Home/ Questions/Q 8453483
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-10T11:47:11+00:00

I’m trying to decode an AMF0 message with AMF3 included .. All is well

  • 0

I’m trying to decode an AMF0 message with AMF3 included .. All is well
except making sense of the U29 format and the way string are encoded
in AMF4

  channel=3  size=134  pkttype=0x11  time=1973

  00000: 00 02 00 14 73 65 6E 64  55 6E 69 76 65 72 73 61  6C 4D 65 73     ....sendUniversalMes
  00020: 73 61 67 65 00 00 00 00  00 00 00 00 00 05 02 00  11 6D 62 5F     sage.............mb_
  00040: 31 32 32 31 30 5F 37 35  39 32 33 33 38 30 05 00  40 58 C0 00     12210_75923380..@X..
  00060: 00 00 00 00 11 0A 0B 01  09 68 62 69 64 04 81 CF  5E 09 73 72     .........hbid...^.sr
  00080: 63 65 06 49 63 37 62 39  32 33 65 65 2D 30 61 30  38 2D 34 62     ce.Ic7b923ee-0a08-4b
  00100: 61 32 2D 38 65 37 63 2D  63 38 32 61 39 33 64 37  37 31 34 32     a2-8e7c-c82a93d77142
  00120: 09 68 62 64 6C 04 00 09  74 65 78 74 01 01                        .hbdl...text..

  first byte I skip 
  02 = string
  00 14 = length of string ( 20 characters , sendUniversalMessage )
  00 00 00 00 00 00 00 00 00 = number = 0
  05 = null
  02 = string
  00 11 = length of string ( 17 characters , mb_12210_75923380 )
  05 = null
  00 40 58 C0 00 00 00 00 00 = number = 99
  11 = AMV+

  here is where I have problems

  0A = AMF3 object 
  now I need to do a readU29 which starts with
  0B = what does this mean
  01 = what does this mean
  09 = what does this mean

  where is the length of the string 'hbid' ?
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    in U29, if the first byte is worth less than 128, it fits on the first byte. So you have to read this as 3 different u29s, worth 0B, 01, 09.

    0B: details about the type of object. It seems you’re not too interested in that byte and it’s complicated, so pass.

    01: The LSB is the bit that says that this isn’t a string reference. Then 01 >> 1 = 0 is the length of the class name. This means empty string, which means this is an anonymous (untyped) object.

    09: = 00001001. The LSB is also the bit that says this isn’t a string reference. Then 1001 >> 1 = 0100 = 4 is the string length.

    hope that helps

    • 0