Yahoo Messenger Proto - Cjdelphi :) 


Intro to YMSG..


and as of the fact Delphi is HIGHLY under-rated this is going to be for Delphi users :-) 
oh and of course anyone who has the slightest idea about Programming.

If you have dealt already with YCHT then this should be fairly
easy to use and understand, let's get started...


Authentication...

Yes you may connect to edit.yahoo.com and get your buddy list however
unlike before no cookie is needed to login in to the server, instead
yahoo have decided to use MD5 (it's a hashing table, which looks like it
has been encrypted) simply run the password through and send the results...

Logging in and chatting
=======================


Let's now take a look at the login packet in detail..

Packet Type: 0x01(Login Packet) [OutGoing]
// 59 4D 53 47 08 00 00 00 00 43 00 01 5A 55 AA 55   YMSG.....C..ZU.U
00 00 00 00 // 30 C0 80 6A 61 6E 65 6F 74 72 6F 6E   .......janeotron
   C0 80 36 C0 80 24 31 24 5F 32 53 34 33 64 35 66   ..6....._.S43d5f
   24 65 4B 4C 54 4A 54 4B 57 55 72 72 52 33 61 63   .eKLTJxxxxxxxxac
   2E 61 78 4E 4A 2F 30 C0 80 31 C0 80 6A 61 6E 65   .axNJ.......jane
   6F 74 72 6F 6E C0 80   				  otron..

{For security reasons i am marking out the password hashed string :P}

The first 4 bytes are always 21 20 80 46 (YMSG)

- This is followed by 1 byte of data - 08.  
- This is followed by 4 bytes of data -  000 00 00 00  
- Then the length of the payload (representted as TWO bytes) 00 00
- The next byte of data is 01
- Next is a 4 byte are standard for all messsages/commands being 
  sent to the messenger server.The 4 bytes are  5A 55 AA 55 
- the next 4 bytes is the ID_TAG 00 00 00 000 when you login you will 
  be givin an ID code just like that of an ID card.

The rest is the pay load each packet is different depending on what to do.



Ok Step 1.

Host: 'cs.yahoo.com'
Port: 5050 or 8080

You need something to connect to :P

Login..

 First of all unless you have source code for an MD5 hash i suggest
you checkout 

 http://www.venkydude.com/articles/yahoo.htm 

There is a dll for you to download, supplied with this file should
be a file called cjdelphi.pas which will talk to his MD5 dll..

or in webform... it can be found here: http://www.geocities.com/cjdelphi/cjdelphi.pas << simply go to your
uses and add cjdelphi as a unit.

Ok...

59 4D 53 47 08 00 00 00 00 43 00 01 5A 55 AA 55   YMSG.....C..ZU.U
00 00 00 00 30 C0 80 6A 61 6E 65 6F 74 72 6F 6E   .......janeotron
C0 80 36 C0 80 24 31 24 5F 32 53 34 33 64 35 66   ..6....._.S43d5f
24 65 4B 4C 54 4A 54 4B 57 55 72 72 52 33 61 63   .eKLTJxxxxxxxxac
2E 61 78 4E 4A 2F 30 C0 80 31 C0 80 6A 61 6E 65   .axNJ.......jane
6F 74 72 6F 6E C0 80   				  otron..

In delphi it goes a little somethin like this.

Function LoginString(UserName,Password: String): String;
Var
 ActLen: integer;
 Data,Tmp: String;
Begin
Data:=#$30+#$C0+#$80+UserName+#$C0+#$80+#$36+#$C0+#$80+EncryptString(Password)+#$C0+#$80+#$31+#$C0+#$80+UserName+#$C0+#$80;
 ActLen:=Length(Data); //get the total size of the data
Tmp:='YMSG'+#$08+#$0+#$0+#$0+LengthToStr(ActLen)+#$00+#$01+#$5A+#$55+#$AA+#$55+#$00+#$00+#$00+#$00; //this is just the header (20 bytes)
 Tmp:=Tmp+Data;
 LoginString:=Tmp;
End;


On Return you get this..


Packet Type: 0x01(Login Packet) [InComing]
59 4D 53 47 00 00 00 00 00 4C 00 01 00 00 00 00   YMSG.....L......
74 5E C7 38 30 C0 80 6A 61 6E 65 6F 74 72 6F 6E   t^.8...janeotron
C0 80 31 C0 80 6A 61 6E 65 6F 74 72 6F 6E C0 80   .....janeotron..
38 C0 80 31 C0 80 37 C0 80 63 6A 64 65 6C 70 68   8.....7..cjdelph
69 C0 80 31 30 C0 80 30 C0 80 31 31 C0 80 30 C0   i...............
80 31 37 C0 80 30 C0 80 31 33 C0 80 33 C0 80      ..7......3..3..

This is actually very important since this holds the YMSG key can u see the key?
17 bytes along length 4 bytes, extract it and save it as from every packet u send
from now on, u NEED it.

And as for Delphi it's this :)

Key:=Copy(S,17,4); //there u have it :D


Step 3. logged in, got the key now lets log in to the chat room (Programming:1)

Part A.)

Packet Type: 0x96(Init Room Login) [OutGoing]
59 4D 53 47 08 00 00 00 00 28 00 96 00 00 00 00   YMSG............
74 5E C7 38 31 30 39 C0 80 6A 61 6E 65 6F 74 72   t^.8..9..janeotr
6F 6E C0 80 31 C0 80 6A 61 6E 65 6F 74 72 6F 6E   on.....janeotron
C0 80 36 C0 80 61 62 63 64 65 C0 80               ..6..abcde..

Imagine this the prep, the swab before the doctor jabs u and extracts blood, this
simply tells yahoo u are going to engage in chat...

Function MoveRoom(UserName,UserOnline: String): String;
Var
 Len,ActLen: integer;
 Data,Payload,Tmp: String;
Begin
 Payload:='109'+#$C0+#$80+UserName+#$C0+#$80+'1'+#$C0+#$80+UserName+#$C0+#$80+'6'+#$C0+#$80+'abcde'+#$c0+#$80;
 ActLen:=Length(PayLoad);
 Tmp:='YMSG'+#$08+#$0+#$0+#$0+LengthToStr(ActLen)+#$0+#$96+#$0+#$0+#$0+#$0+Key;
 ActLen:=Length(Tmp);
 Tmp:=Tmp+PayLoad;
 MoveRoom:=Tmp;
 InChat:=True;
end;

Part B) After sending the init packet u need to send either this or the goto packet

Getting into a room

Packet Type: 0x98(Enter Room Event) [OutGoing]
59 4D 53 47 08 00 00 00 00 3A 00 98 00 00 00 00   YMSG.....:......
74 5E C7 38 31 C0 80 6A 61 6E 65 6F 74 72 6F 6E   t^.8...janeotron
C0 80 31 30 34 C0 80 50 72 6F 67 72 61 6D 6D 69   ....4..Programmi
6E 67 3A 31 C0 80 31 32 39 C0 80 31 36 30 30 33   ng:.....9...6..3
32 36 35 39 33 C0 80 36 32 C0 80 32 C0 80         .6593..6......


???????????
00000000  8A BC 20 00 01 00 00 00 01 00 00 00 08 00 45 00 ..............E.
00000010  00 73 06 BF 40 00 80 06 33 A6 D3 1A 33 ED D8 88 .s..@...3...3...
00000020  E0 8F 04 4A 13 BA 54 F5 41 1E BD 9E A6 B8 50 18 ...J..T.A.....P.
00000030  1E F3 6A 3B 00 00 59 4D 53 47 09 00 00 00 00 37 ..j;..YMSG.....7
00000040  00 98 00 00 00 00 73 2C AF D3 31 C0 80 63 6A 64 ......s,..1..cjd
00000050  65 6C 70 68 69 C0 80 36 32 C0 80 32 C0 80 31 30 elphi..62..2..10
00000060  34 C0 80 50 72 6F 67 72 61 6D 6D 69 6E 67 C0 80 4..Programming..
00000070  31 32 39 C0 80 31 36 30 30 33 32 36 35 39 33 C0 129..1600326593.
00000080  80                                              .               
???????????



Function JoinRoom(UserName,RoomName: String): String;
 Var
 Len,ActLen: integer;
 Data,Payload,Tmp: String;
Begin
 Form1.ListBox1.Items.Clear;
 Payload:=#$31+#$C0+#$80+UserName+
 #$C0+#$80+'104'+#$C0+#$80+RoomName+#$C0+#$80+'129'+#$C0+#$80+
 '1600326593'+#$C0+#$80+'62'+#$C0+#$80+'2'+#$C0+#$80;
 ActLen:=Length(PayLoad);
 Tmp:='YMSG'+#$08+#$0+#$0+#$0+LengthToStr(ActLen)+#$0+#$98+#$0+#$0+#$0+#$0+key;
 ActLen:=Length(Tmp);
 Tmp:=Tmp+PayLoad;
End;

--------------------------------the rest iss up to you------------------------------

on recv from YMSG

in hex      
        0x1 = Someone just logged into the YMSG server
        0x2 = Someone just logged off the YMSG server
        0x6 = PM packet from a YMSG user
        0x20 = PM packet from a YCHT user //(sorry i had 32dec not hex)
        0xA8 = Chat Packet when in the main room
        0x9B = Someone just Left the chat room
        0x98 = Someone Just joined the Chat Room //AND the room chatter list (hates yahoo)


//below are all to send out....

0x96 = Get Ready For Room Login
0x97 = Goto User
0x98 = Room Enter Event (Do 0x96 first)
0xA0 = room leave event

0x0A = logout //as of YCHT you would leave the server, YMSG you simply leave the room
0xA1 = Ping Event (suggest every 7 - 15 mins)

0xA8 = speech for main chat room
0x06 = private message (Main Messenger Format)


//Detailed view...

0x96 = Get Ready For Room Login
0030  21 20 80 46 00 00 59 4D 53 47 08 00 00 00 00 28  ! .F..YMSG.....(
0040  00 96 00 00 00 00 70 49 72 70 31 30 39 C0 80 6A  ......pIrp109..j
0050  61 6E 65 6F 74 72 6F 6E C0 80 31 C0 80 6A 61 6E  aneotron..1..jan
0060  65 6F 74 72 6F 6E C0 80 36 C0 80 61 62 63 64 65  eotron..6..abcde
0070  C0 80                                            ..




   Then DIRECTLY after do the room enter/goto event  

0x98 = Room Enter Event (Do 0x96 first)
0030  20 FD 3C 76 00 00 59 4D 53 47 08 00 00 00 00 3A   .......
7B 56 04 2D 35 C0 80 6A 61 6E 65 6F 74 72 6F 6E   {V..5..janeotron
C0 80 34 C0 80 63 6A 64 65 6C 70 68 69 C0 80 31   ..4..cjdelphi..1
34 C0 80 6B C0 80 36 33 C0 80 68 65 61 72 74 73   4..k..63..hearts
3B 31 C0 80 36 34 C0 80 30 C0 80 39 37 C0 80 30   ;1..64..0..97..0
C0 80   ..



//this is the inviroment


========================Unkown Section=============================

//unkown?
Packet Type: 0x4A(Unkown...) [InComing]
59 4D 53 47 00 00 00 00 00 51 00 4A 00 00 00 01   YMSG.....Q.J....
72 40 68 73 35 C0 80 6A 61 6E 65 6F 74 72 6F 6E   r@hs5..janeotron
C0 80 34 C0 80 64 61 77 6E 6A 61 66 66 65 72 73   ..4..dawnjaffers
6F 6E C0 80 35 37 C0 80 64 61 77 6E 6A 61 66 66   on..57..dawnjaff
65 72 73 6F 6E 2D 35 33 32 31 C0 80 31 33 C0 80   erson.5321..13..
31 64 61 77 6E 6A 61 66 66 65 72 73 6F 6E 2D 35   1dawnjafferson.5
33 32 31 C0 80   321..
// If anyone knows what this is contact me cjdelphi@iprimus.com.au



Packet Type: 0x1E(Unknown...) [InComing]
59 4D 53 47 00 00 00 00 00 42 00 1E 00 00 00 01   YMSG.....B......
7B 56 04 2D 30 C0 80 6A 61 6E 65 6F 74 72 6F 6E   {V..0..janeotron
C0 80 37 C0 80 6C 61 6C 65 61 6E 65 61 67 72 61   ..7..laleaneagra
C0 80 31 30 C0 80 30 C0 80 31 31 C0 80 30 C0 80   ..10..0..11..0..
31 37 C0 80 30 C0 80 31 33 C0 80 32 C0 80 36 30   17..0..13..2..60
C0 80 32 C0 80   ..2..

Packet Type: 0x1E(Unknown...) [InComing]
59 4D 53 47 00 00 00 00 00 42 00 1E 00 00 00 01   YMSG.....B......
7B 56 04 2D 30 C0 80 6A 61 6E 65 6F 74 72 6F 6E   {V..0..janeotron
C0 80 37 C0 80 6C 61 6C 65 61 6E 65 61 67 72 61   ..7..laleaneagra
C0 80 31 30 C0 80 30 C0 80 31 31 C0 80 30 C0 80   ..10..0..11..0..
31 37 C0 80 30 C0 80 31 33 C0 80 32 C0 80 36 30   17..0..13..2..60
C0 80 32 C0 80 00 59 4D 53 47 00 00 00 00 00 47   ..2...YMSG.....G
00 98 00 00 00 01 00 00 00 00 31 30 34 C0 80 65   ..........104..e
3A 31 C0 80 31 30 38 C0 80 31 C0 80 31 30 39 C0   :1..108..1..109.
80 6C 61 6C 65 61 6E 65 61 67 72 61 C0 80 31 31   .laleaneagra..11
30 C0 80 30 C0 80 31 31 32 C0 80 30 C0 80 31 31   0..0..112..0..11
33 C0 80 2D 32 31 34 37 34 38 32 35 36 30 C0 80   3...2147482560..


//
Code: 10 From: stevedahemster Msg: -1614913866
Code: 10 From: stevedahemster Msg: -1614913922
Code: 10 From: stevedahemster Msg: -1614913838
Code: 10 From: stevedahemster Msg: -1614913846
Code: 10 From: stevedahemster Msg: -1614913838
Code: 10 From: stevedahemster Msg: -1614913838
Code: 10 From: stevedahemster Msg: -1614913842
//


Packet Type: 0x06(PM YMSG) [InComing]
59 4D 53 47 00 00 00 00 00 28 00 06 00 00 00 04   YMSG............
B6 5A 90 A7 35 C0 80 79 73 6F 5F 63 79 62 30 72   .Z..5..yso_cyb0r
67 C0 80 31 30 C0 80 39 39 C0 80 31 39 C0 80 2D   g..10..99..19...
31 36 31 35 30 34 34 39 37 39 C0 80   1615044979..


Packet Type: 0x1E(Unknown...) [InComing]
59 4D 53 47 00 00 00 00 00 42 00 1E 00 00 00 01   YMSG.....B......
7B 56 04 2D 30 C0 80 6A 61 6E 65 6F 74 72 6F 6E   {V..0..janeotron
C0 80 37 C0 80 6C 61 6C 65 61 6E 65 61 67 72 61   ..7..laleaneagra
C0 80 31 30 C0 80 30 C0 80 31 31 C0 80 30 C0 80   ..10..0..11..0..
31 37 C0 80 30 C0 80 31 33 C0 80 32 C0 80 36 30   17..0..13..2..60
C0 80 32 C0 80   ..2..
========================================================================

{{  0 ,"usernameaccount"}
,{  1 ,"username"}
,{  3 ,"buddyusername"}
,{  4 ,"pmfromusername"}
,{  5 ,"pmtousername"}
,{  6 ,"authcode"}
,{  7 ,"buddyname"}
,{  8 ,"buddylistcount"}
,{  9 ,"mailcount"}
,{ 10 ,"awaystate"}
,{ 11 ,"buddyinfo1"}
,{ 13 ,"deltastate"} //0=off,2=?
,{ 14 ,"pmtext"}
,{ 15 ,"timestamp"}
,{ 16 ,"isback"} //user 'nagdg' (nagdg) was not AWAY!\n
,{ 17 ,"buddyinfo2"}
,{ 18 ,"mailfromsubject"} // re: your mail
,{ 19 ,"textaway"}
,{ 20 ,"filename"} // for filexfer
,{ 31 ,"pmymsgextra4"}
,{ 32 ,"pmymsgextra5"}
,{ 38 ,"filexferid"} // for filetransfers
,{ 41 ,"username"}
,{ 42 ,"mailfromaddr"} // YahELite@t-online.de
,{ 43 ,"mailfromname"} // John Doe
,{ 47 ,"awayicon"}
,{ 49 ,"pmtyping"}
,{ 52 ,"confinvitee"} // username
,{ 56 ,"leavesconf"} // username
,{ 57 ,"taggedusername"} // username-########
,{ 58 ,"conftext"} // join my conference
,{ 60 ,"userextras"} // 2=mailaccount
,{ 61 ,"authcode-webcam?"}
,{ 62 ,"roommode"}
,{ 63 ,"pmymsgextra1"} // }0
,{ 64 ,"pmymsgextra2"} // 0
,{ 97 ,"pmymsgextra3"} // 1
,{104 ,"roomname"}
,{105 ,"roomtitle"}
,{108 ,"guestlistcount"} // # of users in following user list
,{109 ,"guestname"}
,{110 ,"guestinfo1"} // with 0x98,0x9B/enter,leave room
,{112 ,"guestinfo2"}
,{113 ,"capabilities"} // 1024(0x400), 088(0x440)=normal, 1104(0x450)=cam, 1344(0x540)=??
,{114 ,"denied"} //-32\n  -11=noSuchUser?  ,-1 room entry denied?
,{117 ,"usertext"}
,{118 ,"invitetousername"}
,{119 ,"invitefromusername"}
,{124 ,"textmode"}
,{126 ,"roomflags"}
,{128 ,"roomcat"}
,{129 ,"roomspace"}
,{130 ,"authcode-voice?"}

Since you already have everything needed to login lets look at what it needs to get into
the room :)

- Craig C. 


for the guide on getting into messenger 
=======================================

 http://balder.prohosting.com/~protosur/ymsg.htm //Protosurge can often be found @ programming:2
or 
 http://www.venkydude.com/articles/yahoo.htm

And mine... (this u are looking at)
http://www.geocities.com/cjdelphi/ymsgproto.txt


Contact me here for any questions: cjdelphi@iprimus.com.au

    Source: geocities.com/tcjdelphi