yahoo! messenger & voice protocols
-------------------------------------------
by: bruce'shinkaiho'wiggins
date: 11-29-07
resources:
*yahoo! messenger protocol
commview 5.0 & yahoo! messenger 9.0b
*rtp/rtcp information
http://www.faqs.org/rfcs/rfc1889.html
*auth information
http://ourchat.org/forums/index.php?s=7fe49baa04030c895ebfad6506ac1d4d&showtopic=1783&pid=7859&st=0&#entry7859
*IF YOU FIND SOMETHING THAT ISNT ACCURATE JUST EMAIL ME here*
——————————————-
YMSG (yahoo! messenger protocol) TCP 5050
——————————————-
59 4D 53 47 - name
00 10 - version
00 00 - unk1
00 13 - payload size
00 57 - opcode
00 00 00 00 - unk2
00 00 00 00 - session id
payload
*payload delimited by C0 80*
——————————————-
YMSG auth process
——————————————-
login.yahoo.com:443
*chal is returned from ymsg connection
GET /config/pwtoken_get?src=ymsgr&ts=1195577375&login=user&passwd=pass&chal=chal HTTP/1.1
*token is the ymsgr value returned from the above request
GET /config/pwtoken_login?src=ymsgr&ts=1195577376&token=token HTTP/1.1
*crumb is returned from the above request along with ymsg cookie
307 field is crumb + chal md5ed (16 bytes dont convert to hex) then base64ed
————————————————————————————–
REAL TIME CONTROL PROTOCOL (used to send information about voice connection) TCP 5001
————————————————————————————–
———————–
4 bytes before header
———————–
00 AC - packet size
00 00 - unk1
———————–
81 [information read from bits]
10 - 2 - version
0 - 0 - padding
00001 -1 - reception report count
C9 - opcode
00 30 - length of rtcp header
00 00 00 00 - ssrc
00 00 00 00 - ntp timestamp
00 00 00 00 - rtp timestamp
00 00 00 00 - senders packet count
00 00 00 00 - senders octet count
00 00 00 00 - ssrc_n
00 - fraction lost
00 00 00 - cumulative number of packets lost
00 00 00 00 - extended highest sequence number received
00 00 00 00 - interarrival jitter
00 00 00 00 - last SR timestamp
00 00 00 00 - delay since last SR
—————————————
RTCP Application-defined RTCP packet
all other rtcp packet types can be found at http://www.faqs.org/rfcs/rfc1889.html
—————————————
80 [information read from bits]
10 - 2 - version
0 - 0 -
00000 - subtype
CC - opcode
00 78 - length of header + payload
00 00 00 00 - ssrc/csrc
43 41 21 59 - name
———————————————————————————–
CA!Y (Application-defined RTCP packet 0xCC)
———————————————————————————–
00 01 - opcode
00 00 00 00 - unk1
x - diffrent length/data depending on type of ca!y packet
—————————————————————
REAL TIME PROTOCOL (used to send/recv voice data) UDP 5000-5010
—————————————————————
80 [information read from bits]
10 - 2 - version
0 - 0 - padding
0 - 0 - extension
0000 - 0 - csrc count
A2 [information read from bits]
1 - 1 - marker
0100010 - 22 - payload type
00 82 - sequence number
00 01 5C C0 - timestamp
39 C8 58 CB - ssrc
00 02 57 43 - csrc
payload
———————————————–