blob: 08db802acd66372b7c9522dabdad4e589f9989ee (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
|
# Tencent QQ Protocol - Chinese instant messenger protocol - http://www.qq.com
# Pattern attributes: good notsofast fast
# Protocol groups: chat
# Wiki: http://www.protocolinfo.org/wiki/QQ
# Copyright (C) 2008 Matthew Strait, Ethan Sommer; See ../LICENSE
#
# Over six million people use QQ in China, according to wsgtrsys.
#
# This pattern has been tested and is believed to work well.
#
# QQ uses three (two?) methods to connect to server(s?).
# one is udp, and another is tcp
# udp protocol: the first byte is 02 and last byte is 03
# tcp protocol: the second byte is 02 and last byte is 03
# tony on protocolinfo.org says that now the *third* byte is 02:
# "but when I tested on my PC, I found that when qq2007/qq2008
# use tcp protocol, the third byte instead of the second is always 02.
#
# So the QQ protocol changed again, or I have made a mistake, I wonder
# that."
# So now the pattern allows any of the first three bytes to be 02. Delete
# one of the ".?" to restore to the old behaviour.
# pattern written by www.routerclub.com wsgtrsys
qq
^.?.?\x02.+\x03$
|
