Protocol help

11/15/2006 21:13 TomSilver#1
I am studying the CO protocol, mainly for fun, partly for studies...
Now I strolled upon the first packet sent to the game server...
This packet is quite easy, as it probably just gives version and language info, but there is 4 bytes that change all the time...
My packet looks like this:

1c 0 1c 4 97 45 8f 0 bc fa 79 5 31 31 37 20 45 6e 67 6c 69 73 68 0 0 0 0 0
or
1c 0 1c 4 97 45 8f 0 bc 4c 25 8 31 31 37 20 45 6e 67 6c 69 73 68 0 0 0 0 0
or
1c 0 1c 4 97 45 8f 0 8a f4 1b 2 31 31 37 20 45 6e 67 6c 69 73 68 0 0 0 0 0

Which, in a string, looks like this:

.....E....y.117 English.....
.....E...L%.117 English.....
.....E......117 English.....

I have no idea what those bytes are for.
Anyone have an idea?
I first thought it would be some identifier from the login server, but my packet sniffer found only one incoming packet, not containing these four bytes.
Also the outgoing packets to the login server dont contain this.
Also if I have my packet editor change this value, CO wont work anymore, so it can't be random, and must have a certain use...

Oh and plz dont start asking what I need this for.
Also dont flame me plz, if you dunno the answer, just dont answer.

EDIT: Just to let you know, this is not my first packet, Ive done some others already, but decided to start at the beginning
11/15/2006 21:54 unknownone#2
The value is sent from the login server in the 0x41f packet (first packet you receive.)
11/15/2006 22:01 TomSilver#3
So it is...
TYVM...
Ill look into it.
It's just that I cant find the corresponding value in the packet you are talking about :/

EDIT: Srry found them (yeah Im getting a bit sleepy), it's just that they're encrypted in a way I dunno... Probably just some xor's again, Ill look into it later.

In: 60 ae 07 0f
Out: fb 1a 43 aa

In: a2 a9 4b 06
Out: d7 6a 87 3a

If anyone sees or knows the relation between the two, plz just say, Im too tired to even think about it.
Oh btw unknownone +k ;)
11/16/2006 00:57 d0v3r#4
That is the key used for encryption I believe.
11/16/2006 10:57 TomSilver#5
Nope, it's the same packet though.
These four bytes are the only difference in this packet.
These must be the identification key.
It just needs some encryption I think.

EDIT: again, I was too sleepy :/
This key does, indeed, belong to the encryption.
Im srry.
Now Im at the beginning again :/

EDIT2: OMG I found it...
It was in the topic about the encryption.
These four bytes are just the third key.
Havent got it working yet.