SID_LOGONRESPONSE2
| Protocol | BNCS |
|---|---|
| Directions | Client → Server and Server → Client |
| Used by |    
|
Logs on to an account with a salted X-SHA-1 password proof.
Client → Server
After SID_AUTH_CHECK passes.
| Type | Field | Notes | Confidence |
|---|---|---|---|
UINT32 |
Client token | The same client token sent in SID_AUTH_CHECK. |
✅ Verified |
UINT32 |
Server token | The token from the server's SID_AUTH_INFO. |
✅ Verified |
VOID |
Password proof (20 bytes) | X-SHA-1 of: client token, server token, then X-SHA-1 of the lowercase password. | ✅ Verified |
STRING |
Account name | ✅ Verified |
Server → Client
| Type | Field | Notes | Confidence |
|---|---|---|---|
UINT32 |
Status | See the table below. | ✅ Verified |
STRING |
Reason | Only sent with status 0x06. |
⚠️ Single source |
Status
| Value | Meaning | Confidence |
|---|---|---|
0x00 | Logged on. | ✅ Verified |
0x01 | No such account. The client offers to create it. | ✅ Verified |
0x02 | Wrong password. | ✅ Verified |
0x03 | Account data is damaged. Diablo II only. | ⚠️ Single source |
0x06 | Account closed. A reason string follows. | ⚠️ Single source |
Remarks
Checking the proof. The server stores X-SHA-1 of the lowercase password. To check a logon, it repeats the client's calculation using the server token it issued itself, never the token the client sends back. Using its own token is what stops an old proof from being replayed.
Worked example. With client token 0xDEADBEEF, server token 0x12345678 and the password password, the proof (as five little-endian words) is 7488ad2d 82dc91a2 8aa43a7c 8d596822 a2920091.
A client that gets a status it doesn't recognise shows a general error and disconnects.
Appears in
Sources and credits
- Command Center: bnetccd session handling
- Command Center: PROTOCOL-NOTES.md: X-SHA-1 test vectors
- BNETDocs, SID_LOGONRESPONSE2 (client to server): documented by the original BNETDocs contributors, and edited 2 times since.
- BNETDocs, SID_LOGONRESPONSE2 (server to client): documented by Kyro, and edited 7 times since.
This page is written in our own words. BNETDocs is credited for its research; none of its text is copied. See Credits.