Example (xor decoding already applied), start of game server interaction. Legend: < - packet from client to server. > - packet from server to client. XXX: - packet size. Code: 1) < 265: 0e 3f 03 00 00 09 ...... 2) > 23: 2e 01 fd 14 41 f3 8f b2 96 f6 01 00 00 00 01 00 00 00 00 4a aa 61 1a 3) < 41: 5d 6d 00 61 00 72 00 32 00 33 00 75 00 6e 00 69 00 78 00 00 00 4c 43 0f 00 a4 13 00 00 4c 43 0f 00 7c 51 68 4f 01 00 00 00 4) > 311: 09 01 00 00 00 07 00 00 00 00 66......... 5) < 19: 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6) > 3: 73 00 01 7) > 223: 0b 66 00 67 00 73 00 68 0........ 8) < 3: 03 4d 00 9) < 3: 03 06 00 10) > 163: fe 22 00 09 00 00 00 01 00 ....... 11) < 105: 58 23 92 90 4d 18 30 b5 7c ....... Here you can see (by line): 1) As it was in CT1 - ProtocolVersion packet, with protocol version 831. 2) KeyPacket from server, new token - 4a aa 61 1a, at end of this packet. 3) There should be AuthLogin, but it has different packet code. 5) CharSelected packet - code was not changed (tested by many passes). 8, 9) ExPacket - codes are different again. But after relogin the traffic is changed somehow: Code: < 265: 0e 3f 03 00 00 09 ..... > 23: 2e 01 9d 26 15 9b 0e d0 21 f5 01 00 00 00 01 00 00 00 00 93 5b 62 59 < 43: 7b 6c 00 6f 00 6c 00 6a 00 6f 00 69 00 6e 00 65 00 72 00 39 00 00 00 84 54 0f 00 a6 1e 00 00 84 54 0f 00 bc 27 bd 03 01 00 00 00 > 311: 09 01 00 00 00 07 00 00 0.... < 19: 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 3: 73 00 01 > 221: 0b 62 00 75 00 62 00 75 00 ..... < 3: 42 1b 00 < 3: 42 30 00 < 105: 72 23 92 90 4d 18 30 b5 7c 96 ..... > 163: fe 22 00 09 00 00 00 01 00 00 00 67 ..... As you can see packet codes from client were changed.