|
Yahoo Messenger
Protocol
a.k.a
How to make your own Yahoo Messenger In VB
For all people who have been waiting to make
their own yahoo messenger and could not find any material on the YMSG
protocol,well it's time to stop looking and start making !!!!.The basic
purpose of writing this document is that people should know what's
actually happening when they use the yahoo messenger.There is hardly any
if not any documentation available on the internet concerning the YMSG
ptotocol ,this made it more difficult and at the same time more exciting
and challenging for me to reverse engineer the yahoo messenger
protocol.
The first step involved in any messenger
application is logging into the messenger server and then retrieving the
friends list.The yahoo messenger is slightly different from other
messengers.The yahoo messenger connects to the yahoo HTTP server(port 80)
to retrieve the friends list!!!!.All conversation takes place through the
messenger server(port 5050).Let us first look at logging into the yahoo
server to retrieve the friends list.
We connect to the yahoo server
msg.edit.yahoo.com on port 80.
In order to get the friends list from the
server we send the following data to it
GET
/config/ncclogin?.src=bl&login=ymusertest
&passwd=ympasstest&n= 1 HTTP/1.0
Accept:*/*
Accept:
text/htm
where ymusertest is the username and
ympasstest is the password. .If this data is sent using a Visual Basic
application it would look some thing like this
'Begin VB code
strlogin = "GET
/config/ncclogin?.src=bl&login=ymusertest&passwd=ympasstest&n=1
HTTP/1.0" & vbCrLf
strlogin = strlogin & "Accept: */*" &
vbCrLf
strlogin = strlogin & "Accept: text/html" & vbCrLf &
vbCrLf
WnsckMn.SendData strlogin
'End VB code
On successfully sending the login data we get
the following response from the server
HTTP/1.0 200 OK
Date: Thu, 05 Jul 2001
08:57:11 GMT
Content-Type: text/html
Expires: Thu, 05 Jul 2001
08:57:11 GMT
Cache-Control: private
Pragma:
no-cache
Set-Cookie:Y=v=1&n=25udo5k8tkvjb&l=l4dao_3k34/o&p=m2f17464130004&r=5s&lg=us&intl=us;
expires=Thu, 15 Apr 2010 20:00:00 GMT; path=/; domain=.yahoo.com
Via:
1.0 hydcache (NetCache NetApp/5.0.1R2)
OK
BEGIN BUDDYLIST
Chat
Friends:ambixxxx,ami_xxxx,d_cexxxx,deepxxxx,dixxxx,indian_guyxxxx,k_v_pxxxx,kaxxxxdaram,kavithaxxxx1,malaxxxx,pujaxxxx,sudxxxx,sunxxxxma,swaxxxxadhu,vkxxxx68
END
BUDDYLIST
BEGIN
IGNORELIST
agxxxx,loving_xxxx,shravaxxxxula,varmxxxx1
END
IGNORELIST
BEGIN IDENTITIES
venkxxxxde
END
IDENTITIES
Mail=1
Login= vexxxxe
LOGING ONTO THE SERVER
Now we shall start using the yahoo messenger
protocol to log into the yahoo messenger and then send and receive
messages.
We will connect to the yahoo messenger server
cs.yahoo.com on port 5050
The first and the most difficult part for me
was to log on to this server.Unlike other yahoo protocols like the YCHT
protocol,the YMSG protocol uses encryption to encrypt the user password
while sending it out to the messenger server.The encrypted string looks
something like this
1$_2S43d5f$1LfmOGuxGxDpSWvd6nzGb0
For a mainly MS windows user like me it was a
bit difficult to recognize the type of encryption used.But after a lot of
searching and breaking my head i finally realised that this was a UNIX MD5
CRYPT .This kind of password encryption is used in many unix mahines.Again
i searched for some sort of code in either c++ or VB for this
unix_md5_crypt .Finally i managed to make a dll in c which would perform
this encryption.You can download the dll along with a .bas module made in
vb from here venky.zip .
Now let us start logging into the yahoo
messenger server .We send the following data to the messenger
server
YMSG C
ZUªUbS`ú0À€userÀ€6À€$1$_2S43d5f$1LfmOGuxGxYCSWvd6nzGb0À€1À€userÀ€
This is the data sent when viewed through a
port monitor
0010: 00 7F B1 63 40 00 80 06 00 4C C0 A8
00 08 D8 88 ...c@....L......
0020: AF 90 04 E5 13 BA 21 09 4C 9F B5 59
53 05 50 18 ......!.L..YS.P.
0030: 44 5C 3D D1 00 00 59 4D 53 47 08 00
00 00 00 43 D\....YMSG.....C
0040: 00 01 5A 55 AA 55 6E 56 41 BB 30 C0
80 73 75 6E ..ZU.UnVA.0..sun
0050: 64 61 6D 61 6D 61 C0 80 36 C0 80 24
31 24 5F 32 xxxxxx..6..$1$_2
0060: 53 34 33 64 35 66 24 31 4C 55 68 40
47 75 78 47 S43d5f$1xxxOGuxG
0070: 78 59 43 53 57 76 64 36 6E 7A 47 62
30 C0 80 31 xYCSWvd6nzGb0..1
0080: C0 80 73 75 6E 60 61 63 61 78 63 C0
80 ..sunxxxxxx..
Let us look at what exactly is being
sent
YMSG- is the yahoo standard header for all
messenger command/messages
This is followed by 1 byte of data - 08.
This is followed by 4 bytes of data - 00 00 00 00
Next is the
length of the message information-essentially H31 + 2*length of the userid
The next 2 bytes of data are 00 and 01 respectively
Next is a 4
byte are standard for all messages/commands being sent to the messenger
server.The 4 bytes are 5A 55 AA 55
The next 4 bytes is what i call the
initial 4 bytes bluff identifier. These 4 bytes identify a particular user
and it changes every time you log in. Initially you could send any four
bytes including 00 00 00 00 and you would still be able to log in .
This is followed by one byte of data signifying that the data being
sent is for logging into the server .This byte has an ASCII equivalent of
"0"
This is followed by 2 bytes of data which is the standard argument
separator.- C0 80
This is followed by the yahoo user id and the
standard argument separator.
Followed by one byte which is standard
for the login procedure and which has an ASCII equivalent as "6" and the
standard argument separator.
Next is the md5crypt encrypted password
followed by the standard argument separator.
Followed by one byte
which is standard for the login procedure "1" and the standard argument
separator.
And finally this is followed by again the yahoo user id and
the standard argument separator.
'Begin VB code
dat3 = "0" & Chr(&HC0) &
Chr(&H80) & "ymusertest" & Chr(&HC0) & Chr(&H80)
& "6" & Chr(&HC0) & Chr(&H80) & dat1 &
Chr(&HC0) & Chr(&H80) & "1" & Chr(&HC0) &
Chr(&H80) & "ymusertest" & Chr(&HC0) &
Chr(&H80)
dat2 = "YMSG" & Chr(8) & Chr(0) & Chr(0)
& Chr(0) & Chr(0) & Chr(Len(dat3)) & Chr(0) & Chr(1)
& Chr(&H5A) & Chr(&H55) & Chr(&HAA) &
Chr(&H55) & Chr(&H62) & Chr(&H53) & Chr(&H60)
& Chr(&HFA) & dat3
Wnsckyhoo.SendData dat2
'End VB
code
The response of the server looks like
this
YMSG jLS˜0À€sundaxxxxÀ€1À€sundaxxxxÀ€
This is the data received when viewed through
a port monitor
0010: 00 59 A2 FA 40 00 2D 06 61 DB D8 88 AF
90 C0 A8 .Y..@.-.a.......
0020: 00 08 13 BA 04 E5 B5 59 53 05 21 09 4C
F6 50 18 .......YS.!.L.P.
0030: 83 2C 62 F1 00 00 59 4D 53 47 00 00 00
00 00 1D .,b...YMSG......
0040: 00 01 00 00 00 00 79 52 7E 23 30 C0 80
73 75 6E ......jLS˜0..sun
0050: 64 61 6D 65 62 61 C0 80 31 C0 80 73 75
6E 64 61 daxxxx..1..sunda
0060: 62 65 6D 61 C0 80 00 xxxx...
The
most important part of this response is the 4 byte identifier which the
server sends us the - " jLS˜ " All further communication with the server
will involve using this 4 byte identifier.This is also a user identifier
for the current messenger session.
SENDING A MESSAGE
Here is a typical example of a message being
sent
YMSG ?
ZUªUjLS˜1À€sundaxxxxÀ€5À€venkyxxxxxÀ€14À€hi thereÀ€
This is the data sent when viewed through a
port monitor
0010:00 67 42 01 40 00 80 06 62 33 C0 A8 00 08
CC 47 .gB.@...b3.....G
0020:C9 64 0C D7 13 BA A4 2F 4A C7 2F 18 A2 3A
50 18 .d...../J./..:P.
0030:43 EA 76 11 00 00 59 4D 53 47 08 00 00 00
00 2B C.v...YMSG.....+
0040:00 06 5A 55 AA 55 6A 4C 53 23 31 C0 80 73
75 6E ..ZU.UjLS˜1..sun
0050:64 61 60 69 6D 61 C0 80 35 C0 80 76 65 6E
6B 79 daxxxx..5..venky
0060:50 64 78 64 65 C0 80 31 34 C0 80 68 69 20
74 68 xxxxx..14..hi th
0070:65 72 65 C0 80 ere..
Let us look at what is being sent
YMSG- is
the yahoo standard header for all messenger command/messages
This is
followed by 1 byte of data - 08.
This is followed by 4 bytes of data -
00 00 00 00
The next byte is the length of the message information ,in
this case-HEX(16 + length(senderid)+length(receiverid) + len(message) )
The next 2 bytes of data are 00 and 06 respectively
Next is a 4
byte are standard for all messages/commands being sent to the messenger
server.The 4 bytes are 5A 55 AA 55
The next 4 bytes are the user
identifier for the current session.
This is followed by one byte of
data signifying that the data is a Private Message(PM) being sent to a
user.This byte has an ASCII equivalent of "1"
This is followed by 2
bytes of data which is the standard argument separator.- C0 80
This is
followed by the yahoo user id and the standard argument separator.
Followed by one byte which is standard for while sending a message
which has an ASCII equivalent of "5" and the standard argument separator.
This is followed by the id of the user to whom the message is being
sent and the standard argument separator.
Followed by again one byte
which is standard for while sending a message which has an ASCII
equivalent of "14" and the standard argument separator.
And finally
followed by the message being sent followed by the standard argument
separator.
The VB code to achieve this looks some what like
this
'Begin VB code
ren = "1" &
Chr(&HC0) & Chr(&H80) & Text2.Text & Chr(&HC0)
& Chr(&H80) & "5" & Chr(&HC0) & Chr(&H80)
& Text1.Text & Chr(&HC0) & Chr(&H80) & "14" &
Chr(&HC0) & Chr(&H80) & rtb2.Text & Chr(&HC0)
& Chr(&H80)
mess ="YMSG" & Chr(8) & Chr(0) & Chr(0)
& Chr(0) & Chr(0) & Chr(len(ren)) & Chr(0) & Chr(6)
& Chr(&H5A) & Chr(&H55) & Chr(&HAA) &
Chr(&H55) & Text3.Text & ren
Wnsckyhoo.Senddata
mess
'End VB code
RECEIVING A MESSAGE
YMSG ?
jLS˜5À€sundamamaÀ€4À€venky_dudeÀ€14À€hi thereÀ€
0010: 00 67 B6 8D 40 00 2E 06 3E D0 CC 47 CA
3B C0 A8 .g..@...>..G.;..
0020: 00 08 13 BA 08 DD C5 7E 1E 48 2E F3
76 6F 50 18 .........H..voP.
0030: FF FF E6 F8 00 00 59 4D 53 47 00 00
00 00 00 2B ......YMSG.....+
0040: 00 06 00 00 00 01 6A 4C 53 23 35 C0
80 76 65 6E ......jLS˜5..ven
0050: 6B 79 5F 64 75 64 65 C0 80 34 C0 80
73 75 6E 64 ky_dude..4..sund
0060: 61 6D 61 6D 61 C0 80 31 34 C0 80 68
69 20 74 68 amama..14..hi th
0070: 65 72 65 C0 80 ere..
Let us look at what has been received
YMSG-
is the yahoo standard header for all messenger command/messages
This
is followed by 5 bytes of data - 00 00 00 00 00
The next byte is the
length of the message information ,in this case-HEX(16 +
length(senderid)+length(receiverid) + len(message) )
The next 2 bytes
of data are 00 and 06 respectively
Next is a 4 byte of data signify
that the message/command is to be received .The 4 bytes are 00 00 00 01
The next 4 bytes are the user identifier for the current session.
This is followed by one byte of data signifying that the data is a
Private Message(PM) which is to be received .This byte has an ASCII
equivalent of "5"
This is followed by 2 bytes of data which is the
standard argument separator.- C0 80
This is followed by the yahoo user
id of the user who has sent the message and the standard argument
separator.
Followed by one byte which is standard when receiving a PM
message which has an ASCII equivalent of "4" and the standard argument
separator.
This is followed by the user id receiving the message and
the standard argument separator.
Followed by again one byte which is
standard when receiving a message which has an ASCII equivalent of "14"
and the standard argument separator.
And finally followed by the
message being sent followed by the standard argument separator.
USER
COMES ONLINE
YMSG A
jLS˜0À€venky_dudeÀ€7À€venkyxxxxÀ€10À€0À€11À€7D5798FDÀ€17À€0À€13À€1À€
0010: 00 7D 62 7A 40 00 2E 06 93 A4 CC 47 C9
64 C0 A8 .}bz@......G.d..
0020: 00 08 13 BA 0C D7 2F 18 A2 BF A4 2F 4B
06 50 18 ....../..../K.P.
0030: FF FF 8E 06 00 00 59 4D 53 47 00 00 00
00 00 41 ......YMSG.....A
0040: 00 01 00 00 00 01 6A 4C 53 98 30 C0 80
73 75 6E ......jLS˜0..sun
0050: 64 61 6D 61 6D 61 C0 80 37 C0 80 76 65
6E 6B 79 damama..7..venky
0060: 5F 64 75 64 65 C0 80 31 30 C0 80 30 C0
80 31 31 _dude..10..0..11
0070: C0 80 36 33 35 38 35 34 39 39 C0 80 31
37 C0 80 ..63585499..17..
0080: 30 C0 80 31 33 C0 80 31 C0 80 00
0..13..1...
The important part of this data received are
the 3 bytes of data 37 C0 80 .These 3 bytes signify that the user status
has changed .Basically i split this up into 2 states
User is online (the status maybe set to busy
or be right back etc)
User is offline
The 3 bytes at the end of the
message convey that data if the 3 bytes are 31 C0 80 , then the user is
online.
USER GOES OFFLINE
YMSG 1
jLS˜7À€venkyxxxxxÀ€10À€0À€11À€7D5798FDÀ€17À€0À€13À€0À€
0010: 00 6E 2D 52 40 00 2E 06 C8 DB CC 47 C9
64 C0 A8 .n-R@......G.d..
0020: 00 08 13 BA 0C D7 2F 18 A2 79 A4 2F 4B
06 50 18 ....../..y./K.P.
0030: FF FF B4 B1 00 00 59 4D 53 47 00 00 00
00 00 32 ......YMSG.....2
0040: 00 02 00 00 00 01 6A 4C 53 98 37 C0 80
76 65 6E ......jLS˜7..ven
0050: 6B 79 5F 64 75 64 65 C0 80 31 30 C0 80
30 C0 80 ky_dude..10..0..
0060: 31 31 C0 80 36 33 35 38 35 34 39 39 C0
80 31 37 11..63585499..17
0070: C0 80 30 C0 80 31 33 C0 80 30 C0 80
..0..13..0..
Again in this case the last 3 bytes being 30
C0 80 signify that the user has gone offline.
Download a yahoo
messenger clone from here yahclone.zip
Questions/Comments/Suggestions
send them to venky@venkydude.com .Visit my homepage for some cool VB &
C++ codes.Can also conatact me on Yahoo Messenger-id venky_dude & MSN
Messenger id- venky_dude@hotmail.com
Back to the
top
| 
