I don't know if this belongs in this forum or not. I read the rules, and it seems to be within them, but I don't know. If it doesn't, please move it.

I've been working on reversing part of the World of WarCraft protocol, and I've gotten some decent progress on the first few packets, including the realmlist. What I'm not sure about is the packet header, and what parts it means.

00 02 28 00

I asume that the first 00 means nothing, and is simply a 'sanity' byte, like the FF in Battle.net packets. The 02, I asume, is the packet ID, but I don't really have any evidence of that. 28 00, reversed and converted from WORD to decimal, is 40, the length of this packet minus four (the header length?) This leads me to asume the header goes something like this:
[code](BYTE) Sanity (Always 0x00)
(BYTE) Packet ID
(WORD) Packet Length (Minus header length, and reversed).[/code]

The packet assembling routine would go something like this, asuming thats correct:
[code]Public Sub Push(PacketID as Byte) '// I push my packets first, then Flush() them when I've pushed all that need to be sent.
  Let Buffer2 = Buffer2 & vbNullChar & Chr(PacketID) & strReverse(MakeWORD(Len(Buffer))) & Buffer1
  Let Buffer1 = vbNullString
End Sub[/code]

Does anybody have any information to add to this, or to correct me on?

First byte is like an id, second one is like an error code, and if any data follows that then it depends on both bytes.  For some messages it'll be two more bytes following which include a length of the message, then the message specific data.  This is what I remember from what I've observed in the logon stuff, not anything actually in-game