--- auth/xfer codes appears that 4 bytes separate each command packet the next login, only 2432->2433 and 21253->24396 client: 787 - login? 787#FB#username#FB#password#FB#9#FB#ip#FB#2432#FB#B1.28#FB#3#FB#0#FB#0#FB# fields: username, password, 9?, ip octets, 2432?, version, 3?, 0?, 0? 3 might be max connections or max users 0 could be number of files shared, or upload/download counts.. server: 400 - settings? 400#FB#3566#FB#200#FB#128#FB#BFWALL#FB##FB#83#FB#21253#FB# fields: 3566?, 200?, 128?, BFWALL, ?, 83?, 21253? server: 410 - friends list 410#FB#blahblah#FB#N#FB##FB##FB#minus#FB#N#FB##FB##FB##FB# fields: username, Y|N?, ?, ? N is probably online status client: 801 - logging in to chat? 801#FB# fields: none server: 808 - retrieve listing? command? 808#FB#_mx_listing_#FB#24.66.56.38#FB#2430#FB#nocarrier fields: command, remote ip address, remote port?, whose list to send (maybe for multiuser) the requesting port always seems to be 2430.. client: 300 - ping? status? 300#FB#nocarrier fields: username server: 450 - response to 300, status? 450#FB#86#FB#21254 fields: ?, ? both fields seem to increment over time, during the life of a session --- chat codes RB ends a command FB is a field delimiter, generally means "field begin" $$ is subdelimiter lots of times there is an empty FB at the end, that might not be a value but coded intentionally that way. or else it might be used by the server to answer boolean questions, like client: can I join this channel? server: yes or no. client: CI - check in (login) #CI#nocarrier#FB##RB# #CI# username #FB##RB# fields: username client: VC - client version #VC#B1.28#RB# fields: ip client: IP - ip address #IP#192.168.2.17#FB##RB# fields: ip address, ? ? might be port or something.. client: CL - request channel list #CL##RB fields: none server: CL - channel list response #CL# name #FB# value ##FB##RB# fields: channel or category, user count names preceded by '- - -' are categories, and have 0 user counts client: TC - to channel? (join channel) #TC#lobby#FB##RB# fields: channel, ? server: TC - channel join accepted #TC#lobby#FB#1#RB# fields: channel, yes|no? client: LC - leave channel #LC#lobby#FB##RB# fields: channel, ? server: LC - leave channel accepted #LC#lobby#FB#1#RB# fields: channel, yes|no MH - message a channel server: #MH# channel name $$ message#RB# client: #MH# channel name $$ message $$ font $$ 0:0:0 $$ 204 $$0:0:0:0#FB##RB# fields: channel, message, font, Red, Green, Blue, pointsize*?, bold(1), italic(2), underline(4), strikethrough(8) the shortened MH appears to originate as system messages, while the longer versions are always originating from clients. probably doesn't matter which is used. RGB, size, and then the remaining four fields look as if they should have been a bitmask (by observing the 1-2-4-8 values). they are toggles, but not 0-1 toggles some sizes: (point-value) 320 appears to be max 8 = 165 10 = 195 12 = 240 14 = 285 16 = 315 18 = 320 client: UL - request user list #UL#lobby#FB##RB# fields: channel, ? server: UL - user list response #UL#lobby#FB#brian#FB#Toxik#FB#...#FB##RB# fields: channel, user, user, user first field is channel, remaining are users with trailing empty field server: GM - global message? (relaying a /msg to a user, elicits a response: GR) #GM#hyperspaz#FB#hello#RB# fields: from user, message client: GM - global message? (send a /msg) #GM#hyperspaz#FB#hi there!!!#RB# fields: to user, message client GR - Gm Recieved (after server sends GM, respond with okay) #GR#hyperspaz#FB#1#RB# fields: from user, yes|no