• Welcome to Valhalla Legends Archive.
 

weird packet

Started by botmaster, November 25, 2003, 08:41 PM

Previous topic - Next topic

botmaster


[20:38:49] Unidentified Packet(hex):  FF FF 02 02 FF 02 FF EB EB EB EB A9 FF FF EB EB FF 29 A8 8A FF FF FF FF FF 00 FF 0F 6C 00 01 00 00 00 00 00 00 00 2E 00 00 00 00 00 00 00 0D F0 AD BA 0D F0 AD BA 52 4E 2D 5A 65 61 6C 61 64 69 6E 40 55 53 45 61 73 74 2A 72 6E 32 00 50 58 32 44 55 53 45 61 73 74 2C 52 4E 2D 5A 65 61 6C 61 64 69 6E 2C 84 80 3F 03 03 03 03 0C FF 5E 02 02 FF 04 33 02 02 02 02 FF FF FF 02 02 FF 57 E8 9E FF FF 01 FF FF 00 FF 0F 73 00 01 00 00 00 00 00 00 00 0A 01 00 00 00 00 00 00 0D F0 AD BA 0D F0 AD BA 62 65 6C 6C 61 6E 79 6E 65 62 78 40 55 53 45 61 73 74 2A 4E 65 62 43 72 65 77 6D 61 6E 00 50 58 32 44 55 53 45 61 73 74 2C 62 65 6C 6C 61 6E 79 6E 65 62 78 2C 84 80 3A 02 02 01 01 05 FF 4F 02 02 FF 02 FF FF FF FF FF 51 FF FF FF FF FF 13 A8 82 FF FF FF FF FF 00 FF 0F 76 00 01 00 00 00 00 00 00 00 5E 00 00 00 00 00 00 00 0D F0 AD BA 0D F0 AD BA 4D 61 6E 73 6F 6E 73 43 68 69 6C 64 40 55 53 45 61 73 74 2A 54 48 41


what does this packet mean.....anyone?

MyndFyre

Are you sure that this is a Battle.net packet?  Just because it begins with FF doesn't mean that it is.
QuoteEvery generation of humans believed it had all the answers it needed, except for a few mysteries they assumed would be solved at any moment. And they all believed their ancestors were simplistic and deluded. What are the odds that you are the first generation of humans who will understand reality?

After 3 years, it's on the horizon.  The new JinxBot, and BN#, the managed Battle.net Client library.

Quote from: chyea on January 16, 2009, 05:05 PM
You've just located global warming.

Spht

0000:  FF FF 02 02 FF 02 FF EB EB EB EB A9 FF FF EB EB   ÿÿ..ÿ.ÿëëëë©ÿÿëë
0010:  FF 29 A8 8A FF FF FF FF FF 00 FF 0F 6C 00 01 00   ÿ)¨Šÿÿÿÿÿ.ÿ.l...
0020:  00 00 00 00 00 00 2E 00 00 00 00 00 00 00 0D F0   ...............ð
0030:  AD BA 0D F0 AD BA 52 4E 2D 5A 65 61 6C 61 64 69   ­º.ð­ºRN-Zealadi
0040:  6E 40 55 53 45 61 73 74 2A 72 6E 32 00 50 58 32   n@USEast*rn2.PX2
0050:  44 55 53 45 61 73 74 2C 52 4E 2D 5A 65 61 6C 61   DUSEast,RN-Zeala
0060:  64 69 6E 2C 84 80 3F 03 03 03 03 0C FF 5E 02 02   din,,,€?.....ÿ^..
0070:  FF 04 33 02 02 02 02 FF FF FF 02 02 FF 57 E8 9E   ÿ.3....ÿÿÿ..ÿWèž
0080:  FF FF 01 FF FF 00 FF 0F 73 00 01 00 00 00 00 00   ÿÿ.ÿÿ.ÿ.s.......
0090:  00 00 0A 01 00 00 00 00 00 00 0D F0 AD BA 0D F0   ...........ð­º.ð
00A0:  AD BA 62 65 6C 6C 61 6E 79 6E 65 62 78 40 55 53   ­ºbellanynebx@US
00B0:  45 61 73 74 2A 4E 65 62 43 72 65 77 6D 61 6E 00   East*NebCrewman.
00C0:  50 58 32 44 55 53 45 61 73 74 2C 62 65 6C 6C 61   PX2DUSEast,bella
00D0:  6E 79 6E 65 62 78 2C 84 80 3A 02 02 01 01 05 FF   nynebx,,,€:.....ÿ
00E0:  4F 02 02 FF 02 FF FF FF FF FF 51 FF FF FF FF FF   O..ÿ.ÿÿÿÿÿQÿÿÿÿÿ
00F0:  13 A8 82 FF FF FF FF FF 00 FF 0F 76 00 01 00 00   .¨,ÿÿÿÿÿ.ÿ.v....
0100:  00 00 00 00 00 5E 00 00 00 00 00 00 00 0D F0 AD   .....^........ð­
0110:  BA 0D F0 AD BA 4D 61 6E 73 6F 6E 73 43 68 69 6C   º.ð­ºMansonsChil
0120:  64 40 55 53 45 61 73 74 2A 54 48 41               d@USEast*THA


Isn't that easier to read?

botmaster


iago

* iago notes that it's a list of 0x0f packets, a channel list.
This'll make an interesting test for broken AV:
QuoteX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*


ObsidianWolf

Quote from: Spht on November 25, 2003, 08:52 PM
0000:  FF FF 02 02 FF 02 FF EB EB EB EB A9 FF FF EB EB   ÿÿ..ÿ.ÿëëëë©ÿÿëë
0010:  FF 29 A8 8A FF FF FF FF FF 00 FF 0F 6C 00 01 00   ÿ)¨Šÿÿÿÿÿ.ÿ.l...
0020:  00 00 00 00 00 00 2E 00 00 00 00 00 00 00 0D F0   ...............ð
0030:  AD BA 0D F0 AD BA 52 4E 2D 5A 65 61 6C 61 64 69   ­º.ð­ºRN-Zealadi
0040:  6E 40 55 53 45 61 73 74 2A 72 6E 32 00 50 58 32   n@USEast*rn2.PX2
0050:  44 55 53 45 61 73 74 2C 52 4E 2D 5A 65 61 6C 61   DUSEast,RN-Zeala
0060:  64 69 6E 2C 84 80 3F 03 03 03 03 0C FF 5E 02 02   din,„€?.....ÿ^..
0070:  FF 04 33 02 02 02 02 FF FF FF 02 02 FF 57 E8 9E   ÿ.3....ÿÿÿ..ÿWèž
0080:  FF FF 01 FF FF 00 FF 0F 73 00 01 00 00 00 00 00   ÿÿ.ÿÿ.ÿ.s.......
0090:  00 00 0A 01 00 00 00 00 00 00 0D F0 AD BA 0D F0   ...........ð­º.ð
00A0:  AD BA 62 65 6C 6C 61 6E 79 6E 65 62 78 40 55 53   ­ºbellanynebx@US
00B0:  45 61 73 74 2A 4E 65 62 43 72 65 77 6D 61 6E 00   East*NebCrewman.
00C0:  50 58 32 44 55 53 45 61 73 74 2C 62 65 6C 6C 61   PX2DUSEast,bella
00D0:  6E 79 6E 65 62 78 2C 84 80 3A 02 02 01 01 05 FF   nynebx,„€:.....ÿ
00E0:  4F 02 02 FF 02 FF FF FF FF FF 51 FF FF FF FF FF   O..ÿ.ÿÿÿÿÿQÿÿÿÿÿ
00F0:  13 A8 82 FF FF FF FF FF 00 FF 0F 76 00 01 00 00   .¨‚ÿÿÿÿÿ.ÿ.v....
0100:  00 00 00 00 00 5E 00 00 00 00 00 00 00 0D F0 AD   .....^........ð­
0110:  BA 0D F0 AD BA 4D 61 6E 73 6F 6E 73 43 68 69 6C   º.ð­ºMansonsChil
0120:  64 40 55 53 45 61 73 74 2A 54 48 41               d@USEast*THA


Isn't that easier to read?
Much easier

Arta

Yes, looks like a stream of SID_CHATEVENT packets, starting at 0x1A. I have no idea what that stuff is before 0x1A, possibly a buggy receive buffer?

iago

Quote from: Arta[vL] on November 26, 2003, 06:53 PM
Yes, looks like a stream of SID_CHATEVENT packets, starting at 0x1A. I have no idea what that stuff is before 0x1A, possibly a buggy receive buffer?

It looks like the end of a d2 statstring.  I think that's just a clip from the packet, not the entire thing.
This'll make an interesting test for broken AV:
QuoteX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*


dxoigmn

Quote from: iago on November 26, 2003, 08:57 PM
Quote from: Arta[vL] on November 26, 2003, 06:53 PM
Yes, looks like a stream of SID_CHATEVENT packets, starting at 0x1A. I have no idea what that stuff is before 0x1A, possibly a buggy receive buffer?

It looks like the end of a d2 statstring.  I think that's just a clip from the packet, not the entire thing.

Could he be splitting the packets by 0xff?