Jump to content

BEncode Editor


Ultima

Recommended Posts

A commandline interface has been among the longest-standing items on my todo list for BEncode Editor. And it wasn't done because I couldn't think of a good interface at the time that offered a decent fraction of the flexibility and power that the GUI currently has*. Admittedly, I haven't thought of it in a while, so maybe I'll have some better ideas after revisiting, but personal time constraints don't currently permit.

* No, I'm not silly enough to think that I'll be able to replicate every single GUI feature in a CLI.

Link to comment
Share on other sites

If you need help in further developing contact me via email. As mentioned before I have already experience in autoit scripting and would really appreciate supporting this project. Integrating all features from GUI into CLI would be impossible I guess, but some little things like announce, torrentname, comment and creationtool editing shouldn't be very complex. Path editing/replacing in resume.dat via cli would be nice too, but I don't think it's a feature that is very often needed.

Rest of features aren't very well suited for CLI. So keep it simple, for the rest there is your GUI.

Another nice thing would be merging some settings into utorrent settings.dat via ini file.

So your CLI could accept something like this:

BEncode Editor.exe -utMergeSettings -i "my.ini" -o "settings.dat"

In ini file you could provide some basic settings like up/down speed, queue settings, sharelimits, disccache size etc. So you could easily integrate these basic settings into multiple ut installations without touching rest of settings like folder or port settings of the instance. I personaly use lots of intances on my seedbox and would really appreciate a feature like this. Copying settings.dat requires manualy editing of Folderpaths and Ports so this feature would make it easier to change some major settings global for all instances.

Hope I could give you some good ideas for your upcoming CLI.

Link to comment
Share on other sites

For sure bencode editor can do much more than only editing torrents or utorrent config files. But be honest... majority uses it for exact these purposes, you even mention it as example usage on your google project page. So I don't see a conflict in some ut or torrent specific CLI functions. Supporting general beencode editing via CLI would be possible too, but it would not be very user friendly compared to GUI.

But I understand your problem with my ideas. For doing some specific replacements your tool would need a glue how torrent or ut config files are organized / keys or sections are named contrary to a general beencode editing where user decides what key/value should be changed, added or deleted.

Link to comment
Share on other sites

  • 3 weeks later...

v0.7.1.0 (2010-02-09)The usual false-positives.

v0.7.0.0 Changelog:

http://forum.utorrent.com/viewtopic.php?pid=443916#p443916

I don't know about USUAL false positives, but version 5u is the ONLY one that is clean according to virus total.com. One gots to wonder why that is. version 4 has 12 virus warnings!

v7: 1

http://www.virustotal.com/file-scan/report.html?id=63027f8b9a9320df2b9c20cc8885063bdd15a707ac77aa95673263a11dcdc454-1313244549

v6-unicode: 9

http://www.virustotal.com/file-scan/report.html?id=0b63cae47250b8e8cd42e5ec10b39a8a94560e69dabcaf88f87dc617eb922efa-1313243580

v6-ansi

http://www.virustotal.com/file-scan/report.html?id=e600c8914455ebac5c87e60fd8f39e0199c827f0b4f33b97330917180d6f8400-1313244152

v5: 0 !!!

http://www.virustotal.com/file-scan/report.html?id=c5dab58f8ada7382b0742bcf9c30263b9936a5792f16d05103b5ed8689aaf485-1313244171

v5a:

http://www.virustotal.com/file-scan/report.html?id=1410d39ec4f0601059a6515b112e6bc3ee48648a90d262722f33d2eaba5bb399-1313244168

v4-unicode: 12!!!!!!!!!

http://www.virustotal.com/file-scan/report.html?id=6b20a92128f10e9b0e6974dcea3c8d2c1c3dbc9d5369784cb5e3ebc177bb5418-1313244896

v4-ansi

http://www.virustotal.com/file-scan/report.html?id=bc355411b8f11dbe6271908bf75e05c7f6a7265fb9cd466d421176310ab045f8-1313244888

v3: 1

http://www.virustotal.com/file-scan/report.html?id=d7868de084b358871b7ffb51b1fc3a5a3404758b5ffe023dd631ddbe96696c99-1313244196

v2: 3

http://www.virustotal.com/file-scan/report.html?id=b8edda7868d0245045d6762aac9557b2f3092e4b5a421267141e2dbe6897a02b-1313244209

v1: 3

http://www.virustotal.com/file-scan/report.html?id=c55e769036a594f6e6b38df7385701c8e550cb083418b1a87947541d3c4dfab6-1313244231

Link to comment
Share on other sites

One would think that after years of BEncode Editor being out there, being used by (presumably) thousands of people, and my not having changed anything in forever, someone would've found and reported a virus if indeed there was one to be found.

FYI, I don't really care whether or not you believe me. If you prefer to trust VirusTotal instead, that's your prerogative. I don't gain anything either way.

I don't know about USUAL false positives ... One gots to wonder why that is.

I won't fault you for being cautious. Just don't go insinuating that which is not.

Edit: Have you looked at your own results? On bencode-editor.0610u.zip:

Emsisoft 5.1.0.8 2011.08.13 Riskware.DownloadTool.BEncode!IK

Ikarus T3.1.1.107.0 2011.08.13 not-a-virus.DownloadTool.BEncode

Besides the fact that BEncode Editor uses AutoIt/UPX (a well-known hive for antivirus false positives), it's also associated with BitTorrent, which is inescapably/heavily associated with piracy, which antivirus vendors often have agendas against anyway. Is it seriously any wonder that it would be flagged anyway?

Link to comment
Share on other sites

update:

I've also run the unpacked files of Bencoder thru virustotal.com

Unexpectedly, there IS a difference, between testing these files zipped and unzipped, they all report ONE virus more than when testing them zipped.

Sadly now ALL versions report a at least one virus, even 5.10unicode:

And no, the concept of a false positive is not lost upon me, but when the one before last version (6.10) report 9 to 10 viruses, it gives one pause about the other versions. Especially when it happened before in version 4.10 ....

exe - v7-unicode: 2 virus

http://www.virustotal.com/file-scan/report.html?id=9354117fe9e13648f4a32655bf28b6a51a5282ac675ea6cc28de8da2c15cb6ec-1313250239

zip - v7: 1 virus

http://www.virustotal.com/file-scan/report.html?id=63027f8b9a9320df2b9c20cc8885063bdd15a707ac77aa95673263a11dcdc454-1313244549

exe - v6-unicode: 10 virus

http://www.virustotal.com/file-scan/report.html?id=ea9f694edb145582b1e4474a90229863089612af6da1bf15ed915fc43f64cbf5-1313250585

zip - v6-unicode: 9 virus

http://www.virustotal.com/file-scan/report.html?id=0b63cae47250b8e8cd42e5ec10b39a8a94560e69dabcaf88f87dc617eb922efa-1313243580

exe - v6-ansi 2 virus

http://www.virustotal.com/file-scan/report.html?id=09a6e7302aa384f85f61e61081680ac313fc6dcff578886602cbe07d833e617b-1313250217

zip - v6-ansi: 1 virus

http://www.virustotal.com/file-scan/report.html?id=e600c8914455ebac5c87e60fd8f39e0199c827f0b4f33b97330917180d6f8400-1313244152

exe - v5-unicode: 1 virus

http://www.virustotal.com/file-scan/report.html?id=8bb031e0c2c7b776b9152cb469db24e3d5f04b96567d2504fd3c8550851fcdb8-1313251080

zip - v5-unicode: 0 !!!

http://www.virustotal.com/file-scan/report.html?id=c5dab58f8ada7382b0742bcf9c30263b9936a5792f16d05103b5ed8689aaf485-1313244171

exe - v5-ansi: 2 virus

http://www.virustotal.com/file-scan/report.html?id=036cf3b7bb10a6427c7c1a553e9261d988fe5919430a27e725edd0e04b97e474-1313250142

zip - v5-ansi: 1 virus

http://www.virustotal.com/file-scan/report.html?id=1410d39ec4f0601059a6515b112e6bc3ee48648a90d262722f33d2eaba5bb399-1313244168

exe - v4-unicode: 12 virus

http://www.virustotal.com/file-scan/report.html?id=5582f5e5d8af0e496a6a99abce791d5a654ecc37ed02be77241b37849df939b4-1313250489

zip - v4-unicode: 12!!!!!!!!!

http://www.virustotal.com/file-scan/report.html?id=6b20a92128f10e9b0e6974dcea3c8d2c1c3dbc9d5369784cb5e3ebc177bb5418-1313244896

exe - v4-ansi :2 virus

http://www.virustotal.com/file-scan/report.html?id=f2fba628fe761a1ebd1c676e94ed1d1fc1f7fc15d8adc05bd530445ea5d30488-1313250092

zip - v4-ansi: 1 virus

http://www.virustotal.com/file-scan/report.html?id=bc355411b8f11dbe6271908bf75e05c7f6a7265fb9cd466d421176310ab045f8-1313244888

exe - v3

not tested

zip - v3: 1 virus

http://www.virustotal.com/file-scan/report.html?id=d7868de084b358871b7ffb51b1fc3a5a3404758b5ffe023dd631ddbe96696c99-1313244196

exe - v2

not tested

zip - v2: 3 virus

http://www.virustotal.com/file-scan/report.html?id=b8edda7868d0245045d6762aac9557b2f3092e4b5a421267141e2dbe6897a02b-1313244209

exe - v1

not tested

zip - v1: 3 virus

http://www.virustotal.com/file-scan/report.html?id=c55e769036a594f6e6b38df7385701c8e550cb083418b1a87947541d3c4dfab6-1313244231

Link to comment
Share on other sites

For the Record: I've sent my executables in for manual re-evaluation by antivirus vendors before, and sure, they fixed their definitions, but only soon after released more definition updates that reverted their "fix". I'm not really interested in playing the cat-and-mouse game with them -- not when they're the ones wielding all of the power, and I'd just be there to tell them "your majesty, you have erred -- again". I've got more important things I'd rather deal with.

You can report all the VirusTotal results you'd like, but it won't really make a difference to me (or to antivirus vendors, for that matter). Indeed, I am jaded, and this is a tired topic for me.

If you're doing this just to inform other users, then that's cool with me, as I'm not personally interested in wasting my own effort uploading to VirusTotal for the sole purpose of seeing how many more false positives they can generate. Just, please, stop editorializing the results by saying things like the incredulous "I don't know about USUAL false positives" or the insinuating "one has to wonder why". That does nothing but imply to others that I write or propagate viruses, which I don't take kindly to.

Edit: If anyone comes across these posts and are interested in a real explanation, see here. I tried being diplomatic, but I don't think I'm going to tolerate the FUD any further.

Link to comment
Share on other sites

First off, I'm just the messenger here. Don't bite MY head of.

One would think that after years of BEncode Editor being out there, being used by (presumably) thousands of people, and my not having changed anything in forever, someone would've found and reported a virus if indeed there was one to be found.

They said that about asbestos, cigarettes and Thalidomide as well. They were wrong.

I won't fault you for being cautious. Just don't go insinuating that which is not.

Thanks. and I am only pointing out what several virus scanners have found. Nothing more, nothing less. You've chosen your reaction, and that's that, I guess.

Edit: Have you even looked at your own results? On bencode-editor.0610u.zip:

Emsisoft 5.1.0.8 2011.08.13 Riskware.DownloadTool.BEncode!IK

Ikarus T3.1.1.107.0 2011.08.13 not-a-virus.DownloadTool.BEncode

Okay, this is an odd defense. Not to be facetious, but no, I haven't seen those two, because of the other EIGHT virus reports!

Besides the fact that BEncode Editor uses AutoIt/UPX (a well-known hive for antivirus false positives),

This could very well be plausible, but it's not like they would say: "hey, you know what: our scripts are very vulnerable to piggybacking viruses" now would they?

Still, it's likely you have a point.

it's also associated with BitTorrent, which is inescapably/heavily associated with piracy, which antivirus vendors often have agendas against anyway. Is it seriously any wonder that it would be flagged anyway?

This "We're persecuted because we pirate against Big Corp" defense is NOT very plausible, and is a bit self-serving.

Okay, so let's say that version 7 and 5 have suffered from false positives, do you REALLY think that the same goes for version 4 and 6? I don't think I've ever seen any sort of software program with that many viruses!

Listen, I get it, you work hard, probably for no pay at all, and it's your baby and all that. You might do all this voluntarily. But aren't you worried about 9 to 12 virus scanners reporting malware?

I know, you just wanna shrug it off, and say F .... you or whatever, and that is of course, YOUR prerogative.

But if I were you, I would worry what went so terribly wrong from version 3 to 4 that it produced TWELVE error reports? And from version 5 to 6, from 1/2 to 9(NINE)/10(TEN) error reports?

Okay, let's put it this way: Aren't you REALLY curious what made the number of error reports DROP from NINE to just ONE, when you went from version 6 to 7? ;)

I would be.

1- If you're still reading (which I kind of doubt, but maybe others can point this out), don't you realize that the MOST interesting thing is not that your program has 9 - 12 virus reports. The MOST interesting is that sometimes it has NOT. The up and down swings are immense.

2- Also, why there's a difference in unicode versus ansi versions?

3- Also, if unicode is supposed to handle Chinese characters and stuff, then why is the only virusscanner with a Chinese sounding name Jiangmin always negative about (edit: the unicode versions of ) BEncoder, but not when it's Ansi??

4- Also, why does version 4-unicode have 12 reports, but 4-ansi only 1 or 2?

Based on all these reports, I'd go with version 5.10-ansi, because McAfee has a better reputation than Jiangmin, but maybe I am too eurocentric ... IDK

But ... I can imagine it's easier to shrug this all of and live your life.

Link to comment
Share on other sites

Ultima's editor is just fine (and a nice piece of work, if I may say so; thanks mate). The fact that he's using UPX and AutoIt is what's causing those false positives. I've written a few free utilities myself and they are occasionally getting flagged as trojans and malware, even though I was using pure C++/Win32. I never bothered to contact the antivirus vendors, for the reasons Ultima mentioned.

zploek, I know you're trying to help, but you really can't rely on antivirus products to be 100% correct. Sometimes you have to use your own judgement on their "findings". You'd be surprised how dumb their heuristics engines can be. :P

Link to comment
Share on other sites

Honestly, I find this most amusing: because I leave old versions up, I'm getting dirt thrown at me now. Maybe I should've just taken a cue from µTorrent and not bothered to leave old versions around -- even though BitTorrent sometimes gets mud slinging too for not allowing old versions of µTorrent to even be linked from here. Damned if you do, damned if you don't.

Okay, let's put it this way: Aren't you REALLY curious what made the number of error reports DROP from NINE to just ONE, when you went from version 6 to 7? ;)

If you're directing that question at me, then my response is a resounding "no". If you're so inclined, go ask the antivirus vendors why there are such wild swings in their heuristics engines. Don't ask me why other people's softwares have problems.

Anyway, drop the topic. The evidence is laid bare for others to decide for themselves. I'm not interested in letting this thread get derailed further for your own paranoia.

Link to comment
Share on other sites

Like you said, I am cautious. I think it's good that you've old versions here, it tells me that you're confident about your work. It's good that you don't decide for your users what they can't or can use.

Because of that, I have chose to use version 5.10 and not 6 or 7. So, thanks for that, it's highly useful.

And if you think I am paranoid, well, I have good reason to be. I fully recognize your right to feel however you do. Allow me to feel like I want, and do whatever I think is best to protect my PC.

And no, I didn't know about your long battles with virus companies. I just saw something, I pointed that out, do with it what you will.

And yes, I thought I was doing you and others a favor by running 23 versions of your program through Viruscan,org and Virustotal.com

sue me.

kkdzo, thanks for your remarks.

Link to comment
Share on other sites

And yes, I thought I was doing you and others a favor by running 23 versions of your program through Viruscan,org and Virustotal.com

And indeed I appreciate that you cared enough to do that. It's just that tying it with language that easily confuses users while throwing some dirt at my work (and myself) -- intentional or otherwise -- doesn't evoke nice emotions from me. You'll notice that that's been the main point I've taken issue with this entire time.

You chose to say without real hard evidence that the warnings weren't false-positives, aka "BEncode Editor does contain viruses" (for posterity: it doesn't). Better might it have been for you to just say something along the lines of "it should be noted that version X has a surge of virus warnings on VirusTotal", and leave it at that, with or without your recommendations; it's fine either way, as I have no problems with facts and helpful suggestions.

Anyway, thanks for your concern.

Link to comment
Share on other sites

Oh my, I laughed a lot reading these postings about viruses. It's nothing new that Autoit based executables are recognized as malicious. These false positives can occur if UPX is used while compiling or some bad guys published hundreds of viruses based on same autoit version, you can read more about it in official Autoit forums:

http://www.autoitscript.com/forum/topic/34658-are-my-autoit-exes-really-infected/

http://www.libraries.psu.edu/psul/cataloging/techresources/macros/autoit_docs/false_positives.html

The problem with Autoit is that all executables compiled with same Autoit Version are very similar. In each autoit executable an autoit interpreter and lots of standard functions are included. That means that each autoit executable contains 80% identical data and only 20% self written source code. Antivirus companies create something like fingerprints of parts from these executables to recognize other modified programs containing same virus. So it can happen that these fingerprint is taken from part that is common for every script compiled with autoit version x. That expalins too why there can be differences between program versions of beencode editor. Sometimes older false positives are corrected by antivirus updates, sometimes they are not (because devs don't contact all companies). Sometimes there are no or very less viruses published with compiler version, so there are no or very less false positives. Sometimes there are a lot.

With using upx there is the same problem. It's a common compression algorithm used by many compilers not only autoit.

False positives can occur too if program acts like many viruses, for example sending data via internet, accessing/writing registry, using remote access features or calling some dll functions of windows. So for example the tool "puty" is often recognized as a virus. Things like that are normaly recognized by heurisitic virus search, meaning they don't can find a signature in database, but they find behaviour suspicious.

Some antivirus tools do a good job some do a bad job. So if some small and unknown antivirus tool says this is a virus you should not trust blindly in it. If majority does not detect anything you can be relative sure that there is nothing to detect. If you are unsure send file to the biggest companies to reevaluate it and check again some weeks later. If you are very paranoid don't use closed source software at all and use only open source instead. So you can review source code and compile it yourself.

To show how funny some results can be i wrote a very simple script containing all available standard includes and compiled it with UPX ans max compression:

Sourcecode:

#Region ;**** Directives created by AutoIt3Wrapper_GUI ****#AutoIt3Wrapper_Compression=4#AutoIt3Wrapper_UseX64=n#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****#include <Array.au3>#include <AVIConstants.au3>#include <BorderConstants.au3>#include <ButtonConstants.au3>#include <Clipboard.au3>#include <Color.au3>#include <ColorConstants.au3>#include <ComboConstants.au3>#include <Constants.au3>#include <Crypt.au3>#include <Date.au3>#include <DateTimeConstants.au3>#include <Debug.au3>#include <DirConstants.au3>#include <EditConstants.au3>#include <EventLog.au3>#include <Excel.au3>#include <File.au3>#include <FileConstants.au3>#include <FontConstants.au3>#include <FrameConstants.au3>#include <FTPEx.au3>#include <GDIPlus.au3>#include <GDIPlusConstants.au3>#include <GuiAVI.au3>#include <GuiButton.au3>#include <GuiComboBox.au3>#include <GuiComboBoxEx.au3>#include <GUIConstants.au3>#include <GUIConstantsEx.au3>#include <GuiDateTimePicker.au3>#include <GuiEdit.au3>#include <GuiHeader.au3>#include <GuiImageList.au3>#include <GuiIPAddress.au3>#include <GuiListBox.au3>#include <GuiListView.au3>#include <GuiMenu.au3>#include <GuiMonthCal.au3>#include <GuiReBar.au3>#include <GuiRichEdit.au3>#include <GuiScrollBars.au3>#include <GuiSlider.au3>#include <GuiStatusBar.au3>#include <GuiTab.au3>#include <GuiToolbar.au3>#include <GuiToolTip.au3>#include <GuiTreeView.au3>#include <HeaderConstants.au3>#include <IE.au3>#include <ImageListConstants.au3>#include <Inet.au3>#include <IPAddressConstants.au3>#include <ListBoxConstants.au3>#include <ListViewConstants.au3>#include <Math.au3>#include <Memory.au3>#include <MemoryConstants.au3>#include <MenuConstants.au3>#include <Misc.au3>#include <NamedPipes.au3>#include <NetShare.au3>#include <Process.au3>#include <ProcessConstants.au3>#include <ProgressConstants.au3>#include <RebarConstants.au3>#include <RichEditConstants.au3>#include <ScreenCapture.au3>#include <ScrollBarConstants.au3>#include <Security.au3>#include <SecurityConstants.au3>#include <SendMessage.au3>#include <SliderConstants.au3>#include <Sound.au3>#include <SQLite.au3>#include <SQLite.dll.au3>#include <StaticConstants.au3>#include <StatusBarConstants.au3>#include <String.au3>#include <StructureConstants.au3>#include <TabConstants.au3>#include <Timers.au3>#include <ToolbarConstants.au3>#include <ToolTipConstants.au3>#include <TreeViewConstants.au3>#include <UDFGlobalID.au3>#include <UpDownConstants.au3>#include <Visa.au3>#include <WinAPI.au3>#include <WinAPIError.au3>#include <WindowsConstants.au3>#include <WinNet.au3>#include <Word.au3>
MsgBox(0,"I am a virus","eicar loves me and pentagon sucks")

This script only contains a simple harmless msgbox. Compile it as IamAvirus.exe and let's check results:

http://www.virustotal.com/file-scan/report.html?id=7fa3dccc2047d0fb84c4c69dfb17fa130a542d62c88a8bc5b184864cff7300dc-1313492952

K7AntiVirus 9.109.5017 2011.08.15 Trojan SUPERAntiSpyware 4.40.0.1006 2011.08.16 Trojan.Agent/Gen-Goo 
Link to comment
Share on other sites

  • 2 months later...

Do you think that you could implement a feature that relinks the moved torrents?(by editing the resume.dat file)

For example, I use to download in a general folder called queue, and after a while, I'll sort the torrents in various subfolders based by tracker, type, etc.

The problem is that I can't use "set download location" for hundreds of torrents because it would take forever.

Link to comment
Share on other sites

  • 2 weeks later...
  • 5 weeks later...

I don't know if anyone cares, but with this tool I was able to solve a problem I was having when I moved all my files and utorrent data, list of torrents etc, from my Windows XP to my new computer with Wndows 7.

I don't like to remove my torrents, I just stop them after seeding and let them with 100% and in the finished Status. So that way I have a history of everything i downloaded over the years. Probably a lot of people do that as well. So I wanted to carry all that to my new PC.

But as the utorrent loaded everything, a lot of torrents that was stopped 100% green, and in the finished status got the Status red "Error: invalid download state, try resuming".

So using this tool, I was able to change them from "Error: invalid download state, try resuming" to "Finished" status. I don't know if it is a permanent thing. hope so.

The entry you should change is the key "Started", value from "3" to "0". (You can use Seach Value by key: started key: 3)

It's a shame that we can't search them all and replace them (maybe in the notepad, but I don't know if that will work, I'll try it later since I got more than 300 torrents I need to change that... probably won't do it for all of them)

Thanks for the tool really useful. ;)

Edit: Yep, I manage to replace all of them with Unicode notepad++. Just open the "resume.dat" file and search all of the "startedi3" and replace them to "startedi0".

Link to comment
Share on other sites

Ultima, thanks for great tool! That's a really useful stuff.

Something wrong with the way BEE uses the memory. I'm processing really large resume dat (12898058 bytes), replacing some strings with another by "Replace all". I noticed that every new replace increases Private Bytes value of BEE process. After a few replaces we get an error message (something about memory, I don't remember the exact text), then after a while BEE silently crashes. Tested in WinXP SP3 and Win2k3 R2 SE SP2.

In fact, the only safe way is to restart BEE after each replace. Simple reloading file doesn't help.

Feature request: in Replace options, please add "Search everywhere" option to the corresponding drop-down list: on large dat files, reopening Replace dialog window takes a long time. Also, hot ("underlined") keys for buttons ("Replace all", "Replace" etc) would be appreciated.

Link to comment
Share on other sites

Hello, Ultima! First of all, thank you for this great tool, it's been really usefull.

Lately i've been trying to code a similar program, but in c++ not autoit and I have a question that has been scratching my brain for some time. How is it possible that I load a ~6.6mb file in your program and still uses 500k of ram, i'm just filling the tree view with items, no other memory used for storing data, and it uses about 18mb of ram.

So, please, teach me, master !

Link to comment
Share on other sites

  • 1 month later...
  • 3 months later...

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...