Msn15 协议分析

发布时间：2007年7月

PS:应该把这个小工具发布出来

MSN协议分析

21:56:  VER 77 MSNP15 MSNP14 MSNP13 CVR0  //--> 协商 MSN 版本请求

 

21:56:  VER 77 MSNP15 MSNP14 MSNP13 CVR0  //<-- 协商 MSN 版本请求

 

21:56:  CVR 78 0x0804 winnt 6.0 i386 MSNMSGR 8.1.0178 msmsgs cnqing@gmail.com

USR 79 SSO I cnqing@gmail.com    //--> 发出客户端的 OS 、语言、 MSN Messenger 版本等信息、单点登录

 

21:56:  CVR 78 8.1.0178 8.1.0178 8.0.0787

http://msgr.dlservice.microsoft.com/download/B/D/3/BD343317-2DBF-48FE-8BD9-9E3212D65E6A/Install_Messenger.exe

http://get.live.com/cn

// ß 返回推荐的 MSN Messenger 版本、升级软件需要的下载地址等信息 。

 

21:56:  XFR 79 NS 207.46.106.73:1863 U D     // à 请求分配 SS 服务器

 

21:56:  VER 80 MSNP15 MSNP14 MSNP13 CVR0          // à 服务器转移后重新登录

 

21:56:  VER 80 MSNP15 MSNP14 MSNP13 CVR0          // ß 重复以上的登录过程

 

21:56:  CVR 81 0x0804 winnt 6.0 i386 MSNMSGR 8.1.0178 msmsgs cnqing@gmail.com

USR 82 SSO I cnqing@gmail.com

// ß 重复以上的登录过程

 

21:56:  CVR 81 8.1.0178 8.1.0178 8.0.0787

http://msgr.dlservice.microsoft.com/download/B/D/3/BD343317-2DBF-48FE-8BD9-9E3212D65E6A/Install_Messenger.exe

http://get.live.com/cn

// ß 重复以上的登录过程

 

21:56:  GCF 0 7020 // ß 接下来的内容是一些包含安全策略 BASE64 编码后关键字的 XML 档案（简单整理了一下）

< Policies >

     < Policy type = "ABCH">

         < policy >

              < set id = "push"service="ABCH"priority="200">

                   < r id = "pushstorage" threshold="120000"  />

              </ set >

         </ policy >

     </ Policy >

     < Policy type = "SHIELDS">

         < config >

              < shield >

                   < cli maj = "7"min="0"minbld="0" maxbld="9999"deny="" />

              </ shield >

              < block >

                   < hashes ></ hashes >

                   < regexp >

                       < imtext value = "XC5waWY=" /> //DECODE BASE64= /.pif

                       < imtext  value = "XC5zY3I=" />

                       < imtext value = "Z3JvdXBwaWN0dXJlXC5waHA=" />

                       < imtext value = "Z3JvdXBpY3R1cmVcLnBocA==" />

                       < imtext value = "Z2FsbGVyeVwucGhw" />

                       < imtext value = "c3RhZmZcLnBocA==" />

                       < imtext value = "cGljc1wucGhw" />

                       < imtext value = "cm90dGVudG9tYXRvZXNcLnVz" />

                       < imtext value = "bXNuXC5waHBcP2VtYWlsPQ==" />

                       < imtext value = "ZG93bmxvYWRcLnBocA==" />

                       < imtext value = "NjlcLjU2XC4xMjlcLjY3L2dpZnRcLmNvbQ==" />

                       < imtext value = "eG1hcy0yMDA2" />

                       < imtext value = "bWlyYWxhZm90by9mb3RvXC5leGU=" />

                       < imtext value = "MTY4XC4xNjlcLjc4XC4xOQ==" />

                       < imtext value = "cHJvZmlsZVwucGhwXD8=" />

                       < imtext value = "dHVmb3Rv" />

                       < imtext value = "dmVydGkyL2ZhbnRhc21hXC56aXA=" />

                       < imtext value = "YXJtYXpmaWxlc1wuc210cFwucnU=" />

                       < imtext value = "c3dlZXRwaWN0dXJlc1wubXlwaG90b3NcLmNjL2thdGllc2V4XC5waWY=" />

                       < imtext value = "MjAxXC4yMlwuNlwuNC9mb3Rvcy9zYWZhZGFcLmh0bWw=" />

                       < imtext value = "Y2huc3R1ZGlvXC5jb20vdXBsb2FkL2ltcGx1c2VcLmV4ZQ=="/>

                       < imtext value = "c2h1cmxcLm9yZy9teWhvbWVwYWdl" />

                       < imtext value = "cDEzNzdcLnBpYy1teXNwYWNlXC5pbmZv" />

                       < imtext value = "cGljODMxXC5tcDMtbXlzcGFjZVwuY29t" />

                       < imtext value = "ODhjaGlcLmNvbQ==" />

                       < imtext value = "bmloYW81MlwuY29t" />

                       < imtext value = "ODFjb3B5XC5jb20=" />

                       < imtext value = "bXlvbmxpbmVjYW1cLm5ldA==" />

                       < imtext value = "Nzc4ODVcLmNu" />

                       <