MSN协议分析

21:56:  VER 77 MSNP15 MSNP14 MSNP13 CVR0  //-->协商MSN版本请求

 

21:56:  VER 77 MSNP15 MSNP14 MSNP13 CVR0  //<--协商MSN版本请求

 

21:56:  CVR 78 0x0804 winnt 6.0 i386 MSNMSGR 8.1.0178 msmsgs cnqing@gmail.com

USR 79 SSO I cnqing@gmail.com    //-->发出客户端的OS、语言、MSN Messenger版本等信息、单点登录

 

21:56:  CVR 78 8.1.0178 8.1.0178 8.0.0787

http://msgr.dlservice.microsoft.com/download/B/D/3/BD343317-2DBF-48FE-8BD9-9E3212D65E6A/Install_Messenger.exe

http://get.live.com/cn

// ß返回推荐的MSN Messenger版本、升级软件需要的下载地址等信息。

 

21:56:  XFR 79 NS 207.46.106.73:1863 U D     //à请求分配SS服务器

 

21:56:  VER 80 MSNP15 MSNP14 MSNP13 CVR0          //à服务器转移后重新登录

 

21:56:  VER 80 MSNP15 MSNP14 MSNP13 CVR0          //ß重复以上的登录过程

 

21:56:  CVR 81 0x0804 winnt 6.0 i386 MSNMSGR 8.1.0178 msmsgs cnqing@gmail.com

USR 82 SSO I cnqing@gmail.com

//ß重复以上的登录过程

 

21:56:  CVR 81 8.1.0178 8.1.0178 8.0.0787

http://msgr.dlservice.microsoft.com/download/B/D/3/BD343317-2DBF-48FE-8BD9-9E3212D65E6A/Install_Messenger.exe

http://get.live.com/cn

//ß重复以上的登录过程

 

21:56:  GCF 0 7020 //ß接下来的内容是一些包含安全策略BASE64编码后关键字的XML档案（简单整理了一下）

<Policies>

     <Policy type="ABCH">

         <policy>

              <set id="push" service="ABCH" priority="200">

                   <r id="pushstorage"  threshold="120000"  />

              </set>

         </policy>

     </Policy>

     <Policy type="SHIELDS">

         <config>

              <shield>

                   <cli maj="7" min="0" minbld="0"  maxbld="9999" deny="" />

              </shield>

              <block>

                   <hashes></hashes>

                   <regexp>

                       <imtext value="XC5waWY=" /> //DECODE BASE64= \.pif

                       <imtext  value="XC5zY3I=" />

                       <imtext value="Z3JvdXBwaWN0dXJlXC5waHA=" />

                       <imtext value="Z3JvdXBpY3R1cmVcLnBocA==" />

                       <imtext value="Z2FsbGVyeVwucGhw" />

                       <imtext value="c3RhZmZcLnBocA==" />

                       <imtext value="cGljc1wucGhw" />

                       <imtext value="cm90dGVudG9tYXRvZXNcLnVz" />

                       <imtext value="bXNuXC5waHBcP2VtYWlsPQ==" />

                       <imtext value="ZG93bmxvYWRcLnBocA==" />

                       <imtext value="NjlcLjU2XC4xMjlcLjY3L2dpZnRcLmNvbQ==" />

                       <imtext value="eG1hcy0yMDA2" />

                       <imtext value="bWlyYWxhZm90by9mb3RvXC5leGU=" />

                       <imtext value="MTY4XC4xNjlcLjc4XC4xOQ==" />

                       <imtext value="cHJvZmlsZVwucGhwXD8=" />

                       <imtext value="dHVmb3Rv" />

                       <imtext value="dmVydGkyL2ZhbnRhc21hXC56aXA=" />

                       <imtext value="YXJtYXpmaWxlc1wuc210cFwucnU=" />

                       <imtext value="c3dlZXRwaWN0dXJlc1wubXlwaG90b3NcLmNjL2thdGllc2V4XC5waWY=" />

                       <imtext value="MjAxXC4yMlwuNlwuNC9mb3Rvcy9zYWZhZGFcLmh0bWw=" />

                       <imtext value="Y2huc3R1ZGlvXC5jb20vdXBsb2FkL2ltcGx1c2VcLmV4ZQ=="/>

                       <imtext value="c2h1cmxcLm9yZy9teWhvbWVwYWdl" />

                       <imtext value="cDEzNzdcLnBpYy1teXNwYWNlXC5pbmZv" />

                       <imtext value="cGljODMxXC5tcDMtbXlzcGFjZVwuY29t" />

                       <imtext value="ODhjaGlcLmNvbQ==" />

                       <imtext value="bmloYW81MlwuY29t" />

                       <imtext value="ODFjb3B5XC5jb20=" />

                       <imtext value="bXlvbmxpbmVjYW1cLm5ldA==" />

                       <imtext value="Nzc4ODVcLmNu" />

                       <imtext value="NTF6aGFvZ3VcLmNvbQ==" />

                       <imtext value="NTFzaGVqaWFvXC5jbg==" />

                       <imtext value="Z2FuZ2VuXC5jbg==" />

                       <imtext value="d2FuZ3dcLmNu" />

                       <imtext value="dWdseXBob3Rvc1wubmV0" />

                       <imtext value="ZnVucGljXC5kZQ==" />

                       <imtext value="NTA1dW5pdGVkXC5jb20=" />

                       <imtext value="dDM1XC5jb20=" />

                       <imtext value="cXVpY2tuZXdzXC5pbmZv" />

                       <imtext value="c3ltYW50ZWNcLmNvbS9zZWN1cml0eV9yZXNwb25zZS93cml0ZXVwXC5qc3BcP2RvY2lkPTIwMDQtMT

IwNzE0LTA2NDMtOTk=" />

                       <imtext value="bWVtYmVyc1wubHljb3NcLmNvXC51ay9zdnkyMS90L2NvbnRhY3RcLnBocA==" />

                       <imtext value="c29ucmVzaW1sZXIxXC5nb29nbGVwYWdlc1wuY29tL296ZWxyZXNpbWxlclwuaHRt" />

                       <imtext value="dmlvdGFnYWxsZXJ5XC5jb20=" />

                       <imtext value="aW1hZ2UwMDFcLnBuZw==" />

                        <imtext value="aW1hZ2UwMDJcLmdpZg==" />

                       <imtext value="ZnVuYnVkZHlpY29uc1wuY29t" />

                       <imtext value="d2VsbHdlbGxcLmJpeg==" />

                       <imtext value="Y2FzZWRpbmplcnRpb25rZGVydW5oZGFzZW9cLmNvbQ==" />

                       <imtext value="amVydGlvbmtkZXdpb25kYXNlcnVuZlwuY29t" />

                       <imtext value="YnV0dWlua2Rlc2lvbm1hc1wuY29t" />

                       <imtext value="aW1wXC5leGU=" />

                       <imtext value="YnVzaC1ncmFjaW9zb1wuZXhl" />

                       <imtext value="bWVtZWJlcnNcLmx5Y29zXC5jb1wudWsvZ2V0bWVzc2VuZ2Vy" />

                       <imtext value="Z2V0LW1lc3Nlbmdlcg==" />

                       <imtext value="YmVsZ3JhdmVoZWxwZGVza1wuY29t" />

                       <imtext value="eHBpbWFkXC5jb20=" />

                       <imtext value="YWxidW1cLnppcA==" />

                       <imtext value="bWFsYnJhbmNoZVwuZ29yYWNlclwuZGU=" />

                       <imtext value="YWxicmFoZW1cLmNvbQ==" />

                       <imtext value="aW1wcm9maWxlXC5uZXQ=" />

                       <imtext value="dW5rbm93bnRvb2xzXC5jb20=" />

                       <imtext value="aGV0YW5kdW5oYXNkZVwuY29t" />

                       <imtext value="dGhlY29vbHBpY3NcLm5ldA==" />

                       <imtext value="Lip3d3dcLnByb3ZuYXJrb3Rpa2FcLmNvbS4q" />

                       <imtext value="Z3JhdGlzaG9zdFwuY29t" />

                       <imtext value="ZHJlYW1saWZlMzY1XC5jb20=" />

                       <imtext value="d2hvYWRtaXRzeW91XC5jb20=" />

                       <imtext value="YmxvY2tvb1wuY29t" />

                       <imtext value="YmFyYXRpbmhhXC5teXBldHNcLndz" />

                       <imtext value="bWVzc2FuZ2Vyc3RhdHNcLm5ldA==" />

                       <imtext value="bWVzc2VuZ2VydG9vbHNcLm9yZw==" />

                       <imtext value="c3R1ZmZwbHVnXC5jb20vdGVtcC9kb3duZ3JkclwuZXhl" />

                       <imtext value="aG9ybnltYXRjaGVzXC5jb20=" />

                       <imtext value="aXdhbnR1XC5jb20=" />

                       <imtext value="YmxvY2stY2hlY2tlclwuY29t" />

                       <imtext value="YW1pZ29zcGFyYXNlbXByZVwuc210cFwucnU=" />

                       <imtext value="YW1pZ29zcGFyYXNlbXByb1wuc210cFwucnU=" />

                       <imtext value="Y2hpbmFjaXJjbGVcLmNvbQ==" />

                       <imtext value="bWVuc2FnZW1wYXJhdmNcLm1haWwxNVwuY29t" />

                            <imtext value="OTMwbGVcLmNvbQ==" />

                            <imtext value="NjY2NjNcLmNu" />

                            <imtext  value="c2h1c3VcLmNu" />

                            <imtext value="MTcxN3dhblwuY24=" />

                            <imtext value="OTk1YmFcLmNvbQ==" />

                            <imtext  value="bXlkaXBhblwuY24=" />

                            <imtext value="NTFrb25ncWlcLmNvbQ==" />

                            <imtext value="OTRuaWxlXC5jb20=" />

                            <imtext value="bGlmZTM2NVwuY29t" />

                            <imtext value="cGhvdG9nYmFzZVwuY29tL3BpY3R1cmVzXC5waHBcP3Bob3RvNjU2XC5qcGc=" />

                            <imtext value="bXlwZW5neW91XC5jb20=" />

                            <imtext value="NTFwaW5nZ3VvXC5jbg==" />

                            <imtext  value="c3BvdHlvdXJmYWNlXC5uZXQvbWFpbi9waWN0dXJlcy9zZXh5" />

                            <imtext value="d2luZG93c2xpdmVtZXNzZW5nZXJcLmJpeg==" />

                            <imtext value="bWVuc2FnZWlyb3ZpcnR1YWxcLmxhbmRcLnJ1" />

                            <imtext value="cHJvdm5hcmtvdGlrYVwuY29t" />

                            <imtext value="dGlueXVybFwuY29tL2FzZGtmaDEzLw==" />

                            <imtext value="d2FzZWRpbnRlcmZ1bnZhXC5jb20=" />

                            <imtext value="cWVydW5oZXJkYXNmdW5raW5cLmNvbQ==" />

                            <imtext value="cGhvdG9zXC56aXA=" />

                            <imtext value="Lioybm52YzcuKg==" />

                            <imtext value="Lip1cmx0ZWFcLmNvbS4q" />

                            <imtext value="dXJsdGVhXC5jb20vcDJz" />

                            <imtext value="dGlueXVybFwuY29tLzJubnZjNw==" />

                            <imtext value="bGlua2FuZ2VsXC5uZXQvbXNu" />

                            <imtext value="bWVzc2VuZ2VyLXRpcHNcLmNvbQ==" />

                            <imtext value="aW1yZWFsbVwuY29t" />

                            <imtext value="YmxvY2tuYmxvY2tcLmNvbQ==" />

                            <imtext value="aW10cmFjdFwuY29t" />

                            <imtext value="bWVzc2FnaW5nLW5hbWVz" />

                            <imtext value="LiptZXNzZW5nZXJsaXZlXC5pbmZvLio=" />

                            <imtext value="dGVibG9xdWVvXC5jb20=" />

                            <imtext value="Y2Jzd2VzdFwuY29t" />

                            <imtext value="bmV3bXNu" />

                            <imtext value="Y2lybmV3c1wuY29t" />

                            <imtext value="LiplYXNlZHJ1bmtpb25kZWh1bmZhbnNcLmNvbS4q" />

                       </regexp>