C>S 0xDE SID_UNKNOWN_DE
|Transport Layer:||Transmission Control Protocol (TCP)|
|Application Layer:||Battle.net v1 TCP Messages (SID)|
|Direction:||Client to Server|
|Used By:||Diablo II, Diablo II Lord of Destruction|
(does not include protocol header)
This message is sent by Diablo II in response to ExtraWork and is thought to be part of cheat detection. This message is largely undocumented and more research is needed.
ExtraWork is sent during the first login since the client has been opened and periodically every few minutes thereafter.
When ExtraWork is downloaded, stageb.dll is executed and runs stagec.dll's ExtraWork which produces the result data to send in this message. The ExtraWork function appears to read volatile memory from Diablo II. The message format is an educated guess but could be completely inaccurate.
Packet dump provided by Dzik: https://pastebin.com/RHqqujBJ
Nishimura_Katsuo created a basic visualizer for this message in research, available here and can take any pastebin link: https://www.nishicode.com/DEpackets/?pb=RHqqujBJ
Unknowns 4, 7, and 8 appear to be sequence numbers, since they only ever increase over time.