Protocols/OSCAR/SNAC/OSERVICE PROBE REQ

OSCAR Protocol

Introduction • Terms • Clients

Basic

Datatypes • FLAP • SNAC • TLV

UUIDs • Errors • Tool IDs

Host Interaction

Rate Limits • Migration • Messages

Other Services

ADMIN • ADVERT • ALERT

BART • BOS • BUCP • CHAT

CHAT_NAV

Tutorials

Sign On • BART • Rendezvous

ICBM • Locate • Buddies

Foodgroups

OSERVICE (0x0001)

LOCATE (0x0002)

BUDDY (0x0003)

ICBM (0x0004)

ADVERT (0x0005)

INVITE (0x0006)

ADMIN (0x0007)

POPUP (0x0008)

PD (0x0009)

USER_LOOKUP (0x000A)

STATS (0x000B)

TRANSLATE (0x000C)

CHAT_NAV (0x000D)

CHAT (0x000E)

ODIR (0x000F)

BART (0x0010)

FEEDBAG (0x0013)

ICQ (0x0015)

BUCP (0x0017)

ALERT (0x0018)

PLUGIN (0x0022)

UNNAMED_FG_24 (0x0024)

MDIR (0x0025)

ARS (0x044A)

ID	Origin	Name	Foodgroup	Service	Status	Version
0x0001, 0x001F	Host	OSERVICE__PROBE_REQ	Unspecified	All	Active	4.0

Client verification request.

SNAC Header

Foodgroup	uint16 (word)	00 01
Subgroup	uint16 (word)	00 1F
Flags	uint16 (word)	00 00
Request ID	uint32 (dword)	00 00 00 00

SNAC Data

Unconfirmed: This SNAC contains no data

From Aleksandr Shutko: SNAC(01,1F) server client verification command SNAC(01,1F) OSERVICE__PROBE_REQ

The verification request contains eight bytes. The first four are an offset, the second four are a length. The offset is an offset into aim.exe when it is mapped during execution on Win32. So far, AOL has only been requesting bytes in static regions of memory. When the client recieves the request, it adds it to the current ds (0x00400000) and dereferences it, copying the data into a buffer which it then runs directly through the MD5 hasher. The 16 byte output of the hash is then sent back to the server. If the client does not send any data back, or the data does not match the data that the specific client should have, the client will get the following message from "AOL Instant Messenger": "You have been disconnected from the AOL Instant Message Service (SM) for accessing the AOL network using unauthorized software. You can download a FREE, fully featured, and authorized client, here http://www.aol.com/aim/download2.html" The connection is then closed, recieving disconnect code 1, URL http://www.aim.aol.com/errors/USER_LOGGED_OFF_NEW_LOGIN.html.  00 01   word   SNAC family  00 1F   word   SNAC subtype  00 00   word   SNAC flags  xx xx xx xx   dword   SNAC request-id  xx xx xx xx   dword   Requested data offset  xx xx xx xx   dword   Requested data length

Example SNAC dump with flap header:

2A 02 E5 65 00 12 00 01 00 1F 00 00 82 E8 D1 D1 *..e............ 03 FF FF FF 03 FF FF FF ........

From Aleksandr Shutko: Client verification sequence

<a name="verification"></a> Client verification sequence        This request used by AOL AIM server to recognize clone clients. The request contains eight bytes. The first four are an offset, the second four are a length.      When the client receives the request, it adds it to the current ds (0x00400000) and dereferences it, copying the data into a buffer which it then runs directly through the MD5 hasher. The 16 byte output of the hash is then sent back to the server.  Client verification   <<   SNAC(01,1F)   Server ack client for verification reply   >>   SNAC(01,20)   Client sends verification reply

OSERVICE SNACs

SNAC List

Subgroup Origin Name 0x0001 Any OSERVICE__ERR This is the error SNAC for the OSERVICE foodgroup. 0x0002 Client OSERVICE__CLIENT_ONLINE This message is sent by the client once it has initialized the host state (set preferences, Buddy Lists, locate information, capabilities) and is ready to be announced as being online by the host. 0x0003 Host OSERVICE__HOST_ONLINE This is the very first SNAC sent from the host to the client after the FLAP signon frames are sent. It contains an array of all of the foodgroups the service supports. 0x0004 Client OSERVICE__SERVICE_REQUEST This SNAC requests that the specified service (foodgroup) be provided to it in a way further specified by qualifying parameters. 0x0005 Host OSERVICE__SERVICE_RESPONSE This SNAC contains information about connecting to the new server. It is the response from the server to a service request. 0x0006 Client OSERVICE__RATE_PARAMS_QUERY This SNAC is sent by the client to query for the current rate limit parameters. 0x0007 Host OSERVICE__RATE_PARAMS_REPLY Contains response to the OSERVICE__RATE_PARAMS_QUERY. 0x0008 Client OSERVICE__RATE_PARAMS_SUB_ADD Subscribe to any rate parameter changes among the specified class IDs. If there was no prior subscription for a given class ID, an immediate notification will be queued. 0x0009 Client OSERVICE__RATE_DEL_PARAM_SUB Cancels any rate parameter subscriptions for the specified class IDs. 0x000A Host OSERVICE__RATE_PARAM_CHANGE This contains an array of class rate parameters that have changed since last query or notification. 0x000B Host OSERVICE__PAUSE_REQ This is sent by the server when it needs to migrate the client. 0x000C Client OSERVICE__PAUSE_ACK This is sent by the client to acknowledge the receipt and processing of a OSERVICE__PAUSE_REQ SNAC request. 0x000D Host OSERVICE__RESUME In certain situations the server may abort a migration after having told the client to PAUSE. 0x000E Client OSERVICE__USER_INFO_QUERY This is a query to find out one's current info. The server will send a OSERVICE__USER_INFO_UPDATE. 0x000F Host OSERVICE__USER_INFO_UPDATE This SNAC is sent by the server whenever significant parts of a user's info change. 0x0010 Host OSERVICE__EVIL_NOTIFICATION This is a notice that the user's evil level has changed. 0x0011 Client OSERVICE__IDLE_NOTIFICATION This SNAC is sent by the client to inform the server of the user's idle state. 0x0012 Host OSERVICE__MIGRATE_GROUPS This SNAC commands the client to reconnect to the server specified by the included OSERVICE__TLV_TAGS_RECONNECT_HERE TLV. 0x0013 Host OSERVICE__MOTD Message of the day (MOTD). Often contains upgrade information for clients as well as notices about clients. 0x0014 Client OSERVICE__SET_PRIVACY_FLAGS Set privacy flags. 0x0015 Host OSERVICE__WELL_KNOWN_URLS Service related URLs for the client to use or provide to the user. 0x0016 Client OSERVICE__NOOP Legacy SNAC keepalive, replaced in large part with FLAP level keepalive. 0x0017 Client OSERVICE__CLIENT_VERSIONS Sent after OSERVICE__HOST_ONLINE, it contains the client's foodgroup version list so the host knows what functionality the client is capable of. 0x0018 Host OSERVICE__HOST_VERSIONS The host responds to OSERVICE__CLIENT_VERSIONS with its foodgroup version list so that the client knows what this host provides and its capabilities. 0x0019 NCD OSERVICE__MAX_CONFIG_QUERY This is not currently documented. Want to contribute? 0x001A NCD OSERVICE__MAX_CONFIG_REPLY This is not currently documented. Want to contribute? 0x001B NCD OSERVICE__STORE_CONFIG This is not currently documented. Want to contribute? 0x001C NCD OSERVICE__CONFIG_QUERY This is not currently documented. Want to contribute? 0x001D NCD OSERVICE__CONFIG_REPLY This is not currently documented. Want to contribute? 0x001E Client OSERVICE__SET_USERINFO_FIELDS This allows the client to set some of the fields in user info that are sent to every client. 0x001F Host OSERVICE__PROBE_REQ Client verification request. 0x0020 Client OSERVICE__PROBE_ACK Client verification reply. 0x0021 Host OSERVICE__BART_REPLY This reply is used to tell the client that a BART item needs to be uploaded or changed. 0x0022 Client OSERVICE__BART_QUERY2 This query sees if the BART IDs are available; OSERVICE__BART_REPLY2 is sent as a response. 0x0023 Host OSERVICE__BART_REPLY2 This SNAC is sent on initial login about items in the personality section of the Feedbag. It is also used in response to a OSERVICE__BART_QUERY2.