Yahoo Messenger Protocol (ver 9)
(UNOFFICIAL DOCUMENTATION)
DISCLAIMER
*************************************************************************************************
The new yahoo protocol is really right up there when it comes to security unlike the previous versions .Also i do not expect people to stop using the original yahoo messenger and use a simple clone which just about sends and receives messages.Yahoo has added a whole range of features to it's messenger like IM Environments,voice chat and webcam support which are pretty cool and pretty tough to replicate(maybe i'llgive it a shot when i got loads of free time!!!).And finally i expect people who might use this protocol info to not harm anybody by making booters and bombers,that's really an awful waste of technology besides serving no purpose. And last but not the least ,thank yahoo for providing a nice tool for instant communication
*************************************************************************************************
The basic purpose of writing this document is that people should know what's actually happening when they use the yahoo messenger.There is hardly any if not any documentation available on the internet concerning the YMSG ptotocol .
The first step involved in any messenger application is logging into the messenger server and then retrieving the friends list..The yahoo messenger connects to the yahoo server(cs.yahoo.com) on port 5050.Let us first look at logging into the yahoo server
We will connect to the yahoo messenger server cs.yahoo.com on port 5050
As always the most difficult part to figure out in any messenger protocol is the login encryption.The earlier version of the yahoo protcol used the MD5 CRYPT function to do the encryption.This was a pretty weak encryption considering that the encrypted data being sent back to the server was always constant.With ver 9 of their protocol yahoo has tried to make the login process more secure.Yahoo introduced a new challenge response mechanism where the server sends a 24 charecter string and the messenger has to encrypt the password using this string and send back 2 such 24 charecter strings.
The encryption algorithm used remains MD5.One of the 2 strings is made by encrypting the password hash, the username the challenge string and one charceter of the 24 charecter string,The other string is made by encrypting the crypt hash of the password the username and the challenge string and one charceter of the 24 charecter string.The 2 strings are finally encoded in mac64 encoding format.The Mac64 encoding format is similar to the base64 encoding format except for 3 charecters, the charecters "+ " , "\" & "=" used in the base64 encoding format are replaced by the charecters "." ,"_" & "-" respectively for the mac64 encoding format.
You can download the dll along with a vb bas module on how to use it here ,venky2.zip
Now let us start logging into the yahoo messenger server .We send the following data to the messenger server to start the login process
YMSG W 1Ŕ€sundaxxxaŔ€
This is the data sent when viewed through a port monitor
0000: 20 53 52 43 00 00 44 45 53 54 00 00 08 00 45 00 SRC..DEST....E.
0010: 00 4A CC 04 40 00 80 06 BD 17 CB 5E EA D9 D8 88 .J..@......^....
0020: E2 D0 04 8B 00 50 00 71 FD 88 82 BE 3A C0 50 18 .....P.q....:.P.
0030: 21 80 7F 04 00 00 59 4D 53 47 09 00 00 00 00 0E !.....YMSG......
0040: 00 57 00 00 00 00 00 00 00 00 31 C0 80 73 75 6E .W........1..sun
0050: 64 61 44 67 69 61 C0 80 dxxxa..
Let us look at what exactly is being sent
- YMSG- is the yahoo standard header for all messenger command/messages
- This is followed by 1 byte of data - 09. -this indicates the version number of the protocol
- This is followed by 4 bytes of data - 00 00 00
- Next 2 bytes specify is the length of the message information-i.e total lengthof the string -length of the header(20 bytes)
- The next bytes of data is 00
- This is followed by the charecter "W" this signifies that the command being sent is a challenge command
- Next is a 4 byte are -00 00 00 00
- The next 4 bytes is what i call the initial 4 bytes bluff identifier. These 4 bytes identify a particular user and it changes every time you log in. Initially you could send any four bytes including 00 00 00 00 and you would still be able to log in .
- This is followed by one byte of data signifying that the data being sent is for logging into the server .This byte has an ASCII equivalent of "0"
- This is followed by 1 byte of data - 31 whose ascii equivalent is "1"
- This is followed by 2 bytes of data which is the standard argument separator.- C0 80
- Finally this is followed by the yahoo user id and the standard argument separator.
-
- The server in response sends a challenge string to verify the password.The response of the server looks like this
YMSG , W ~* —1Ŕ€sundxxxaŔ€94Ŕ€3x0FCwY8xVwZSf90P.g5SA--Ŕ€
This is the data received when viewed through a port monitor 0000: 44 45 53 54 00 00 20 53 52 43 00 00 08 00 45 00 DEST.. SRC....E.
0010: 00 68 49 02 40 00 32 06 8D FC D8 88 E2 D0 CB 5E .hI.@.2........^
0020: EA D9 00 50 04 8B 82 BE 3A C0 00 71 FD AA 50 18 ...P....:..q..P.
0030: FF FF B1 A6 00 00 59 4D 53 47 00 00 00 00 00 2C ......YMSG.....,
0040: 00 57 00 00 00 01 7E 2A 0A 97 31 C0 80 73 75 6E .W.....*..1..sun
0050: 64 34 6D 51 6D 61 C0 80 39 34 C0 80 33 78 30 46 dxxxa..94..3x0F
0060: 43 77 59 38 78 56 77 5A 53 66 39 30 50 2E 67 35 CwY8xVwZSf90P.g5
0070: 53 41 2D 2D C0 80 SA--..
- YMSG- is the yahoo standard header for all messenger command/messages
- This is followed by 1 byte of data - 00. -this indicates that the data has been sent by the server
- This is followed by 3 bytes of data - 00 00 00
- Next 2 bytes specify is the length of the message information-i.e total lengthof the string -length of the header(20 bytes)
- The next bytes of data is 00
- This is followed by the charecter "W" this signifies that the command being sent is a challenge command
- Next is a 4 byte are -00 00 00 01
- The next 4 bytes are the most important part of this response these 4 bytes also signify the session id .All future messages/command being sent to the server require this session id
- This is followed by 1 byte of data - 31 whose ascii equivalent is "1"
- This is followed by 2 bytes of data which is the standard argument separator.- C0 80
- This is followed by the yahoo user id and the standard argument separator.
- Next are two bytes having ascii equivalent "9" and "4", "94" signifies that what follows is a 24 charecter challenge string
- Finally the 24 charecter challenge string followed by the standard argument seperator
|