Packet Layout

(1.1.2.4125)

AuthLogonProof_Client
Offset	Type	Name	Description
0x0	uint8	command	0x1
0x1	uint8[32]	a
0x21	uint8[20]	m1
0x35	uint8[20]	crc_hash
0x49	uint8	num_keys

AuthLogonProof_Client
Offset	Size / Endianness	Type	Name	Description
0x0	1 / -	uint8	command	LOGIN_PROOF (0x1)
0x1	32 / Little	uint8[32]	a	SRP6 Client public key. Called A (capital A) in RFC2945.
0x21	20 / Little	uint8[20]	m1	SRP6 Client proof.
0x35	20 / Little	uint8[20]	crc_hash	Hash of arbitrary files. Can be safely ignored.
0x49	1 / -	uint8	num_keys	Used for unknown telemetry. Can be expected to always be 0. See the table below for when it is not 0.
num_keys amounts of num_key fields, if applicable.
0x4A	1 / -	bool (size 1 byte)	two_factor_enabled	If false the packet ends here, if true the fields in the table below are included. Added in 1.12.x client branch.
security_flags.PIN fields, if applicable.

When num_keys is not 0, the field is followed by 4 key data fields that repeat num_key times.

num_keys Fields
Size / Endianness	Type	Name	Description
2 / -	uint16	unk1	Used for unknown telemetry. Can be expected to not be present.
4 / -	uint32	unk2	Used for unknown telemetry. Can be expected to not be present.
4 / -	uint8[4]	unk3	Used for unknown telemetry. Can be expected to not be present.
20 / -	uint8[20]	unk4	Used for unknown telemetry. Can be expected to not be present.

When two_factor_enabled is not 0, the field is followed by the data in the table below.

two_factor_enabled Fields
Offset	Size / Endianness	Type	Name	Description
	16 / ?	uint8[16]	pin_salt	Salt used for PIN. Only included if two_factor_enabled is true.
	20 / ?	uint8[20]	pin_hash	Client proof for PIN. Only included if two_factor_enabled is true.

AuthLogonProof_Client
Offset	Size / Endianness	Type	Name	Description
0x0	1 / -	uint8	command	LOGIN_PROOF (0x1)
0x1	32 / Little	uint8[32]	a	SRP6 Client public key. Called A (capital A) in RFC2945.
0x21	20 / Little	uint8[20]	m1	SRP6 Client proof.
0x35	20 / Little	uint8[20]	crc_hash	Hash of arbitrary files. Can be safely ignored.
0x49	1 / -	uint8	num_keys	Used for unknown telemetry. Can be expected to always be 0. See the table below for when it is not 0.
num_keys amounts of num_key fields, if applicable.
0x4A	1 / -	bool (size 1 byte)	security_flags	Bit pattern for optional authentication features. More than one feature can be used, and the fields are just appended in the bit pattern order from lowest first. See security_flag. tables below for specifics. If 0 the packet ends here.
security_flags.PIN fields, if applicable.
security_flags.unknown fields, if applicable.
security_flags.Authenticator field, if applicable.

When num_keys is not 0, the field is followed by 4 key data fields that repeat num_key times.

num_keys Fields
Size / Endianness	Type	Name	Description
2 / -	uint16	unk1	Used for unknown telemetry. Can be expected to not be present.
4 / -	uint32	unk2	Used for unknown telemetry. Can be expected to not be present.
4 / -	uint8[4]	unk3	Used for unknown telemetry. Can be expected to not be present.
20 / -	uint8[20]	unk4	Used for unknown telemetry. Can be expected to not be present.

When security_flags is not 0 the following fields can appear.

security_flags.PIN Fields
Offset	Size / Endianness	Type	Name	Description
0x00	4 / Little	uint32	pin_grid_seed	Seed value for the PIN grid on the client. Only here if the two_factor_authentication field is true.
0x04	16 / Little	uint8[16]	pin_salt	Salt value for the client. Only here if the two_factor_authentication field is true.

security_flags.Unknown0 Fields
Offset	Size / Endianness	Type	Name	Description
0x00	1 / -	uint8	unknown0	Unknown. Statically set to 0 in Mangos.
0x01	1 / -	uint8	unknown1	Unknown. Statically set to 0 in Mangos.
0x02	1 / -	uint8	unknown2	Unknown. Statically set to 0 in Mangos.
0x03	1 / -	uint8	unknown3	Unknown. Statically set to 0 in Mangos.
0x04	8 / -	uint64	unknown4	Unknown. Statically set to 0 in Mangos.

security_flags.Authenticator Fields
Offset	Size / Endianness	Type	Name	Description
0x00	1 / -	uint8	unknown0	Statically set to 1 in Mangos.