You will need to check the documentation of the nat device you are using to see if it supports IRC DCC translation. If it does support DCC translation make sure it is turned on.

If it does not you may still be able to use iroffer if the device supports inbound tcp port forwarding to a specific host on the private network. You will need to setup inbound tcp port forwarding for either a specific TCP port number range or all TCP port numbers. Configure iroffer with your public IP address under the 'usenatip' configurable. If you use a specific port number range you must enable the 'firewall' and 'dccrangestart' options in the iroffer config file and forward 100 TCP ports starting at the dccrangestart port number.

Also note that some NAT devices only detect DCC commands if you connect to port 6667 of the irc server. Make sure you are using port 6667 if you are having problems.

This will generally be seen by this message from iroffer:
WARNING: Couldn't find transfer that user tried to resume!

In order for iroffer to resume a transfer, it needs to know:

IRC servers will excess flood a client if the server can't keep up with the commands sent from the client. Unfornately this means there is no predefined rate at which a client can safely send text. One rate of commands can be acceptable at certain times (when the IRC server is idle) while the same rate can be unacceptable at other times (if the IRC server is very busy).

iroffer queues all commands sent to the IRC server and rate limits the data sent. This allows bursts of commands to happen quickly, but will rate limit if large amounts of text is sent.

iroffer also queues and combines XDCC LIST and PLIST output. For example if two users request an XDCC LIST at around the same time iroffer will send the listing to both users simultaneously, saving commands sent to the server

The best way to prevent excess flooding is to reduce the amount of data sent to the server. This can be done by:

Run iroffer with the '-c' flag and follow the instructions to generated an encrypted password, then enter that in the config file:

WRONG: adminpass foo12345
RIGHT: adminpass F37ls723XrFQ2

You need to run the cygwin installer and select these additional packages:

Under devel:

WRONG: server_join_raw msg person hi there
WRONG: server_join_raw message person hi there
WRONG: server_join_raw /msg person hi there
WRONG: server_join_raw privmsg person hi there
WRONG: server_join_raw person hi there
RIGHT: server_join_raw PRIVMSG person :hi there

If the underlying operating system supports large files (greater than 2GB) then iroffer will work with files upto 4GB in size. If large files are not supported, then 2GB is the upper limit.

It is important to note that the currently defined DCC protocol cannot support files larger than 4GB because the application level ACKing in DCC transfers uses a 32bit number.

Also, just because iroffer can support files upto 4GB does not mean the client on the other end of the transfer supports it. Most irc clients will not receive files larger than 2GB.

Channel keys, nickserv password and other items cannot be encrypted in the config file because iroffer needs to send them in plain text to the irc server. These items cannot use a one-way cypher as iroffer needs to decryprt them.

iroffer could use a two-way cypher but the logic needed to decrypt them would need to be stored within iroffer. This isn't very practical as it would either need to be fixed at compile time or initialzed every time iroffer starts from a user-input.

Login to your shell and modify it.

iroffer makes outgoing TCP connections to irc servers. Typically this is on port 6667 but this can be configured differently in the iroffer configuration file. iroffer will also make outgoing TCP connections for users who upload files or request a DCC chat. The port number used for uploads/DCC chat is dynamic and determined by the user performing the upload not iroffer.

iroffer accpets incoming TCP connections from clients that download files from it or request DCC chat. Depending on settings in the iroffer configuation file this can either by dynamic (choosen by the OS) or within a fixed range (for users who have incoming connections firewalled). The fixed range starts at the 'dccrangestart' configurable.

If you are using iroffer on a very fast internet connection iroffer can easially stress your computer's disk and network hardware as well as your OS and hardware drivers. If you suspect iroffer is causing problems with your computer please try a different program that similarly stresses your computer such as a ftpd. It is most likely a sign that either your OS or drivers are flawed or you have faulty hardware.

The password stored in the config file is encrypted with a standard UNIX crypt(). You can use any brute-force password cracker designed for 13 character DES passwords.

That's a very bad security decision. iroffer will not let you use very weak adminhosts. I will not change this.

Use a better hostmask for administration. You can define as many hostmasks as you want.

Whenever iroffer connects to an irc server it calls socketpair() to pass information to a fork'ed process that does DNS lookups for the server.

The cygwin implementation of socketpair() emulates AF_UNIX sockets with AF_INET. Because of this limitation, cygwin opens a UDP/IP port using an OS assigned port number, then connets to it using the localhost address (127.0.0.1). This connection should only last for the duration of the DNS lookup and then be closed.

If you are seeing the "Connection refused" error message, your firewall may be denying UDP packets to/from 127.0.0.1. You will need to allow these.

When running iroffer on OS's without cygwin this problem does not happen as AF_UNIX socket types are supported.

To run iroffer from within a chrooted environment you need to:

1. Use the iroffer_chroot executable which includes the NSS libraries
2. Run iroffer with the -t and -u flags which will cause iroffer to chroot and drop root privledges
3. Place the following files into your chroot:
   • [chroot]/etc/resolv.conf
   • [chroot]/mybot.config
   • [chroot]/files/*
   • [chroot]/upload/*

NOTE: When using the -t flag no shared libaries or even the iroffer executable are needed within the chroot directory, but your config file does need to be.

Most likely you have trailing whitespace in your config file.

Yes, that's what the web was designed for.

Make sure Configure and /bin/sh are executable (chmod a+x Configure).

Make sure iroffer is executable (chmod a+x iroffer). For windows users make sure your account has permission to execute it and a virus/security/firewall program isn't denying access to iroffer.

Neither the author of iroffer nor anyone associated with iroffer.org broke into your computer or installed iroffer. iroffer was not and can not (by design) be used to break into your computer. Questions, accusations, threats, or complaints directed at us will be refered to this FAQ or ignored.

Unfortuntately many crackers use rootkits that install iroffer for their own use after breaking into your computer. The official versions of iroffer (found on this site) are not maliscious in nature and are not used to break into your computer, it was just placed on your computer for the cracker to harness your computing and network resources.

If you want to remove iroffer you'll need to find the executable, startup scripts, config, etc... You'll probably want to find the security bug so it wont happen again, but I can't help you with that.

iroffer consists of at least 4 components, however if you were cracked, they could be cleaverly named and hidden to deceive you.

• the iroffer executable
• the iroffer configuration file (text file)
• the iroffer state file (binary file)
• the actual offered files

If you are running windows, you can find the first 2 files by doing a 'Search for files and folders' and look for files containing the text 'user_nick'.

Once you have found the configuration file you can then use it to locate the state file by looking for the 'statefile' line.

If iroffer was configured to create a logfile ('logfile' in the config file). You can use that to see who setup the bot via DCC chat from such logs as:

** 2004-03-24-11:09:14: DCC CHAT attempt authorized from NICK!USER@HOST.COM
** 2004-03-24-11:09:14: DCC CHAT received from NICK, attempting connection to 192.168.5.44:16674

You can use the IP address above to determine what host connected to iroffer to set it up.

You can use the config file to get the irc server names and channel names ('server' and 'channel' lines). Use the server information and visit the website of the server. You should be able to obtain an 'abuse' email address or other contact information for the server. Please use this information to report the channel's name plus information you obtained from the logfile the irc server's operators to prevent further abuse by the channel.

There is nothing inherent about iroffer that makes it a back-door or virus program anymore than any FTP server or webserver program. iroffer does not trick you into installing it. iroffer does not replicate itself and must be installed by either yourself or another program that has run on your computer.

The versions of iroffer you can download from this site do not provide remote command or execute access to your system. It does what it was intended to do, namely download of only the files you specify, upload of files (if configured to do so), and nothing else. This is equivilant to a FTP or HTTP server.

You should contact the manufacturer of your virus scanning software and tell them you are trying to use iroffer for legitimate purposes.