Decoding Habbo packet structures

[Keiz]

Hi y'all.

It's some time I contributed to the community, so I thought why not create a simple tutorial on packets.

A year ago I was in your position, (assuming you have only the basic knowledge of packets).
No one bothered to help me, I know what that's like so I decided to make a tutorial on this.

Requirements
- A packetlogger, I cannot provide you one because it's seen as scripting software on RZ.(It rhymes with danji)
- Basic knowledge of C# (or Java, whatever your emulator is written in)

Let's get started
Okay, so let's do this. I'm gonna use the PollOfferEvent server packet for educational purposes, this is not a tutorial on how to add Polls,
Say I need to packetlog a packet of a new feature in Habbo, that sends the client a notification.
In your packetlogger this packet would look something like

You must be registered to see links

It starts off with

Incoming(2827, 69, _-6K5, _-4D)

You don't need to know what it's all about, just the first number, 2827, that will be the packet header.

Going on with the packet,

[0][0][0]E[11][11][0][0][9]@[0][10]CLIENT_NPS[0]Customer Satisfaction Poll[0]Give us your opinion!

( Note some characters aren't shown on RageZone, watch the screenshot from before to see the missing characters )

Starting off with a little explanation,
in server packets, you can write integers, booleans, shorts, strings.
Examples of integers:

[0][0][0][0] = 0
[0][0][0]E = 69

Booleans:

[0] = false
[1] = true

Shorts:

[0][1] = 1
[3]A = 833

Strings:

[0][3]lol = lol, first a short of the string length, then the actual string

With this information we can decypher our packet, let's divide into these pieces:

Spoiler

NOTE: A packet always starts off with an integer of the packet length following a short of the packet header, so after 6 "bytes", the packet actually starts.

Now we have decoded the packet!
This is just a tutorial on decoding simple packets, not turning them into systems.
Here is an example of the polloffer packet I use though:

Spoiler

( This is just an example, don't blindly copy the code, you still need to write the Poll System, this tutorial is just for some more explanation of packet structures )

Sidenote
For decoding integers and shorts into actual numbers, I use the packetlogger named before.

Spoiler

A way using as3
http://forum.ragezone.com/f335/decoding-habbo-packet-structures-1119904/#post8719233

End
Thanks for reading, this is my first tutorial so cut me some slack (And I'm Dutch :$)
I really hope you have some more insight of packetlogging and studying its structure.
Don't expect to understand everything instantly, practice makes perfect.
Do like if I might have helped you, I'd surely appreciate it.


Loves,
Keiz

 

[Jamal7]

Or use Azure Packet Scout to read the information faster.

 

[Keiz]

Or use Azure Packet Scout to read the information faster.

Never knew about this! Although I stand by the fact knowledge of packets must be moved on to new developers in the scene.
Can you provide a link for that tool though, it would save me a lot of time in the future!

 

[Jamal7]

Never knew about this! Although I stand by the fact knowledge of packets must be moved on to new developers in the scene.
Can you provide a link for that tool though, it would save me a lot of time in the future!

You must be registered to see links

 

[The General]

Only used packetloggers twice while developing Arcturus. They are not mandatory.

 

[Keiz]

Only used packetloggers twice while developing Arcturus. They are not mandatory.

Assuming the developer wants to log the packets themselves for educational purposes.
Ofcourse is using packet structures from other emulators an option, but it will let you down if you want to create a new feature of Habbo's. It would require you to wait for others to find it out for you, this tutorial is for those who want to find out themselves.

 

[The General]

You don't need other emulators. From the Habbo.swf you can dump the AS3 source code in which you can find the packet structures.

It will look like this:

(Server -> Client)

_SafeStr_5357[1249] = _SafeStr_3218;

1249 is the header.

Then you search for class _SafeStr_3218

Which gives:

public class _SafeStr_3218 extends _SafeStr_2257 implements _SafeStr_2254 
    {

        public function _SafeStr_3218(k:Function)
        {
            super(k, _SafeStr_3223);
        }
        public function _SafeStr_5658():_SafeStr_3223
        {
            return ((this._SafeStr_7138 as _SafeStr_3223));
        }

    }

Now this class uses the class _SafeStr_3223 to parse the packet structure. So search for class _SafeStr_3223 and you'll find:

public class _SafeStr_3223 implements _SafeStr_2251 
    {

        private var _SafeStr_19778:String;

        public function flush():Boolean
        {
            return (true);
        }
        public function parse(k:_SafeStr_2698):Boolean
        {
            this._SafeStr_19778 = k.readString();
            return (true);
        }
        public function get info():String
        {
            return (this._SafeStr_19778);
        }

    }

Now in the parse() method is where the packet is being read. This packet only contains a string.

Now to find out where this packet is being used we'll look where the event has been registered to an function. So search for new _SafeStr_3218 and you will find:

            this.addMessageEvent(new _SafeStr_3218(this._SafeStr_15080));

Where this._SafeStr_15080 is a function in the current class.

private function _SafeStr_15080(k:_SafeStr_2254):void
        {
            var _local_2:_SafeStr_3223 = _SafeStr_3218(k)._SafeStr_5658();
            this._SafeStr_6198.windowManager.alert("Update failed", _local_2.info, 0, null);
        }

Which sends an alert when the updating of a wired fails (But you could not have known as no emulator uses it)

 

[Keiz]

Interesting way of defining structures, I did look into this some time back but found logging quicker tbh. Thanks though a link of this respond is added to the topic

 

[The General]

Interesting way of defining structures, I did look into this some time back but found logging quicker tbh. Thanks though a link of this respond is added to the topic

But what if you get this from a packet:

[0][0][0][0][0][0][0][0][0][0][0][0][0][0]

You don't know what the structure is. Maybe all booleans. Maybe a couple ints, empty strings and booleans set to false.

 

[Keiz]

That's the risk ;-)

 

[Boraida]

You can always packet log nothing wrong with that, but don't trust the 'Packet Scout' blindly. Always search the for the structure in the Habbo.swf

 

[mamezone]

Thanks for his!
Very useful the truth!

 

[ovflowd]

Or use Azure Packet Scout to read the information faster.

Azure Packet Scout was one of the best things created by Xdr.

It's a lot useful. I think you @Sir Jamal can repost it

You don't need other emulators. From the Habbo.swf you can dump the AS3 source code in which you can find the packet structures.

It will look like this:

(Server -> Client)

_SafeStr_5357[1249] = _SafeStr_3218;

1249 is the header.

Then you search for class _SafeStr_3218

Which gives:

public class _SafeStr_3218 extends _SafeStr_2257 implements _SafeStr_2254 
    {

        public function _SafeStr_3218(k:Function)
        {
            super(k, _SafeStr_3223);
        }
        public function _SafeStr_5658():_SafeStr_3223
        {
            return ((this._SafeStr_7138 as _SafeStr_3223));
        }

    }

Now this class uses the class _SafeStr_3223 to parse the packet structure. So search for class _SafeStr_3223 and you'll find:

public class _SafeStr_3223 implements _SafeStr_2251 
    {

        private var _SafeStr_19778:String;

        public function flush():Boolean
        {
            return (true);
        }
        public function parse(k:_SafeStr_2698):Boolean
        {
            this._SafeStr_19778 = k.readString();
            return (true);
        }
        public function get info():String
        {
            return (this._SafeStr_19778);
        }

    }

Now in the parse() method is where the packet is being read. This packet only contains a string.

Now to find out where this packet is being used we'll look where the event has been registered to an function. So search for new _SafeStr_3218 and you will find:

            this.addMessageEvent(new _SafeStr_3218(this._SafeStr_15080));

Where this._SafeStr_15080 is a function in the current class.

private function _SafeStr_15080(k:_SafeStr_2254):void
        {
            var _local_2:_SafeStr_3223 = _SafeStr_3218(k)._SafeStr_5658();
            this._SafeStr_6198.windowManager.alert("Update failed", _local_2.info, 0, null);
        }

Which sends an alert when the updating of a wired fails (But you could not have known as no emulator uses it)

That's the same way that i do. And i prefer doing this way, so much better. But some times you will need the PacketLogger, to research about packets that you can simply don't understand from who they are.

But what if you get this from a packet:

[0][0][0][0][0][0][0][0][0][0][0][0][0][0]

You don't know what the structure is. Maybe all booleans. Maybe a couple ints, empty strings and booleans set to false.

Good that Sulake never did that.

 

[The General]

Azure Packet Scout was one of the best things created by Xdr.

It's a lot useful. I think you @Sir Jamal can repost it





That's the same way that i do. And i prefer doing this way, so much better. But some times you will need the PacketLogger, to research about packets that you can simply don't understand from who they are.





Good that Sulake never did that.

Like I said, only needed it twice and look how far Arcturus has come :closedeyes:

 

[ovflowd]

Like I said, only needed it twice and look how far Arcturus has come :closedeyes:

Reverse engineering it's like the gif of your signature. When we got the thing... We got the thing

 

[The General]

Reverse engineering it's like the gif of your signature. When we got the thing... We got the thing

Well go reverse engineer where its from.

 

[Keiz]

Like I said, only needed it twice and look how far Arcturus has come :closedeyes:

I took the liberty of trying your method, the structure itself is clear indeed. It does take a lot of time to determine what int belongs to what value.
My recommendation is using your way, then checking the values with a packetlogger

 

[ovflowd]

I took the liberty of trying your method, the structure itself is clear indeed. It does take a lot of time to determine what int belongs to what value.
My recommendation is using your way, then checking the values with a packetlogger

Or... by testing it on your hotel. (Other way to check)

 

[The General]

I took the liberty of trying your method, the structure itself is clear indeed. It does take a lot of time to determine what int belongs to what value.
My recommendation is using your way, then checking the values with a packetlogger

I rarely search through the SWF to find what a certain value is. Usually I test it on my client. I added a command handler to Arcturus which lets me executes packets (Server -> Client) just by using <header> b:1/0 s:string i:1337

Most packets do something (Open a window, message etc) so just from putting in those values you can easily figure out what something does.

 

[Droppy]

You don't need other emulators. From the Habbo.swf you can dump the AS3 source code in which you can find the packet structures.

It will look like this:

(Server -> Client)

_SafeStr_5357[1249] = _SafeStr_3218;

1249 is the header.

Then you search for class _SafeStr_3218

Which gives:

public class _SafeStr_3218 extends _SafeStr_2257 implements _SafeStr_2254 
    {

        public function _SafeStr_3218(k:Function)
        {
            super(k, _SafeStr_3223);
        }
        public function _SafeStr_5658():_SafeStr_3223
        {
            return ((this._SafeStr_7138 as _SafeStr_3223));
        }

    }

Now this class uses the class _SafeStr_3223 to parse the packet structure. So search for class _SafeStr_3223 and you'll find:

public class _SafeStr_3223 implements _SafeStr_2251 
    {

        private var _SafeStr_19778:String;

        public function flush():Boolean
        {
            return (true);
        }
        public function parse(k:_SafeStr_2698):Boolean
        {
            this._SafeStr_19778 = k.readString();
            return (true);
        }
        public function get info():String
        {
            return (this._SafeStr_19778);
        }

    }

Now in the parse() method is where the packet is being read. This packet only contains a string.

Now to find out where this packet is being used we'll look where the event has been registered to an function. So search for new _SafeStr_3218 and you will find:

            this.addMessageEvent(new _SafeStr_3218(this._SafeStr_15080));

Where this._SafeStr_15080 is a function in the current class.

private function _SafeStr_15080(k:_SafeStr_2254):void
        {
            var _local_2:_SafeStr_3223 = _SafeStr_3218(k)._SafeStr_5658();
            this._SafeStr_6198.windowManager.alert("Update failed", _local_2.info, 0, null);
        }

Which sends an alert when the updating of a wired fails (But you could not have known as no emulator uses it)

old but gold. I remember doing this with Glaceon back in the day... I think you remember the tool I've made some time later aswell ( http://forum.ragezone.com/f353/auto-packet-structure-creator-922491/ , terrible name tho)

I've made a new one some time later... I wish the community to put more effort to it

Anyways OP, thanks for it. Maybe we all could make a huge thread with all informations about everything (update structure, header, etc), and for other versions aswell ( i.e http://forum.ragezone.com/f335/understanding-habbo-protocols-v1-v6-928075/ )