MSN Messenger protocol (MSN protocol set)

Msnp9 Protocol Analysis Report
1. Connection

The MSN Messenger protocol is built on TCP/IP. In addition to direct "point-to-point" communication between file transmission and voice chat, all other scenarios are performed through the server.

Logically, there are three types of servers with their respective roles:

Dispatch server (DS)-the server on which the client first connects. Allocates appropriate notification servers to clients. The domain name is messenger.hotmail.com, and the standard service port is 1863. After the task is dispatched, cut off the TCP connection.
Notification Server (NS)-the server on which the client must stay connected. Many tasks need to be completed in this session, including logon, status change, user list retrieval, user information modification, chat initiation, call reception, email notification, and logout. The Service port is specified by the dispatch server, and is usually 1863.
Switchboard server (SS)-the intermediate server used for chatting between clients. Each time a chat window is opened, a TCP session is established between the client and the server. When file transmission or voice chat is required between clients, send system messages and establish a "point-to-point" session channel (UDP may be used ). The Service port is generally 1863. The port used for "point-to-point" communication is determined by the client's automatic negotiation. For example, port 6891 is usually used for file transmission.
2. Life order

The MSN Messenger command uses a pure ASCII code. Use URL encoding for non-ASCII characters. The command syntax is

XXX [& lt; sp & gt; trid & lt; sp & gtaram1 & lt; sp & gt; param2…] & Lt; CRLF & gt;
& Lt; sp & gt; is a blank character, & lt; CRLF & gt; Is a carriage return line break, XXX is a three-character command string, and TRID is a serial number, paramx is a parameter and is optional in. The simplest command does not have a sequential number or a parameter. For convenience, "" stands for & lt; sp & gt;, "\ r \ n" stands for & lt; CRLF & gt;, "\ x ?? "Indicates a value of 0x ?? Bytes. Red indicates sent by the client, blue indicates sent by the server. An example of an MSN Messenger command is as follows:

USR 18 twn I example@hotmail.com \ r \ n
3. Error

The server can return an error whether the Command sent by the client is invalid, the parameter is invalid, or another reason. Format:

XXX [& lt; sp & gt; trid] & lt; CRLF & gt;
XXX is a three-digit string. For example

Add 21 Al non_existent@passport.com \ r \ n
205 21 \ r \ n
In the above example, the non_existent@passport.com is a non-existent account.

4. Message consumption

The MSN Messenger message conforms to the mime 1.0 standard and consists of the message header and message body. Typically, UTF-8 encoding is used, and URL encoding is also required in the message header, while the message body uses binary data directly.

An example of an MSN Messenger message is as follows:

Mime-version: 1.0 \ r \ n
Content-Type: text/plain; charset = UTF-8 \ r \ n
X-MMS-im-format: fn = % E5 % AE % 8B % E4 % BD % 93; EF =; CO = 0; cs = 86; pF = 0 \ r \ n
\ R \ n
Bhw98 \ xe4 \ xbd \ xa0 \ xe5 \ xa5 \ xbd \ XeF \ xbc \ x81
The simple analysis shows that "% E5 % AE % 8B % E4 % BD % 93" is the UTF-8 of "" and URL encoding, "bhw98 \ xe4 \ xbd \ xa0 \ xe5 \ xa5 \ xbd \ XeF \ xbc \ x81" is "Hello bhw98! "UTF-8 encoding.

Command Overview
Command Source Direction description remarks
Ack SS client confirms and gives a positive answer. Acknowledgement
Add client NS sends a request to add a new contact to the list. Add User
The NS client returns the response to the request for adding a new contact.
ADG client NS sends a request to add a new contact group. Add Group
The NS client returns the response to the request for adding a new contact group.
Ans client SS accepts chat connection requests. Answer
The BLP client NS sets a confidentiality policy for the list of contacts that are not explicitly allowed/prohibited. Block List privacy
The NS client returns the response that sets the confidentiality policy.
The bye SS client notifies the client to terminate the session. Bye
Cal client SS sends a chat connection request. Call
The SS client returns the response to the chat connection request.
The chg client NS sends a request to change the status. Change state
The NS client returns a response to change the status.
The chlorophyll NS client server sends verification requirements. Challenge
SS Client
CVR client NS sends the OS, language, and MSN Messenger version of the client. Client Version
Client SS
The NS client returns information about the recommended MSN Messenger version and software upgrade.
SS Client
The fln ns client notifies a user in the contact list to go offline. Off-line
GTC client NS sets the prompt when the user status in the contact list changes. Greeting to changes?
The NS client returns the set Response Request.
INF client NS queries the authentication method supported by the server. Information?
Client SS
The NS client returns the authentication method supported by the server.
SS Client
The iln NS client notifies you of the contact status in the list when you log on to the client or add a contact to the list. Initial online State
When a new user joins a chat connection, the iro ss client notifies the client of the user name list in the connection. Initial roster information
The jio ss client notifies the client that a chat connection has been established with another user. Jion
LSG client NS sends a request to obtain the Contact Group list. List groups
The NS client returns the response to the request for obtaining the Contact Group list.
The lst client NS sends a request to obtain the contact list. List
The NS client returns the response to the request for obtaining the contact list.
MSG client SS sends messages to other users (chat objects ). Message
The NS client transmits messages from the server (system) to the client.
The SS client transmits messages from other users (chat objects) to the client.
The nak SS client makes a negative answer. Negative acknowledgement
The nln ns client notifies the client contact to go online or change the status. On-line
Out all ends the client-server connection. Out
PNG client NS test the TCP connection status. Ping
Client SS
In this case, the pc_client NS sends a request to set the personal phone number. Personal phone number
The NS client returns the set Response Request.
PNG client NS test the TCP connection status. Ping
Client SS
The qng NS client returns a response to test the TCP connection status. Quiz Ping?
SS Client
The qry client NS client answers server verification requirements. Quiz reply?
Client SS
Rea client NS sends a request to modify the user nickname. Rename nickname
The NS client returns the response to the request for modifying the user nickname.
Reg client NS sends a request to modify the Contact Group. Rename Group
The NS client returns the response to the request for modifying the Contact Group.
Rem client NS sends a request to delete a user from the contact list. Rename user
The NS client returns the response to the delete user request.
RMG client NS sends a request to delete a contact group. Remove Group
The NS client returns the response to the request for deleting a contact group.
The rng ns client notifies the client that a chat connection is required. Ring
SYN client NS client-server synchronization. Synchronization
NS Client
URL client NS sends a request to obtain the MSN service URL. URL
The NS client returns the response to the URL request.
USR all declares, transmits, and identifies a user. User
The ver client DS negotiates with the MSN Messenger protocol version. Version
Client NS
DS Client
NS Client
The xfr ds client assigns ns to the client (notifies the client to switch to the specified NS ). Transfer
The client NS sends a request for SS allocation.
The NS client returns the response to the request allocated to the SS.

MSN Messenger protocol-error code Overview
Code Description comments of possible command Error Examples
200 invalid command ABC 18 \ r \ n
200 18 \ r \ n
201 The chg 19 FLN 0 \ r \ n parameter is invalid.
201 19 \ r \ n
Add 20 Al AAA @ BBB @ CCC \ r \ n
201 20 \ r \ n
205 the user does not exist Add add 21 Al none@hotmail.com \ r \ n
205 21 \ r \ n
206 domain name missing
207 You have logged on to USR 20 twn I example@hotmail.com \ r \ n
207 20 \ r \ n
USR 21 TWN s 8d30fc782aa25ec9e1293fdda13cab42 \ r \ n
207 21 \ r \ n
208 invalid user name Cal 2 @ hotmail.com \ r \ n
208 2 \ r \ n
209 invalid user nickname rea 18 one@hotmail.com kill % 20microsoft \ r \ n
209 18 \ r \ n
210 too many users add Add 23 FL one@hotmail.com 0 \ r \ n
210 23 \ r \ n Max 150
215 the user has added add 36 FL one@hotmail.com 2 \ r \ n in the list
Add 36 825 FL one@hotmail.com 2 \ r \ n
Add 37 FL one@hotmail.com 2 \ r \ n
215 37 \ r \ n
Cal 5 two@hotmail.com \ r \ n
Cal 5 ringing 213697 \ r \ n
Cal 6 two@hotmail.com \ r \ n
215 6 \ r \ n
216 the user is not in the list REM 14 FL three@hotmail.com \ r \ n
216 14 \ r \ n
Rea rea 48 three@hotmail.com three \ r \ n
216 48 \ r \ n
Cal cal2 three@hotmail.com \ r \ n
216 2 \ r \ n
217 users not online Cal 2 two@hotmail.com \ r \ n
217 2 \ r \ n
218 BLP 17 BL \ r \ n in the specified mode
BLP 17 151 BL \ r \ n
BLP 18 BL \ r \ n
218 18 \ r \ n
GTC 19 A \ r \ n
GTC 19 152 A \ r \ n
GTC 20 A \ r \ n
218 20 \ r \ n
219 The user has added add 15 Al four@hotmail.com \ r \ n in the reverse list
Add 15 Al 56 four@hotmail.com four \ r \ n
Add 16 BL four@hotmail.com \ r \ n
219 16 \ r \ n
223 too many user groups ADG 28 new % 20 group 0 \ r \ n
223 28 \ r \ n Max 30
224 Invalid Group number add RMG 24 3 \ r \ n
RMG 24 11506 3 \ r \ n
Add 25 Fl five@hotmail.com 3 \ r \ n
224 25 \ r \ n
Rem RMG 24 3 \ r \ n
RMG 24 11506 3 \ r \ n
Rem 25 Fl five@hotmail.com 3 \ r \ n
224 25 \ r \ n
Reg RMG 24 3 \ r \ n
RMG 24 11506 3 \ r \ n
Reg 25 3 new % 20 name 0 \ r \ n
224 25 \ r \ n
RMG 24 3 \ r \ n
RMG 24 11506 3 \ r \ n
RMG 25 3 \ r \ n
224 25 \ r \ n
225 users out of group REM 26 FL six@hotmail.com 3 \ r \ n
225 26 \ r \ n
229 Group Name Too Long ADG 27 abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789 0 \ r \ n
229 27 \ r \ n Max 60
230 You cannot delete group 0 RMG 28 0 \ r \ n
230 28 \ r \ n
300 required parameters are missing
302 not logged on
500 Internal Server Error
540 verification response error
600 server busy
707 unable to establish a connection
910 server busy
911 authentication failed

Simple Example of msnp9 Protocol
In the past, MSN Messenger versions (earlier than msnp8) were used to authenticate user identities by using MD5 and other hash algorithms. Msnp9/msnp10 uses a TWN (Tweener) authentication method to connect to servers such as login.passport.com and loginnet.passport.com through SSL/TLS. After the authentication is passed, the account and password are entered through the HTTP protocol, to get the "admission ticket ".

Real Identity Authentication occurs between the client and the Notification Server (NS. When the client logs on to the NS, it first exchanges version information. Both parties support msnp8 and later versions before performing the authentication process. If the client version is low and does not support TWN, the login fails.

In the following example, the account is "stodtleo@msn.com" and the password is "password ".

Ver 4 msnp10 msnp9 cvr0 \ r \ n
Ver 4 msnp9 cvr0 \ r \ n
CVR 5 0x0804 winnt 5.0 i386 msnmsgr 6.1.0203 MSMSGS stdotleo@msn.com \ r \ n
CVR 5 6.0.0602 6.0.0602 5.0.0527 http://download.microsoft.com/do... 15561d7/setupnt. EXE http://messenger.msn.com/cn \ r \ n
USR 6 twn I stdotleo@msn.com \ r \ n
USR 6 twn slc = 1033, id = 507, Tw = 40, FS = 1, Ru = http % 3A % 2f % 2 fmessenger % 2 emsn % 2 ECOM, Ct = 1073355862, KPP = 1, KV = 5, Ver = 2.1.0173.1, TPF = ed1c2f217a21c191c61251eb8b73bb60 \ r \ n
(At this time, the identity authentication is performed through SSL to get the "admission ticket ")
USR 7 twn s t = hour $ & P = hour! 57cvqiyvfo86kgcrywhi2kuds0m! 7bdi82eda1fyp3wbohd! Scq17ozh7lpqi7fozrgssmzwgszri2fntpxf13odnifdckcg! 2gudvzkepk78a $ \ r \ n
USR 7 OK stdotleo@msn.com 1 0 \ r \ n
(TRID = 4). Both parties negotiate the MSN version number. The client says "I can support msnp9 and msnp10", and the NS says "OK, let's talk about msnp9 ".

(TRID = 5), client reports local information: OS = Windows 2000 (NT 5.0), language = Simplified Chinese, MSN Messenger version = 6.1.0203, account = stdotleo@msn.com. NS provides the recommended version number, the oldest version number, new version number, and official website address.

(TRID = 6), the client requires identity authentication (I = initial), and NS gives the required long string of information (S = subsequent ). TPF is equivalent to challenge. It participates in hash operations and ensures that the strings returned for each authentication are different.

(TRID = 7), the client shows the "admission ticket" obtained from the authentication server, and the NS is allowed (OK ).

The SSL authentication process between (TRID = 6) and (TRID = 7) is as follows:

First, send a GET request to login.passport.com at https port 443 to send a long string of information given by the account, password, and NS.

GET/login2.srf HTTP/1.1 \ r \ n
Authorization: passport1.4 orgverb = Get, orgurl = http % 3A % 2f % 2 fmessenger % 2 emsn % 2 ECOM, sign-In = example % 40passport.com, Pwd = password, lc = 1033, id = 507, Tw = 40, FS = 1, Ru = http % 3A % 2f % 2 fmessenger % 2 emsn % 2 ECOM, Ct = 1073355862, KPP = 1, KV = 5, Ver = 2.1.0173.1, TPF = ed1c2f217a21c191c61251eb8b73bb60 \ r \ n
HOST: login.passport.com \ r \ n
Different URLs are redirected as needed. In this example, redirect to "https://loginnet.passport.com/login2.srf? Lc = 1033 ", Server Response

HTTP/1.1 302 found \ r \ n server: Microsoft-IIS/5.0 \ r \ n
Date: Mon, 22 Dec 2003 21:10:05 GMT \ r \ n
Ppserver: H: lawpplog5c006 \ r \ n
Connection: Close \ r \ n
Content-Type: text/html \ r \ n
Expires: Mon, 22 Jun 2003 21:09:05 GMT \ r \ n
Cache-control: No-Cache \ r \ n
Cachecontrol: No-store \ r \ n Pragma: No-Cache \ r \ n
P3p: Cp = "DSP cur otpi ind otri onl fin" \ r \ n
Authentication-Info: passport1.4 da-status = redir \ r \ n
Location: https://loginnet.passport.com/login2.srf? Lc = 1033 \ r \ n
\ R \ n ......
Then, send a request to the specified URL again and get the following response:

HTTP/1.1 200 OK \ r \ n
Server: Microsoft-IIS/5.0 \ r \ n
Date: Mon, 22 Dec 2003 21:10:07 GMT \ r \ n
Ppserver: H: lawppiis6b061 \ r \ n
Connection: Close \ r \ n Content-Type: text/html \ r \ n
Expires: Mon, 22 Dec 2003 21:09:07 GMT \ r \ n
Cache-control: No-Cache \ r \ n
Cachecontrol: No-store \ r \ n
Pragma: No-Cache \ r \ n
P3p: Cp = "DSP cur otpi ind otri onl fin" \ r \ n
Set-COOKIE:... \ r \ n
Authentication-Info: passport1.4 da-status = success, tname = mspauth, tname = mspprof, tname = mspsec, from-pp = 't=$ $ & P = success! 57cvqiyvfo86kgcrywhi2kuds0m! 7bdi82eda1fyp3wbohd! Scq17ozh7lpqi7fozrgssmzwgszri2fntpxf13odnifdckcg! 2gudvzkepk78a $ ', Ru = http://messenger.msn.com/r \ n
Content-Length: 0 \ r \ n
\ R \ n

You can send a correct request directly to loginnet.passport.com at the beginning. It is not hard to see that the from-PP string value in the authentication-Info Field is the so-called "admission ticket" in the returned information of successful Server Authentication ".

If authentication fails, the server returns error 401.

HTTP/1.1 401 unauthorized \ r \ n ......
In this way, you cannot get the "admission ticket". Naturally, you cannot enter a valid string in (TRID = 7.