How to detect fake videos before downloading them

SamKook

Akiba Citizen
Uploader
May 10, 2009
2,795
3,791
If you downloaded a video from a blog(or somewhere else) and couldn't play it properly, chances are that the video file is actually a dummy(fake) file and that the uploader just made some money off of you downloading those file.
If you want to avoid this in the future and discourage those uploaders from creating more fake files, here's what you should do.

What you need:
-An hexadecimal editor like wxhexeditor

The 3 steps:
1. Download the first few MB of the first link(if it has multiple links).
2. Open that file with the hexadecimal editor of your choice.
3. Analyze the file content(this is the most complicated part, but is still pretty easy).

Some informations about the files(not essential):
A normal video file will have what is called a header which is the part where some information about a video is stored and this is usually followed by an empty block(represented as a bunch of 0).
If the video is in an archive file(.rar, .7z, etc.), there will also be a header for it but the rest will be the same as the video if there wasn't any compression used(which is usually useless with video file and fake file would be compressed to almost nothing so compression is never used on them).
Here's an image comparing a video file with the same video, but in an archive file:
(the left column is the address of the data inside the file, the middle one is the data in hexadecimal form and the right one is the data in ASCII(text) form)
mkv-rar_compare.jpg


The selected text is the video header so everything before it in the rar file is the rar header.

What's important in trying to detect a fake file is what comes after this.

How to tell if it's fake or not:
There are 3 types of fake files:
- An empty file(the hexadecimal portion is filled with 0's after the header)
- A file filled with a pattern(x number of hexadecimal characters(usually less than 20) are repeated over and over again for the whole file after the header)
- There could also be a 3rd type where the file would contain all random data or simply be the wrong video, but there is no way to tell without downloading all of it. But luckily, they don't even bother doing that most of the time.

The empty file is very easy to detect since there's only 0's everywhere. Just scroll down for a while and if you only see 0's then you know it's fake.

The pattern one is a little harder to detect since it looks like there is something in the file, but if you scroll down rapidly, it's usually very easy to see the pattern repeat itself and that tells you it's fake.

Here's a comparison of an empty fake file and an actual video file:
(Empty fake file on the left and actual video on the right)
fake-real_compare.jpg


I skipped over 2 empty blocks(you can tell where with the address column) in the real file, but the rest is all filled with random data as opposed to the empty file which only has 0's.

That way you don't have to finish downloading any of the files so it won't give the uploader any money and if everyone does this, he'll hopefully realize that it's a waste of time to upload fake files.

I'll try to also add an example of a fake file with a pattern next time I see one(if someone finds one, please let me know).

If you have questions, commentaries or suggestions, don't hesitate to ask here.
 
Last edited:
  • Like
Reactions: dwnldingDaikaiju

frizzled

New Member
Sep 28, 2008
5
5
How do you download just the first few MB of a file? When I cancel a partial download, my browser (FF11) deletes it.

Also 0xED is a great free hex editor for mac os. Just google 0xED and it should be the first hit.
 

SamKook

Akiba Citizen
Uploader
May 10, 2009
2,795
3,791
I usually use jdownloader, it doesn't delete partial file and my browser(opera) act the same way.
But instead of canceling the download, you can open the file while it's still downloading and check it(assuming your hex editor support this. Mine opens them in read only and keeps refreshing it as it downloads).
 

gyoza ramen & a beer

Active Member
Feb 20, 2009
548
31
Is there anyway to send something "wet" to these fake uploaders?

Another thing to watch for -- and considerably less specific than SamKook's excellent advice above -- is to look at the file-sizes for several posts by the same uploader which, in my experience and not surprisingly, are frequently posted one right after another to see if the MB totals are identical in several consecutive threads.

This is, of course, only gonna be the case with especially lazy uploaders but I'm surprised how often this happens. First noticed this on legendary------.com a few months back.

Finally, how 'bout starting a thread listing sites that are know to do this?
 
  • Like
Reactions: Ace69

zoolanimal

jav fisting connoisseur
Apr 29, 2009
3,367
5,468
thax to SamKook for helping us find fake videos . . .

thax for the info SamKook - wondered about the proliferation of fakes.

on march 23, 2012 someone here informed me that the gloryquest video, TT-020 緊縛巨乳熟女 飲尿水責めWフィスト had been posted on adultjav.com but that he couldn't get the video to work. that person later sent me the entire video i am posted here:

http://depositfiles.com/files/6h2qsabxo
http://bitshare.com/files/bajji4yb/12_0597.part5.rar.html
http://www.crocko.com/084C0D71C6574AC5A688548209373035/12_0597.part1.rar
http://www.crocko.com/95DC4196F9704CFF8A8640EE308F89C5/12_0597.part2.rar
http://depositfiles.com/files/e7ht2zaph
http://www.crocko.com/7BD4B6A03C6A47239FEF926FB36F0626/12_0597.part3.rar

here's the cover for TT-020:

View attachment 589525

gspot and mediainfo yield no information on a codec which by itself may be a good clue it is a fake

i got a free hex editor, HxD, opened the video in it and got the following info i have partially made a screenshot of which goes on for numerous .txt pages:

[fullattach]589526[/fullattach]

that is your classic fake
 
Jun 17, 2008
51
12
How do you download just the first few MB of a file? When I cancel a partial download, my browser (FF11) deletes it.

Also 0xED is a great free hex editor for mac os. Just google 0xED and it should be the first hit.

open file directory where the file is saved,
copy the file,
paste it somewhere else, (or there with a different name),
open it.
voila