Since March 10, 2003 - Version 2
hypothetic.org

MSN Messenger Protocol

Notification - Miscellaneous

Back To Normal Layout

Cosnumer Versioning (CVR)

The CVR command sends version information about a client and operating system to the server. For the official client, the server will reply with information about a recommended version of the client (which may be the same as the current version).

The CVR command is optional in protocol versions up to and including MSNP7. It's debatable whether third-party clients should send CVR. On one hand, Microsoft might start blocking users based on this command. On the other hand, they might treat third-party clients better if there was evidence that a significant number of people used them. On the one hand, there are serious privacy issues with the information given out. On the other hand, there's no way for Microsoft to verify the information given.

The CVR command includes information about the language you speak, the name and version of your client, and the name and version of your OS. You can send a CVR command to the NS at any time after you have finished logging in, but the official client always sends it immediately after sending the initial CHG. You can send CVR as many or as few times as you like. CVR has a TrID and 6 parameters in MSNP2 and MSNP3, or 7 parameters in MSNP5 and MSNP7.

Like with any other command, the server will reply to a CVR command with a CVR reply. For some reason, though, the official client would be just as happy if you replaced CVR with CVQ in the reply. The reply command will contain 5 parameters:

Here is the CVR information sent by version 3.6 of the official client.

>>> CVR 7 0x0409 win 4.10 i386 MSMSGS 3.6.0025 MSMSGS\r\n

<<< CVR 7 4.6.0083 4.6.0083 1.0.0000 http://download.microsoft.com​/download/msnmessenger/install/4.6/win98me/en-us/​mmssetup.exe http://messenger.microsoft.com\r\n

>>> CVR 8 0x0409 win 4.10 i386 MSGSTRST 3.6.0025 MSMSGS\r\n

<<< CVR 8 1.0.0000 1.0.0000 1.0.0000 http://download.microsoft.com​/download/msnmessenger/install/4.6/win98me/en-us/​mmssetup.exe http://messenger.microsoft.com.\r\n

Service URLs (URL)

The URL command retrieves URLs relating to the various MSN services to be opened in an external or integrated browser. It takes one parameter, which can be multiple words. Note that the parameter is case-sensitive. The 0x... does not symbolize a special character and is to be taken literally. The parameter must be one of the following:

The server will respond with another URL. It always has three parameters: the first two are URLs and the third is an ID number. These parameters are used to determine how to direct the web browser. The first four items are explained in the notification server messages page.

Below is an example of requesting the URL information for the Hotmail inbox:

>>> URL 15 INBOX\r\n

<<< URL 15 /cgi-bin/HoTMaiL https://loginnet.passport.com/ppsecure/md5auth.srf?lc=1033 2\r\n

The URL command does not give you the URL to view profiles of people in the MSN Member List. To do this, direct the web browser to http://members.msn.com/default.msnw?mem=ACCOUNTNAME where ACCOUNTNAME is the account name of the user whose profile you want to view.

Sending an e-mail invitation

Note: This command has not been well tested. If you have done any research on this command, please let us know!

You can send an e-mail saying "<your-passport> wants to talk to you!" to a specified e-mail address with the SND command, which has a TrID and 4 parameters.

If the message was sent successfully, the server will reply with an SND with a single parameter of OK. Here is an example.

>>> SND 22 alice@hotmail.com 0x409 MSMSGS MSMSGS\r\n

<<< SND 22 OK\r\n

If bob@hotmail.com sent this message, Alice would receive an e-mail saying "bob@hotmail.com wants to talk to you!".

Searching For Users

MSN Messenger used to include a search facility, but this has been superceded by the MSN Memeber Directory. The command used for this was FND. Sending an FND command in any version of the MSN Messenger protocol will now cause you to receive a 502 error, and nothing more.

MSN Alerts

Note: This command has not been well tested. If you have done any research on this command, please let us know!

MSN Alerts use the NOT ("notification") command, which has one parameter - the length of the message body.

If you use the official client, you can register this service by clicking on the golden bell tab (under the msn "green buddy" tab).

This command hasn't been thoroughly researched, so the information in this section is fairly speculative. If you are interested in it, please let us know what you find! Only two examples of this command has been observed.

<<< NOT 586\r\n
    <NOTIFICATION ver="1" siteid="111100200" siteurl="http://calendar.msn.com" id="2">\r\n
    <TO pid="0x00060000:0x81ee5a43" name="jabber_test@hotmail.com" />\r\n
    <MSG pri="" id="2">\r\n
    <ACTION url=​"/calendar/isapi.dll?request=action&operation=modify​&objectID=2​&uicode1=modifyreminder&locale=2052"/>\r\n
    <SUBSCR url=​"/calendar/isapi.dll?request=action&operation=modify​&objectID=2​&uicode1=modifyreminder&locale=2052"/>​<CAT id="111100201" />\r\n
    <BODY lang="2052" icon="/En/img/calendar.png">\r\n
    <TEXT>aaaaa (bbbbb) 2002偁十䁁月14�星期�21:45 - 22:45 </TEXT>\r\n
    </BODY>\r\n
    </MSG>\r\n
    </NOTIFICATION>\r\n

<<< NOT 590\r\n
    <NOTIFICATION ver="1" siteid="111100200" siteurl="http://calendar.msn.com" id="1">\r\n
    <TO pid="0x00060000:0x81ee5a43" name="jabber_test@hotmail.com" />\r\n
    <MSG pri="" id="1">\r\n
    <ACTION url=​"/calendar/isapi.dll?request=action&operation=modify​&objectID=1​&uicode1=modifyreminder&locale=2052"/>\r\n
    <SUBSCR url=​"/calendar/isapi.dll?request=action&operation=modify​&objectID=1​&uicode1=modifyreminder&locale=2052"/>​<CAT id="111100201" />\r\n
    <BODY lang="2052" icon="/En/img/calendar.png">\r\n
    <TEXT>goto club 7. 2002 21:15 - 22:15 </TEXT>\r\n
    </BODY>\r\n
    </MSG>\r\n
    </NOTIFICATION>\r\n

The body appears to be XML, though we're not sure whether it's actually parsed as XML, which commands are necessary, whether you can insert arbitrary extra fields, and so on. Our current theories about the various sections of the message are:

Mobile Paging (PAG)

Note: This command has not been well tested. If you have done any research on this command, please let us know!

You can page someone on their MSN Mobile device with the PAG command. It is believed that you can receive an incoming message from an MSN Mobile device with the IPG command.

If someone on your forward list has an MSN Mobile device and have allowed you to send messages to them with it, their "MOB" will be set to "Y". The PAG command has a TrID and two arguments.

The body of a PAG can be either <TEXT xml:space="preserve"> . . . </TEXT> or <PHONE pri="1">​<LOC>string</LOC>​<NUM>string</NUM>​</PHONE><​TEXT xml:space="preserve"> . . . </TEXT>. The extra information in the second format is not yet understood.

If the command failed to send, the reply is an 800 error. If there is some other error (for example, you are not allowed to send PAGs, or your PAG is malformed), you get a 220 error. If the message was sent successfully, there is no reply.

A message sent with the PAG command must be no more than 113 characters long. It can include any characters valid in an XML document. That means that & must be converted to &amp;, characters with values greater than 127 or less than 32 must be converted to &#NN;, etc.

The IPG command has never been observed in the wild, but analysis of the official client suggests that it is a normal payload command with a specified length.

Copyright ©2002-2003 to Mike Mintz.
<http://www.mikemintz.com/>