• Welcome to Valhalla Legends Archive.
 

Packet 0x33 Information

Started by taylorjonl, December 19, 2003, 05:53 PM

Previous topic - Next topic

taylorjonl

I am studying the battlenet protocols for Diablo II and started from the beginning.  Basically used Ethereal packet sniffer to only capture packets related to uswest.battle.net.  I started it up and captured the packets that came from choosing a realm to login to and hitting the battlnet button.  I got these results.

SEND: 01
SEND: FF 50
RECV: FF 25
SEND: FF 25
RECV: FF 50
SEND: FF 51
RECV: FF 51

SEND: FF 33
RECV: FF 33


The first set I am familiar with what they are from bnetdocs.valhallalegends.com but the 0x33 packet isn't listed on that page.  Anyone know what they are for?

UserLoser.

0x33: SID_GETFILETIME

Requests the filetime of a file that is downloadable from Battle.net.  If the client's filetime of the file requested doesn't match the server's response, the client should download the file.

taylorjonl

Quote from: UserLoser. on December 19, 2003, 06:52 PM
0x33: SID_GETFILETIME

Requests the filetime of a file that is downloadable from Battle.net.  If the client's filetime of the file requested doesn't match the server's response, the client should download the file.

Thx.  Did you research that or is it somewhere on this site?  Don't like asking questions I the information is already out there.

UserLoser.

Quote from: taylorjonl on December 19, 2003, 06:55 PM
Quote from: UserLoser. on December 19, 2003, 06:52 PM
0x33: SID_GETFILETIME

Requests the filetime of a file that is downloadable from Battle.net.  If the client's filetime of the file requested doesn't match the server's response, the client should download the file.

Thx.  Did you research that or is it somewhere on this site?  Don't like asking questions I the information is already out there.

I researched this my self, although I'm sure it's somewhere on another website

iago

It's fairly obvious if you look at the rest of the packet.  At least, it was to me.

Information can be found on bnetdocs, if that's still alive
http://www.valhallalegends.com/arta/bnetdocs
This'll make an interesting test for broken AV:
QuoteX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*


taylorjonl

Quote from: iago on December 20, 2003, 08:33 AM
It's fairly obvious if you look at the rest of the packet.  At least, it was to me.

Information can be found on bnetdocs, if that's still alive
http://www.valhallalegends.com/arta/bnetdocs

I did know it had something to do with a .ini file since it is encoded in the packet but didn't know the specific purpose.  Also you should note that in my original post I said that I checked bnetdocs but that packet isn't listed, which it isn't.

iago

Ah, I didn't see that.

And the file isn't really encoded, it's just there..
This'll make an interesting test for broken AV:
QuoteX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*


UserLoser.

Quote from: iago on December 20, 2003, 08:33 AM
It's fairly obvious if you look at the rest of the packet.  At least, it was to me.

Information can be found on bnetdocs, if that's still alive
http://www.valhallalegends.com/arta/bnetdocs

I don't understand

UserLoser.

#8
Quote from: DarkMinion on December 20, 2003, 11:32 AM
Quoteresearched this my self

::)

Uhhuh, don't roll your eyes at me - You should look around this forum, all the stuff I post and findings that most people don't even know about.  I first posted the new changes in 0x54, a lot about 0x44, some findings from battle.snp, d2gs stuff, 0x59-0x5b i posted, and much more - I don't see you contributing anything here on this forum - And if it's not on BnetDocs (for my access level, if it's even there), where else would I get it from?

iago

Quote from: UserLoser. on December 20, 2003, 10:39 AM
Quote from: iago on December 20, 2003, 08:33 AM
It's fairly obvious if you look at the rest of the packet.  At least, it was to me.

Information can be found on bnetdocs, if that's still alive
http://www.valhallalegends.com/arta/bnetdocs

I don't understand

What don't you understand?  You send out the name of a couple important files, and download them if the information returned is wrong.  I think it's pretty obvious.
This'll make an interesting test for broken AV:
QuoteX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*


UserLoser.

#10
Quote from: iago on December 20, 2003, 05:01 PM
Quote from: UserLoser. on December 20, 2003, 10:39 AM
Quote from: iago on December 20, 2003, 08:33 AM
It's fairly obvious if you look at the rest of the packet.  At least, it was to me.

Information can be found on bnetdocs, if that's still alive
http://www.valhallalegends.com/arta/bnetdocs

I don't understand

What don't you understand?  You send out the name of a couple important files, and download them if the information returned is wrong.  I think it's pretty obvious.

I don't understand is it's not on BnetDocs, yet you're supplying that URL even though they said they checked there

And i do understand the packet as I stated above

iago

Quote from: UserLoser. on December 20, 2003, 05:02 PM
Quote from: iago on December 20, 2003, 05:01 PM
Quote from: UserLoser. on December 20, 2003, 10:39 AM
Quote from: iago on December 20, 2003, 08:33 AM
It's fairly obvious if you look at the rest of the packet.  At least, it was to me.

Information can be found on bnetdocs, if that's still alive
http://www.valhallalegends.com/arta/bnetdocs

I don't understand

What don't you understand?  You send out the name of a couple important files, and download them if the information returned is wrong.  I think it's pretty obvious.

I don't understand is it's not on BnetDocs, yet you're supplying that URL even though they said they checked there

And i do understand the packet as I stated above

Ah, well that was a simple mistake on my part.  I didn't notice him say that, and I didn't go check bnetdocs to confirm, one way or the other.
This'll make an interesting test for broken AV:
QuoteX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*


UserLoser.

Quote from: iago on December 20, 2003, 06:37 PM
Quote from: UserLoser. on December 20, 2003, 05:02 PM
Quote from: iago on December 20, 2003, 05:01 PM
Quote from: UserLoser. on December 20, 2003, 10:39 AM
Quote from: iago on December 20, 2003, 08:33 AM
It's fairly obvious if you look at the rest of the packet.  At least, it was to me.

Information can be found on bnetdocs, if that's still alive
http://www.valhallalegends.com/arta/bnetdocs

I don't understand

What don't you understand?  You send out the name of a couple important files, and download them if the information returned is wrong.  I think it's pretty obvious.

I don't understand is it's not on BnetDocs, yet you're supplying that URL even though they said they checked there

And i do understand the packet as I stated above

Ah, well that was a simple mistake on my part.  I didn't notice him say that, and I didn't go check bnetdocs to confirm, one way or the other.

Let's just say we had a misunderstanding between all of us :P

iago

Quote from: UserLoser. on December 20, 2003, 06:51 PM
Quote from: iago on December 20, 2003, 06:37 PM
Quote from: UserLoser. on December 20, 2003, 05:02 PM
Quote from: iago on December 20, 2003, 05:01 PM
Quote from: UserLoser. on December 20, 2003, 10:39 AM
Quote from: iago on December 20, 2003, 08:33 AM
It's fairly obvious if you look at the rest of the packet.  At least, it was to me.

Information can be found on bnetdocs, if that's still alive
http://www.valhallalegends.com/arta/bnetdocs

I don't understand

What don't you understand?  You send out the name of a couple important files, and download them if the information returned is wrong.  I think it's pretty obvious.

I don't understand is it's not on BnetDocs, yet you're supplying that URL even though they said they checked there

And i do understand the packet as I stated above

Ah, well that was a simple mistake on my part.  I didn't notice him say that, and I didn't go check bnetdocs to confirm, one way or the other.

Let's just say we had a misunderstanding between all of us :P

I think this discussion is over, but mass quotes is fun.
This'll make an interesting test for broken AV:
QuoteX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*


Soul Taker

Quote from: iago on December 20, 2003, 07:57 PM
Quote from: UserLoser. on December 20, 2003, 06:51 PM
Quote from: iago on December 20, 2003, 06:37 PM
Quote from: UserLoser. on December 20, 2003, 05:02 PM
Quote from: iago on December 20, 2003, 05:01 PM
Quote from: UserLoser. on December 20, 2003, 10:39 AM
Quote from: iago on December 20, 2003, 08:33 AM
It's fairly obvious if you look at the rest of the packet.  At least, it was to me.

Information can be found on bnetdocs, if that's still alive
http://www.valhallalegends.com/arta/bnetdocs

I don't understand

What don't you understand?  You send out the name of a couple important files, and download them if the information returned is wrong.  I think it's pretty obvious.

I don't understand is it's not on BnetDocs, yet you're supplying that URL even though they said they checked there

And i do understand the packet as I stated above

Ah, well that was a simple mistake on my part.  I didn't notice him say that, and I didn't go check bnetdocs to confirm, one way or the other.

Let's just say we had a misunderstanding between all of us :P

I think this discussion is over, but mass quotes is fun.
Agreed.