The message reference.
Explore the messages behind SIGS login, rooms, and game handoff. A versioned reference for the Outpost 2 client and the SIGSWON implementation.
Documented, with room for discovery.
This is an incomplete, reverse-engineered reference for SIGS 3.0.3.0, based on the supplied Outpost 2 SierraNW and SNWValid DLLs, captured behavior, and project experiments. It is not an official Sierra specification. Message names and field labels are project descriptions.
A verified layout does not prove a field’s meaning, message direction, or successful live behavior. Candidate names, hypotheses, and experimental ordering remain provisional. Read each entry’s notes before implementing it.
Reference binary fingerprints
SHA-256 · SierraNW.dllf41ae063d7197eda7c012ef3c32810f62edcbd4d72f79a8ec1e5551cf77003c3
SHA-256 · SNWValid.dll863c8fe7d44a28ca9f955235fd92bc4d31f496caf980205a4fd07028fdeec550
Static addresses in message notes use image base 0x10000000. Other DLL builds may differ.
Wire format
TCP carries framed messages. A receiver must buffer partial frames and handle multiple frames in a single read.
TCP envelope
| Offset | Size | Meaning |
|---|---|---|
| 0 | 4 bytes | Outer length, unsigned big-endian |
| 4 | 4 bytes | Inner length, unsigned big-endian |
| 8 | 4 bytes | Message ID, unsigned big-endian |
| 12 | 4 bytes | Flags, unsigned big-endian |
| 16 | Variable | Encoded fields |
In the working profile, both lengths equal 12 + payload bytes; the complete frame is 16 + payload bytes. Normal flags are 0x01000000. Other flag meanings remain unresolved.
These are the project’s working framing conventions, not a claim that every historical SIGS variant behaves identically. The emulator’s 1 MiB frame cap is an implementation limit.
Field tokens
| Token | Encoding / caveat |
|---|---|
%s | NUL-terminated byte string. Historical text encoding is unverified; the project uses Latin-1 for reversible bytes. |
%i | 32-bit big-endian integer. Project decoding is signed; individual field semantics may differ. |
%l | 16-bit big-endian integer. Project decoding is unsigned; historical signedness remains unresolved. |
%c | One byte. |
%f | IEEE-754 binary32, big-endian; verified statically. Not supported by the generic codec. |
%b | 32-bit big-endian byte count followed by bytes in dedicated adapters. Not supported by the generic codec; updater use remains untested. |
Fields appear in format order. DLL accessors may index fields by type, so “integer 0” is not necessarily the first field in a packet. Preserve unknown payloads as opaque bytes.
Example: fieldless Ping (207 / 0xCF)
00 00 00 0C 00 00 00 0C 00 00 00 CF 01 00 00 00
outer length · inner length · message ID · flags — this example contains no payload or account information.
From validation to a game
01 / Validation
616 version check → 901 connection response → 626 → 907.
The emulator’s no-update path replies with (0, 0, 0), then the client reconnects to the lobby.
02 / Lobby
601 login → 311 reply; 306 room records.
602 entry request → 303 response → room endpoint. The login reply is the current emulator path.
These flows combine observations and the current emulator profile. They are not a complete state machine. Server port assignments are deployment choices, not protocol constants.
Authentication: the original SIGS login sends a plaintext password in message 601. Protect transport before login; do not publish real credentials or unredacted account captures.
Messages
C → S means client to server; S → C means server to client. Unknown direction or state is deliberately retained.
71 messages
No messages match these filters. Try a broader search or choose all states.
Download the catalog
All 71 entries, including evidence status and uncertainty notes. No packet captures or account data.