PHP read qqwry.dat ip address database file program

PHP read qqwry.dat ip address database file program_PHP tutorial

WBOY

Release： 2016-07-20 11:11:05

Original

1263 people have browsed it

The article first introduces the file content structure of qqwry.dat. Then according to its characteristics, we can write to read the content of the qqwry.dat ip library to find the content we want.

First, let’s take a look at the content structure of the QQWry.Data file and how to interpret it.

1. File structure
Files are mainly divided into three structures
1. File header, 8 bytes;
2. Data recording area, variable length;
3. Index Area, the length is an integer multiple of 7;

2. File header
The 8 bytes of the file header are divided into two parts, each part is 4 bytes, respectively specifying the starting address and the index area end address. Therefore, the total number of records can be calculated by dividing the difference between the two addresses by 7 and then adding 1.

2. Recording area
The data in the recording area needs to obtain the starting position of each data through the data in the index area; the data in this area records the end address of the IP address and the region string; all regional characters Strings end with 0×00.

3. Index area
To retrieve the area corresponding to the IP, the key is to find the index content corresponding to the IP starting address. An IP index data contains 7 bytes, the first 4 bytes are the starting value of the IP address, and the last 3 bytes are the offset address of the corresponding IP data record in the file; in the IP data record, the first 4 bytes The stanza is the IP end address; the data that follows has two patterns: 0×01 pattern and 0×02 pattern.

0×01 mode, that is, the 5th byte of the IP data is 0×01, and the next 3 bytes are the offset address of the country and region data; the country and region data includes the country and region these two strings. That is,
————————————————————
4 bytes | 3 bytes redirection 0x NN NN NN -> File offset of country and region data Shift address
————————————————————

0×02 mode, that is, the 5th byte of IP data is 0× 02, then the next 3 bytes are the offset address of the national data, and the regional data is the following string, ending with 0×00. i.e.
——————————————————————————–
4 bytes | 3 bytes Redirect 0x NN NN NN -> Country File offset address of data | Region string | 0×00
————————————————————————————–

for In the country and region data obtained by the 0×01 pattern, it may also contain a redirection structure, that is,
————————————–
Country string | 0×00 | Region string | 0×00
————————————–
or
—————————————————— ————-
Country string | 0×00 | 0×02 | 3 bytes 0x NN NN NN -> File offset address of region string
—————————— ————————————————-

For the former case, it is relatively simple, just read the two string data directly; for the latter case, you need Redirect again to the offset address of the region string, and then read to 0×00 as the end of the string.

For this method of mapping actual string values by address, the main function is to avoid repeated recording of string values. There are too many identical string records in the entire IP address library file. Using a 3-byte mapped address saves much space than repeatedly recording string values.

PHP code reading operation QQWry.dat file:

The code is as follows

Copy code

function bin2ip($bin){
$ip = '';
$bd = str_split($bin, 1);
for($i = 4; $i > 0; $ i--){
$ip .= "." . sprintf("%03d", implode('', unpack('s', $bd[$i-1] . chr(0)))) ;
}
return substr($ip, 1);
}

//------------------------ --------------------------------
$f = fopen('QQWry.Dat', 'r');
$c = fread($f, 4);
$d = fread($f, 4);

$index_begin = implode('', unpack('L', $c));
$index_end = implode('', unpack('L', $d));
if($ index_begin < 0) $index_begin += pow(2, 32);
if($index_end < 0) $index_end += pow(2, 32);

$ip_num = ($index_end - $index_begin) / 7 + 1;

echo "index begin at: $index_beginn";
echo "index end at: $index_endn";
echo "ip data count : $ip_numn" ;

$output = '';

for($i = 0; $i < $ip_num; $i++){

//The file pointer points to each Get the index data (7 bytes) of the IP data file on
fseek($f, $i * 7 + $index_begin);
$ip4 = fread($f, 4); //IP starts Starting address
if(strlen($ip4) < 4) exit('data file error');

$ip3 = fread($f, 3); //IP record offset address
if(strlen($ip3) < 3) exit('data file error');

$dataseek = implode('', unpack('L', $ip3 . chr(0)) );
if($dataseek < 0) $index_ip_record += pow(2, 32);

//Point to the record area $dataseek location to find the record
fseek($f, $dataseek );
$ipdata = fread($f, 4); //IP end address
if(strlen($ipdata) < 4) exit('data file error');

$area = '';
$country = '';

//Read a flag bit
$flag = fread($f, 1);
if($flag == chr(1)){ //Country name offset mark bit pattern 0x01
$area1seek = fread($f, 3);
if(strlen($area1seek) < 3) exit('data file error');
$area1seek = implode('', unpack('L', $area1seek . chr(0)));
fseek($f, $area1seek);
$flag = fread ($f, 1); //It may be another flag bit
}
if($flag == chr(2)){ //Country and region redirection
$area1seek = fread($f, 3);
if(strlen($area1seek) < 3) exit('data file error');
$area1seek = implode('', unpack('L', $area1seek . chr(0) ));
$flag = fread($f, 1);
if($flag == chr(2)){
$area2seek = fread($f, 3);
$ area2seek = implode('', unpack('L', $area2seek . chr(0)));
fseek($f, $area2seek);
}else{
fseek($f, - 1, SEEK_CUR);
}
while(($c = fread($f, 1)) != chr(0)) $area .= $c;
fseek($f, $area1seek );
while(($c = fread($f, 1)) != chr(0)) $country .= $c;
}else{
fseek($f, -1, SEEK_CUR);
while(($c = fread($f, 1)) != chr(0)) $country .= $c;

$flag = fread($f, 1) ; //If the area is redirected
if($flag == chr(2)){
$area2seek = fread($f, 3);
$area2seek = implode('', unpack ('L', $area2seek . chr(0)));
fseek($f, $area2seek);
}else{
fseek($f, -1, SEEK_CUR);
}
while(($c = fread($f, 1)) != chr(0)) $area .= $c;
}
$adata = trim($country) . trim( $area); //$country is the country string, $area is the region string
}
fclose($f);

This function we What I see most are the file operation related functions such as fopen, fseek, and fread. Friends in need can take a look.