Site hosted by Angelfire.com: Build your free website today!
structure of .dat files
Structure of .dat files:

if you have discovered some info not covered here
or in this gr8ttt work by frejon55,

you could be interested on sending me that, in order to complete this table and the dat viewer !(idleloopyahoo.com)
u would be added to the list of contributors

rows with palid rose background indicate incomplete comprehension of that data:
you can try to figure out their meaning !.
rows with green background indicate recently discovered things.

data
description
DATA data being downloaded
dw {0x0, 0x1, ...}

download state:
0x0: ACTIVE
0x1: PAUSED
0x3, 0x4... ??? i've seen 0x4 value sometimes... ("searching"?)

dw {number of users} # users stored

loop {number of users}

string {file name}, byte 0 'file name' is repeated or no, for every user: usually it's only stored in the first user: the rest are mere [word 0].
'url' field is infrequent.
string {url}, byte 0
word {fileID}, word 0 user file ID: indicate a subfolder related (at least) with an old form of kazaa http links.
byte array[20] file signature.
dw {file size}  
dw {user ip}  
dw {user port}  
dw {supernode ip}  
dw {supernode port}  
bytearray[69] {user name + byte 0} + random pad
dw {transfer speed} in kbps (not kBs, KBs)
dw {date when transfer speed was last checked}  
dw unknown
dw {source group?} i haven't find a use for this one.
dw {retry?} i haven't find a use for this one.

dw

byte

unknown (always 0x0?)

byte 1 marks end (?)

end loop

for each user there's this structure of data. If {file name} is not stored, each user occupy 141 bytes.
dw {number of parameters} always greater than zero.

loop {number of parameters}

dw {parameter type} an integer identifier.
dw {parameter length} bytes occupied by parameter data.
bytearray[parameter length]  

end loop

parameters describing the archive being downloaded and its contents.
list of parameters stored and their meaning.
dw date # seconds from epoch: last modification of this file? : i'm not completely sure... sometimes this date isn't enough accurate, and others has a value little different from the one the OS assigns to the file...
bytearray [8] unknown data (?), seems to be =
0xFF FF FF FF  +   bytearray[4]
string {download path} + byte 0 indicates where the archive will be written and with which name when the download ends.
dw 0, dw 1 always these values, or not ?
dw {number of downloaded data blocks}  
loop {number of downloaded data blocks}

dw {start of the block}
this byte is the beginning of a data block
dw {length of the block} bytes occupied by that data block.

end loop

The first data block is numbered 0.
The {number of downloaded data blocks}may be zero: in this case, this block of data isn't present.
dw {0x0, 0xFFFFFFFF} if {number of downloaded data blocks}>0, this is usually 0x0.
dw {total length of file being downloaded (in bytes) }  
byte 0 always zero?
loop

dw { ??? } unknown. Seems to represent valid byte positions for begin new blocks of data (dw), with some unknown data associated (dw). Usually, one of these positions (dw, dw) is repeated at the end.

end loop

this part isn't always present. In fact, only few files have it.
dw 0  
bytearray[4] = 'KAZA' KaZaA file identifier
word {length of dat tail info - 10} bytes of appended tail data.
dw {dat info signature} this signature protects dat info from modifications.
idleloopyahoo.com


1
'Year(dw)', least sign. byte, 0,0,0
2
 
3
'Signature (same as user stored data)', hexadecimal
4
'Title', string,0
5
'Time(DW:SEC)', : least sign. byte, 0,0,0
6
'Artist', string,0
7
 
8
'Album', string,0
9
 
10
'Language', string,0
11
 
12
'Keyword', string,0
13
'Image or Film X(DW) Y(DW)', : least sign. byte, more sign. byte,0,0 X =
14
'Category', string,0
15
 
16
'OS',
17
'Color Depth (bits)', : least sign. byte, 0,0,0
18
'TypeDesc', string,0
19, 20
 
21
'Quality(dw)', (bitrate 4 mp3: 0x80=128kbps)
22, 23
 
24
'Version', (dw*4/100?)
25
'Date (?)',
26
'Description', string,0
27
 
28
'Compression' (codec), string (4 bytes) (without final 0x0 !)
29-40
 
41
sometimes there are lots of this type..., with usual values from xx xx xx 00 to xx xx xx 01 (dw, always).
42-52
 
53
Integrity rating 4 bytes: 0=poor, 1=average, 2=excellent
thanx to: grandmaster.kgmx.de, frejon55, hope i haven't forgotten anyone!

Conventions:
dw=double word (32 bits),
w or word=16 bits,
byte=8 bits,
0x = indicates a number in hexadecimal notation (0x45, 0xA7...) filling up necessary bits.
0 = indicates all bits 0, filling up all available space.

by far, the most comprehensive study about kazaa formats that i've found, can be explored here: >> frejon55 << ... it was a pity this info wasn't available when i made my effort...  ;)
if you have discovered some info not covered here (or in this gr8ttt work by frejon55),
you could be interested on sending me that, in order to complete this table and the dat viewer !(idleloopyahoo.com)
u would be added to the list of contributors


list of contributors:
by order of appearance ;)     i could use "importance" or "alphabetic" ordering, but it takes less work 4 me this way :b
grandmaster.kgmx.de
this could be u :)))
idleloopyahoo.com (this is me ;)

read as " let's open that mandarin ! "