Parsing 0x0F (ChatEvent) Specific Event 0x01

Fr3DBr · September 19, 2006, 11:45 PM

Ok, seen that event doesnt have a defined packet format since it can vary alot in its size im wanting some more information on that to parse it correctly, sometimes server merges up these packets so they are like glued (its not the tcp/ip effect) because the first packet has the lenght of all the packets that are on that stream and they do match !!!

Lets see what can we do around this

Hdx · September 19, 2006, 11:48 PM

Do you have a packet log of this 'merged' packet? An actuall log, not your programs output. (Etheral, WPE, etc..)
~-~(HDX)~-~

l2k-Shadow · September 19, 2006, 11:57 PM

Quote from: Fr3DBr on September 19, 2006, 11:45 PM
Ok, seen that event doesnt have a defined packet format since it can vary alot in its size im wanting some more information on that to parse it correctly, sometimes server merges up these packets so they are like glued (its not the tcp/ip effect) because the first packet has the lenght of all the packets that are on that stream and they do match !!!

Lets see what can we do around this

In 3 years of Battle.net programming, I have never had once case of this, I am 99.9% positive it is your program stacking the packet length variable.

Fr3DBr · September 20, 2006, 12:18 AM

its not let me provide a SS.

Code Select


[S->C] [OPCODE : 0x0F] [LENGHT : 000443 BYTES]
OFFSET  00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | 0123456789ABCDEF
--------------------------------------------------------------------------
000010  FF 0F BB 01 01 00 00 00 00 00 00 00 48 01 00 00   ............H...  
000020  00 00 00 00 0D F0 AD BA 0D F0 AD BA 2A 64 32 32   ............*d22  
000030  32 32 32 32 00 56 44 32 44 00 FF 0F 2C 00 01 00   2222.VD2D...,...  
000040  00 00 00 00 00 00 57 01 00 00 00 00 00 00 0D F0   ......W.........  
000050  AD BA 0D F0 AD BA 2A 64 32 32 32 32 32 32 23 32   ......*d222222#2  
000060  00 56 44 32 44 00 FF 0F 7B 00 01 00 00 00 00 00   .VD2D...{.......  
000070  00 00 EB 00 00 00 00 00 00 00 0D F0 AD BA 0D F0   ................  
000080  AD BA 64 79 45 2D 52 61 6E 63 61 54 6F 63 6F 40   ..dyE-RancaToco@  
000090  55 53 45 61 73 74 2A 72 61 6E 63 61 74 6F 63 6F   USEast*rancatoco  
000100  5B 64 79 65 5D 00 50 58 32 44 55 53 45 61 73 74   [dye].PX2DUSEast  
000110  2C 64 79 45 2D 52 61 6E 63 61 54 6F 63 6F 2C 84   ,dyE-RancaToco,.  
000120  80 53 03 03 02 03 0E FF 54 03 01 FF 05 EA 0A 0A   .S......T.......  
000130  0A 0A 51 FF 11 0A 0A FF 55 C8 98 FF FF 03 FF FF   ..Q.....U.......  
000140  00 FF 0F 7B 00 01 00 00 00 00 00 00 00 CC 00 00   ...{............  
000150  00 00 00 00 00 0D F0 AD BA 0D F0 AD BA 54 72 69   .............Tri  
000160  4C 6F 75 63 6F 2D 63 41 70 65 74 41 40 55 53 45   Louco-cApetA@USE  
000170  61 73 74 2A 74 72 69 6C 6F 75 63 6F 2D 61 00 50   ast*trilouco-a.P  
000180  58 32 44 55 53 45 61 73 74 2C 54 72 69 4C 6F 75   X2DUSEast,TriLou  
000190  63 6F 2D 63 41 70 65 74 41 2C 84 80 53 02 02 01   co-cApetA,..S...  
000200  01 19 FF 54 02 02 FF 02 EA EA EA EA EA 26 FF 09   ...T.........&..  
000210  EA EA FF 49 C8 98 FF FF 03 FF FF FF 0F 6F 00 01   ...I.........o..  
000220  00 00 00 00 00 00 00 39 01 00 00 00 00 00 00 0D   .......9........  
000230  F0 AD BA 0D F0 AD BA 6E 6F 69 65 72 61 2D 4E 44   .......noiera-ND  
000240  50 40 55 53 45 61 73 74 2A 61 6C 71 5B 6E 64 70   P@USEast*alq[ndp  
000250  5D 00 50 58 32 44 55 53 45 61 73 74 2C 6E 6F 69   ].PX2DUSEast,noi  
000260  65 72 61 2D 4E 44 50 2C 84 80 FF 02 02 03 01 0F   era-NDP,........  
000270  FF FF 03 03 60 03 FF FF FF FF FF FF FF FF FF FF   ....`...........  
000280  FF 57 E8 9A FF FF 03 FF FF 00 00                  .W.........  
--------------------------------------------------------------------------

See ? It cant be a 400 bytes 0x0F size packet, and i dont change any of the bytes on the incomming packet... i got that using a external packet viewer !

Arta · September 20, 2006, 12:36 PM

Your offsets are wrong. Where are lines A0/B0/C0 ... and 1A0/1B0/1C0 etc? Also, your offsets ought to start a 0, not 16. Length is misspelled. Also, there are numerous headers within that dump ("FF 0F 7B 00") which indicate the start of new messages. The lengths of those messages appear, from a brief examination, to be correct.

What software did you use to obtain this data? Can you reproduce this data using a packet capture utility like Ethereal?

I also think you have a bug.

l2k-Shadow · September 20, 2006, 02:28 PM

Quote from: Fr3DBr on September 20, 2006, 12:18 AM
its not let me provide a SS.

Code Select Expand
[S->C] [OPCODE : 0x0F] [LENGHT : 000443 BYTES] OFFSET 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | 0123456789ABCDEF -------------------------------------------------------------------------- 000010 FF 0F BB 01 01 00 00 00 00 00 00 00 48 01 00 00 ............H... 000020 00 00 00 00 0D F0 AD BA 0D F0 AD BA 2A 64 32 32 ............*d22 000030 32 32 32 32 00 56 44 32 44 00 FF 0F 2C 00 01 00 2222.VD2D...,... 000040 00 00 00 00 00 00 57 01 00 00 00 00 00 00 0D F0 ......W......... 000050 AD BA 0D F0 AD BA 2A 64 32 32 32 32 32 32 23 32 ......*d222222#2 000060 00 56 44 32 44 00 FF 0F 7B 00 01 00 00 00 00 00 .VD2D...{....... 000070 00 00 EB 00 00 00 00 00 00 00 0D F0 AD BA 0D F0 ................ 000080 AD BA 64 79 45 2D 52 61 6E 63 61 54 6F 63 6F 40 ..dyE-RancaToco@ 000090 55 53 45 61 73 74 2A 72 61 6E 63 61 74 6F 63 6F USEast*rancatoco 000100 5B 64 79 65 5D 00 50 58 32 44 55 53 45 61 73 74 [dye].PX2DUSEast 000110 2C 64 79 45 2D 52 61 6E 63 61 54 6F 63 6F 2C 84 ,dyE-RancaToco,. 000120 80 53 03 03 02 03 0E FF 54 03 01 FF 05 EA 0A 0A .S......T....... 000130 0A 0A 51 FF 11 0A 0A FF 55 C8 98 FF FF 03 FF FF ..Q.....U....... 000140 00 FF 0F 7B 00 01 00 00 00 00 00 00 00 CC 00 00 ...{............ 000150 00 00 00 00 00 0D F0 AD BA 0D F0 AD BA 54 72 69 .............Tri 000160 4C 6F 75 63 6F 2D 63 41 70 65 74 41 40 55 53 45 Louco-cApetA@USE 000170 61 73 74 2A 74 72 69 6C 6F 75 63 6F 2D 61 00 50 ast*trilouco-a.P 000180 58 32 44 55 53 45 61 73 74 2C 54 72 69 4C 6F 75 X2DUSEast,TriLou 000190 63 6F 2D 63 41 70 65 74 41 2C 84 80 53 02 02 01 co-cApetA,..S... 000200 01 19 FF 54 02 02 FF 02 EA EA EA EA EA 26 FF 09 ...T.........&.. 000210 EA EA FF 49 C8 98 FF FF 03 FF FF FF 0F 6F 00 01 ...I.........o.. 000220 00 00 00 00 00 00 00 39 01 00 00 00 00 00 00 0D .......9........ 000230 F0 AD BA 0D F0 AD BA 6E 6F 69 65 72 61 2D 4E 44 .......noiera-ND 000240 50 40 55 53 45 61 73 74 2A 61 6C 71 5B 6E 64 70 P@USEast*alq[ndp 000250 5D 00 50 58 32 44 55 53 45 61 73 74 2C 6E 6F 69 ].PX2DUSEast,noi 000260 65 72 61 2D 4E 44 50 2C 84 80 FF 02 02 03 01 0F era-NDP,........ 000270 FF FF 03 03 60 03 FF FF FF FF FF FF FF FF FF FF ....`........... 000280 FF 57 E8 9A FF FF 03 FF FF 00 00 .W......... --------------------------------------------------------------------------

See ? It cant be a 400 bytes 0x0F size packet, and i dont change any of the bytes on the incomming packet... i got that using a external packet viewer !

As far as what I can deduce, your problem is you are counting the length of the entire TCP clump that comes in from your winsock, not just the actual packet. Remember to parse the header... everything in that clump that starts with "FF 0F" is the beginning of a new packet. and the packet log is not right, your offsets are in decimal values, while the length of each line is 0x10 not 10.

Cat Food · September 20, 2006, 07:48 PM

Quote from: l2k-Shadow on September 20, 2006, 02:28 PM
As far as what I can deduce, your problem is you are counting the length of the entire TCP clump that comes in from your winsock, not just the actual packet. Remember to parse the header... everything in that clump that starts with "FF 0F" is the beginning of a new packet. and the packet log is not right, your offsets are in decimal values, while the length of each line is 0x10 not 10.

Genius, pure...brilliance!
Arta why didn't you think of that?

Arta · September 21, 2006, 03:47 AM

Why didn't I think of what?

ShadowDancer · September 21, 2006, 06:02 AM

FF 0F [BB 01] (

??)

Arta · September 21, 2006, 06:14 AM

What are you talking about? The whole thread is about that header. Isn't it rather obvious that my comments related to the obvious wrongness of it? Tell you what:

Quote
I also think you have a bug [in relation to the anomolous initial header which is the subject of the thread].

Better?

Fr3DBr · September 21, 2006, 05:42 PM

Code Select


--------------------------------------------------------------------------
[S->C] [OPCODE : 0x0F] [LENGHT : 000241 BYTES]
OFFSET  00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | 0123456789ABCDEF
--------------------------------------------------------------------------
000010  FF 0F F1 00 05 00 00 00 00 00 00 00 8D 00 00 00   ................  
000020  00 00 00 00 0D F0 AD BA 0D F0 AD BA 43 4C 41 4E   ............CLAN  
000030  5F 4D 41 4E 40 55 53 45 61 73 74 2A 43 4C 41 4E   _MAN@USEast*CLAN  
000040  4D 41 4E 23 32 00 40 40 40 40 40 40 40 40 40 40   MAN#2.@@@@@@@@@@  
000050  40 40 40 40 40 40 40 40 40 40 40 40 40 40 40 40   @@@@@@@@@@@@@@@@  
000060  40 40 40 20 40 40 40 40 40 40 40 40 40 40 40 40   @@@ @@@@@@@@@@@@  
000070  40 40 40 40 40 40 40 40 40 40 40 40 40 40 40 40   @@@@@@@@@@@@@@@@  
000080  40 20 40 40 40 40 40 40 40 40 40 40 40 40 40 40   @ @@@@@@@@@@@@@@  
000090  40 40 40 40 40 40 40 40 40 40 40 40 40 40 40 20   @@@@@@@@@@@@@@@   
0000A0  40 40 40 40 40 40 40 40 40 40 40 40 40 40 40 40   @@@@@@@@@@@@@@@@  
0000B0  40 40 40 40 40 40 40 40 40 40 40 40 40 20 40 40   @@@@@@@@@@@@@ @@  
0000C0  40 40 40 40 40 40 40 40 40 40 40 40 40 40 40 40   @@@@@@@@@@@@@@@@  
0000D0  40 40 40 40 40 40 40 40 40 40 20 57 20 57 20 57   @@@@@@@@@@ W W W  
0000E0  20 2E 20 43 20 4C 20 41 20 4E 20 4D 20 41 20 4E    . C L A N M A N  
0000F0  20 2E 20 43 20 4A 20 42 20 2E 20 4E 20 45 20 54    . C J B . N E T  
000100  00                                                .  
--------------------------------------------------------------------------

Everything is fine now

Cat Food · September 22, 2006, 12:14 AM

Quote from: Arta[vL] on September 21, 2006, 03:47 AM
Why didn't I think of what?

Was mocking l2k-shadow, being that he said the same thing you said.

Arta · September 22, 2006, 04:54 AM

Oh, ok then