QQ2010 Protocol Analysis Series (ii)-first entry (0x0091)

QQ2010 Protocol Analysis First article

Test qq:597789809

Nickname: Ruthless Prodigal Son

Try QQ Server ip:112.95.240.125

Client ip:222.35.174.5 (my extranet IP)

Password: Forget it.

Send:

See the figure below is very confused, don't worry, I slowly explain

The following text is a hex string, which is commonly used for network 16 binary text mode.

QQ Common message Packet structure:

Baotou: 02//Indicates the beginning of the package

1F//QQ version code, here to indicate QQ2010SP3 version

00 91//Package command

58 16//This is not fixed, indicating the serial number

The 16 hex A1 8C//qq number indicates that 597789809

　　　　02 00 00 00 01 01 01 00 00 64 48//unknown, but each message packet has, and may be, the description of this version.

　　　　

################### #Touch (0x0091) ####################

[2011-01-19 10:41:37 848 SEND]

02//Start tag of the package

1F//QQ Version number

00 91//Command number

58 16//Serial number

A1 8C//qq Number

The//the same for QQ version of XX

7F ED 16 BB A2 9B F9 F7 AA-random-bit key

-Redaction omitted-

Decrypt:

Random key-7f ED-BB A2 9B F9 DE-CD-F7-AA

-----------------------------------------------

-----------------------------------------------

00 01-Fixed

E0-QQ The local information of the machine, representing some languages ah, country code, etc.

The 0C 73-qq version description information of the XX

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00-Fixed

-----------------------------------------------

-----------------------------------------------

03-Bag Tail

Receive:

################# #Touch (0x0091) reply################

[2011-01-19 10:41:38 324 RECEIVE]

1F A1 8C 71//Ibid.

//QQ version check correctly returns to 0

-Redaction omitted-

Decrypt:

Decryption key = 0x0091 secret key (the 16-bit key that you randomly generated)

7F ED, BB, A2 9B F9 F7

-----------------------------------------------

-----------------------------------------------

00-touch success

4D 4D Fd-touch Server time

F9 DB 64-client IP

at xx xx, xx 00-the same

00 38-Token Length (avoid the length is 16 decimal notation, 16 binary 38 represents the metric of 56), the following is the token data

BC (BA AD)-A4 AC

F3 E1 9E 3B A6 B3 E6 All in F5 9D, E2 C6

C2 8F F8 B2 2B 8D 9E 8E 2C 86 19

D3 9A 6B DF A3 9F F9 F6

00-touch completed, (01 means unsuccessful, continue Touch)

(01-When 01 is,

01 00 00 00

09 00 00) 00 00

5A 8A 8c-qq Server recommended IP, next touch to find it)

-----------------------------------------------

-----------------------------------------------

03

QQ2010 Protocol Analysis Series (ii)-first entry (0x0091)