FreeTDS Development Group

[Stephan February <essef AT mweb.co.za>]

Hi there

Here are some initial specs on the TDS 7.0 login packet as done by MS
SQL Server 7.0. The most interesting thing for me would have to be the
encoding of the password. It would seem like MS has decided to confound
would-be crackers by using a combination of Unicode and a 'scrambled'
ascii table to encode the login password.
The password is therefore encoded as a two-byte Unicode character, with
the first character corresponding to a lookup table translation as
specified below ( all numbers are in decimal):

<packet stuff>
Unicode character placeholder = 165

179 a
131 b
147 c
227 d
243 e
195 f
211 g 
35  h
51  i
3   j
19  k
99  l
115 m
67  n
83  o
162 p
178 q
130 r
146 s
226 t
242 u
194 v
210 w
34  x
50  y
2   z


177 A
129 B
145 C
225 D
241 E
193 F
209 G
33  H
49  I
1   J
17  K
97  L
113 M
65  N
81  O
160 P
176 Q
128 R
144 S
224 T
240 U
192 V
32  X
48  Y
0   Z



166 0
182 1 
134 2
150 3
230 4
246 5
198 6
214 7
38  8
54  9 

66  ~
183 !
161 @
151 #
231 $
247 %
64  ^
199 &
7   *
39  (
55  )

/*I'm not too sure about the following chars, need verification*/
163 `
119 -
118 
16  [
112 ]
23  + //?
32  } //?


/*generic offsets etc*/
114 login name start
50  login name length (login name is follows by pw immediately)
54  pw length
86  start of 'ODBC' - what would you call that? Driver type?
93  start of Application name

/*encoding of the packet header*/
byte 1 - 0x10 = login
         0x04 = response from server
         0x01 = query

byte 2 - last packet indicator?
         0x00 - more packets
         0x01 - all done

bytes 3+4 - size of packet
        - byte1 looks like it could be n*256 (where n is the value held
by this byte)
        - byte2 is probably offset from above value


</packet stuff>

for example, if your password is 'tux' , that would translate into
'226:165:242:165:34' minus the colons and each number encoded into a
consecutive byte.
Unfortunately there is no code to accompany this (I know, I suck). I
would of course welcome it if someone could validate the information on
their side, in which case I would be glad to supply you with the Linux
proxy program for logging the traffic to the SQL server.
The following is a dump of an actual login packet. 

SQL Server Name : ULRICH_NT
User Name : Stephan
Password  : password
Application Name : MS SQL Query Analyzer
ODBC Datasource Name : sadev_PROX

<login packet>
len is 242
0:16
1:1
2:0
3:242
4:0
5:0
6:1
7:0
8:234
9:0
10:0
11:0
12:0
13:0
14:0
15:112 p
16:0
17:0
18:0
19:0
20:0
21:0
22:0
23:6
24:99 c
25:177
26:250
27:255
28:0
29:0
30:0
31:0
32:224
33:3
34:0
35:0
36:136
37:255
38:255
39:255
40:54 6
41:4
42:0
43:0
44:86 V
45:0
46:0
47:0
48:86 V
49:0
50:7
51:0
52:100 d
53:0
54:8
55:0
56:116 t
57:0
58:21
59:0
60:158
61:0
62:10
63:0
64:0
65:0
66:0
67:0
68:178
69:0
70:4
71:0
72:186
73:0
74:0
75:0
76:186
77:0
78:0
79:0
80:0
81:64 @
82:51 3
83:154
84:107 k
85:80 P
86:186
87:0
88:48 0
89:0
90:234
91:0
92:0
93:0
94:115 s
95:0
96:116 t
97:0
98:101 e
99:0
100:112 p
101:0
102:104 h
103:0
104:97 a
105:0
106:110 n
107:0
108:162
109:165
110:179
111:165
112:146
113:165
114:146
115:165
116:210
117:165
118:83 S
119:165
120:130
121:165
122:227
123:165
124:77 M
125:0
126:83 S
127:0
128:32  
129:0
130:83 S
131:0
132:81 Q
133:0
134:76 L
135:0
136:32  
137:0
138:81 Q
139:0
140:117 u
141:0
142:101 e
143:0
144:114 r
145:0
146:121 y
147:0
148:32  
149:0
150:65 A
151:0
152:110 n
153:0
154:97 a
155:0
156:108 l
157:0
158:121 y
159:0
160:122 z
161:0
162:101 e
163:0
164:114 r
165:0
166:115 s
167:0
168:97 a
169:0
170:100 d
171:0
172:101 e
173:0
174:118 v
175:0
176:95 _
177:0
178:80 P
179:0
180:82 R
181:0
182:79 O
183:0
184:88 X
185:0
186:79 O
187:0
188:68 D
189:0
190:66 B
191:0
192:67 C
193:0
194:78 N
195:84 T
196:76 L
197:77 M
198:83 S
199:83 S
200:80 P
201:0
202:1
203:0
204:0
205:0
206:6
207:130
208:0
209:0
210:0
211:0
212:0
213:0
214:0
215:0
216:0
217:0
218:0
219:0
220:0
221:0
222:0
223:0
224:0
225:0
226:0
227:0
228:0
229:0
230:48 0
231:0
232:0
233:0
234:0
235:0
236:0
237:0
238:48 0
239:0
240:0
241:0
</login packet>

Rgrds
Stephan