Summarize Our Knowledge Of Kazaa Registry

[KazaaSearch]

KAZAA REGISTRY EXPLANATION

1. HKLM\\Software\\Kazaa

DisablePort80Listen: self-evident, if non-zero, then port 80 is disabled. You can check it by typing http://localhost/ into web browser; if it shows the list of your shared files, then your Kazaa listens to port 80.

ListenPort: default value is 1214. Note: if you specifu here another port, Kazaa will listen to both 1214 and this port, but will report only this port to others. X-Kazaa-IP: my_ip_address:ListenPort

my_ip_address: evident

network_config: among unidentified binary info, contains that irritating auto-update message in many languages. Here is all textual info contained in this key.

en
New version KMD 2.0.2 available
Includes updates for Kazaa v2
Kazaa v2 features include:
Integrated anti-virus protection
Customizable skins
+ more!
Click Yes to update
kmd202gu_en.exe
Kazaa update 2.0.2
Sharman Networks Ltd

de
Neue KMD 2.0.2 Version erhältlich
Zu den Leistungsmerkmalen gehören:
Integrierter Virenschutz
Individualisierbare Skins
+ mehr!
Klicken Sie “Ja” zum Aktualisieren
kmd202gu_de.exe

Nouvelle version de BMK 2.0.2 disponible
Ses caractéristiques sont :
Une protection anti-virus intégrée
Des habillages à personnaliseret
+ encore !
Cliquez "Oui" pour mettre à jour

kmd202gu_fr.exe

Está disponible la nueva versión EMK 2.0.2
Sus características incluyen:
Protección integrada contra virus
Pieles personalizadas
+ ¡más!
Hacé click en Sí para actualizar
kmd202gu_es.exe

:KaZaA ConnectedNetworks:Grokster fileshare MusicCity

Please install this Grokster upgrade to Version 1.5.1 which will provide better network connectivity and several bug fixes. Grokster thanks you for helping build the largest and best file sharing community on the Internet!

Choose "Yes" and the upgrade will take place automatically. If you have questions or problems upgrading, please consult the support forum on our homepage.
GroksterUpdate151.exe
Grokster update 1.5.1

:Grokster ConnectedNetworks:KaZaA fileshare MusicCity
:fileshare ConnectedNetworks:KaZaA Grokster MusicCity
:MusicCity ConnectedNetworks:KaZaA fileshare Grokster

RequiredClientEncryptionBits:41
RequiredSupernodeEncryptionBits:41
AuthUrlMask:5
HTTPAuthBits:38
MinSupernodeLibVersion:26
MinSupernodeSoftwareVersion_1752395113:126
SearchIndirectNodesMin:6
SearchIndirectNodesMax:10
SearchIndirectEndResults:10
SearchResultsMax:200
DownloadSearchStep:1
DownloadSearchCount:12
UDPMode:7
InfoCode:5d6bf0f0e872b998cef28458cddc0f8a
<KaZaASignature>


2. HKLM\\Software\\Kazaa\\Bandwidth

Anybody, please explain these values, and give tips how to manipulate Kazaa bandwidth (without crashing it).

3. HKLM\\Software\\Kazaa\\CDN

No idea.

4. HKLMSoftwareKazaaCloudload

NOTE: in Kazaa Lite 1.7.2 this key was renamed to Cloadload.

ExeDir: path to Kazaa.exe, very useful for programmers.

5. HKLMSoftwareKazaaConnectionInfo

KazaaNet: includes local database of supernode IP's. And probably includes some security certificates/keys/etc. for connection with current SN?

6. HKLMSoftwareKazaaLocalContent

values are self-evident.

7. HKCUSoftwareKazaa

LastSearchHash: 24-byte hash made of your participation level and machine-specific info (like HardDisk serial number and maybe more). Used for participation level storage.

LimitBitrate: very important key, MUST be set to zero, otherwise you LOSE a lot of hi-quality files!

8. HKCUSoftwareKazaaAdvanced

MaxSearchResult: must be set to 1000 or higher (otherwise you can lose some results); normally set to 100 or 200. Intrinsic limit of Kazaa is about 500.

ScanFolder: I don't know what folder scan is regulated by this. Probably your shared folder.

SuperNode: actually means "Disable supernode", corresponds to "Do not function as a supernode" checkbox in Tools/Options/Advanced. If you set it to zero, you have a chance to become a supernode. If you set it to nonzero, you will never be SN.

9. HKCUSoftwareKazaaInstantMessaging: evident settings

10. HKCUSoftwareKazaaKazaa Lite: settings for graphics interface like column sizes etc. Nothing really important.

11. HKCUSoftwareKazaaLocalContent: list of shared directories, your DownloadDir, and DisableSharing flag.

12. HKCUSoftwareKazaaResultsFilter: evident values

13. HKCUSoftwareKazaaSearch: probably this is the storage of previous search results, although the data are binary, anyone can explain?

14. HKCUSoftwareKazaaSettings

Date: what date is it? First installation date?

UseCount: count of what? use what for?

15. HKCUSoftwareKazaaSkins, HKCUSoftwareKazaaSOCKS - evident values

16. HKCUSoftwareKazaaTransfer: another important key

CacheDiscoveryTime, CacheHost, CachePort: what is cache? Does it mean supernode or local cache or what?

ConcurrentDownloads: controls the number of your downloads. I usually set it to 1000000 or something :)
ConcurrentUploads: same for uploads.
DlDir0: another way of controlling your downloads directory. What if it is not the same as HKCUSoftwareKazaaLocalContentDownloadDir ???
NoUploadLimitWhenIdle: very bad option, must be zero.
UploadBandwidth: on my comp it is zero, I think this means no upload bandwidth limit? What is the best value for it?

17. HKCUSoftwareKazaaUserDetails: evident

[KazaaSearch]

I figured out that my current supernode IP and port is located in KazaaNet reg key (HKLM Software Kazaa ConnectionInfo). I will experiment and try forcing Kazaa to connect to a given supernode. Maybe somebody has already done it? Random Nut, you seem very skilled in playing with Kazaa :) Did you try this?

Anyway, if this doesn't work, I will try to rewrite supernode IP directly in the Kazaa memory. Provided that the virtual memory page is not write-protected...

PS. How do I figure out my current SN IP and port? I use javascript:
<script>
function getURL(url){
try{
req = new ActiveXObject("Microsoft.XMLHTTP");
req.open("GET", url , false);
req.send("");
// text=req.getResponseHeader("X-Kazaa-SupernodeIP");
text=req.getAllResponseHeaders();
} catch(e){}
return text;
}
alert(getURL("http://127.0.0.1:1214/"));
</script>

[the flinger]

i dunno, but chip does it wel :)

[KazaaSearch]

Who is chip? Brother of Dale?

[the flinger]

you COULD be shot for that :)

www.dietk.com (http://www.dietk.com)

the new release looks SO DAMN GOOD

[KazaaSearch]

Originally posted by the flinger@Nov 27 2002, 01:30 AM
you COULD be shot for that :)

www.dietk.com (http://www.dietk.com)

the new release looks SO DAMN GOOD
Why do you give this link to DietK? I found no info about KAzaa Registry on their site.

BTW, is there anything besides registry changes and dowloads accelerator (which is the same as FTA or even worse) in DietK? I tried this program, but found it absolutely useless.

What can it actually do?

[KazaaSearch]

Hmm, I have experimented with ListenPort registry entry, set it to another value, and now I got the following thing:
Kazaa reports to other clients that it uses another port (let's say, 6666), like this:
X-Kazaa-IP: 66.66.66.66:6666

I thought this may increase security because hackers and other network explorers (like RIAA bastards seeking for Kazaa users) assume that everybody uses port 1214 which is default port.

But then I scanned my comp for open ports and saw that Kazaa was still listening to port 1214, as well as port 6666! Instead of stoppin up security hole I opened another one...

However, I disabled port80 listening in the registry. This port is too frequently scanned (actually this is the first to be scanned by anybody) and listening to it may be a huge security hole.

What do you guys think

[evilbagpuss]

Originally posted by KazaaSearch@Nov 26 2002, 11:35 PM
7. HKCUSoftwareKazaa

LastSearchHash: what the hell is that?


This is the participation level. There is an algorithim unique to each machine that converts the P-level integer to hex digits and back again. You can verify this with regmon and see this registry level change as your P-level changes.

You can also "capture" your current P-level by exporting this part of the registry with regedit and import it back again to get the same P-level.

This is as close to a cheat for 2.0.2 I have been able to find.

NB This registry setting will only work on your machine. If you have a P-level of 1000 you cant export the registry value give it to a friend and expect them to get a P-level of 1000.

This is because the algorithim is specified by unique variables such as the serial number of your HD.

Sorry if this has already been mentioned somewhere on this board, but when you search for participation level there are a lot of results to look through.

[Barbarossa]

Originally posted by KazaaSearch@Nov 27 2002, 02:24 AM
But then I scanned my comp for open ports and saw that Kazaa was still listening to port 1214, as well as port 6666! Instead of stoppin up security hole I opened another one...

Yeah, I noticed this too. What a piece of crap. I think that the specifying another port option is simply a way to get round ISP's who block port 1214.

[VB]

Tip: if you want to use a in your post, type two backslashes B)


C:program fileskazaa lite

will result in:

C:program fileskazaa lite

[random nut]

Originally posted by Paul@Nov 27 2002, 06:00 PM
Tip: if you want to use a in your post, type two backslashes B)


C:program fileskazaa lite

will result in:

C:program fileskazaa lite
LOL, that really helped, didn't it? :D I don't see your \'s.

[KazaaSearch]

Originally posted by random nut+Nov 27 2002, 06:28 PM--></span><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (random nut @ Nov 27 2002, 06:28 PM)</td></tr><tr><td id='QUOTE'><!--QuoteBegin--Paul@Nov 27 2002, 06:00 PM
Tip: if you want to use a &nbsp; in your post, type two backslashes &nbsp; B)


C:program fileskazaa lite

will result in:

C:program fileskazaa lite
LOL, that really helped, didn't it? :D I don't see your 's.[/b][/quote]
I was so smart to try double-slash escape sequence cople days ago. And was really surprised when I ended up with same shit...
Paul, something is wrong in the Kingdom of Denmark! (this pretends to be Shakespeare's quote) :)

[KazaaSearch]

Originally posted by random nut+Nov 27 2002, 06:28 PM--></span><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (random nut @ Nov 27 2002, 06:28 PM)</td></tr><tr><td id='QUOTE'><!--QuoteBegin--Paul@Nov 27 2002, 06:00 PM
Tip: if you want to use a &nbsp; in your post, type two backslashes &nbsp; B)


C:program fileskazaa lite

will result in:

C:program fileskazaa lite
LOL, that really helped, didn't it? :D I don't see your 's.[/b][/quote]
But how did you finally input backslash, random nut? :) I see at least one in the original post. Though, ther is no in the quotation.
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

[random nut]

Originally posted by KazaaSearch@Nov 27 2002, 10:48 PM
But how did you finally input backslash, random nut? :) I see at least one in the original post. Though, ther is no in the quotation.
\\\\\\\\\\\\\\\\\
Just use double backslashes like this \\ (the original message includes 4, but only 2 of course are visible). The forum doesn't restore the backslashes to double backslashes when quoting (or editing!) a message, so that's why it was removed.

[KazaaSearch]

Nobody knows more about registry? Pah!

[random nut]

Grab yourself a debugger and catch all calls to the functions that read and write registry keys.

That CloudLoad stuff might be the PE executable found in Kazaa.