| 1 |
4ae45b10
|
Ermal Luçi
|
# Tencent QQ Protocol - Chinese instant messenger protocol - http://www.qq.com
|
| 2 |
66f2dd0e
|
Ermal Lu?i
|
# Pattern attributes: good notsofast fast
|
| 3 |
4ae45b10
|
Ermal Luçi
|
# Protocol groups: chat
|
| 4 |
|
|
# Wiki: http://www.protocolinfo.org/wiki/QQ
|
| 5 |
66f2dd0e
|
Ermal Lu?i
|
# Copyright (C) 2008 Matthew Strait, Ethan Sommer; See ../LICENSE
|
| 6 |
4ae45b10
|
Ermal Luçi
|
#
|
| 7 |
|
|
# Over six million people use QQ in China, according to wsgtrsys.
|
| 8 |
|
|
#
|
| 9 |
|
|
# This pattern has been tested and is believed to work well.
|
| 10 |
|
|
#
|
| 11 |
|
|
# QQ uses three (two?) methods to connect to server(s?).
|
| 12 |
|
|
# one is udp, and another is tcp
|
| 13 |
|
|
# udp protocol: the first byte is 02 and last byte is 03
|
| 14 |
|
|
# tcp protocol: the second byte is 02 and last byte is 03
|
| 15 |
|
|
# tony on protocolinfo.org says that now the *third* byte is 02:
|
| 16 |
|
|
# "but when I tested on my PC, I found that when qq2007/qq2008
|
| 17 |
|
|
# use tcp protocol, the third byte instead of the second is always 02.
|
| 18 |
|
|
#
|
| 19 |
|
|
# So the QQ protocol changed again, or I have made a mistake, I wonder
|
| 20 |
|
|
# that."
|
| 21 |
|
|
# So now the pattern allows any of the first three bytes to be 02. Delete
|
| 22 |
|
|
# one of the ".?" to restore to the old behaviour.
|
| 23 |
|
|
# pattern written by www.routerclub.com wsgtrsys
|
| 24 |
|
|
|
| 25 |
|
|
qq
|
| 26 |
|
|
^.?.?\x02.+\x03$
|