Character Server ; Opcode ; Doc

[blar0]

So after the Lobby Server send the ip adress and port to the client to connect to the CharacterServer, here are some info about opcode and some internal structures related to the CharacterServer. (Informations related to version eso.live.1.0.0.714440)

If you don't know why I'm talking about a second server used for characters, you should read all the other posts, regarding my work.

Before starting just some reminder, and some definitions

Each network operations require the server to read 4 bytes for the full lenght of the paquet.

SIZE_PAQUET : [DWORD]

Then come the HEADER (that can change if encryption is ON or OFF)

DATA_SIZE_INCLUDE_HEADER : [DWORD]            // If encryption is ON or OFF
NS_VERSION : [WORD]
NS_STREAMID : [WORD]
DATA_SIZE : [DWORD]

Then come the DATA, different for every OPCODE

OPCODE                     : [WORD]

Some definitions / typing :

[TESO_BUFFER] type is :

SIZE_BUFFER : [WORD]
DATA : [BYTE] * SIZE_BUFFER
NULL_BYTE (\x00) : [BYTE]

[ZLIB_BUFFER] type is :

UNCOMP_SIZE : [DWORD]
COMP_SIZE     : [DWORD]
DATA_ZLIB       : [BYTE] * COMP_SIZE

Character Opcode list :

Opcode 0x0110

First packet received by the CharacterServer from the client, after it connects.

OPCODE (0x0110)            : [WORD]
UID                        : [TESO_BUFFER]
LANGAGE                    : [TESO_BUFFER]
LOBBY_PROTOCOL             : [DWORD]
KEYX_PUBLIC                : [ZLIB_BUFFER]
UNK_BYTE_00                : [BYTE]
UNK_DWORD_00               : [DWORD]
UNK_DWORD_01               : [DWORD]
KEYX_PUBLIC                : [ZLIB_BUFFER]
KEYX_PUBLIC                : [ZLIB_BUFFER]
KEYX_PUBLIC                : [ZLIB_BUFFER]
KEYX_PUBLIC                : [ZLIB_BUFFER]
REGION_PROTOCOL            : [DWORD]
VERSION                    : [TESO_BUFFER]
UUID                       : [TESO_BUFFER]

Opcode 0x010A

Client send this packet to server to say that the communication is now encrypted with the CharacterServer

OPCODE (0x010A)            : [WORD]
UNK_BYTE_00                : [BYTE]

Opcode 0x0114

Ask connection to World / Region

OPCODE (0x0114)            : [WORD]
UNK_BYTE_00                : [BYTE]
ID_CHARACTER               : [QWORD]

Opcode 0x0115

Send informations related to character already created by the player

OPCODE (0x0115)            : [WORD]
UNK_QWORD_00               : [QWORD]        // LAST ID_CHARACTER USED ?
MAX_NB_CHARACTER_ALLOWED   : [BYTE]
UNK_QWORD_01               : [QWORD]
UNK_BYTE_01                : [BYTE]
NB_CHARACTER               : [BYTE]
CHARACTER                  : [CHARACTER_STRUCT] * NB_CHARACTER

The [CHARACTER_STRUCT] is explained further in this post.

Opcode 0x0116

Delete character

OPCODE (0x0116)            : [WORD]
ID_CHARACTER               : [QWORD]

Opcode 0x0117

Create Character

OPCODE (0x0117)            : [WORD]
ALLIANCE                   : [DWORD]
CLASS                      : [DWORD]
SEX                        : [DWORD]
RACE                       : [DWORD]
BODY_OPTIONS               : [QWORD]
SIZE_ATTRIBUTE_FACE        : [BYTE]
ATTRIBUTE_FACE             : [BYTE] * SIZE_ATTRIBUTE_FACE
UNK_DWORD_04               : [DWORD]
NAME                       : [TESO_BUFFER]

ALLIANCE

• 0x01 : The aldmeri dominion
• 0x02 : The ebonheart pact
• 0x03 : The daggerfall covenant

SEX

• 0x01 : Female
• 0x02 : Male

RACE

• 0x01 : Breton
• 0x02 : RedGuard
• 0x03 : Orc
• 0x04 : Dark Elf
• 0x05 : Nord
• 0x06 : Argonian
• 0x07 : High Elf
• 0x08 : Wood Elf
• 0x09 : Khajiit

CLASS

• 0x01 : Dragon knight
• 0x02 : Sorcerer
• 0x03 : Nightblade
• 0x04 : ???
• 0x05 : ???
• 0x06 : Templar

BODY_OPTIONS

TODO

Opcode 0x0118

Creation Character OK

OPCODE (0x0118)            : [WORD]
NB_CHARACTER               : [BYTE]   // If NB_CHARACTER > 1 goto error
CHARACTER                  : [CHARACTER_STRUCT] * NB_CHARACTER

CHARACTER_STRUCT

ID_CHARACTER               : [QWORD]
LEVEL                      : [DWORD]
NAME                       : [TESO_BUFFER]
CLASS                      : [DWORD]
RACE                       : [DWORD]
SEX                        : [DWORD]
UNK_DWORD_00               : [DWORD]
LOCATION                   : [DWORD]
ALLIANCE                   : [DWORD]
UNK_QWORD_01               : [QWORD]
UNK_WORD_00                : [WORD]
UNK_DWORD_01               : [DWORD]
UNK_QWORD_02               : [QWORD]
UNK_WORD_01                : [WORD]
UNK_DWORD_02               : [DWORD]
UNK_QWORD_03               : [QWORD]
UNK_WORD_02                : [WORD]
BODY_OPTIONS               : [QWORD]
SIZE_ATTRIBUTE_FACE        : [BYTE]
ATTRIBUTE_FACE             : [BYTE] * SIZE_ATTRIBUTE_FACE
UNK_BYTE_00                : [BYTE]
    for i in range(0, 22)            // Maybe related to inventory 
         UNK_DWORD_00      : [DWORD]
         UNK_DWORD_01      : [DWORD] 
         UNK_BYTE_00       : [BYTE] 
         UNK_BYTE_01       : [BYTE] 
         UNK_DWORD_02      : [DWORD]
UNK_DWORD_03               : [DWORD]
UNK_DWORD_04               : [DWORD]
UNK_QWORD_04               : [QWORD]
UNK_DWORD_05               : [DWORD]

LOCATION

• 0x123 : Razak's Wheel
• 0x164 : Thibaut's Cairn
• 0x1AD : Khenarthin's roost
• 0x1DD : The Wailing Prison
• TODO MORE

Opcode 0x0220

Kind of PING.
You have to transmit the message to Lobby Server, in order than the Lobby Server send the packet 0x2B0D to answer to the PING.

OPCODE (0x0220)            : [WORD]
UNK_DWORD                  : [DWORD]

There is more opcodes for Character Server, but that's the only ones I know so far for eso.live.1.0.0.714440.

[Anakin5]

hi blar0. Isn't the first OPCode sent by the client 0x0001 ? or are you referring to packet sent later by the client ?

00000000h: 00 00 03 1E 00 01 00 01 00 00 03 16 2B 10 00 04 ; ............+...
00000010h: 31 32 33 34 00 00 15 65 73 6F 2E 6C 69 76 65 2E ; 1234...eso.live.
00000020h: 31 2E 30 2E 30 2E 37 31 34 34 34 30 00 00 00 00 ; 1.0.0.714440....


Edit: Disregard the question, I was not awake. Its 2B10

[blar0]

hi blar0. Isn't the first OPCode sent by the client 0x0001 ? or are you referring to packet sent later by the client ?

00000000h: 00 00 03 1E 00 01 00 01 00 00 03 16 2B 10 00 04 ; ............+...
00000010h: 31 32 33 34 00 00 15 65 73 6F 2E 6C 69 76 65 2E ; 1234...eso.live.
00000020h: 31 2E 30 2E 30 2E 37 31 34 34 34 30 00 00 00 00 ; 1.0.0.714440....


Edit: Disregard the question, I was not awake. Its 2B10

And you are talking about an opcode related to the Lobby Server ...

[Anakin5]

My confusion came from the fact that the first message from the lobby server looks like the first message from the character server.

[blar0]

My confusion came from the fact that the first message from the lobby server looks like the first message from the character server.

Not from, but for.

yeah, looks like, to clarify : the first packet for Lobby server is :

OPCODE (0x2B10)            : [WORD]
LOGIN                      : [TESO_BUFFER]
VERSION                    : [TESO_BUFFER]
KEYX_PUBLIC                : [ZLIB_BUFFER]
KEYX_PUBLIC                : [ZLIB_BUFFER]
KEYX_PUBLIC                : [ZLIB_BUFFER]
REGION_PROTOCOL            : [DWORD]
KEYX_PUBLIC                : [ZLIB_BUFFER]
UNK_DWORD_00               : [DWORD]
LOBBY_PROTOCOL             : [DWORD]
UNK_DWORD_01               : [DWORD]
KEYX_PUBLIC                : [ZLIB_BUFFER]
UNK_BYTE_00                : [BYTE]
LANGAGE                    : [TESO_BUFFER]

[Anakin5]

Hi,

For this story with the Ping, I am trying to see what data identify a client between character server and lobby server.
In case the server handle multiple clients, by the time we receive 0x0220 on Character Server, we need to find the corresponding Lobby Server connection. And it cannot be done only by looking at IP address because one can launch several game on the same machine.

The character server received UUID and UID from the first packet sent by the client. But the lobby server never receive information about UID and the UUID is different.

Does anyone see what data (known by both character server and lobby server and unique by client game instance) can be used to link the 2 tcp connections ?

[dodoman]

Doesn't the client have to use different ports to handle both on one mashine?

[blar0]

iirc some opcodes are equal from one server to another (lobby, character, for example), but they have to be handled in a different way, that's why it's better to have one service (lobby, charac, region) by port.

[Anakin5]

Ok, I am not sure but I think I got some info about Client identification:

When the lobby server send character server details to the client (message 0x2B12), it includes 2 QWORD. (so we have the link "Lobby client" <-> 2 QWORD).
When the client send the first message to the character server (0x0110), it contains a 36 bits buffer at the end that contains the previous 2 QWORD. This is called UUID in blar0 python server but it is not the same UUID as the one we generate during login sequence. (so we have the link "Character client" <-> 2 QWORD").
When the client send the first message to the region server (0x0100), it contains the 2 QWORD (so we have the link "Region server" <-> 2 QWORD).

I believe these 2 QWORD that are in 0x2B12, 0x0110 and 0x0100 are an internal user ID and that can be used to answer ping requests.

[spartakexer]

I'm sorry to ask but is there any plan on making or compiling tool for data extraction?

[Anakin5]

Any info on 0x0240 for character server ? It happened just after character creation.

[Esoserv2]

Any info on 0x0240 for character server ? It happened just after character creation.

As i understand it, a 0x0240 is a error or "re-request missing, wrong formated" packet opcode... But i don't know exact.