1,063 bytes added
, 21:15, 23 September 2014
=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x001F0006]
|-
| 1
| (NetworkStructSize<<12) <nowiki>|</nowiki> 0x402
|-
| 2
| Input network struct buffer ptr
|-
| 3
| (Tag0BufSize<<12) <nowiki>|</nowiki> 0x802
|-
| 4
| Tag0 data buffer ptr
|-
| 5
| (Tag1BufSize<<12) <nowiki>|</nowiki> 0xC02
|-
| 6
| Tag1 data buffer ptr
|}
The following is located 0x100-bytes after the beginning of the above command buffer:
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| (Size<<14) <nowiki>|</nowiki> 2
|-
| 1
| Ptr to output buffer, size is hard-coded to 0x280.
|}
=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}
=Description=
The sizes of the input/output buffers are hard-coded. The tag-data buffers begin at the OUI field in the tags. Normally tag1buf is unused(all-zero), tag1 is only used when the crypt-size is larger than 0xFA. The decrypted data is byte-swapped to little-endian when copying to the output buffer.