MSN Messenger Animated Custom Emotions

[lexecutil]

Hi, ive been working on trying to get animated custom emotions work in msn messenger 6 and this is what ive found out about it so far.

Custom emotions are stored here: C:\Documents and Settings\USERNAME\Application Data\Microsoft\MSN Messenger\EMAIL\CustomEmoticons, if you have for example 5 custom emotions there will be 7 files in the folder. There is one file called map.txt it will read something similar to this:

<msnobj Creator="[email protected]" Size="764" Type="2" Location="TFR141.tmp" Friendly="AAA=" SHA1D="HbAOHnbnyRpJRJS/leWdvyQLRFo=" SHA1C="M53lPb3XQl2Eklnvc5jmD0dmO60="/>

The file TFR141.tmp (the file name could be anything) is the file with info about your custom emotions, if you rename it to a .txt it will read something like this:

(88) gost-2-1053702256 <msnobj Creator="[email protected]" Size="592" Type="2" Location="TFRAC.tmp" Friendly="AAA=" SHA1D="ZYSjjA3UhMjdopsmli7NZP7BqQ0=" SHA1C="JhXGjmzq9yNxC1LsfB2jIsu1t5o="/>

(test) 1033 <msnobj Creator="[email protected]" Size="322" Type="2" Location="TFR140.tmp" Friendly="AAA=" SHA1D="7e1vkzqVLy8UKOVJAwEeyHvjVoA=" SHA1C="q1PbKsC0rJK6c7pxmN0UopOkGTs="/>

Each file under Location= is your emotion file so if you rename it to a .png its your emotion. Messenger uses the SHA1 encryption so you cannot edit your emotions after they have been entered into messenger under my emotions. If you try and edit your emotions and change the Size= tag messenger will say your custom emotions cannot be user (or something similar to that)

If you edit a custom emotion this code

SHA1D="7e1vkzqVLy8UKOVJAwEeyHvjVoA=" SHA1C="q1PbKsC0rJK6c7pxmN0UopOkGTs="/>

would need to be changed to make it work. All this info applys for the "Backgrounds" and "UserTile" folders aswell.

Dan

[lexecutil]

Also there were rumors that msn messenger 6 used the mng format for its animated emotions (mng is basicly animated png) this is untrue, msn messenger uses pngs with sections of 19x19 pixels and chops them up and makes it animated you can check this by using reshack and exporting one of the animated emotions.

Dan

[lexecutil]

So for now unless someone somehow disables or cracks the encryption (i do not support this in anyway) it looks like noone will be able to make a program that automaticly imports emotions.

Dan

[vortex2050]

Reminder, SHA1 is your Secure Hashing Algo. that takes input up to 2^64 bits in length and produces a 160-bit message digest which is all hell to brute force. The strings you pasted are not SHA1 hashes, by the way. Read below.

Some random notes:

Partial Type Listing(?)

===============

Type 2 = Emoticon

Type 3 = Profile Picture

Type 5 = Background

Example map.txt SHA1(false) String

=========================

VMmh9p+B+5j4hiCGxJfjwIv/qWw=

These are not SHA1 hashes, as they contain invalid characters. An example SHA1 hash would look like:

0efe503114c284670128cd45c7981efef3a7483b

The string above is Base64-encoded (or it seems to be) - Its output (when decoded) yields something similar to:

Tɡ ėl

(For exactness (as some characters don't display correctly), you can code a simple PHP script to output its decoded form and pipe it to a file)

I haven't been able to figure out why/where these are used however they seem to be hashes/signatures of files which have data inside them that do the same thing to another set of files (redundancy) More info will be available when I learn of more.

[lexecutil]

thanks for clearing that up vorte[x] :)

Dan

[vortex2050]

You'll probably find a little more out by investigating the use of the following exported functions in MSNM6 (hooking/monitoring would be nice):

CryptReleaseContext, CryptDestroyHash, CryptCreateHash, CryptAcquireContextA, CryptGetHashParam

Kiddies: I do not recommend you remove the use of these functions (via r.engineering) within' MSNM6 as its used in other places, not just in emotes. (Passport/etc)

[tomwarren Veteran]

Glad to see people are working on getting them working or at least understanding them ;)

[vortex2050]

Its general knowledge, to me.

[RadishTM Veteran]

Moved to Customization & Skinning Section

Radish.

[lexecutil]

hmm dont really think this should be in Customization & Skinning Section since its kinda todo with programming and software but your the boss Radish?.

Dan

[slang123]

hmm dont really think this should be in Customization & Skinning Section since its kinda todo with programming and software but your the boss Radish?.

Dan

I agree. hes probably trying to get all the msn messenger 6 stuff together. And the fact that it has emoticons in the title doesnt help

[AQUaDeX]

now not to spoil your ideas, but remember the following:

animated emoticons requires a mechanism to be triggered so that MSN Messenger knows it's animated and animates it, you cannot simply link up a couple of 19x19px images, crack all the way to get MSN Messenger display it and think MSN Messenger would animate it for you

Microshaft has been using this method to do animations in their applications for a long history already, for example the butterfly icon flying on top of the Messenger windows when you log in is a very good example

if Microshaft wants to forbid you to animate your custom emoticons, they have their own way of doing it, the most effective one would be NOT building the mechanism of animating linked 19x19px images and enable animated gif support as custom emoticons

hope you guys will have fun reverse engineering Messenger 6 but don't give too much hope on getting animated custom emoticons to work, this is my tip for you guys

[lexecutil]

the main thing im trying todo is just being able to replace the file after it has been entered into messenger because i dont "think" messenger checks the file before it gets sent to the other end.

Dan

[vortex2050]

It gets put into memory upon start of MSN Messenger, therefore any alterations of the custom emoticons/backgrounds during an IM conversation is useless. I'll take a look at the loading upon EXE launch tommorow.

[lexecutil]

so if you make changed you just have to restart messenger? ok, i make changes with messenger shut down anyway.

Dan

[vortex2050]

If you make changes, you have to restart messenger (or sign in/out) to experience the effect.

[f0uw0mbats]

How do you go about making changes, are we talking about the background image or something more complex?

[vortex2050]

I'm refering to hex-editional changes to the .tmp files.

[slang123]

If you could get this to work, couldnt u also use different sized emoticons. im think about twice the size or something because from what it sounds like it only checks this wen u add an emoticon and not when it sends/receives it. just a thought, feel free to scrap it

[lexecutil]

yeah thats what im hoping slang123.

Dan