MSN Explorer

A client without a server is just a window

MSN Explorer was Microsoft's own internet access: browser, e-mail, Messenger and portal in one. The servers behind it have been switched off. Since then the client starts, calls home – and gets no answer.

Puppenspieler gives the answers. It speaks Passport 1.4 and Directory Access and delivers configuration, sign-in, permissions, wizard pages and installation files. The client doesn't notice. It dances because someone is holding the strings.

From installer to sign-in

The complete flow in one run: the wizard starts, downloads the packages, sets up the account – and MSN Explorer signs in. Recorded on a Windows XP VM against the server described here. Uncut.

Download the video (MP4)
Download the emulator (ZIP)

The chain: four steps, each depends on the one before

If one fails, the client stops – usually without saying why.

1. Directory – The client asks the Nexus where to go. The answer is stored in the registry and stays valid until it is deleted.
2. Sign-in – clientpost.srf takes address and password. The response carries success, ticket and the target the client jumps to next.
3. Permissions – Which services the account may use. Without a matching identifier the client considers itself not activated.
4. Installation – The wizard fetches package descriptions and program files, creates the account locally and starts MSN Explorer.

From the binaries: what was never written down

These formats don't come from documentation – there is none left – but from disassembling msnsign.dll and from captures of a working rebuild. They are the real reason it works now.

The sign-in response

The parser checks an attribute on the root element, not a child element. The ticket sits inside <User>. And the redirect target needs a query string, because the client appends &home=….

<?xml version="1.0" encoding="utf-8"?>
<LoginResponse Success="true">
  <User>
    <TNP>t=…*1&amp;p=…</TNP>
  </User>
  <Redirect>https://…/dummy.htm?ru=1</Redirect>
</LoginResponse>

The Directory Access envelope

The root element is called Return, not root. root is the envelope of the request. Confirmed against an endpoint that still answers today.

<Return><Result>SUCCEEDED</Result> … </Return>
<Return><Result>FAILED</Result><Errors><Error>
  <Code>217</Code><ErrNumber>901</ErrNumber>
</Error></Errors></Return>

The member list

The sign-in name is in PMN, not in Member – visible from the XPath Member[PMN $ieq$ "…"] in the DLL. Known roles are SubscriptionViewer, SubscriptionAdmin and BillableAccountAdmin.

<Members><Member>
  <PMN>name@msn.com</PMN>
  <PUIDHigh>…</PUIDHigh><PUIDLow>…</PUIDLow>
  <Role>BillableAccountAdmin</Role>
</Member></Members>

The Nexus still delivers

The configuration file at nexus.passport.com/client/client.xml is still generated and served by Microsoft's build system – provable by the embedded build stamp with timestamp, build server and environment prod. Sign-in there is dead; the configuration lives on.

Status: what works

Directory client.xml	working
Sign-in clientpost.srf	working
Profile ClientProfileRequest.srf	working
Permissions getpermits.asp	working
Members enumerate.asp	working
Wizard getxgl.asp	working
Product data msninstallersvc.asmx	working
Program files /downloads/	working
Messenger gateway.dll	not yet
Groups · mailbox data	not yet

Installation and sign-in run all the way through: create account, download packages, install, launch, sign in.

Setup: what you need

Client	MSN Explorer 9, German edition
System	Windows XP in a VM
Server	IIS with ASP.NET 4
Network	hosts redirect of the MSN names, own root certificate

The package contains the emulator, the wizard packages, scripts for certificate and registry, and a guide. A word of warning: the client checks the certificate and insists on HTTPS – without the imported root certificate no connection is made.

Download the emulator

Why: files alone are only half the software

The behaviour of a networked program lives half in the client and half in the protocol. Whoever keeps only the installation files has kept one half – the less interesting one. Only when the server answers again can you see how the thing really worked.