MSN Explorer 9

The client thinks Microsoft is still there

What the binaries say

Things that were written down nowhere

These formats did not come from documentation - there is none left. They came out of the disassembly of msnsign.dll and out of captures against a working rebuild. They are the reason this runs at all.

The sign-in response

The parser checks an attribute on the root element, not a child element. The ticket sits inside <User>. And the redirect target needs a query string, because the client appends &home=… to it.

<?xml version="1.0" encoding="utf-8"?>
<LoginResponse Success="true">
  <User>
    <TNP>t=…*1&amp;p=…</TNP>
  </User>
  <Redirect>https://…/dummy.htm?ru=1</Redirect>
</LoginResponse>

The Directory Access envelope

The root element is called Return, not root. root is the envelope of the request. Confirmed against an endpoint that still answers today.

<Return><Result>SUCCEEDED</Result> … </Return>

<Return><Result>FAILED</Result><Errors><Error>
  <Code>217</Code><ErrNumber>901</ErrNumber>
</Error></Errors></Return>

The member list

The sign-in name is in PMN, not in Member - you can see it in the XPath Member[PMN $ieq$ "…"] inside the DLL. The roles it knows are SubscriptionViewer, SubscriptionAdmin and BillableAccountAdmin.

<Members><Member>
  <PMN>name@msn.com</PMN>
  <PUIDHigh>…</PUIDHigh><PUIDLow>…</PUIDLow>
  <Role>BillableAccountAdmin</Role>
</Member></Members>

The Nexus is still being published

The configuration file at nexus.passport.com/client/client.xml is still produced and served by Microsoft's build system - you can tell from the embedded build stamp, with timestamp, build server and environment prod. Sign-in there is dead. The configuration is alive.

---

More detail, and the working notes behind all of this, are in the wiki.