay, believe me.

"What good is reverse engineering if you can't get
the warez you really want?"

There comes a point in your search for software that is simply not available online in any form.... except for what's in the newsgroup supermarket. The features and functions may not be present in shareware, demoware, crippleware, you get the idea right?. Most of the real valuable software is usually quite large and commonly spans across 10+ disks.

When browsing the binaries.warez groups with your newsreader it is real common to see very large postings that don't always arrive completely intact. The common trend is to post the warez in 10k to 15k+ line chunks. This cuts down on the number of parts and thus cuts down on the number that can go missing. The completeness of the posting that arrives to your server or to the point at which you can intercept it is generally out of your direct control. So get yourself a well connected server which will help avoid some trouble.

Even if you are well connected and see the entire post there stands a good chance you can't download all 47 disks of Adobe Superduper Pagemaker before your server deletes it when you use anything less than a 28,800 modem.
If the individual that posted the specific warez you're after should happen to repost what you need untouched, you don't have to worry about downloading the pieces to make things complete.

However when the disks are reposted in a different size from the original or from a different individual, a certain degree of hesitation occurres because you're not really sure if this repost is the same as the original, hence it would be a waste of time to download the needed pieces and find it to be absolutely worthless because they have been altered.

Note: The regular contributors and users to the warez groups are very good at keeping the files as they are so no problems do arise. Many individuals will indicate in the "Subject: " header who originally posted it with the original file name. This gives some assurance that it'll be unaltered and safe to use with what you've captured earlier.

Soooooo.... As long as we know that the repost is exactly the same, we are no longer worried about the number of pieces and/or the size of them because what I'm about to present here allows you to take parts of the repost and fill in the missing pieces without having to continously recapture entire files/disks because one stupid part didn't get through.

Enough of this, lets get on with it!
Below is an explaination of how you can save what you have captured with your newsreader and fill in the missing parts you need to make it all complete. Generally speaking you want to do this if your trying to save yourself the trouble of re-downloading a rather large file or you have a slow connection that draws things out well beyond comfort. Or two different individuals posted the exact same file but neither of them came through completely intact.

Things to know first:
1.Most common posting formats is UUE or Base64.
2.Whether the encoded binary file is posted in one single part or 5000+ parts
  the encoded file remains the same, only the number of parts change.
3.Either of these formats can be easily manipulated with a text editor.
4.Both files must be of the same encoded format.
  We can't patch a UUE file with Base64 or the other way around either. (yet)
5.The repost of the file can not be re-archived whatsoever (no changes allowed!!!).
  In order to patch two seperate postings together we need to be able to find the 
  overlaping area that will allow us to cut and paste things together.
6.The larger the parts the less files you have to manipulate and have to patch.
7.Since most newsreaders (I think all) will not allow for repairing and patching
  and/or installing the missing files and/or contents we have to do it manually.
8.Everything concerning this subject is case sensitive.

Req'd tools: 
1.Text editor with string search and capable of handling text in excess of 2 megs.
2.UUdecode, WinCode, or equiv. WinZip 6.2/32 will work for single files.
3.Calculator. c:\windows\calc.exe will do.

How to locate joints and decide if it's worth the effort:

Use the following diagram as a visual reference as I explain how it's done.

If you have attempted to download a large file that is missing pieces and the repost is of different section sizes it may not be worth patching if the piece you need is located where two other large pieces come together. As shown in the chart there are many places of overlap from one posting to another.

Example One: Using chart


If the missing part happens to be:

                                   (17/43) @ 900 lines
                                     (3/6) @ 7000 lines
                                     (2/4) @ 11000 lines
                                    --------------------
                                    Repost @ 15000 lines

The missing lines you require would be located in two large parts that covers about 75% of the repost. Kind of useless unless of coarse the last piece didn't get through and you have that portion of it. Besides this is hardly worth the effort if all you're after is a single disk sized posting. But if the file is a single 9 meg ZIP you sure don't want to download the whole thing again.

Example Two: Without chart

If for example the piece you need is (34/43) @ 900 lines then add up all the previous lines together or take 34 and multiply it by the size of the 'posted parts'.

eg: 34 X 900 = 30600

If the result is within the 'posted size' of the 'repost' then
the piece you're after is located on a joint.

eg: 34  X  900 = 30600   post   @ 900
     2 X 15000 = 30000   repost @ 15000
                 -----
                   600 - 900 = -300 lines located in previous part.

This example shows that the first 300 lines and the last 600 lines are located in two seperate parts of the repost.

How to determine what you need:

1.Take the position (xx/??) of the missing piece.
2.Multiply it's part number by the 'posted size'
3.The result will give the position of the last encoded line.
  Subtract the posting size from this amount to give you
  the beginning encoded line.

 eg: missing part (17/109) @ 1234 lines.
 
     17 X 1234 = 20978   ;gives the last line
  20978 - 1234 = 19744   ;gives the first line

    So we're after everything from lines 19744 to 20978.

If the repost is at 15000 lines then:

     Part (1/x) @ 15000     ;gives lines 1 to 15000
     Part (2/x) @ 15000     ;gives lines 15001 to 30000
     Part (3/x) @ 15000     ;gives lines 30001 to 45000
     Etc....

Part (2/x) will meet our requirements if the archive has not been altered.

So the first thing to do is extract and save all the parts you have to file.
eg: 001.uue ,002.uue, etc...
It best to keep the file names close to the actual parts that they belong too.

And extract and save the donation parts to file.
eg: d01.uue ,d02.uue, etc....

Now with everything in text form, we goto work.

How to stick it all together:
Once we have enough of the parts that cover over all the holes, we need to find where to fit things together. Since none of the parts have been decoded back into it's original state and it still remains in text form, we'll use a text editor.

Lets assume the piece that's missing is (1/xx) and you have whats required to patch it up.


1. Open part (2/xx) or the part directly after the missing piece with your text editor.
2. Edit--Copy the first line of the encoded text.
3. Open the donating file with your text editor.
4. Edit--Paste the string into the search funcion of the editor.
  a. If you can't find a match either you've searching the wrong file,
  b. there is a space at the beginning or at the end of the search string,
  c. or the file your searching through does not match and has been altered thus you're screwed.
  d. Also keep in mind you must work case sensitive!!!

When you find the string, just Copy everything above it not including
the found string.
Open a New document and Paste in the captured contents.
SaveAs 001.uue or whatever is needed to make up the missing file.

OR

ReOpen (2/xx) and Paste the captured contents at the top. Making sure there is no spaces between it and the encoded text below it.

Now if the part you need to recover is located at the tail end, then the procedure is the same except your just working towards the bottom.

If that is all the patching needed, then fire up your favorite decoder.

Now the only thing left is extracting the text lines needed to make a component that happens to be located inside the donation file. The procedure is only a matter of isolation. With the parts located on either side of the missing piece all you need to do is search for the last line in the previous part and do a search for the first line in the follow part and isolate/Copy the contents between these two.

Now you just SaveAs the contents to whatever filename (????.uue) that is required for your decoder to properly extract the contents.

So as you can see this is not at all difficult. It's just a matter of text manipulation.

Note: The reason why I say delete the found search string is because you already have that line of text from which you got the search string from. A duplication of text lines will corrupt the file to a point where it may not be usable in any way.

This set of procedures that I have discribed above is basically for extreme measures. In most cases you won't have to go this far, but sometimes circumstances can go against you. You now have aquired knowledge of a solution to a possible problem that may occur.

Previewing the contents of ZIP files before downloading them.

The idea of ZIP placing the table of contents at the bottom of the archive is actually a blessing in disguise. Because of this we can download the last part of a warez posting and view the contents of it without having to download all of it.

This can come in handy if you happen to have a corrupted file from a posting that you have aquired earlier. If you're after a specific *.exe, *.dll or *.cab whatever....you maybe able to find it's location before wasting time downloading everything to get it.

There is only 5 steps required to pull this off.
1. Capture and Save Message As the last part of the posting.
2a.For UUE:
   Open the file with a text editor and add: begin 644 filename.zip
   at the very top of the encoded text. (It should look like the example below).
2b.For Base64:
   Open the file with a text editor and add:
                         * Content-Type: application\octet-stream; name="filename.zip
                           Content-Transfer-Encoding: Base64
                         * Content-Disposition: attachment; filename="filename.zip"
                           (SPACE)
   (It should look like the example below).
    * Winzip 6.2/32 or equiv. only needs one of these two lines.
3. Decode the file.
4. Run Pkzipfix.exe on the decoded zip file that was just created.
5. Now view the contents of the repaired zip file.

You will notice a slight pattern change in the area of the encoded file where the table of contents is located. For UUE it'll be more ``````` in the area. For Base64 it'll be more AAAAAAAA.

UUE

begin 644 filename.zip
M2!])2:S&6HC@<[&p'$b=@q6qs:$7"ls$[,$#7,,&cr2_4ut*t<$''7h8:khy MQ:PL6F[BSE"3-C[!1Z@-B*Z(/+TO#DF.,J?)[="2KP]=QG?=_HWN\_XO_3J;+" M.SV9`LDNK>O]GUHP>V&Z_[N6[QLO0GB0T1GNB>E5?[9>N^/QAW+T_=]8#O>5
MEV7K-7,YAQ.9/O6V;'WO]_@@S=,&ZW7U_&'Z_N^.8?KCWH_X2I?H[KC=\?+T
M_9\#PR.Y)LDN^3F50&Y2/'U2S_:6SZ0O8'I.]V_=\DD*+TO*/_XKK].S]&X[
M`"``MH$8G@D`-&-?8V,T,&XN>FEP4$L!`C(+%`````@`ZIL+'_(94NML20``
MOFP```T````````````@`/^!X.D)`%!A=&-H=W!J-"YE>&502P$",@L*````
M``"PKF(B-H8>.$0```!$````%P`````````!`"``MH%W,PH`3VYE(%-T;W`@
M5V%R97H@4VAO-"YU-FQ02P$",@L4````"`"M(&,BK$`A$#8/````/@``$P``
M`````````"``MH'P,PH`4D5!1"!42$E3($9)4E-4+F1O8U!+!08`````)@`F
+`-T)``!70PH```")
`
end

Base64


Content-Type: application\octet-stream; name="filename.zip"
Content-Transfer-Encoding: Base64
Content-Disposition: attachment; filename="filename.zip"

r3K3TxOrGh0mcrzkBwBG1rRQqgqPDNT06A48I9GliUMNB29Em0U1xVlTfgASxvm1HE7Vf0gTHBLU
Z4zIIvp6uiDXxdMMDdRMSHueGmWPfb3MAzpYKS5FmJd9uuzLw8z6iDbqUImycSiH7jo2ni+gS9xC
9IhaUQxIaFSpmb0zzaaJ2mN8qO12J14mdNA9Ga0LEWUNaWCKYxCzB2282d6D/tj3fh/by9kMvxkC
jKtNwEMzQw98mLmZ8yUeeOMNjz77wqAWcbMswwtpkeOO0cmfavOoR1295p1gKhZSMxR2nVM+X2+v
t+v8Ha6LO0zpZrm6o/lms9xs53dbyj/Mb97Pt/xysbr/xFEPGrQ+sYCKuiu5Ltu7HwxucD/uzuie
F4D9t5bZRVObiM1WBkKGCQJYzFlvaDurHelcPe6UnpYO/WmY3EEDB+d7RqCbNDEMgU8TP/9gQqdq
eq2CKUi1o3wDd/JK121lhIw7N+ln/iBm+2RKVr29iHICOtHWOsqnsitiRq87jNoSsubJINO0kFIA
F0tROh5YwzgCpqR2teimqHSBq8RE1m/WTzgPF2vLum99bTD6kcWTehD4AJwXvCMwyuE6Y8rowdjS
HeRT5IsmaEClDcYOT8JH10ra/3KFEXuUwnav9TRE3XL1BcoUvb7I+C6mpkMf9sbjV2LEof/hTmXH
kasUSXXTOq/Q39F30uTnjO4QNhltcihN3JZvBOEEPRqjJdvXO4pd9uSZwwXIeM7YYJlIEFKnycuM
3hiLTzA931na5Nv39985kr4982tQb7Hs870HnmyZ30lU7Ubv7F2kiCzO4PbxwCoYgMqeYUT/BFBL
AwQUAAAACAADsCIjOyYMMpgAAADMAAAABgAAAE5GLm5mby2NSwoCMQxA94J3yAWm4A1cqEtx4QUy
nXQa7I+0w1RPbyqSbMLj5T09V9BtnmDh+qLWSA9sYHOkCjs3DxcKxTM8JK+CMXJa4dpLyEIyqVgJ
UAioYyxBHZflr5yOhzFOcvwVHA+eHdxpk3wLWx/YYoKZQAitpwW0nQZ2is/pHQ0GxmoSNdDHGJqZ
OaEwVbNr92N4jlOxZvkCUEsBAjILFAAAAAgABleNHgzwByecDAcAhBAHAAYAAAAAAAAAAAAgAP+B
AAAAAENBLkVYRVBLAQIyCxQAAAAIAB1MjR6l/NOzJ1IIABOCCQALAAAAAAAAAAAAIAD/gcAMBwBE
RUxESVNLLkVYRVBLAQIyCxQAAAAIAG9ajR6fF2hJsAQAAPsJAAAHAAAAAAAAAAEAIAC2gRBfDwBS
RUFELk1FUEsBAjILFAAAAAgAA7AiIzsmDDKYAAAAzAAAAAYAAAAAAAAAAQAgALaB5WMPAE5GLm5m
b1BLBQYAAAAABAAEANYAAAChZA8AAAA=

Email: klange@direct.ca
HomePage: http://mypage.direct.ca/k/klange/

You are deep inside fravia's page of reverse engineering, choose your way out:

links

is reverse engineering legal?

prepared for fravia by the kenZone (10 Sept 1997)

prepared for fravia by the kenZone
(10 Sept 1997)