Disable DHT blocking in popular torrent clients

On many so-called "private" trackers, torrents are distributed with the flag set, which does not allow the use of the DHT network . The purpose of this is to prevent the distribution of material to customers who are not registered on this tracker. However, for the user, this means a decrease in the number of siders, sometimes significant.

Below we will look at how to disable this restriction in popular torrent clients. The general approach, as well as practical application to the current version of uTorrent and qBitTorrent, will be considered .

1. Introduction.

In the past, a lot of information was posted on the network regarding the so-called “DHT patches”, as well as the patches themselves. However, when analyzing these data, they often turn out to be contradictory and even in some cases completely inoperative. This is due to the constant updating of clients, changes in the structure of programs, and in some cases - the incorrect approach of the authors of the patches.

We will try not just to create a ready-made solution, but to analyze the main steps so that the reader can, even in case of a change in the future, remove the limitations of DHT in new versions of clients.

2. Preparation.

We will need:

1. Actual distribution of the torrent client.
2. An archiver capable of unpacking installation files, for example, in the case of uTorrent and qBitTorrent - 7-zip .
3. Unpacker of client executable files, in case of uTorrent - UPX .
4. IDA or any other disassembler.

First, extract and extract the executable files. To do this, open the downloaded installers and open them in 7-zip. We will need:

• in case of uTorrent - Carrier.exe file;
• In the case of qBitTorrent, the files qbittorrent.exe and qbittorrent.pdb (or their 64-bit counterparts if the 64-bit client changes).

For uTorrent it is also necessary to unpack the UPX packaging, this can be done with the command
upx.exe -d Carrier.exe

2. Search and change the code.

In general, the implementation of DHT blocking in all clients at the Assembler level looks the same, this is a call to the flag check function, and if this function returns a zero value, go to the code area that allows you to use DHT:

call TestPrivate
test eax, eax
jz NotPrivate

for this reason, the patch itself will be expressed in a simple change of one byte of the code 74 => EB, turning the conditional jz transition into an unconditional one and thus ignoring the check for "privacy".

It remains to find this function.

In fact, this is not at all difficult, given the specifics of this code and the presence of the “private” keyword. Open the unpacked uTorrent client file in the IDA and search for this keyword:



It can be seen that with the specified key in uTorrent there are only three sections of code. Here's what they look like:

1. 
2. 
3. 

It is quite obvious that the code we need is the third in the list, since only it is a function call and a check for returning to zero with a subsequent conditional transition.

Our task is to simply replace the function, as we mentioned earlier:

In fact, this is a replacement of the characteristic sequence
68 00 FF 69 00 E8 19 F1 FA FF 85 C0 74 07
with. In the case of qBitTorrent, the task is simplified even more, since the developer has embedded the pdb file in the installer, so that the names of the functions will be more obvious, and search by the keyword is simplified: This is the verification code itself: As you can see, in fact it is indistinguishable from uTorrent. The patch will be similar: This is a replacement of the characteristic sequence with
68 00 FF 69 00 E8 19 F1 FA FF 85 C0 EB 07














E8 20 CB FA FF 84 C0 74 59

E8 20 CB FA FF 84 C0 EB 59

qBitTorrent is also offered as a 64-bit client. The actions against him will be exactly the same, except that we need a 64-bit version of the IDA. The search result for the keyword is expectedly similar:



The appearance of the corresponding function is slightly different, but the essence remains the same:



Well, the corresponding patch, here it will be three bytes:



This is a replacement of the characteristic sequence
E8 8F 0E F8 FF 4C 8D 3D 54 E5 46 01 83 CB FF 84 C0 0F 84 DB 00 00 00
with
E8 8F 0E F8 FF 4C 8D 3D 54 E5 46 01 83 CB FF 84 C0 E9 DC 00 00 00 00

3. Summary

We have successively studied the procedure for searching and disabling the function of restricting the use of DHT for private torrents in the popular uTorrent and qBitTorrent clients.
I think that the proposed mechanism will be similar for any other clients - in any case, I checked it on ComboPlayer .

To automate the process, I created two patchers for the current versions of uTorrent and qBitTorrent. For uTorrent, the patcher also unpacks the original installer. Files can be downloaded here:

qBitTorrent x32
patcher qBitTorrent x64
patcher unpacked uTorrent Silent patcher
all-in-one uTorrent patcher: unpacks, patches and packs the installer back, and also unpacks, patches and packs back the already installed uTorrent (provided that the installation folder is the default, that is, "% userprofile% \ AppData \ Roaming \ uTorrent \"