Parsing AMF3 objects

Question

I'm trying to decode an AMF0 message with AMF3 included .. All is well except making sense of the U29 format and the way string are encoded in AMF4

  channel=3  size=134  pkttype=0x11  time=1973

  00000: 00 02 00 14 73 65 6E 64  55 6E 69 76 65 72 73 61  6C 4D 65 73     ....sendUniversalMes
  00020: 73 61 67 65 00 00 00 00  00 00 00 00 00 05 02 00  11 6D 62 5F     sage.............mb_
  00040: 31 32 32 31 30 5F 37 35  39 32 33 33 38 30 05 00  40 58 C0 00     12210_75923380..@X..
  00060: 00 00 00 00 11 0A 0B 01  09 68 62 69 64 04 81 CF  5E 09 73 72     .........hbid...^.sr
  00080: 63 65 06 49 63 37 62 39  32 33 65 65 2D 30 61 30  38 2D 34 62     ce.Ic7b923ee-0a08-4b
  00100: 61 32 2D 38 65 37 63 2D  63 38 32 61 39 33 64 37  37 31 34 32     a2-8e7c-c82a93d77142
  00120: 09 68 62 64 6C 04 00 09  74 65 78 74 01 01                        .hbdl...text..

  first byte I skip 
  02 = string
  00 14 = length of string ( 20 characters , sendUniversalMessage )
  00 00 00 00 00 00 00 00 00 = number = 0
  05 = null
  02 = string
  00 11 = length of string ( 17 characters , mb_12210_75923380 )
  05 = null
  00 40 58 C0 00 00 00 00 00 = number = 99
  11 = AMV+

  here is where I have problems

  0A = AMF3 object 
  now I need to do a readU29 which starts with
  0B = what does this mean
  01 = what does this mean
  09 = what does this mean

  where is the length of the string 'hbid' ?

Answer 1

in U29, if the first byte is worth less than 128, it fits on the first byte. So you have to read this as 3 different u29s, worth 0B, 01, 09.

0B: details about the type of object. It seems you're not too interested in that byte and it's complicated, so pass.

01: The LSB is the bit that says that this isn't a string reference. Then 01 >> 1 = 0 is the length of the class name. This means empty string, which means this is an anonymous (untyped) object.

09: = 00001001. The LSB is also the bit that says this isn't a string reference. Then 1001 >> 1 = 0100 = 4 is the string length.

hope that helps