The three messages sent in the handshake are binary structures. Each one is described below as a pseudo-C struct and in a memory layout diagram.
All fields are unsigned.
Numbers are stored in little-endian order. Struct fields named zero contain all zeroes. Hexadecimal numbers and quoted characters in the comments of the struct indicate fixed values for the given field. This message contains the host name and the NT domain name of the client. The offset's refer to the offset of the specific field within the message, and the lengths are the length of specified field.