Structure

The Endless Online packet stream consists of a two byte length followed by possibly encoded data:

(Length:2) (Data:''n'') where ''n'' is the number specified by Length.

The same format is followed for both client-to-server and server-to-client communication.

The first two bytes of the (unencrypted) data are are the packet action and packet family. The remaining data is packet dependent. See Packet_List for a list of packet IDs.

(PacketAction:1) (PacketFamily:1) (Data:''n'') where ''n'' is the length, minus 2.

There is commonly a third byte included with packets sent client-to-server which is an additional security mechanism. This is discussed in the Encryption section.

Number Encoding

Numbers are not sent in plain Two's compliment, as the stream is binary safe (contains no zero bytes) and consequently they have a slightly smaller range of possible values they can represent. See [EncodeNumber] for an algorithm to encode/decode numbers.

Encryption

Communication between the Endless Online client and server is very lightly encrypted and fairly easy to encode/decode. It is a stateful process and not all packets are encoded.

There are three stages: Flipping, interleaving and "dickwinding". These only apply to the actual packet data (including the ID) and ''not'' the length bytes. For most client-to-server packets there is also a byte inserted immediately following the packet ID which we will refer to as the "counter".