Reverse Engineering of eMule

eMule is a popular peer-to-peer (p2p) client which builds upon the severbased eDonkey2000 (ed2k) platform. In newer versions of eMule, lookups can also be performed over the serverless Kad-network, an implementation of a distributed hash table (DHT) called Kademlia. Since only little is known about the techniques and algorithms used by eMule, this thesis presents an analysis of the implementation of Kademlia in eMule. This includes the structure of the routing table, the connection phase with bootstrapping, searching and publishing in Kademlia, the behavior of the client if network address translation (NAT) or a firewall is used and an analysis of all message types used in Kademlia. The algorithms found are compared to the version described in the Kademlia paper. Additionally, a successful attack is presented, that removes an arbitrary keyword from the Kademlia network, using a modified version of the client.