QQ protocol overview
Last modified: October 3, 2003
QQ version:
QQ version upgrade is more frequent, and it is different from most software, and its client's upgrade is often altered with the protocol.
Currently, it is important to study the QQ protocol version:
QQ2000c. Its corresponding client protocol version is 08xx, and there is currently more research on this version.
QQ2003 (0808) This is the latest QQ version of Tencent. It is currently found that it corresponds to the client protocol version of 0A 1D. The current research on this version has just begun, and this version has made a relatively large change on the agreement.
agreement type:
We try to classify QQ protocols:
Text chat protocol (TCPF, Text Chatting Protocol Family): It mainly supports writing with other QQ clients. TCPF is based on the UDP protocol. The first character 02 in the UDP packet is the identifier of this protocol. TCPF's server uses 8000 ports, Tencent's QQ client software typically starts attempting from 4,000 ports, but in fact, the port number used to client is not limited. Current research focuses on TCPF.
Other unknown protocols may exist:
We observed QQ to communicate with other servers in addition to communicating with TCPF servers. The server we observed is 218.17.217.111: 8000. The client uses a different port with TCPF. The package from the client is currently observed at 06, and the package returned by the server starts at 01. It is currently unknown. We noticed an interesting phenomenon. If you return to the line after you choose to go back, this communication has begun before issuing a login package. We temporarily name it as a data transfer protocol (DTPF, DATA TRANSFER Protocol Family). The latest study found that it passed the picture data of QQ Show.
Voice, video chat: There is no analysis yet, and has not yet known to use UDP or TCP protocol.
Chat room: No analysis, it should be the TCP protocol.
With the beginning of these protocols, we will give them more fine division and proper naming.
TCPF:
TCPF is a protocol established on the UDP protocol, mainly supporting text chat. TCPF is working in request - response mode. That is, the client issues a request, the server is given a corresponding response; the server sends information to the client, and the client will respond to the server. The request and response are paired by the same serial number (request code should be the same). And the initiator of each request is the same. Currently, known requests include:
0x0001 login
0x0002 heartbeat information
0x0004 Update User Information
0x0005 search user
0x0006 Get user information
0x0009 does not need to be certified to add friends
0x000A Delete Friends
0x000B requires authentication to add friends
0x000D setting stealth, is busy, etc.
0x0012 confirms the received system message
0x0016 Send message
0x0017 receives a message (server initiated)
The 0x001a is unknown.
0x001c deletes yourself on the other friends list
0x001D unknown role.
0x0022 login
0x0026 Get friends list
0x0027 Get online friends
0x0030 group operation instruction
0x0080 receives system messages (initiated by the server)
0x0081 Receive a friend status change message (server initiated)
revise history:
October 3, 2003 Jeff_YECN increases the definition of group operation
Jeff_YECN increased to DTPF named on August 30, 2003
Jeff_yecn created on August 29, 2003
