The Matrix Online Server Emulator - Packets Margin

Margin Packets

Fri, 31 Jul 2009 01:15:34 +0000

Just to put the info i got while entering some times to get data for chars.

I bet all got autocomprehensive names.

somePackets.zip (Size: 244.03 KB / Downloads: 55)

MS_CreateCharacterRequest (work in progress)

Thu, 30 Jul 2009 19:44:26 +0000

Hi all.
Lets talk about creating char and our RSI image.
This is a work in progress. Not so many things tried. Just a pattern structure of create char packet.

Most thing investigated on woman char (default in my mxo).

Personality byte is shared between both sexes.

(Warning: big block of text below!!)

#####################################
###STANDARD CHAR(full zero) packet WOMAN ###
#####################################

0c 00 00 00 00 69 00 00 00 64 00 00 00 65 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 9f 02 00 00 4a 03 00 00 00 00 00 00 00 00 00 00 23 16 00 00 00 00 00 00 4e 1a 00
00 34 01 00 00 4d 00 53 00 59 00 67 00 04 00 64 65 66 00 04 00 67 68 69 00 0c 00 44 45 53 43 52
49 50 54 49 4f 4e 00 11 00 46 43 58 36 32 59 6d 53 72 44 51 37 77 44 6b 65 00

-----------------------------
67 00 04 00 64 65 66 00 04 00 67 68 69 00 0c 00 44 45 53 43 52
49 50 54 49 4f 4e 00 11 00 46 43 58 36 32 59 6d 53 72 44 51 37 77 44 6b 65 00

Correspond to:
67 00 (length of bytes ahead)
04 00 (length of null terminated first name)
64 65 66 00 (first name: "def")
04 00 (length of null terminated last name)
67 68 69 00 (last name: "ghi")
0c 00 (length of null terminated description)
44 45 53 43 52 49 50 54 49 4f 4e 00 (description: "DESCRIPTION")
11 00 (length of null terminated random string)
46 43 58 36 32 59 6d 53 72 44 51 37 77 44 6b 65 00 (random string)
------------------------------

RSI DATA

PHISICAL TRAITS STANDARD IMAGE:

CLOTHES STANDARD IMAGE:

0c 5! 00 00 00 2! 00 00 00 4! 00 00 00 1! 00 00 00 3! 00 00 00 6! 00 00 00 7! 00 00 00 8! 00 00
00 02 00 00 4a 03 00 00 00 00 00 00 16 00 00 00 00 00 00 00
00 P! 01 00 00 4d 00 53 00 59 00 67 00 04 00 64 65 66 00 04 00 67 68 69 00 0c 00 44 45 53 43 52
49 50 54 49 4f 4e 00 11 00 46 43 58 36 32 59 6d 53 72 44 51 37 77 44 6b 65 00

P!ersonality:
34 Detached spectator
30 Devoted ascetic
2f Fanatic self improver
32 Inquisitive genious
31 Lunatic fringe
2e New Age hippie
33 Secluded introvert
2b Suspicious cynic
2d Troubled intellectual
2c True believer

#PHISICAL TRAITS#

1! uint32 hair
[xx 00 00 00] .available values(65 66 67 71 72 73 74 78 79 7a 7b 7c 7d 7e 7f 87 88 8d 64)

2! body:
69 00 00 00 Thin
66 00 00 00 Normal
64 00 00 00 Boobies

3! uint32 hair color:
[xx 00 00 00] .available values(01 to 1F,all)

4! uint32 face type:
[xx 00 00 00]. available values (64 65 66 6c 6e 70 72 73 82 78 79 7a 7b 7c 7d 7e 7f 80 81 8a )

5! uint32 skin tone:
[xx 00 00 00]. available values (00 to 0F, all)

6! uint32 Tatoo
[xx 00 00 00]. available values (00 to 07, all). Default 01 (one tatoo)

7! uint32 facial details type
[xx 00 00 00]. available values (6c 6b 6d 6e 6f 70 71 72 73 74 75 7a). default 6c, no facial details

8! uint facial details colors
[xx 00 00 00]. available values (00 to 07, all). Default 00 (first color)
NOTE: facial details colors value if no facial details ON is [00 00 00 00]

#OUTFIT#
:
00 00 00 00 none
e1 02 00 00 cap

lasses:
9f standard
c0 changed
00 none

ves:
00 00 none
d6 02 gloves

wear:
00 00 00 00 standard green
e2 15 00 00 large violet
f5 15 00 00 short violet

kirts/pants
25 standard
23 standard+1

oes
4e 1a 00 00 standard(red shoes)
89 03 00 00 standard+1

#####################################
###STANDARD CHAR(full zero) MAN ###
#####################################

0c 01 00 00 00 65 00 00 00 67 00 00 00 6a 00 00 00 00 00 00 00 01 00 00 00 65 00 00 00 00 00 00
00 06 04 00 00 db 03 00 00 db 04 00 00 47 1a 00 00 9a 03 00 00 25 04 00 00 00 00 00 00 ec 04 00
00 2c 01 00 00 4d 00 53 00 59 00 67 00 04 00 64 65 66 00 04 00 67 68 69 00 0c 00 44 45 53 43 52
49 50 54 49 4f 4e 00 11 00 46 65 68 72 61 6b 67 6c 78 39 61 55 55 54 75 49 00

MEN have no interest for me.... err i mean "just not enough time to study"

Possible bytes that made sex on char are the "03" and "04" after "db" on standad char(full zero) MAN.

Hope you all enjoy

MS_LoadingCharacter - General Info

Thu, 30 Jul 2009 11:56:58 +0000

Code:

10 00 00 00 00 ac 53 02 00 00 00 01

10 = every encrypted Packet starts with.

ac 53 02 = little endian format , 253ac = Player ID:152492 (verify ClientError.log for this).

Player ID = character ID (not account ID) and is everytime when you login with the same character the same.

01 = sequence of margin packets sent from server (following packets have 02, 03 etc.).

MS_LoadingCharacter - Little Inventory analyze

Thu, 30 Jul 2009 11:18:49 +0000
I had made some little inventory packets analyze tests...
the big problem we have is that we dont really know the item ids for the items...but inventory generation is partically broken (for the order i mean).

There is one value in the packet for an item that defines the position.

Little example (which isnt complete correct cause of some byte position issue, but only to see what i mean):

Slot1
--------------------

Row 1:
b1 03 00 c1 09 00 00 00 00 <- Twin WestTek 49SAs
00 10 01 c1 09 00 00 00 00 <- Twin WestTek 49SAs
00 10 02 c1 09 00 00 00 00 <- Twin WestTek 49SAs
00 10 03 c1 09 00 00 00 00 <- Twin WestTek 49SAs

Row 2:
00 10 04 c1 1e 00 00 00 00 <- HN2000 Assault Rifle
00 10 05 c1 1e 00 00 00 00 <- HN2000 Assault Rifle
00 10 06 c1 1e 00 00 00 00 <- HN2000 Assault Rifle
00 10 07 c1 1e 00 00 00 00 <- HN2000 Assault Rifle

Row 3:
00 10 08 c6 1e 00 00 00 00 <- MP-2000 Advanced Pump Action
00 10 09 c6 1e 00 00 00 00 <- MP-2000 Advanced Pump Action
00 10 0a c6 1e 00 00 00 00 <- MP-2000 Advanced Pump Action
00 10 0b c6 1e 00 00 00 00 <- MP-2000 Advanced Pump Action

So what is if we have a space in our inventory ...easy to do.
Just skip the number.

For example if we have in slot 1 row 1 the second place empty, packet should be something like this :

b1 03 00c1 09 00 00 00 00 <- Twin WestTek 49SAs
00 10 02 c1 09 00 00 00 00 <- Twin WestTek 49SAs
00 10 03 c1 09 00 00 00 00 <- Twin WestTek 49SAs

Just a stupid simple example..and many things are missing here too, i know that.

I try now to find out, where is the amount of items (like 3 antibiotics for example).

MS_DeleteCharacterRequest

Thu, 30 Jul 2009 05:17:01 +0000
1. Delete mxoemu character

MS_DeleteCharacterRequest

Code:

0d 0b 00 44 87 1f 00 00 00 00 00 11 00 62 65 32 6f 38 43 66 4a 6f 72 6b 44 46 54 41 69 00 .  .  .  D  .  .  .  .  .  .  .  .  .  b  e  2  o  8  C  f  J  o  r  k  D  F  T  A  i  .

MS_DeleteCharacterReply

Code:

0e 44 87 1f 00 00 00 00 00 00 00 00 00 .  D  .  .  .  .  .  .  .  .  .  .  .

2. Delete mxoemu character

MS_DeleteCharacterRequest

Code:

0d 0b 00 e8 87 1f 00 00 00 00 00 11 00 62 71 30 63 33 75 4c 53 4c 46 59 52 58 32 6c 67 00 .  .  .  .  .  .  .  .  .  .  .  .  .  b  q  0  c  3  u  L  S  L  F  Y  R  X  2  l  g  .

MS_DeleteCharacterReply

Code:

0e e8 87 1f 00 00 00 00 00 00 00 00 00 .  .  .  .  .  .  .  .  .  .  .  .  .

As referenced in Char create thread you can see there the Char ID "e8 87 1f" and 44 87 1f (first delete).

  delete_char.zip (Size: 8.71 KB / Downloads: 11)

MS_ClaimCharacterNameRequest

Thu, 30 Jul 2009 05:11:37 +0000
1.

MS_ClaimCharacterNameRequest

Code:

0a 03 00 07 00 6d 78 6f 65 6d 75 00 .  .  .  .  .  m  x  o  e  m  u  .

MS_ClaimCharacterNameReply

Code:

0b 0f 00 00 00 00 00 44 87 1f 00 00 00 00 00 07 00 6d 78 6f 65 6d 75 00 .  .  .  .  .  .  .  D  .  .  .  .  .  .  .  .  .  m  x  o  e  m  u  .

2. (repeat the same)

MS_ClaimCharacterNameRequest

Code:

0a 03 00 07 00 6d 78 6f 65 6d 75 00 .  .  .  .  .  m  x  o  e  m  u  .

MS_ClaimCharacterNameReply

Code:

0b 0f 00 00 00 00 00 44 87 1f 00 00 00 00 00 07 00 6d 78 6f 65 6d 75 00 .  .  .  .  .  .  .  D  .  .  .  .  .  .  .  .  .  m  x  o  e  m  u  .

Therea are 3 bytes that varried..i bet this could be a "character ID" or something.

Will add a third create here soon and attached the 3 files for that too.

EDIT : Yes i was right, i see this at character delete procedure.

  create_char.zip (Size: 296.43 KB / Downloads: 9)

Initial Packet : Client->margin

Wed, 08 Jul 2009 11:44:36 +0000
World List Packet

Code:

82 43 0B 00 00 00 00 00 00 00 00 00 00 9F 00 D7 01 1F 00 00 00 21 00 1D D1 00 00 3D 00 00 00 39 02 00 00 01 00 00 0E 00 DE 13 1C 00 00 00 00 00 00 17 00 0A 00 41 72 63 68 69 74 65 6B 74 00 03 00 00 15 00 52 65 63 75 72 73 69 6F 6E 00 00 00 00 00 00 00 00 00 00 00 01 01 F1 1D 07 00 01 00 21 00 16 00 53 79 6E 74 61 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 01 F1 1D 07 00 01 00 31 00 17 00 56 65 63 74 6F 72 2D 48 6F 73 74 69 6C 65 00 00 00 00 00 00 01 01 F1 1D 07 00 01 00 31 // Here starts the "copy" of the packet for sending to margin 36 // encrypted blob 1 01 47 E2 4D 62 C0 78 14 B7 B2 EB 8D D7 F6 DC 0A 90 D4 95 19 1F AD D6 CA D6 BA ED B1 EF D2 D7 38 53 B8 79 4D F8 E1 BF 15 C5 7C 3B F1 98 80 A2 35 1E 35 16 CA E5 C1 A0 69 8C 05 22 02 10 9D 44 76 6C 3C 13 7A 76 6A FA 19 F0 AF 18 7D BF 81 28 CB E0 59 7E FE 25 E4 5E ED D3 FE 3A 0E 85 35 7E 72 36 59 10 38 51 A4 88 BF 9E 78 16 B2 F6 B9 44 55 68 A8 89 26 3F 25 03 6E 10 35 77 7F 47 4C 43 29 4F 01 90 1D 9B 00 //Username (norajob here is the username). 6E 6F 72 61 6A 6F 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 // TimeStamp little endian Format 2F 8B 54 4A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 EC 42 1C 49 A5 51 6C 0C F8 31 72 D2 40 78 94 FA 24 57 94 42 F0 F0 75 3C 33 41 44 5F C8 16 61 5D 08 86 BB EF 83 61 49 FD A8 69 FA 1B E0 AC B2 90 4E 2F 93 64 44 A6 E1 23 3B 69 5D B1 18 7A 9D F5 C7 F0 F4 03 33 97 1F 8A B0 8C 7F C3 E3 13 4E 89 56 CA F0 B8 BB 00 95 68 30 67 44 EE 62 A7 C2 CB B5 33 FF 26 // End copy of packet // somewhere there is second encrypted blob 60 00 8E B3 96 6E F8 A0 35 D1 2C E5 8F 9F BD 79 F5 5B EA 96 30 F5 92 0D 83 E3 64 08 9F CD EE E1 16 57 10 43 4A 9C 39 A0 51 6D 18 35 21 CE 97 28 EA F2 34 03 9B 05 48 49 38 5A B2 35 77 5E 7A 24 CF 02 39 82 57 E0 30 02 F5 BF 0B 56 B8 F3 06 97 65 EF 78 D2 91 EF B7 D5 65 F5 88 ED 64 43 AC 08 60 49 08 00 6E 6F 72 61 6A 6F 62 00

// Packet to Margin Server 1

Code:

81 3b 01 03 00 // the part that is copied starts here 36 // encrypted blob 1 01 9b a0 4f 1f 1a a5 d0 2f c4 1e 81 ef 08 67 44 8d 0a e9 7e 9d 1b e5 9d 56 58 02 3b 76 40 fa 60 c2 68 71 c5 ae c6 cf af 8b ca 85 6f 86 1a 21 4c 93 05 a5 8e 54 3f 4a 34 7e 04 85 aa f0 1e 13 54 2f 4b 16 c7 88 3c d4 f9 41 04 51 4b 13 81 68 dd cf 23 b0 4b dc 11 b4 b4 1f 6d da a5 a8 5a 57 ef 6c db f8 73 83 d4 37 fb df fc d4 db f5 bb b3 e7 9a 2a cc 8d 94 42 07 f4 a5 e7 //Username 8e e6 01 8e 8d 23 fa 01 51 4e 79 00 55 73 65 72 4E 61 6D 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 // time stamp ef f6 51 4a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 ab 1c 76 11 3f 67 0e 21 61 0c 22 04 2c af 5d e8 ce bd 77 a0 26 41 03 eb f8 14 22 f7 55 3e 47 46 6e c6 42 1e 7b e9 b3 f3 3b fe f1 7b 18 b0 ae 84 3f c8 ea da 52 fd d0 2e c4 30 73 5f 44 c4 6f 79 d2 2e 95 4c 3d 4c 1d 28 0f 4a a6 4a c8 01 af be 67 f1 b1 d7 7a 20 25 9a 51 93 b2 46 2c 76 04 07 cb 10 19 26

This is the initial packet sent from client to the margin server.
We didnt have it decrypted yet, but one thing comes direct into the eye, when you compare this packet with a part of the wordlist packet.

After the 4th Byte (starting with 0x36), the complete packet is just a copy of a part of the world list.

The only thing that is 100% clear, is the username there (put in in a hex editor to see what i mean) and the timestamp.

The timestamp are the highlighted ef f6 51 4a bytes (little endian format, you have to read them backwads 4a 51 f6 ef and convert them to decimal to get the timestamp).

MS_ list

Wed, 01 Jul 2009 10:31:22 +0000
0x01 CERT_ConnectRequest
0x02 CERT_Challenge
0x03 CERT_ChallengeResponse
0x04 CERT_ConnectReply
0x05 CERT_NewSessionKey
0x06 MS_ConnectRequest
0x07 MS_ConnectChallenge
0x08 MS_ConnectChallengeResponse
0x09 MS_ConnectReply
0x0A MS_ClaimCharacterNameRequest
0x0B MS_ClaimCharacterNameReply
0x0C MS_CreateCharacterRequest
0x0D MS_DeleteCharacterRequest
0x0E MS_DeleteCharacterReply
0x0F MS_LoadCharacterRequest
0x10 MS_LoadCharacterReply
0x11 MS_EstablishUDPSessionReply
0x12 MS_RefreshSessionKeyRequest
0x13 MS_RefreshSessionKeyReply
0x14 MS_ServerShuttingDown
0x15 MS_FailoverRequest
0x16 MS_FailoverReply
0x17 MS_AdjustFloodgateRequest
0x18 MS_AdjustFloodgateReply
0x19 MS_GetPlayerListRequest
0x1A MS_GetPlayerListReply
0x1B MS_FakePopulationRequest
0x1C MS_UnloadCharacterRequest
0x1D MS_GetClientIPRequest
0x1E MS_GetClientIPReply