Bypassing Messenger word filter

.NET Messenger Service has a word filter that won't allow certain words in your friendly name… as plain text. MSN/Windows Messenger changes all spaces and percentage signs in a nick to the hex value (AKA, URL encoding), so it can be sent to the server as one long message as there cannot be spaces, because spaces separate the command arguments. You can also not send characters like éóÖÙÝýçÈᣦ­°£ºÝ, so you must encode them in UTF-8, encoded it would look like éóÖÙÃýçÃᣦ­°£ºÃ.

Update: This information is now outdated. When you send a full URL encoded nick, the server will only accept certain characters, and when you re-sign in, certain encoded characters are removed from your nickname (eg. %0D).

So if encoding spaces into hex is allowed… what about the whole nick? Special characters don't need to be encoded (eg. éóÖÙÝýçÈᣦ­°£ºÝ), as its not likely a word like that would be banned, plus MSN Messenger only de-hex's normal characters. Take the word 'fuck' for example, encoded in hex it would be %66%75%63%6B, chances are you don't see that is an evil word, neither does the server, if the server were to check it properly it would decode it, then check it.

What The Hex

Lets look at the encoded evil word character by character, the first encoded character is f, so f = %66. The % sign is just there to say, “Hey! Next 2 characters represent a hex value”, the 66 is the hex value of 102, and 102 is the ASCII value for f, this is case sensitive, so the ASCII value for F is 70, and the hex value of 70 is 46.

How The Hex

First, you need the ASCII value of each character, in Visual Basic you use the Asc() function (eg. iASCII = Asc(”f”)). In PHP, you use the ord() function (eg. $iASCII = ord(”f”);). You then take that ASCII value and turn it to hexadecimal, in Visual Basic you use the Hex() function (eg. sHex = Hex(iASCII)). In PHP, you use the dechex() function, (eg. $sHex = dechex($iASCII);).

Hex It All

So to hex the whole nick, you must do each character separately, which is done using a loop. Also keeping in mind not to hex the special characters, just those with an ASCII value below and including 127. Because the hex value for numbers below 16 is only 1 character, which the client will just ignore, you must pad a 0 in front of it.

PHP

To UTF-8 encode you can use the function uft8_encode()

function encode($text)
{
       $encoded = ""; // Init a string to put the encode values into.

       for ($i = 0; $i <= strlen($text) - 1; $i++) {
              $chr   = substr($text, $i, 1); // Get the character we are going to work on.
              $ascii = ord($chr); // Get the ASCII value of that of that character.
              $hex   = strtoupper(dechex($ascii)); // Get its hex value, and make it uppercase.

              // If its a normal character, or a special character (ASCII value above 128).
              if ($ascii <= 128) {
                     // Append the hex val to the buffer, and pad a 0 at the start if the hex value is only 1 byte.
                     $encoded .= "%".str_pad($hex, 2, "0", STR_PAD_LEFT);
              } else {
                     $encoded .= $chr;
              }
       }

       // Return the buffer and call utf8_encode to encode any special characters.
       return utf8_encode($encoded);
}

VB

This example doesn't include UTF-8 encoding:

Public Function Encode(ByVal v_sText As String) As String

       Dim sEncoded As String   'The encoded string
       Dim iCounter As Integer
       Dim iCount As Integer
       Dim sChar As String
       Dim sHex As String
       Dim iAsc As Integer

       iCount = Len(v_sText)

       For iCounter = 1 To iCount
              sChar = Mid$(v_sText, iCounter, 1) 'Get the character we are going to work on.
              iAsc = Asc(sChar) 'Get the ASCII value of that of that character.
              sHex = Hex$(iAsc) 'Get its hex value, and make it uppercase.

              'If its a normal character, or a special character (ASCII value above 128).
              If iAsc <= 128 Then
                     sEncoded = sEncoded & "%" & String(2 - Len(sHex), "0") & sHex
              Else
                     sEncoded = sEncoded & sChar
              End If

       Next iCounter

       Encode = sEncoded

End Function