PKT 3.1 (English)

Материал из YTDB DataBase

(Различия между версиями)
Перейти к: навигация, поиск
м (Network Stream Fragments)
м
 
Строка 1: Строка 1:
-
PKT 3.1 — a format of [[PKT]] network packet dump files, successor of [[PKT 3.0]].
+
PKT 3.1 — a format of [[PKT]] network packet dump files, successor of [[PKT 3.0 (English)|PKT 3.0]].
The main reason for creating PKT 3.1 is the inability of PKT 3.0 to store multiple World of Warcraft TCP/IP connections in a single RAW file. <ref>[http://ru-mangos.ru/showthread.php?t=4373#post22656 LordJZ says about the inability to store packets from multiple connections with PKT 3.0]</ref><ref>[http://ru-mangos.ru/showthread.php?t=4373#post22659 RomanRom2 says that a new format is needed]</ref>
The main reason for creating PKT 3.1 is the inability of PKT 3.0 to store multiple World of Warcraft TCP/IP connections in a single RAW file. <ref>[http://ru-mangos.ru/showthread.php?t=4373#post22656 LordJZ says about the inability to store packets from multiple connections with PKT 3.0]</ref><ref>[http://ru-mangos.ru/showthread.php?t=4373#post22659 RomanRom2 says that a new format is needed]</ref>

Текущая версия на 23:12, 1 января 2012

PKT 3.1 — a format of PKT network packet dump files, successor of PKT 3.0.

The main reason for creating PKT 3.1 is the inability of PKT 3.0 to store multiple World of Warcraft TCP/IP connections in a single RAW file. [1][2]

The spec consists of two file formats that are used to keep decrypted and encrypted World of Warcraft packets, with extensions .pkt and .raw respectively.

Содержание

PKT spec

Inside a .pkt file, first there goes the main header. It contains general information about the packet dump. After the main header, there are packet stream fragments with headers.

Fields longer than 1 byte use little-endian byte order by default.

File Name

FieldValue
File nameany
File extensionAlways .pkt

Main Header

FieldLengthContent
Signature3 bytesSymbols 'PKT' in ASCII
Format version2 bytes0x01, 0x03 for PKT 3.1
Sniffer ID1 bytesSee PKT Sniffer ID
Client Build Number4 bytes
Client Language Code4 bytesi.g. 'enGB' in ASCII
Session Key40 bytesOptional. Can be filled with zeros.
Dump started unix time[3]4 bytesNumber of seconds passed since the Unix Epoch (UTC)
Dump started tick count[3]4 bytesNumber of milliseconds passed since the OS start
Optional data length4 bytes
Optional dataLength of this field is in the previous field

Network Stream Fragments

FieldLengthContent
Packet Direction4 bytes'SMSG' or 'CMSG' in ASCII for S->C and C->S packets respectively
Connection ID[3][4]4 bytesPacket's TCP/IP connection's unique identifier
Packet arrival ticks4 bytesNumber of milliseconds passed since the OS start
Optional data length4 bytes
Data length4 bytesAt least 4 bytes
Optional dataContent of this field is controlled by the sniffer's developer.
Length is in the "Optional data length" field.
DataContains data of one World of Warcraft packet. Opcode is included into the data and is aligned to 4 bytes.
Length is in the "Data length" field.

RAW spec

Not Yet Translated

Links

References

  1. LordJZ says about the inability to store packets from multiple connections with PKT 3.0
  2. RomanRom2 says that a new format is needed
  3. 3,0 3,1 3,2 New in PKT 3.1
  4. Field "Packet arrival unix time" was replaced with "Connection ID" in PKT 3.1
Личные инструменты