# Table of contents:

# MIME Content-Types

Content-Types are a part of the Multi-purpose Internet Mail Extensions, though technically they predate that spec (in RFC1049, however not in their most well-known form, which was only introduced with the original RFC1341 spec itself.

As the MSG MSNP command heavily relys on MIME formatting and interpretation, an informal declaration of all (well, most of them) valid types may be useful.

# text/plain

Not sent by the Official Client.

Standard text. Decoded with your system's codepage.

MIME-Version: 1.0
Content-Type: text/plain

This is a text/plain message.

# text/plain; charset=UTF-8

Standard text. Always decodes using the UTF-8 format.

Can contain multiple headers:

MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Roster: 987654321;10.0.1.200:1863
X-MMS-IM-Format: FN=MS%20Sans%20Serif; EF=; CO=0; CS=0; PF=0

This is a text/plain; charset=UTF-8 message.

# text/html

Not sent by the Official Client.

HTML markup. Decoded with your system's codepage.

MIME-Version: 1.0
Content-Type: text/html

(If you know what gets this to render in the client, please let me know.)

# text/html; charset=UTF-8

Not sent by the Official Client.

HTML markup. Always decodes using the UTF-8 format.

MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8

(If you know what gets this to render in the client, please let me know.)

# text/x-msmsgscontrol

A control message.

Usually contains the TypingUser header, which has the user handle of the person writing a message.
Otherwise, may contain the RecordingUser header with the user handle of the person recording a voice message.

MIME-Version: 1.0
Content-Type: text/x-msmsgscontrol
TypingUser: example@hotmail.com

# image/gif

GIF (Graphics Interchange Format).
Used for handwritten messages when a client announces support for such, but not for ISF.

Content is base64 encoded.

Expected to be chunked.

MIME-Version: 1.0
Content-Type: image/gif

base64:...

# application/x-ms-ink

ISF (Ink Serialized Format).
Used for handwritten messages when a client announces support for it.

Content is base64 encoded.

Expected to be chunked.

MIME-Version: 1.0
Content-Type: application/x-ms-ink

base64:...

# text/x-msmsgssystemmessage

A system notification that tells the client something based on the body's Type.

This type is not parsed when sent over Switchboard.

This type has six headers inside it's body:

MIME-Version: 1.0
Content-Type: text/x-msmsgssystemmessage

Message-Number: 1
Minutes-To-Shutdown: 5
Type: 1
Arg1: 5

# text/x-msmsgssystemmessage; charset=UTF-8

Same function as text/x-msmsgssystemmessage.

This type is not parsed when sent over Switchboard.

So far there is no reason to specify a UTF-8 formatted system message, as there are no formatted strings being used.

MIME-Version: 1.0
Content-Type: text/x-msmsgssystemmessage; charset=UTF-8

Type: 1
Arg1: 5

# application/x-msmsgssystemmessage

Same function as text/x-msmsgssystemmessage.

This type is not parsed when sent over Switchboard.

MIME-Version: 1.0
Content-Type: application/x-msmsgssystemmessage

Type: 1
Arg1: 5

# text/x-msmsgsprofile

The user's profile. Sent after log in from the Notification Server.

Text-based fields are decoded with your system's codepage.

This type is not parsed when sent over Switchboard.

This type supports at most twenty five headers:

MIME-Version: 1.0
Content-Type: text/x-msmsgsprofile
LoginTime: 1780900587
EmailEnabled: 1
MemberIdHigh: 1
MemberIdLow: 2
lang_preference: 1033
PreferredEmail: example@hotmail.com
country: US
PostalCode: 
Gender: 
Kid: 0
Age: 
BDayPre: 
Birthday: 
Wallet: 
Flags: 1027
sid: 507
kv: 11
MSPAuth: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA$$
ClientIP: 192.168.1.111
ClientPort: 18183
ABCHMigrated: 1
Nickname: example user
RouteInfo: msnp://10.0.0.5/00000000
BetaInvites: 5
MPOPEnabled: 1

# text/x-msmsgsprofile; charset=UTF-8

Same function as text/x-msmsgsprofile.

Text-based fields are decoded with UTF-8.

This type is not parsed when sent over Switchboard.

MIME-Version: 1.0
Content-Type: text/x-msmsgsprofile; charset=UTF-8
LoginTime: 1780900587
EmailEnabled: 1
MemberIdHigh: 1
MemberIdLow: 2
lang_preference: 1033
PreferredEmail: example@hotmail.com
country: US
PostalCode: 
Gender: 
Kid: 0
Age: 
BDayPre: 
Birthday: 
Wallet: 
Flags: 1027
sid: 507
kv: 11
MSPAuth: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA$$
ClientIP: 192.168.1.111
ClientPort: 18183
ABCHMigrated: 1
Nickname: example user
RouteInfo: msnp://10.0.0.5/00000000
BetaInvites: 5
MPOPEnabled: 1

# text/x-msmsgsemailnotification

An e-mail notification.

Text-based fields are decoded with your system's codepage.

This type is not parsed when sent over Switchboard.

This type supports some headers:

MIME-Version: 1.0
Content-Type: text/x-msmsgsemailnotification

From: Example User
Message-URL: /cgi-bin/getmsg?msg=MSG1728932553.00&start=1&len=12&curmbox=ACTIVE
Post-URL: https://loginnet.passport.com/ppsecure/md5auth.srf?lc=1033
Subject: Just saying hello.
Dest-Folder: ACTIVE
From-Addr: example@hotmail.com
id: 2

# text/x-msmsgsemailnotification; charset=UTF-8

Same function as text/x-msmsgsemailnotification.

Text-based fields are decoded with UTF-8.

This type is not parsed when sent over Switchboard.

MIME-Version: 1.0
Content-Type: text/x-msmsgsemailnotification; charset=UTF-8

From: Example User
Message-URL: /cgi-bin/getmsg?msg=MSG1728932553.00&start=1&len=12&curmbox=ACTIVE
Post-URL: https://loginnet.passport.com/ppsecure/md5auth.srf?lc=1033
Subject: =?"us-ascii"?Q?Just saying hello.?=
Dest-Folder: ACTIVE
From-Addr: example@hotmail.com
id: 2

# application/x-msmsgsemailnotification

Used as both text/x-msmsgsemailnotification. and text/x-msmsgsinitialemailnotification in MSNP2.

Only the id header is not supported.

Text-based fields are decoded with your system's codepage.

This type is not parsed when sent over Switchboard.

MIME-Version: 1.0
Content-Type: application/x-msmsgsemailnotification; charset=UTF-8

From: Example User
Message-URL: /cgi-bin/getmsg?msg=MSG1728932553.00&start=1&len=12&curmbox=ACTIVE
Post-URL: https://loginnet.passport.com/ppsecure/md5auth.srf?lc=1033
Subject: =?"us-ascii"?Q?Just saying hello.?=
Dest-Folder: ACTIVE
From-Addr: example@hotmail.com

# text/x-msmsgsinitialemailnotification

The initial e-mail service configuration data.

Text-based fields are decoded with your system's codepage.

This type is not parsed when sent over Switchboard.

MIME-Version: 1.0
Content-Type: text/x-msmsgsinitialemailnotification

Inbox-Unread: 1
Folders-Unread: 0
Inbox-URL: /cgi-bin/HoTMaiL
Folders-URL: /cgi-bin/folders
Post-URL: http://www.hotmail.com

# text/x-msmsgsinitialemailnotification; charset=UTF-8

Same function as text/x-msmsgsinitialemailnotification.

Text-based fields are decoded with UTF-8.

This type is not parsed when sent over Switchboard.

MIME-Version: 1.0
Content-Type: text/x-msmsgsinitialemailnotification; charset=UTF-8

Inbox-Unread: 1
Folders-Unread: 0
Inbox-URL: /cgi-bin/HoTMaiL
Folders-URL: /cgi-bin/folders
Post-URL: http://www.hotmail.com

# text/x-msmsgsactivemailnotification

Used when moving messages around in your e-mail inbox, or when a message is read if the source and destination are the same.

Text-based fields are decoded with the system's codepage.

This type is not parsed when sent over Switchboard.

This type has three headers in it's body:

MIME-Version: 1.0
Content-Type: text/x-msmsgsactivemailnotification

Src-Folder: trAsH
Dest-Folder: .!!trAsH
Message-Delta: 1

# text/x-msmsgsactivemailnotification; charset=UTF-8

Same function as text/x-msmsgsactivemailnotification.

Text-based fields are decoded with UTF-8.

This type is not parsed when sent over Switchboard.

MIME-Version: 1.0
Content-Type: text/x-msmsgsactivemailnotification; charset=UTF-8

Src-Folder: trAsH
Dest-Folder: .!!trAsH
Message-Delta: 1

# text/x-msmsgsinvite; charset=UTF-8

An application invite.

Text-based fields are decoded with UTF-8.

This type can have many headers in it's body:

The invitation proceedure goes as such:

  1. Inviter sends INVITE.
  2. Target sends ACCEPT which asks for inviter's IP.
  3. Inviter sends ACCEPT with their IP (of the current network interface), port, other parameters if necessary.
  4. Target connects to inviter, or sends a CANCEL.

If NAT detection is enabled and is triggered, the proceedure is changed:

  1. Inviter sends INVITE which asks for target's IP.
  2. Target sends ACCEPT with their IP (from the profile), port and other parameters if necessary.
  3. Inviter connects to target, or sends a CANCEL.

If the target does not support the Connectivity header, it will fall back to the standard proceedure from step 3 onward, and the inviter will have to send their own IP (likely from the profile?) and port.

For more information on the file transfer protocol used, learn more about MSNFTP.

MIME-Version: 1.0
Content-Type: text/x-msmsgsinvite; charset=UTF-8

Application-Name: NetMeeting
Application-GUID: {44BBA842-CC51-11CF-AAFA-00AA00B6015C}
Session-Protocol: SM1
Application-URL: http://microsoft.com
Invitation-Command: INVITE
Invitation-Cookie: 11223344
Session-ID: {44BFD5A4-7450-4BDA-BA3A-C51B3031126D}

# text/x-mms-emoticon

Used for custom emoticon descriptors.

Format is tab deliminated:

  1. The text to replace with the emoticon.
  2. The <msnobj> object descriptor. You have to initiate the download for the object if it is unavaliable.
  3. Terminator, if there are more emoticons to send, concatenate all descriptors and send as one message.

NOTE: The XML <msnobj> has been exploded for visibility. Formatting <msnobj>s are undefined behaviour.

MIME-Version: 1.0
Content-Type: text/x-mms-emoticon

(?)	<msnobj
	Creator="example@hotmail.com"
	Size="889"
	Type="2"
	Location="example.png"
	Friendly="AAA="
	SHA1D="L/Q/zm2QjISFKvv2HBmxLr9lox8="
	SHA1C="MA0ktY4VStXZ0amX5uQyosUTOak="
/>

# text/x-mms-animemoticon

Same format as text/x-mms-emoticon, but for animated emoticons.

NOTE: The XML <msnobj> has been exploded for visibility. Formatting <msnobj>s are undefined behaviour.

MIME-Version: 1.0
Content-Type: text/x-mms-emoticon

bones1 <msnobj
	Creator="example@hotmail.com"
	Size="136540"
	Type="2"
	Location="skeleton.gif"
	Friendly="AAA="
	SHA1D="vL+zg1YhmXGgk1gbIPcA44bHai0="
	SHA1C="lFsgLlLe4IkpU8L//0IjRr0Wo60="
/>

# text/search-query

Sent when a client wants to perform a shared search.

MIME-Version: 1.0
Content-Type: text/search-query

This is a search query.

# text/x-msnmsgr-datacast

Sent for various types of data with no explict type.

What's sent depends on the ID header sent in the body:

MIME-Version: 1.0
Content-Type: text/x-msnmsgr-datacast

ID: 1

# application/x-msnmsgrp2p

Peer to peer session context data.

Always has the header P2P-Dest, which is the user handle of the receiving user.

Since MSNP16, there is also the P2P-Src header, which is the user handle of the sending user.

Peer to peer version 1 messages use this format:

00 00 00 00 11 11 11 11 22 22 22 22 22 22 22 22
33 33 33 33 33 33 33 33 44 44 44 44 55 55 55 55
66 66 66 66 77 77 77 77 88 88 88 88 88 88 88 88

Where (values in little endian):

The peer to peer message always ends with a 32-bit value (values in little endian):

The Official Client will chunk messages every 1202 bytes.
You may chunk any size below the maximum size of bytes by setting the relevant values in the header, and 1202 bytes is the maximum size.

NOTE: The binary header and footer has been represented as hexadecimal.

MIME-Version: 1.0
Content-Type: application/x-msnmsgrp2p
P2P-Dest: example@hotmail.com
00 00 00 00 12 34 56 78 00 00 00 00 00 00 00 00
a5 04 00 00 00 00 00 00 a5 04 00 00 00 00 00 00
9a bc de f0 00 00 00 00 00 00 00 00 00 00 00 00
(actual body)
00 00 00 00

# MSNSLP bodies

These messages resemble those of the Session Initialization Protocol.

As an invitation, it will start with INVITE MSNMSGR:user-handle MSNSLP/1.0:

Where user-handle is the user handle.

As a response, it will start with MSNSLP/1.0 status-code status-message:

Where status-code and status-message are:

As a termination, it will start with BYE MSNMSGR:user-handle MSNSLP/1.0:

Where user-handle is the user handle.

Any of these messages contains the following eight headers:

NOTE: The terminating null byte has been transcribed as [0x00], and the Context has been split across multiple lines.

INVITE MSNMSGR:anotheruser@hotmail.com MSNSLP/1.0
To: <msnmsgr:anotheruser@hotmail.com>
From: <msnmsgr:example@hotmail.com>
Via: MSNSLP/1.0/TLP ;branch={1C741604-1F35-446E-A50C-A97345A10452}
CSeq: 0 
Call-ID: {2F22F5DD-3EFC-4576-8634-FAD287B8D733}
Max-Forwards: 0
Content-Type: application/x-msnmsgr-sessionreqbody
Content-Length: 327

EUF-GUID: {A4268EEC-FEC5-49E5-95C3-F126696BDBF6}
SessionID: 12345678
AppID: 1
Context: PG1zbm9iaiBDcmVhdG9yPSJleGFtcGxlQGhvdG1haWwuY29tIiBTaXplPSI4ODki
IFR5cGU9IjIiIExvY2F0aW9uPSJleGFtcGxlLnBuZyIgRnJpZW5kbHk9IkFBQT0iIFNIQTFEP
SJML1Evem0yUWpJU0ZLdnYySEJteExyOWxveDg9IiBTSEExQz0iTUEwa3RZNFZTdFhaMGFtWD
V1UXlvc1VUT2FrPSIvPgA=

[0x00]

NOTE: The terminating null byte has been transcribed as [0x00].

MSNSLP/1.0 200 OK
To: <msnmsgr:example@hotmail.com>
From: <msnmsgr:anotheruser@hotmail.com>
Via: MSNSLP/1.0/TLP ;branch={1C741604-1F35-446E-A50C-A97345A10452}
CSeq: 1 
Call-ID: {2F22F5DD-3EFC-4576-8634-FAD287B8D733}
Max-Forwards: 0
Content-Type: application/x-msnmsgr-sessionreqbody
Content-Length: 25

SessionID: 12345678

[0x00]

NOTE: As the body of this type is all special characters, the entire body has been transcribed as hexadecimal.

BYE MSNMSGR:anotheruser@hotmail.com MSNSLP/1.0
To: <msnmsgr:anotheruser@hotmail.com>
From: <msnmsgr:example@hotmail.com>
Via: MSNSLP/1.0/TLP ;branch={9B973CE6-BCA7-4D46-A995-C684E6CB7776}
CSeq: 0 
Call-ID: {95E7E9D3-BA3B-46D7-80FD-BB03C9FAB349}
Max-Forwards: 0
Content-Type: application/x-msnmsgr-sessionclosebody
Content-Length: 3

0d 0a 00

# application/x-msnmsgr-sessionreqbody

A session request.

This type has up to four headers:

NOTE: The Context has been split across multiple lines.

EUF-GUID: {A4268EEC-FEC5-49E5-95C3-F126696BDBF6}
SessionID: 12345678
AppID: 1
Context: PG1zbm9iaiBDcmVhdG9yPSJleGFtcGxlQGhvdG1haWwuY29tIiBTaXplPSI4ODki
IFR5cGU9IjIiIExvY2F0aW9uPSJleGFtcGxlLnBuZyIgRnJpZW5kbHk9IkFBQT0iIFNIQTFEP
SJML1Evem0yUWpJU0ZLdnYySEJteExyOWxveDg9IiBTSEExQz0iTUEwa3RZNFZTdFhaMGFtWD
V1UXlvc1VUT2FrPSIvPgA=

# application/x-msnmsgr-sessionclosebody

An end of session notification. Always comes from a BYE message.

NOTE: As the body of this type is all special characters, the entire body has been transcribed as hexadecimal.

0d 0a 00

# application/x-msnmsgr-transreqbody

A transfer request.

This body has nine headers:

Bridges: TRUDPv1 TCPv1
NetID: 0
Conn-Type:
UPnPNat: false
ICF: true
IPv6-global: 1111:2222:3333:4444:5555:6666:7777:8888
Hashed-Nonce: {6DF18B56-8FD1-3716-E9B9-A8F396E01250}

# application/x-msnmsgr-transrespbody

A transfer response.

This body has many headers:

Bridge: TCPv1
Listening: true
Hashed-Nonce: {6DF18B56-8FD1-3716-E9B9-A8F396E01250}
IPv4External-Addrs: 11.22.33.44
IPv4External-Port: 5555
IPv4Internal-Addrs: 192.168.1.111
IPv4Internal-Port: 5555
IPv6-Addrs: 1111:2222:3333:4444:5555:6666:7777:8888
IPv6-Port: 5559

# application/x-msnmsgr-transdestaddrupdate

A transfer destination address update.

This body has three headers:

IPv4ExternalAddrsAndPorts: 11.22.33.44:5555
IPv4InternalAddrsAndPorts: 192.168.1.111:5556
IPv4External-Connecting-Port-End-Range: 5558

# application/x-msnmsgr-transudpswitch

A transfer UDP switch.

This body has three headers:

IPv6AddrsAndPorts: 1111:2222:3333:4444:5555:6666:7777:8888#5556
IPv4ExternalAddrsAndPorts: 11.22.33.44:5555
IPv4InternalAddrsAndPorts: 192.168.1.111:5555

# other P2P bodies

TODO: Write any of these. Highly volatile to parameters.

These three headers show up on many bodies when SChannel is usable:

# Various other headers

A list of various other headers, which may be valid for multiple types.

# Chunking

If the feature is enabled, you may get messages with the following headers:

MIME-Version: 1.0
Content-Type: image/gif
Message-ID: {DEE6A95E-1BAE-4123-807E-E49DC41F9957}
Chunks: 2

base64:...

MIME-Version: 1.0
Content-Type: image/gif
Message-ID: {DEE6A95E-1BAE-4123-807E-E49DC41F9957}
Chunk: 1

...

# Special headers

If the message was sent by an action not done by the user, any one of these headers may be set: