

Message Id: | 0xDE |
---|---|
Message Name: | SID_UNKNOWN_DE |
Direction: | Client to Server |
Flags: | In Research |
Used By: | Diablo II, Diablo II Lord of Destruction |
Format: |
|
This message is sent by Diablo II in response to ExtraWork and is thought to be part of cheat detection. This message is largely undocumented and more research is needed.
ExtraWork is sent during the first login since the client has been opened and periodically every few minutes thereafter.
When ExtraWork is downloaded, stageb.dll is executed and runs stagec.dll's ExtraWork which produces the result data to send in this message. The ExtraWork function appears to read volatile memory from Diablo II. The message format is an educated guess but could be completely inaccurate.
Packet dump provided by Dzik: https://pastebin.com/RHqqujBJ
Nishimura_Katsuo created a basic visualizer for this message in research, available here and can take any pastebin link: https://www.nishicode.com/DEpackets/?pb=RHqqujBJ
Unknowns 4, 7, and 8 appear to be sequence numbers, since they only ever increase over time.