3

I've been doing a little DHT scraping to figure out the popularity of various BitTorrent clients. In the results I've collected, some of the most common version strings are from a client identifying itself as "BigUp", but I haven't been able to find anything with this name. Here's a sample of the version strings returned from BEP10 handshakes:

BigUp/11 libtrt/1.1.0.0 Downloader/12430
BigUp/11 libtrt/1.1.0.0 Downloader/12440
BigUp/11 libtrt/1.1.0.0 Downloader/12450
BigUp/12 libtrt/1.2.0.0 Downloader/12460
BigUp/12 libtrt/1.2.0.0 Downloader/12470
BigUp/12 libtrt/1.2.0.0 Downloader/12480
BigUp/12 libtrt/1.2.0.0 Downloader/12490
BigUp/12 libtrt/1.2.0.0 Downloader/12500
BigUp/12 libtrt/1.2.0.0 Downloader/12510
BigUp/12 libtrt/1.2.0.0 Downloader/12520
BigUp/12 libtrt/1.2.0.0 Downloader/12530
BigUp/12 libtrt/1.2.0.0 Downloader/12540
BigUp/12 libtrt/1.2.0.0 Downloader/1940
BigUp/12 libtrt/1.2.0.0 Downloader/1950
BigUp/12 libtrt/1.2.0.0 Downloader/1960
BigUp/12 libtrt/1.2.0.0 Downloader/1970
BigUp/12 libtrt/1.2.0.0 Downloader/1980
BigUp/12 libtrt/1.2.0.0 Downloader/1990
BigUp/12 libtrt/1.2.0.0 Downloader/2010

Version numbers go all the way down to BigUp/5 libtorrent/0.16.0.0, but those are much less common. Also, the torrents that they are sharing are rather odd. Here's a sample of the most common infohashes:

3b2e1b303703b733f6407becc1140eae937d55ac
3b2e1b303703b733f6407becc1140eae937d55ac
4b21bf8f097a4e018ba2d2badf353012d686cd17
b16a48675e0fdb371238e4a6b075807bbd544c40
bd2045ad99b2f29f655ba566f26aedf50eae2780
d89a935c6e8c151b7b1a8278597a8dcba7d468b3
dbab2707740d3d3dadb16d1ea4d602959573cd05
dbf9a9a2815488c32a9c44aeb0af8ad04a33ebac
dde57ab80b8d0313f823e22e70af75ef6ec22882
debeeb0f4cad5861b322e55b8b18ed11169a27f4

Of the infohashes I've managed to resolve to torrent files, they have names like "warfacediff170-171" and contain small zipped files:

name            | size
--------------- | ------
patch.7z.001    | 7.4MB
manifest.xml.gz | 705.0B

While these BigUp clients do have regular DHT functionality, they don't seem to offer magnet-link based torrent downloads, so it's hard to actually get copies of the torrent files. Also, there are relatively few unique torrents being shared by these clients - I've only found about 3k, while other less popular clients share hundreds of thousands.

Does anyone know what this client is?

slang
  • 626
  • 7
  • 26
  • BigUp seems to be a niche cryptocurrency. Maybe they're using bittorrent for their updates. – the8472 Apr 29 '17 at 10:39
  • I doubt it - I'm seeing more than 6 million unique IP addresses that are using this client... it has to be something bigger than that. – slang Apr 29 '17 at 20:52
  • 6 million? That's a lot. Over which time span have you measured that, they might be dynamic IP pools. Are they even on the DHT? Because during some times of the day that's about the number of non-NATed DHT nodes according to my own estimates. And have you checked their ASNs, that might give a hint whether they're dominant in a specific country. – the8472 Apr 29 '17 at 21:02
  • Yeah, it's surprising because that's more than I'm seeing for clients like uTorrent. I've been measuring for a few months. They're on the DHT for connecting to other peers, but they don't support ut_metadata. Haven't done any sort of GeoIP analysis yet, but I'll do that eventually. – slang Apr 29 '17 at 22:09
  • 1
    Also, I've found a video game company called "my.com" that produces a bunch of games named "warface", which might explain the torrent names. Their "my.com game center" also uses BitTorrent based downloads (based on complaints I've read in their forum threads over the last couple years). So I'm trying to unpack a copy of their software to see if that's it. – slang Apr 29 '17 at 22:15
  • Oh wow, my.com's installer actually contains a file called "BIGUP2.dll"... I'll have to figure out how to decompile it or run it in a VM to know for sure, but this seems like it's what I've been looking for. – slang Apr 29 '17 at 22:27

1 Answers1

6

It's a component in the "My.com Game Center" and is used for distributing updates for games and probably the game center itself. Warface is one of the games that My.com owns, which explains the torrent named "warfacediff".

If you decompile the Game Center installer, you will find a file named BIGUP2.dll. That is the torrent client, and it seems to be based on libtorrent.

Presumably, the reason why the client doesn't respond to ut_metadata requests is because the update torrent files are distributed centrally from https://static.gc.my.com/ and they don't want people scraping their torrents. They do run their own tracker, but they don't mark their torrents as private.

slang
  • 626
  • 7
  • 26