1. Akiba-Online is sponsored by FileJoker.

    FileJoker is a required filehost for all new posts and content replies in the Direct Downloads subforums.

    Failure to include FileJoker links for Direct Download posts will result in deletion of your posts or worse.

    For more information see
    this thread.
    Dismiss Notice

How to detect fake videos before downloading them

Discussion in 'Tutorials' started by SamKook, Apr 15, 2012.

  1. SamKook

    SamKook Akiba Citizen Uploader

    If you downloaded a video from a blog(or somewhere else) and couldn't play it properly, chances are that the video file is actually a dummy(fake) file and that the uploader just made some money off of you downloading those file.
    If you want to avoid this in the future and discourage those uploaders from creating more fake files, here's what you should do.

    What you need:
    -An hexadecimal editor like wxhexeditor

    The 3 steps:
    1. Download the first few MB of the first link(if it has multiple links).
    2. Open that file with the hexadecimal editor of your choice.
    3. Analyze the file content(this is the most complicated part, but is still pretty easy).

    Some informations about the files(not essential):
    A normal video file will have what is called a header which is the part where some information about a video is stored and this is usually followed by an empty block(represented as a bunch of 0).
    If the video is in an archive file(.rar, .7z, etc.), there will also be a header for it but the rest will be the same as the video if there wasn't any compression used(which is usually useless with video file and fake file would be compressed to almost nothing so compression is never used on them).
    Here's an image comparing a video file with the same video, but in an archive file:
    (the left column is the address of the data inside the file, the middle one is the data in hexadecimal form and the right one is the data in ASCII(text) form)
    mkv-rar_compare.

    The selected text is the video header so everything before it in the rar file is the rar header.

    What's important in trying to detect a fake file is what comes after this.

    How to tell if it's fake or not:
    There are 3 types of fake files:
    - An empty file(the hexadecimal portion is filled with 0's after the header)
    - A file filled with a pattern(x number of hexadecimal characters(usually less than 20) are repeated over and over again for the whole file after the header)
    - There could also be a 3rd type where the file would contain all random data or simply be the wrong video, but there is no way to tell without downloading all of it. But luckily, they don't even bother doing that most of the time.

    The empty file is very easy to detect since there's only 0's everywhere. Just scroll down for a while and if you only see 0's then you know it's fake.

    The pattern one is a little harder to detect since it looks like there is something in the file, but if you scroll down rapidly, it's usually very easy to see the pattern repeat itself and that tells you it's fake.

    Here's a comparison of an empty fake file and an actual video file:
    (Empty fake file on the left and actual video on the right)
    fake-real_compare.

    I skipped over 2 empty blocks(you can tell where with the address column) in the real file, but the rest is all filled with random data as opposed to the empty file which only has 0's.

    That way you don't have to finish downloading any of the files so it won't give the uploader any money and if everyone does this, he'll hopefully realize that it's a waste of time to upload fake files.

    I'll try to also add an example of a fake file with a pattern next time I see one(if someone finds one, please let me know).

    If you have questions, commentaries or suggestions, don't hesitate to ask here.
     
    Last edited: Aug 13, 2015
    dwnldingDaikaiju likes this.
  2. frizzled

    frizzled New Member

    How do you download just the first few MB of a file? When I cancel a partial download, my browser (FF11) deletes it.

    Also 0xED is a great free hex editor for mac os. Just google 0xED and it should be the first hit.
     
  3. SamKook

    SamKook Akiba Citizen Uploader

    I usually use jdownloader, it doesn't delete partial file and my browser(opera) act the same way.
    But instead of canceling the download, you can open the file while it's still downloading and check it(assuming your hex editor support this. Mine opens them in read only and keeps refreshing it as it downloads).
     
  4. gyoza ramen & a beer

    gyoza ramen & a beer Active Member

    Is there anyway to send something "wet" to these fake uploaders?

    Another thing to watch for -- and considerably less specific than SamKook's excellent advice above -- is to look at the file-sizes for several posts by the same uploader which, in my experience and not surprisingly, are frequently posted one right after another to see if the MB totals are identical in several consecutive threads.

    This is, of course, only gonna be the case with especially lazy uploaders but I'm surprised how often this happens. First noticed this on legendary------.com a few months back.

    Finally, how 'bout starting a thread listing sites that are know to do this?
     
    Ace69 likes this.
  5. antirad

    antirad Can you see me?

  6. zoolanimal

    zoolanimal jav fisting connoisseur

    thax to SamKook for helping us find fake videos . . .

    thax for the info SamKook - wondered about the proliferation of fakes.

    on march 23, 2012 someone here informed me that the gloryquest video, TT-020 緊縛巨乳熟女 飲尿水責めWフィスト had been posted on adultjav.com but that he couldn't get the video to work. that person later sent me the entire video i am posted here:

    http://depositfiles.com/files/6h2qsabxo
    http://bitshare.com/files/bajji4yb/12_0597.part5.rar.html
    http://www.crocko.com/084C0D71C6574AC5A688548209373035/12_0597.part1.rar
    http://www.crocko.com/95DC4196F9704CFF8A8640EE308F89C5/12_0597.part2.rar
    http://depositfiles.com/files/e7ht2zaph
    http://www.crocko.com/7BD4B6A03C6A47239FEF926FB36F0626/12_0597.part3.rar

    here's the cover for TT-020:

    View attachment 589525

    gspot and mediainfo yield no information on a codec which by itself may be a good clue it is a fake

    i got a free hex editor, HxD, opened the video in it and got the following info i have partially made a screenshot of which goes on for numerous .txt pages:

    [fullattach]589526[/fullattach]

    that is your classic fake
     
  7. open file directory where the file is saved,
    copy the file,
    paste it somewhere else, (or there with a different name),
    open it.
    voila