Page 1 of 1

I'm looking to replicate qa particular form of obfuscation handled by sabnzbd

Posted: January 21st, 2018, 3:39 am
by terminaltrip421
I hope it's alright to ask this here. I've exhausted my other avenues uincluding asking at places where such files were found. a particular form of obfuscation has recently become familiar to me and when I first came across it I was using newshosting's own leecher which couldn't handle the files and that's when I came to use sabnzbd. this particular obfuscation always seems to take the form of rar names randomized into letters and digits with no uniformity and lacking a file extension. sabnzbd will actually rename them as they're downloaded, which is pretty neat, but anyway they're always(?) named yay.rar, yay.r01 etc after being renamed. the pars generally share a file name uniformity. also it would seem that the need for a password with these is negated as they're never passworded. lastly if someone is familiar perhaps they could answer whether or not these require the nzb in order to decrypted / renamed or just the pars? either way I've tried searching to for files based on the names found in the nzb - both par names and obfuscated file names- and been unable to find them on usenet search engines which I found interesting.

so I was hoping someone might be able to point me towards how to replicate it if they are indeed familiar as it seems like a great tool to have. any and all help would be greatly appreciated, thank you! oh, and sabnzbd is very nice software so thank you for that too =)

Re: I'm looking to replicate qa particular form of obfuscation handled by sabnzbd

Posted: January 28th, 2018, 11:53 am
by shypike
Can you email an example NZB file to bugs@sabnzbd.org ?
(Please include the URL of this message.)

Re: I'm looking to replicate qa particular form of obfuscation handled by sabnzbd

Posted: January 29th, 2018, 10:37 am
by safihre
I don't know which tool they use to make this kind of obfuscation, but indeed it's the most recent one.
So since articles are scrambled so intensely, we do really need an NZB. Otherwise we don't know the order of the articles within files.
Within this NZB the files can still be named rubbish, because SABnzbd will inspect the first bytes of each file to see if it's maybe a par2 file.
As soon as one of these is detected, the information from it is used to identify the filenames of all the other files.
Par2 files contain the MD5-hash of the whole file, but also the MD5 hash of the first 16k bytes of a file. So we only need the first article of each file to know the real filename of the file. Pretty neat!
From SABnzbd 2.3.2 this is exactly what happens, we download the first article of all files to identify first the names of all files in 1 go. This way we can start Direct Unpack with the right first file, since the order of the files is also random within NZB's nowadays.

All this stuff is mostly coded here:
https://github.com/sabnzbd/sabnzbd/blob ... ar2file.py

(Sorry for slow response, I was moving homes)