MOVE ALONG NOTHING TO SEE HERE

All new docs are being written in the github msndevs wiki

The old contents are left here for historical reference

old contents

CNT - Connect

First command of the connection.

It has an XML payload, all elements are required to be at least one char long but their values don't matter.

One value that does matter is <ver>2</ver>. Outlook.com seems to use version 2 right now. Maybe what I'm documenting is actually msnp25.

>>> CNT 1 CON 114

<connect><ver>2</ver><agent><os>winnt</os><osVer>5.2</osVer><proc>x86</proc><lcid>en-us</lcid></agent></connect>

<<< CNT 1 CON 126

<connect-response><ver>2</ver><qostest>false</qostest><nonce>xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx</nonce></connect-response>

Changing version to 1 results in missing nonce in the CON reply and the following ATH command will have no payload. That sounds like it would make authentication much easier (only cookies?)

Unknown:

  • CON?
  • nonce? Only present in version 2.
  • qostest?

ATH - Authenticate

>>> ATH 2 CON\USER 312

<user><uic>[very long base64 string]</uic><web-compact-ticket /></user>

Success:

<<< ATH 2 CON 131

<auth-response><new-thread-allowed>false</new-thread-allowed><p2p-migration-allowed>false</p2p-migration-allowed></auth-response>

Failure:

911 2 CON 23

Authentication failed

The error code 911 was used previously for USR authentication failures, according to msnpiki.

Also yay, error messages have payloads/headers/bodies with descriptions!

Unknown:

  • The <uic> in the payload probably comes from a cookie called UIC. It's not set by login.srf, but by one of the requests in the middle
  • Should check if the contents of the UIC cookie match or if there's any transformation.
  • web-compact-ticket - sounds vaguely similar to oauth2 stuff, might be interesting

BND - Bind

SBS

Documented a bit in msnp-sharp's MSNP21 docs

DEL

Documented a bit in msnp-sharp's MSNP21 docs

NFY

Documented a bit in msnp-sharp's MSNP21 docs

PUT

Documented a bit in msnp-sharp's MSNP21 docs

GET

Oddly not documented in the msnp-sharp docs

SDG

Documented a bit in msnp-sharp's MSNP21 docs

XFR

Probably not used. It's not needed for SB since they don't exist anymore, or NS because this is HTTP only

Documented a bit in msnp-sharp's MSNP21 docs

OUT