MSN Messenger Protocol

Cosnumer Versioning (CVR)

The CVR command sends version information about a client and operating system to the server. For the official client, the server will reply with information about a recommended version of the client (which may be the same as the current version).

The CVR command is optional in protocol versions up to and including MSNP7. It's debatable whether third-party clients should send CVR. On one hand, Microsoft might start blocking users based on this command. On the other hand, they might treat third-party clients better if there was evidence that a significant number of people used them. On the one hand, there are serious privacy issues with the information given out. On the other hand, there's no way for Microsoft to verify the information given.

The CVR command includes information about the language you speak, the name and version of your client, and the name and version of your OS. You can send a CVR command to the NS at any time after you have finished logging in, but the official client always sends it immediately after sending the initial CHG. You can send CVR as many or as few times as you like. CVR has a TrID and 6 parameters in MSNP2 and MSNP3, or 7 parameters in MSNP5 and MSNP7.

• The first parameter is hexadecimal number specifying your locale ID (e.g. "0x0409" For U.S. English).
• The second parameter is your OS type (e.g. "win" for Windows).
• The third parameter is your OS version (e.g. "4.10" for Windows 98).
• The fourth parameter is the architecture of your computer (e.g. "i386" for Intel-comaptible PCs of type 386 or above).
• The fifth parameter is your client name (e.g. "MSMSGS" for the official MSN Messenger client).
• The sixth parameter is your client version (e.g. "1.0.0863" for the first version of the official client).
• The seventh parameter is always "MSMSGS" in the official client. Your guess about what this means is as good as mine.

Like with any other command, the server will reply to a CVR command with a CVR reply. For some reason, though, the official client would be just as happy if you replaced CVR with CVQ in the reply. The reply command will contain 5 parameters:

• The first parameter is a recommended version of the client for you to use, or "1.0.0000" if your client information is not recognised.
• The second parameter is identical to the first.
• The third parameter is "1.0.0000".
• The fourth parameter is a URL you can download the recommended version of the client from.
• The fifth parameter is a URL the user can go to to get more information about the client.

Here is the CVR information sent by version 3.6 of the official client.

>>> CVR 7 0x0409 win 4.10 i386 MSMSGS 3.6.0025 MSMSGS\r\n

<<< CVR 7 4.6.0083 4.6.0083 1.0.0000 http://download.microsoft.com​/download/msnmessenger/install/4.6/win98me/en-us/​mmssetup.exe http://messenger.microsoft.com\r\n

>>> CVR 8 0x0409 win 4.10 i386 MSGSTRST 3.6.0025 MSMSGS\r\n

<<< CVR 8 1.0.0000 1.0.0000 1.0.0000 http://download.microsoft.com​/download/msnmessenger/install/4.6/win98me/en-us/​mmssetup.exe http://messenger.microsoft.com.\r\n

Service URLs (URL)

The URL command retrieves URLs relating to the various MSN services to be opened in an external or integrated browser. It takes one parameter, which can be multiple words. Note that the parameter is case-sensitive. The 0x... does not symbolize a special character and is to be taken literally. The parameter must be one of the following:

• INBOX - Hotmail inbox
• FOLDERS - Believed to be the Hotmail's "MSN home" URL.
• COMPOSE - Compose an email
• COMPOSE example@passport.com - Compose an email for example@passport.com
• PROFILE 0x1409 - Edit your MSN member directory profile
• CHGMOB - Mobile settings (pager etc.)
• PERSON 0x0409 - Member services, password, secret question, account info
• CHAT 0x0409 - Chat rooms

The server will respond with another URL. It always has three parameters: the first two are URLs and the third is an ID number. These parameters are used to determine how to direct the web browser. The first four items are explained in the notification server messages page.

Below is an example of requesting the URL information for the Hotmail inbox:

>>> URL 15 INBOX\r\n

<<< URL 15 /cgi-bin/HoTMaiL https://loginnet.passport.com/ppsecure/md5auth.srf?lc=1033 2\r\n

The URL command does not give you the URL to view profiles of people in the MSN Member List. To do this, direct the web browser to http://members.msn.com/default.msnw?mem=ACCOUNTNAME where ACCOUNTNAME is the account name of the user whose profile you want to view.

Sending an e-mail invitation

Note: This command has not been well tested. If you have done any research on this command, please let us know!

You can send an e-mail saying "<your-passport> wants to talk to you!" to a specified e-mail address with the SND command, which has a TrID and 4 parameters.

• The first parameter is the e-mail address you want to send the message to.
• The second parameter is the locale ID of the language to send the message in.
• The third and fourth parameters are "MSMSGS MSMSGS".

If the message was sent successfully, the server will reply with an SND with a single parameter of OK. Here is an example.

>>> SND 22 alice@hotmail.com 0x409 MSMSGS MSMSGS\r\n

<<< SND 22 OK\r\n

If bob@hotmail.com sent this message, Alice would receive an e-mail saying "bob@hotmail.com wants to talk to you!".

Searching For Users

MSN Messenger used to include a search facility, but this has been superceded by the MSN Memeber Directory. The command used for this was FND. Sending an FND command in any version of the MSN Messenger protocol will now cause you to receive a 502 error, and nothing more.

MSN Alerts

Note: This command has not been well tested. If you have done any research on this command, please let us know!

MSN Alerts use the NOT ("notification") command, which has one parameter - the length of the message body.

If you use the official client, you can register this service by clicking on the golden bell tab (under the msn "green buddy" tab).

This command hasn't been thoroughly researched, so the information in this section is fairly speculative. If you are interested in it, please let us know what you find! Only two examples of this command has been observed.

<<< NOT 586\r\n
    <NOTIFICATION ver="1" siteid="111100200" siteurl="http://calendar.msn.com" id="2">\r\n
    <TO pid="0x00060000:0x81ee5a43" name="jabber_test@hotmail.com" />\r\n
    <MSG pri="" id="2">\r\n
    <ACTION url=​"/calendar/isapi.dll?request=action&operation=modify​&objectID=2​&uicode1=modifyreminder&locale=2052"/>\r\n
    <SUBSCR url=​"/calendar/isapi.dll?request=action&operation=modify​&objectID=2​&uicode1=modifyreminder&locale=2052"/>​<CAT id="111100201" />\r\n
    <BODY lang="2052" icon="/En/img/calendar.png">\r\n
    <TEXT>aaaaa (bbbbb) 2002偁十䁁月14�星期�21:45 - 22:45 </TEXT>\r\n
    </BODY>\r\n
    </MSG>\r\n
    </NOTIFICATION>\r\n


<<< NOT 590\r\n
    <NOTIFICATION ver="1" siteid="111100200" siteurl="http://calendar.msn.com" id="1">\r\n
    <TO pid="0x00060000:0x81ee5a43" name="jabber_test@hotmail.com" />\r\n
    <MSG pri="" id="1">\r\n
    <ACTION url=​"/calendar/isapi.dll?request=action&operation=modify​&objectID=1​&uicode1=modifyreminder&locale=2052"/>\r\n
    <SUBSCR url=​"/calendar/isapi.dll?request=action&operation=modify​&objectID=1​&uicode1=modifyreminder&locale=2052"/>​<CAT id="111100201" />\r\n
    <BODY lang="2052" icon="/En/img/calendar.png">\r\n
    <TEXT>goto club 7. 2002 21:15 - 22:15 </TEXT>\r\n
    </BODY>\r\n
    </MSG>\r\n
    </NOTIFICATION>\r\n


The body appears to be XML, though we're not sure whether it's actually parsed as XML, which commands are necessary, whether you can insert arbitrary extra fields, and so on. Our current theories about the various sections of the message are:

• The NOTIFICATION element specifies that this is a notification.
  • The "ver" attribute specifies the version of the notification standard being used.
  • The "siteurl" attribute is the base URL to be used with the relative URLs in nested elements.
  • The "id" attribute is an ID value which increases by one for every notification in the current session.
• The TO element specifies who the message is addressed to (i.e. you). The "name" attribute is your passport.
• The MSG element contains a particular message. This might suggest that more (or less?) than one message can be sent in a single notification. The "id" attribute is the same as the id of the NOTIFICATION tag.
• The ACTION and SUBSCR elements are identical, and give a URL (relative to the URL given in the NOTIFICATION element) to visit.
• The CAT element might be some kind of categorisation?
• The BODY element contains the body of the notification.
  • The "lang" attribute is a language code.
  • The "icon" attribute is an icon to display in the alert box.
• The TEXT element contains the text of the alert

Mobile Paging (PAG)

Note: This command has not been well tested. If you have done any research on this command, please let us know!

You can page someone on their MSN Mobile device with the PAG command. It is believed that you can receive an incoming message from an MSN Mobile device with the IPG command.

If someone on your forward list has an MSN Mobile device and have allowed you to send messages to them with it, their "MOB" will be set to "Y". The PAG command has a TrID and two arguments.

• The first argument is the passport of the user you want to send the message to.
• The second argument is the length of the message body.

The body of a PAG can be either <TEXT xml:space="preserve"> . . . </TEXT> or <PHONE pri="1">​<LOC>string</LOC>​<NUM>string</NUM>​</PHONE><​TEXT xml:space="preserve"> . . . </TEXT>. The extra information in the second format is not yet understood.

If the command failed to send, the reply is an 800 error. If there is some other error (for example, you are not allowed to send PAGs, or your PAG is malformed), you get a 220 error. If the message was sent successfully, there is no reply.

A message sent with the PAG command must be no more than 113 characters long. It can include any characters valid in an XML document. That means that & must be converted to &, characters with values greater than 127 or less than 32 must be converted to &#NN;, etc.

The IPG command has never been observed in the wild, but analysis of the official client suggests that it is a normal payload command with a specified length.