PKT 3.0 (English)

Материал из YTDB DataBase

PKT 3.0 is the first universal version of PKT network packet dump file format.

The specification consists of two file formats to contain decrypted and encrypted network packets of World of Warcraft, with .pkt and .raw extensions respectively.

Содержание 1 PKT Spec 1.1 File Naming 1.2 Main Header 1.3 Network Stream Fragment 2 RAW Spec 2.1 File Naming 2.2 Main Header 2.3 Network Stream Fragment 3 Links

PKT Spec

First goes the Main Header. The Main Header contains meta data about the packet dump. Fragments of the network stream go afterwards.

For fields longer than 1 byte, little-endian byte order is used by default.

File Naming

Field	Value
File Name	Any
File Extension	Mandatory .pkt

Main Header

Field	Length	Contents
File Signature	3 bytes	'PKT' in ASCII, sequently
Format Version	2 bytes	First minor, than major version bytes. For PKT 3.0 it is 0x00, 0x03
Sniffer Id	1 byte	See Sniffer Id in PKT
Client Build Number	4 bytes
Client Language	4 bytes	Language code bytes in ASCII, sequently, i.g. 'enGB'
Session Key	40 bytes	Optional. Can be filled with zeros.
Optional Data Length	4 bytes
Optional Data		Length is in previous field.

Network Stream Fragment

Field	Length	Contents
Packet Direction	4 bytes	4 chars in ASCII sequently, 'SMSG' for server-to-client packets, 'CMSG' for client-to-server packets.
Packet Arrival Time	4 bytes	Number of seconds passed since the UTC Unix Epoch
Packet Arrival Ticks	4 bytes	Number of milliseconds passed since the system start
Optional Data Length	4 bytes
Packet Data Length	4 bytes	At least 4 bytes
Optional Data		Only the sniffer's developer controls what data is contained in this field. Length is in "Optional Data Length"
Packet Data		Data of a single World of Warcraft packet. Length is in "Packet Data Length". First 4 bytes of the field are the opcode.

RAW Spec

First goes the Main Header. The Main Header contains meta data about the packet dump. Fragments of the network stream go afterwards.

For fields longer than 1 byte, little-endian byte order is used by default.

File Naming

Field	Value
File Name	Any
File Extension	Mandatory .raw

Main Header

Field	Length	Contents
File Signature	3 bytes	'RAW' in ASCII, sequently
Format Version	2 bytes	First minor, than major version bytes. For PKT 3.0 it is 0x00, 0x03
Sniffer Id	1 byte	See Sniffer Id in PKT
Client Build Number	4 bytes
Client Language	4 bytes	Language code bytes in ASCII, sequently, i.g. 'enGB'
Session Key	40 bytes
Optional Data Length	4 bytes
Optional Data		Length is in previous field.

Network Stream Fragment

Field	Length	Contents
Packet Direction	4 bytes	4 chars in ASCII sequently, 'SMSG' for server-to-client packets, 'CMSG' for client-to-server packets.
Packet Arrival Time	4 bytes	Number of seconds passed since the UTC Unix Epoch
Packet Arrival Ticks	4 bytes	Number of milliseconds passed since the system start
Optional Data Length	4 bytes
Packet Data Length	4 bytes	At least 4 bytes
Optional Data		Only the sniffer's developer controls what data is contained in this field. Length is in "Optional Data Length"
Packet Data		Data of a single TCP packet. Length is in "Packet Data Length".

Links

• PKT 3.0 spec in Russian