Community hub
0 subscribers7 pages, 0 posts
Recent from talks
All channels
Be the first to start a discussion here.
Be the first to start a discussion here.
Be the first to start a discussion here.
Be the first to start a discussion here.
Contribute something
Welcome to the community hub built to collect knowledge and have discussions related to Ed2k URI scheme.
Nothing was collected or created yet.
Ed2k URI scheme
View on Wikipediafrom Wikipedia
 | This article needs additional citations for verification. (June 2016) |
In computing, eD2k links (ed2k://) are hyperlinks used to denote files stored on computers connected to the eDonkey filesharing P2P network.
General
[edit]Many programs, such as eMule, MLDonkey and the original eDonkey2000 client by MetaMachine, which introduced the link type, as well as others using the eDonkey file sharing protocol, can be used to manage files stored in the filesharing network.
eD2k links allow a file to be identified from a link in a web browser and to be downloaded thereafter by a client like eMule, Shareaza or any other compatible software. This linking feature was one of the first URIs to be introduced in peer-to-peer file sharing, and had a vast effect on the development of the eDonkey network, as it allowed external link sites to provide verified content within the network. Nowadays, so-called Magnet links have replaced eD2k links in practice. They serve a similar role, but are not limited to the eD2k hash and can contain other hashes such as SHA-1 or MD5 for example, which makes it possible to use these links to point to files in several networks (as well as in BitTorrent) at once.
eD2k links include file hashes, as these hashes can be used as a unique identifier for files within the network, so even if the linked-to file has a different name on two computers within the network, the file can be found on both of them, and file chunks can be obtained from both sources. This is done by using a hash function on the file to calculate its checksum, depending only from the file content, not from its name.
Like other URI protocols, web browsers can be configured to automatically handle ed2k URIs. After installing an eD2k client, the eD2k protocol is optionally registered so that clicking on it in the browser automatically starts the download or asks whether the user wants to start downloading.
File link format
[edit]File links are preceded with the "file" token, which indicates that this is a file link, as opposed to a server, serverlist, nodelist or friend link. The typical eD2k file link also includes the filename and the file size. An example (a link to the 15 MB Purist Edit trailer) is provided below:
ed2k://|file|The_Two_Towers-The_Purist_Edit-Trailer.avi|14997504|965c013e991ee246d63d45ea71954c4d|/
eD2k links can also include a reference to the IP address and port of specific clients that are known to share the linked-to file. This is done by adding a list of sources after the main part of the link, like shown in the following example:
ed2k://|file|The_Two_Towers-The_Purist_Edit-Trailer.avi|14997504|965c013e991ee246d63d45ea71954c4d|/|sources,202.89.123.6:4662|/
On eMule, the link often contains also an AICH top hash |h=H52BRVWPBBTAED5NXQDH2RJDDAKRUWST| to help recover the file in case of corruption during file transfer.
eD2k hash algorithm
[edit]The eD2k hash function is a root hash of a list of MD4 hashes. It gives a different result than a simple usage of the MD4 algorithm.
The file data is divided into full chunks of 9500 KiB (9728000 bytes) plus a remainder chunk, and a separate 128-bit MD4 checksum is computed for each. If the file is greater than 9500 KiB (which means that there is more than one chunk), the eD2k hash is computed by concatenating the chunks' MD4 checksums in order and hashing the result again using MD4. Otherwise, the MD4 hash of the only chunk of the file is used with no further modifications.[1]
This method of hashing allows the recipient to verify that a hash list corresponds to an original eD2k file hash, without the need to actually have the file present on disk.
In the past, there has been some ambiguity for files whose size is a multiple of the chunk size (9500 KiB). Old versions of some eD2k hash tools computed file hashes with an additional 0-byte chunk at the end. This is because an ambiguity of the term remainder chunk which can be interpreted as either the last chunk or a non-full chunk at the end. Following the latter interpretation, some implementations added a zero byte chunk in case the last chunk of a file was a complete one. This practice is discouraged however and the first interpretation is used as a standard nowadays to prevent some files from having different hashes depending on the algorithm implementation used to calculate their hash.[2]
AICH
[edit]The AICH (Advanced Intelligent Corruption Handling) is an eMule extension. It subdivides the 9500 KiB chunk into 180-KiB blocks and builds a Merkle tree out of the SHA1 hashes of the 53 blocks, so that the root hash of each block is called a block hash. The block hashes further feed into a Merkle tree, the root hash of which is the actual AICH root hash. The smaller block size allows eMule clients to more precisely identifify locations of corruption.[3]
Server links
[edit]A server link is a reference to an eDonkey2000 server; clicking on such a link typically adds it to the server list. Server links are indicated by the server token at the beginning of the link and have the following format:
ed2k://|server|IP|PORT|/
- IP – IP of the server to connect to.
- PORT – Port where the server is listening for incoming eD2k connections
Example:
ed2k://|server|207.44.222.51|4242|/
See also
[edit]References
[edit]- ^ emule source, method
CKnownFile::CreateFromFile. - ^ "Ed2k-hash - MLDonkey". mldonkey.sourceforge.net. Archived from the original on 19 December 2017. Retrieved 23 April 2018.
- ^ "Corruption Handling". www.emule-project.net.
External links
[edit]- emule forum guides How to remove the ed2k link protocol association in windows.
- aMule wiki: ed2k link.
- emule project Ed2k link formats supported by emule client.
- ED2K tools - ED2K_Hash Tool to create ED2K hashes.
- Phantom P2P eD2k Links Provider
Ed2k URI scheme
View on Grokipediafrom Grokipedia
ed2k://|file|<filename>|<size in bytes>|<MD4 hash>|/, where the hash uniquely identifies the file content regardless of its name or location, and server links, formatted as ed2k://|server|<IP address>|<TCP port>|/, which direct clients to connect to specific indexing servers for search and metadata retrieval.[1][2]
These links were commonly shared via websites, emails, or forums to distribute files—often media content—across the network, with client applications like eDonkey2000 and eMule registering as handlers to intercept and act on ed2k URIs in web browsers.[2]
Although the official eDonkey2000 software was discontinued in 2005 following legal actions by the Recording Industry Association of America (RIAA) over copyright infringement facilitation, the ed2k scheme persists as of 2025 in open-source clients and communities, supporting ongoing use of the resilient eD2k network infrastructure.[3][4]
History and Development
Origins in eDonkey Network
Jed McCaleb founded the eDonkey network in 2000 through his company MetaMachine, Inc., with Sam Yagan joining as CEO in 2001, as a hybrid server-based peer-to-peer file-sharing system intended to mitigate the single-point-of-failure issues inherent in centralized protocols like Napster by distributing indexing across multiple dedicated servers.[5][6] The ed2k URI scheme emerged in 2001 alongside the eDonkey2000 client software, functioning as web hyperlinks that enabled users to directly access and initiate downloads of specific files within the network by embedding file identifiers.[2] At its core, the scheme was motivated by the need for content-based file identification through cryptographic hashes, which provided unique, filename-independent references to support efficient, decentralized searches and multi-server downloads across the distributed architecture.[6][2] A pivotal early event was the 2005 shutdown of the official eDonkey2000 operations, prompted by legal pressures from a Recording Industry Association of America (RIAA) lawsuit that targeted peer-to-peer networks, which prompted greater dependence on community-driven open-source implementations such as eMule.[7]Evolution and Extensions
The eMule project launched in May 2002 as a free, open-source peer-to-peer file-sharing client for Windows, serving as an alternative to the proprietary eDonkey2000 software while extending compatibility with the ed2k URI scheme.[8] Later versions of eMule, starting with v0.40 in 2004, introduced enhancements such as integration with the Kademlia (Kad) network, enabling decentralized searches and operations alongside the traditional semi-centralized ed2k servers, which ensured the scheme's continued relevance.[9] This open-source adaptation proved crucial after the eDonkey network's official client and central servers were discontinued in September 2005, following legal action by the Recording Industry Association of America (RIAA) and the U.S. Supreme Court's ruling in MGM Studios v. Grokster, which pressured MetaMachine to cease operations.[7] Key protocol extensions emerged through eMule's development, including the addition of Advanced Intelligent Corruption Handling (AICH) in 2003, which improved file integrity by generating hierarchical hashes for data blocks, allowing recovery from partial corruption without redownloading entire 9.28 MB chunks.[10] By 2004, eMule incorporated support for specifying multiple sources directly within ed2k URIs, facilitating faster connection to peers and web-based download points for more efficient file acquisition.[11] In September 2012, the Internet Assigned Numbers Authority (IANA) granted provisional registration to the ed2k URI scheme, defining its standard syntax ased2k://|file|<filename>|<size>|<hash>|/ to enhance interoperability with web browsers and other applications beyond P2P clients.[1]
The ed2k URI scheme's model of embedding content identifiers and sources in hyperlinks influenced subsequent P2P systems, notably serving as a basis for the magnet URI scheme in BitTorrent, developed in 2002 as a vendor-neutral generalization of ed2k and Freenet URI formats to enable metadata-free file referencing via hashes.[12]
As of 2024, the eMule project continues with community-maintained releases, such as version 0.70b, ensuring ongoing support for the ed2k URI scheme.[8]
Syntax and Format
General Structure
The ed2k URI scheme adheres to a structured format beginning with the scheme identifiered2k://, followed by a type-specific path where components are delimited by the pipe character (|). This design facilitates the identification of resources on the eDonkey network, such as files or servers, through hyperlinks that clients can parse and act upon. The structure terminates with a forward slash (/) in basic forms, ensuring compatibility with standard URI parsing conventions.[1][2]
Mandatory elements in all ed2k URIs include the "ed2k" scheme prefix, an action type indicator (e.g., "file" for file links or "server" for server connections), and subsequent parameters specific to the type, such as encoded identifiers or metadata. These parameters are separated by pipes to maintain clarity and ease of parsing in client applications. For instance, file links require details like filename and size, while server links include IP address and port, all integrated within this delimited framework.[1][2]
Parameters involving text, such as filenames, must be percent-encoded using UTF-8 representation in accordance with RFC 3986 to handle special characters, spaces, and non-ASCII content safely within the URI. Binary elements, including cryptographic hashes, are encoded in lowercase hexadecimal notation to ensure unambiguous transmission and verification. This encoding approach aligns with broader URI standards while accommodating the scheme's P2P-specific needs.[13]
File Link Format
The file link format in the ed2k URI scheme identifies specific files for download within the eDonkey network, using a structured syntax that prioritizes content verification through hashing. The complete format ised2k://|file|<URL-encoded filename>|<file size in decimal bytes>|<hex eD2k hash>[optional parameters]|/, where parameters are delimited by pipe characters (|) and the URI concludes with a trailing slash after the final pipe.[14][15][2]
The filename parameter consists of a human-readable name, including any extension, which is URL-encoded to safely handle special characters or spaces in web contexts. The file size, specified as an integer in decimal bytes, aids in initial compatibility checks and bandwidth estimation during transfers. The core eD2k hash is a 32-character hexadecimal string serving as the file's unique identifier, computed as an MD4 hash of concatenated MD4 digests from fixed-size file blocks (typically 9,728,000 bytes each).[14][15][16]
Optional parameters follow the hash and are separated by pipes, including sources for direct peer connections (e.g., |sources,192.168.1.1:4662|), the AICH root hash for enhanced integrity verification (e.g., |h=<32-char AICH hash>|). A basic example without optionals is ed2k://|file|example.txt|1024|0123456789abcdef0123456789abcdef|/, representing a 1,024-byte file named "example.txt" with the specified hash.[14][15]
These URIs act as content-addressable pointers, allowing eDonkey clients to query network servers or peers by hash to locate matching files, decoupling identification from filenames or storage locations for robust distribution.[2][14]
Server Link Format
The server link format in the ed2k URI scheme provides a means for clients to directly connect to specific eDonkey network servers by encoding the server's address and port in a standardized hyperlink structure.[14] This format begins with the scheme identifiered2k:// followed by the token |server|, the server's IP address or hostname, the TCP port number, and terminates with |/. The full syntax is ed2k://|server|<IP [address](/page/Address) or hostname>|<TCP [port](/page/Port)>|/.[14][2]
The IP address parameter accepts either dotted decimal notation (e.g., 192.168.1.1) or a DNS-resolvable hostname (e.g., example.server.com), allowing flexibility in addressing the target server. The TCP port specifies the primary connection endpoint, typically defaulting to 4661 if not explicitly provided; this port handles initial client-server handshakes and reliable data exchange.[2]
A representative example of a basic server link is ed2k://|server|example.server.com|4661|/, which instructs a compatible client like aMule or eMule to add the specified server to its list and attempt a connection.[14]
This format enables users to manually incorporate trusted servers into their client's configuration, circumventing automated server discovery mechanisms that rely on peer exchanges or static lists.[14] It proves particularly valuable in environments with restricted connectivity, such as firewalls blocking broadcast traffic or regions with censored network access, where direct specification ensures reliable entry into the eDonkey network for subsequent file searches and downloads.[2]
Hashing Mechanisms
eD2k Hash Algorithm
The eD2k hash algorithm serves as the core identifier for files in the ed2k URI scheme, generating a unique 128-bit value to facilitate file sharing, deduplication, and integrity checks within the eDonkey network. It relies on the MD4 hash function, a one-way cryptographic primitive designed for producing fixed-length digests from arbitrary input data. This multi-stage hashing process ensures that even minor alterations to a file result in a completely different identifier, while supporting efficient partial downloads and verifications.[18] The computation begins by partitioning the file into fixed-size chunks of 9,728,000 bytes, with the final chunk hashed as-is if smaller than this size when the file length is not evenly divisible. Each chunk is then processed independently using the MD4 algorithm to produce a 128-bit (16-byte) hash. These per-chunk hashes are concatenated sequentially to form a single binary string, which is subsequently hashed again with MD4 to derive the final eD2k hash—a 128-bit value typically encoded as 32 hexadecimal digits. For files under 9,728,000 bytes, the process simplifies to a direct MD4 hash of the entire file content, bypassing chunking.[18][19] This procedure can be expressed as:eD2k_hash = MD4( CONCAT( MD4(chunk_1), MD4(chunk_2), …, MD4(chunk_N) ) )
eD2k_hash = MD4( CONCAT( MD4(chunk_1), MD4(chunk_2), …, MD4(chunk_N) ) )
chunk_size = 9728000 bytes and N = ceil(file_size / 9728000).[18][19]
The algorithm's design offers strong collision resistance for practical file deduplication purposes, with the 128-bit output space making accidental hash matches negligible in large-scale networks. However, MD4's known cryptographic flaws render the eD2k hash vulnerable to deliberate collision attacks, enabling adversaries to construct distinct files (e.g., benign and malicious variants) that share the same identifier, thus undermining network trust. As a Merkle-Damgård hash construction, it is also prone to length-extension attacks, where an attacker can extend the input data while forging a valid hash without knowing the original content. The uniform chunk size supports granular features like verifying downloaded portions independently, enhancing resilience to transmission errors.[20][21]
AICH Root Hash
The AICH Root Hash, part of the Advanced Intelligent Corruption Handling (AICH) system, was developed by the eMule project and introduced in version 0.44a released on September 5, 2004, as an optional extension to the ed2k URI scheme for enhanced file integrity verification.[22] This feature allows clients to detect and repair data corruption at a granular level without requiring a full file rehash, addressing limitations in the original eDonkey network's chunk-based verification.[23] The underlying algorithm constructs a Merkle tree using SHA-1 hashes applied to fixed 180 KB (184,320-byte) blocks within each 9.28 MB file part, resulting in approximately 53 blocks per part.[23] Block hashes are iteratively combined through parent nodes up to the root, enabling targeted validation of subtrees for partial file verification rather than holistic checks. The root hash itself is a 160-bit SHA-1 value encoded in base32, yielding a 32-character string that serves as a compact integrity anchor for the entire tree.[23] In ed2k URIs, the AICH root hash is appended directly after the standard eD2k hash using the format |h=<base32_root_hash>|, making it an seamless extension for compatible clients. For instance, a complete file link might appear as:ed2k://|file|example.file|9728000|ed2k_md4_hash|h=H52BRVWPBBTAED5NXQDH2RJDDAKRUWST|/.[11] This integration ensures that links generated by eMule include the parameter when AICH data is available, while older clients simply ignore it.[11]
By providing block-level granularity, the AICH root hash minimizes bandwidth waste during recovery: upon detecting corruption in a part, a client can solicit a recovery packet containing relevant subtree hashes from peers with the full AICH hashset, allowing precise block repairs instead of re-downloading megabyte-scale chunks.[23] This mechanism is particularly advantageous in peer-to-peer environments, where it reduces overall redownload overhead from up to 4.64 MB per corrupted part (under prior intelligent chunk handling) to as little as 180 KB, enhancing reliability for large or frequently transferred files.[22]
Features and Extensions
Sources Specification
The sources parameter in ed2k file URIs is an optional component that embeds a list of known peer endpoints to facilitate direct connections in the eDonkey network. This parameter is particularly valuable for accelerating the discovery and connection to file sources, bypassing initial server queries or searches, which is beneficial for rare files or in private sharing scenarios where peer availability may be limited.[14] The format follows the structure|sources,IP:port,IP:port,...|, where each source is an IP address or hostname followed by a colon and the port number. Multiple sources are separated by commas, allowing clients to attempt connections to listed peers immediately upon processing the URI.[14]
For example, a URI including a single source for localhost on port 8080 would appear as |sources,127.0.0.1:8080|. This text-based encoding is straightforward and URL-safe, though practical limits are typically 50-100 sources per URI due to browser and URL length constraints (e.g., around 2,083 characters in many systems).[14]
Other optional extensions include HTTP sources in the format |http://URL|, which allow clients to download from web servers as an additional source, and part hashes (|part|hash1|hash2|...|) for specifying incomplete file sections to resume downloads efficiently. These features enhance flexibility in file sharing across the network.[14]
Usage and Implementation
Client Support
The ed2k URI scheme is primarily supported by dedicated peer-to-peer (P2P) clients designed for the eDonkey network, which parse these URIs to initiate file downloads, connect to servers, and manage sources. Among the primary clients, eMule has been active since 2002 as an open-source alternative to the original eDonkey software, offering full support for ed2k URIs including file links, server links, and advanced features like AICH root hashes for corruption handling.[24][25] MLDonkey, a multi-protocol P2P client, integrates ed2k URIs alongside support for networks like BitTorrent and Gnutella, enabling swarming downloads across protocols since version 2.5.30.[26] Shareaza, a Windows-based multi-network client, historically provided robust ed2k URI parsing and eDonkey network compatibility, though its development has largely stalled after version 2.7.10.2, making it a legacy option for ed2k operations. Cross-platform implementations extend ed2k support beyond Windows. aMule serves as a fork of eMule tailored for Linux and macOS, maintaining full ed2k URI handling and AICH integration while adding Unix-specific features like remote GUI control.[27][28] The original eDonkey2000 client, which was Windows-only and introduced the ed2k URI scheme, ceased operations in 2005 following legal settlements, but its legacy influenced subsequent open-source clients.[29] Browser integration for ed2k URIs typically involves registering the scheme as a URI handler at the operating system level, allowing direct launching of compatible clients upon clicking a link. For instance, Firefox and Chrome can be configured to pass ed2k URIs to clients like eMule or aMule via extensions or default application settings, though this requires manual setup such as editing browser configurations or installing handler tools.[30] As of 2025, eMule's official latest stable release is version 0.50a, with community mods providing updates up to versions like 0.70b; these continue to support all ed2k extensions such as sources specification and opaque keywords, ensuring compatibility with modern network conditions.[4] However, browser support remains limited due to evolving security policies that restrict custom URI schemes to mitigate risks like unauthorized protocol execution.[31]Security Considerations and Legacy
The eD2k URI scheme, integral to the eDonkey network, has been susceptible to several security vulnerabilities, particularly in its early implementations. One notable issue was the buffer overflow in eDonkey2000 clients prior to version 35.16.61, where crafted ed2k URIs containing overlong filenames (e.g., exceeding 247 bytes) could overwrite stack memory, leading to denial-of-service crashes or potential arbitrary code execution.[2] This exploit, documented in CVE-2002-0967, was deliverable via hyperlinks in emails, web pages, or chat, exploiting the client's URI parsing mechanism without requiring authentication.[2] Additionally, the reliance on the MD4 hash function for file identification exposed the network to collision attacks, allowing adversaries to generate distinct files with identical hashes since the algorithm's weaknesses were identified as early as 1991.[32] These collisions facilitated fake-file attacks, where benign content could be distributed to most peers while malicious variants (e.g., containing branching or encrypted payloads) were selectively delivered to targets, undermining file integrity and enabling targeted malware distribution.[20] Efficient practical collisions were demonstrated by 2005, amplifying risks in peer-to-peer environments like eD2k.[20] To mitigate these risks, users are advised to enable protocol encryption for source connections, often via the 0x01 flag in eMule's extended protocol, which obfuscates traffic and reduces eavesdropping exposure.[33] Verifying files against AICH (Advanced Intelligent Corruption Handler) root hashes, a SHA-1-based extension, provides an additional layer of integrity checking beyond MD4, detecting alterations from collisions or corruption during downloads—though it requires explicit enablement and is most effective when applied universally rather than selectively.[20] Furthermore, connecting only to trusted servers minimizes man-in-the-middle (MITM) risks, as unverified servers could impersonate legitimate ones to intercept or alter file exchanges.[9] By 2025, the ed2k URI scheme persists in a niche capacity primarily through the eMule client, which connects tens of thousands of users to the eDonkey and Kademlia networks for file sharing, though it represents a minor fraction of overall peer-to-peer traffic dominated by more modern protocols.[9] Operational servers such as Mazinga continue to support the network, maintaining lists of active peers and files as evidenced by updated server.met files.[34] This enduring but limited usage stems from the scheme's specialized features like source exchange and credit systems, yet it has declined sharply since the 2005 shutdown of the official eDonkey2000 service amid legal pressures from copyright holders, including cease-and-desist actions by the Recording Industry Association of America (RIAA).[7] The rise of BitTorrent starting in 2001 accelerated this decline, as its decentralized trackerless model and superior efficiency for large files captured the majority of P2P traffic, shifting user preferences away from server-dependent systems like ed2k.[35] With no official development since the eDonkey shutdown, ed2k relies on community-maintained clients like eMule, limiting innovation and adaptability to contemporary security standards and legal landscapes.[36]References
- https://wiki.amule.org/wiki/Ed2k_link
- https://wiki.amule.org/wiki/MD4_hash
- https://wiki.[amule](/page/AMule).org/wiki/Ed2k_link
- https://wiki.amule.org/wiki/AICH
- https://wiki.amule.org/wiki/MlDonkey
- https://wiki.amule.org/wiki/Ed2k_links_handling