[Android Software Development] willsteel:
reversing protocol and api is not easy, nor legal but doable

Hi,

first of all, if we do this i would recommend to gather up some folks on a sourceforge website.

i have experience in VoIP, network protocol and android programming, because its my job. Thats why i'm afraid sipdroid is of no help because TS3 has a complete proprietary (and encrypted) protocol. I already know how to encode speex on android/java no problem here. the real trick is to break the ts3 protocol, because the support client API SDK is of no use, because its precompiled (and not for ARM V5/7 CPUs).

I took the time to have a loot at TS3 UDP packet structure and it does not look very promising because they are using obviously some kind of encryption that is somewhere hardcoded in the client library. I think it is a lightwight encryption, maybe even combination of MD5 or some easy bit operations. But resulting network traffic does not contain any default encoded values (like asn1 int/strings/...). I was not able to do a fake login. In order to do this someone needs to disassemble the TS3 Client library. This one really needs to know what he is doing. The compile library is 4MB in size, so there is a lot of stuff. I think it is out of my scope. However, it can be done, but it is anything else than of easy.

here are my first wireshark results:

Facts:
- UDP only (think so, even though TCP is mentioned in docs)
- Default port: 9987

General Structure:
- Each packet heads a 8Byte hash.
- Hash MAY contain a checksum and/or sequence
- Once connection is established a keepalive an ack ist looped containing a sequence number (in plain)

================

Connecte Request (1 client packet)

HASH (each packet)
00000000 [e0 e2 2e d8 fd cd 03 3b] 00 00 00 00 02 9d 74 8b .......; ......t.

00000010 45 aa 7b ef b9 9e fe ad 08 19 ba cf 41 e0 16 a2 E.{..... ....A...
VARIABLE PER CONNECTION
00000020 [2b 77 d5 94 fe e7 31 72 e6 d0 a3 2f 2d 59]90 95 +w....1r .../-Y..

00000030 23 3e 00 97 2b 1c 71 b2 4e c0 61 f1 d7 6f c5 7e #>..+.q. N.a..o.~

00000040 f6 48 52 bf 82 6d a9 3a 52 da 23 5f 03 2b d9 bf .HR..m.: R.#_.+..

00000050 3a da 2e aa fe 74 c6 fc 23 de 99 71 23 91 b9 06 :....t.. #..q#...

00000060 16 4a 4e eb 2b 48 ae c3 2d 14 a1 e6 77 cc 68 ab .JN.+H.. -...w.h.

00000070 c1 cf 0f fd 07 ac 0d 42 09 15 bb a0 86 33 2a 23 .......B .....3*#

00000080 08 03 8a 65 81 89 c6 2b 85 82 4b d5 fd f8 61 3c ...e...+ ..K...a<

00000090 b4 39 76 fb cf 18 2a aa 97 9b f7 ad 81 82 33 66 .9v...*. ......3f

000000A0 be 8d

==================

Answer (1 server packet)

HASH
00000000 [be e2 d4 c4 8f 8c 54 51] 00 00 02 97 76 8b 54 ad ......TQ ....v.T.
VAR
00000010 79 e3 af 87 eb aa 1a 19 ba cf 41 e0 16 a2[6c 5e]y....... ..A...l^
VAR LO LO HI hi
00000020 [e3 cf 93 df 2f 4a f9 f2 97 29 22 59]90 95 23 33 ..../J.. .)"Y..#3
VAR LO HI HI LO HI LO HI LO
00000030 08 86 2d 40[29 b6 39 cf 40 e6 c5 3a c6 5a f0 6f]..-@).9. @..:.Z.o
9c FIX
00000040 65 89 d6[12]c3 62 6f 88 32 7a 69 3e cd a4 12 ce e....bo. 2zi>....
44
00000050 62 fe de 1e 96 d0 0e a9 9f 76 7e cc a7 63 1c 47 b....... .v~..c.G

00000060 0a 94 38 22 f5 f9 06 34 d6 f6 78 92 6c 91 c6 d9 ..8"...4 ..x.l...

00000070 2d fa 2a 8e 10 54 6c 33 91 be 92 3f 2d 2b 0d 3c -.*..Tl3 ...?-+.<

00000080 a2 7c 89 de e2 27 ae b0 53 e4 c7 fd 64 0a e3 2d .|...'.. S...d..-

00000090 2c fc c4 06 0e fc f7 81 f6 de a7 cc 1c 71 bc 80 ,....... .....q..

000000A0 d3 54 8b 02 9a 1b ca ad 92 99 28 62 cc 62 fa 53 .T...... ..(b.b.S

000000B0 1b 13 ec 93