Yahoo! Messenger Protocol - Login

Login

The login process is a multi-step process that spans two protocols. The client, after successfully establishing a TCP connection to a ymsg server, sends an authentication packet that contains the user name that the user wishes to log in with to the YMSG server. The YMSG server then responds with an authentication packet containing a challenge string in key/value field 96. The HTTPS process then starts, connecting to login.yahoo.com, and sending the token_get string that is constructed with the username and password of the account the client is trying to log in with. The HTTPS response to the token login if successful will contain a token string. Then another HTTPS request is sent to login.yahoo.com with the token_login that is constructed with the token. If successful, the response will contain three strings: a crumb, Tcookie, and YCookie. The client then combines the crumb and challenge strings and performs an md5 hash on the combined string, then converts the resulting 16-byte value to a base64 string, and performs a very negligible amount of manipulation on the resulting base64 string by making three character replacements ( '+' with '.', '=' with '-', and '/' with '_' ). The resultant base64 string is then used in building the AuthenticationResponse packet, whose key 307 contains the resultant base64 string value. The client then sends the AuthenticationResponse packet. If the AuthenticationRepsonse packet is successful, the client then will receive the List, ListV15, StatusV15, NewMail, Ping, and any number of Y7 Buddy Authorization and Message packets (for offline messages, and buddy requests). The List packet contains all the aliases to the user accounts YahooID, the ListV15 contains the users friends, groups, and ignored user list. The StatusV15 packet contains the users from the listV15 that are online, busy, or idle, as well as any status messages those users may have, and potentially a string that represents the resource on another http server that is that user's display image.