Investigate unknown and/or unobserved client/launcher window messages

[alexrp]

Tl.exe -> launcher.exe:

• 0 (csPopup() and promoPopup(%d) only; gameEvent(%d) and endPopup(%d) are understood)
• 4 (ticket; not observed; unclear how it relates to 8)
• 5 (last_svr; not observed)
• 6 (char_cnt; not observed)
• 7 (not observed)
• 8 (ticket; not observed; unclear how it relates to 4)
• 10 (getWebLinkUrl(%d,%s))

(Note that launcher.exe only ever replies to Tl.exe with the same message ID it received; it does not send its own messages.)

TERA.exe -> Tl.exe:

• 24
• 25 (potentially related to opening a Web browser; not observed)
• 26 (some kind of binary data; includes the data sent to launcher.exe as getWebLinkUrl(%d,%s) with ID 10)
• 1000 (some kind of binary data; includes the Windows user name)
• 100x and 101x (usually empty; forwarded to launcher.exe as gameEvent(%d) with ID 0)
  • 1001, 1002, 1003, 1004, 1011, and 1012 (observed)
  • 1005, 1006, 1007, 1008, 1009, 1010, 1013, and 1016 (not observed)
• 1020 (sent on normal exit; binary data including the exit reason sent to launcher.exe as endPopup(%d) with ID 0)
• 1021 (sent if the client crashes; string with exception details)
• 1022 (seems to mean "XIGNCODE3 starting"; not observed)
• 1023 (seems to mean "XIGNCODE3 started"; not observed)
• 1024 (seems to mean "XIGNCODE3 failed to start"; includes the value of GetLastError in the high bits of a 64-bit integer; not observed)
• 1025 (seems to mean "please open the customer support website"; not observed)
• 1027 (seems related to cash shop purchases; not observed)

(Tl.exe only ever acts on request messages received by TERA.exe. In response to those, it may send messages to launcher.exe to retrieve data. The reply messages sent back to TERA.exe will have a different message ID than the request message ID.)

Tl.exe -> TERA.exe:

• 27 (sent in response to message 26)

[alexrp]

TL;DR for launcher.exe <-> Tl.exe communication is:

• All event notifications are always sent with ID 0. The handshake is always sent with ID 0x0dbadb0a.
  • Event notifications are csPopup(), endPopup(%d), gameEvent(%d), and promoPopup(%d).
  • All other messages are sent with an ID that increments on every sent message.
  • So, launcher.exe has to parse the contents of the message if the ID is not one of those two. Looking at the ID is not enough.
• The response for slsurl is just the URL to fetch the server list from.
• launcher.exe can send the exact same JSON response for gamestr, ticket, last_svr, and char_cnt as long as it includes all needed information.
• Worth noting that messages with ID 0 do not come with a NUL terminator. The same is weirdly true for getWebLinkUrl(%d,%s). All other messages do come with one. Responses must always have one.

[alexrp]

Game events are, roughly, as follows:

1001 = requesting server list
1002 = received server list
1003 = entering lobby
1004 = entered lobby
1005 = entering character creation
1006 = leaving lobby
1007 = deleted character
1008 = canceling character creation
1009 = entered character creation
1010 = created character
1011 = entered world
1012 = finished loading screen
1013 = leaving world
1014 = mounted pegasus
1015 = dismounted pegasus
1016 = changed channel

[alexrp]

Message ID 26 from TERA.exe to Tl.exe is just a binary form of getWebLinkUrl(%d,%s). The %d value is written in binary form and the rest of the content is a UTF-16 string representing %s, with lots of NULs terminating it.

Message ID 27 from Tl.exe to TERA.exe contains two integers in binary form. The first is the %d value from earlier. Not sure about the second.

[alexrp]

Message ID 1020 from TERA.exe has three 32-bit values. The first is the payload length, the second is what will become the process exit code, and the third is the value that gets sent from Tl.exe as endPopup(%d). These values also seem to correspond directly to what gets sent in S_EXIT.

[alexrp]

Values found in TERA.exe for message ID 25:

4
7
15
500

There are almost certainly more.

[alexrp]

Message ID 1024 contains the value (ulong)GetLastError() << 32 and indicates failure to start XIGNCODE3.

[alexrp]

Message ID 1000 contains the SrcRegVer from ReleaseRevision.txt, an unknown value (zero), and the Windows user name.

Message ID 25 tells the launcher to open a well-known URL, with the value in the payload indicating which.