Packet Description

XPROTO

XProto is some custom Protocol outline. It is composed of the following:

/*
 * \brief The Packet Length
 */
int length;

/*
 * \brief The Packet Command
 * \description Possible values are: 1 = CMSG_DoLogin, 12 = CMSG_SendInternalNotifyByProxy, 25 = CMSG_OnKickout, 34 = CMSG_SendPing, 35 = CMSG_SendProtoBuff)
 */
int command;

After the XProto header (Len + CMD) the specified function for a command is executed. Currently only CMSG_SendProtoBuff is being investigated

CMSG_SendProtoBuff

This is a Google Protobuf message with extended header. The content follows the up_msg.proto rules. Although the *.proto files are present, there is no way to make these work with C# without having to rewrite them for Proto3 therefore having to re-compile the client with Proto3. Since they're written in Proto2.

/*
 * \brief ????
 */
int __vxtemp1;

/*
 * \brief ????
 */
int __vxtemp2;

/*
 * \brief ???? (Cannot be smaller than 0 and not greater than 0x2FFFFFFF
 */
int __lpLen;

/*
 * \brief ???? (Although specified as int, it really is just a byte casted to an int.)
 * \example mode = (int)reader.ReadByte();
 */
int mode;

/*
 * \brief Some magic number to calculate the uinLen
 * \remark Although it says 'unsigned char' here. It is actually a byte (8-Bits)
 */
unsigned char count1;

/*
 * \brief Some magic number to calculate the uinLen
 * \remark Although it says 'unsigned char' here. It is actually a byte (8-Bits)
 */
unsigned char count2;

/*
 * \brief The uin
 */
char uin[count2 * 256 + count1];

/*
 * \brief Protobuf Message and magic numbers to calculate length of it encrypted with AES CBC with empty IV and the sessionKey as Key prepened with 'darogn' (If the sessionKey length < 9 [Since a AES key has to be 16] nullbytes get added to the end until it's 16)
 * \remark In Win32 it seems that it's always 123456789
 * \remark Although it says 'unsigned char' here. It is actually a byte (8-Bits)
 */
unsigned char encryptedCode[Length - Position];

Decrypted Code

/*
 * \brief Magic Number used to calculate the length of the Protobuf message
 * \remark Although it says 'unsigned char' here. It is actually a byte (8-Bits)
 */
unsigned char count1;

/*
 * \brief Magic Number used to calculate the length of the Protobuf message
 * \remark Although it says 'unsigned char' here. It is actually a byte (8-Bits)
 */
unsigned char count2;

/*
 * \brief Magic Number used to calculate the length of the Protobuf message
 * \remark Although it says 'unsigned char' here. It is actually a byte (8-Bits)
 */
unsigned char count3;

/*
 * \brief Magic Number used to calculate the length of the Protobuf message
 * \remark Although it says 'unsigned char' here. It is actually a byte (8-Bits)
 */
unsigned char count4;

/*
 * \brief The actual Protobuf Message
 * \remark Although it says 'unsigned char' here. It is actually a byte (8-Bits)
 */
unsigned char protoBufMessage[count4 * 256 * 256 * 256 + count3 * 256 * 256 + count2 * 256 + count1];