Background
Remote Replication Agent (RRA), is as the name suggests a protocol used for synchronization. It is used for all synchronization on Windows Mobile devices predating Windows Mobile 2005, but is still used partly on the latter platform for all the non-PIM items (files, favorites, media and notes), whilst AirSync is used for the PIM ones (appointments, contacts, e-mails and tasks).
Connection
The desktop computer begin to listen on port 5678 for incoming connections. It then makes the undocumented CeStartReplication RAPI function call to tell the remote device to connect. The remote device makes two connections to port 5678. The first connection is a control channel and the second connection is a data channel.
Control Channel
The control channel is the first of the two established connections where data is exchanged. Requests may be made from both sides, but only one request expecting a response may be in progress from each side at any given time. Transactions are comprised of commands of different types, documented below.
Basic Command Structure
Name |
Size |
Description |
CommandType |
2 |
Command type. The different types are documented in a section for each. |
CommandLength |
2 |
Number of bytes following this field. |
CommandArgument |
4 |
A DWORD which contains a command-specific argument. |
Commands
Response
Name |
Size |
Description |
CommandType |
2 |
Response (108 / 0x6C) |
CommandLength |
2 |
Number of bytes following this field. |
ReplyToCommand |
4 |
The CommandType that this command is the response to. |
Result |
4 |
Result of the request. |
ResponseDataSize |
4 |
Number of bytes of response data following the next field. |
Unknown1 |
4 |
Unknown field. |
... |
... |
0..n bytes of response data (depending on the command which this is the response to). |
GetMetaData
Request
Name |
Size |
Description |
CommandType |
2 |
GetMetaData (111 / 0x6F) |
CommandLength |
2 |
Number of bytes following this field. |
GetMask |
4 |
A bitmask specifying what metadata to get. |
GetMask
A 32-bit bitmask specifying what to get. If any of the parameters in the third column is -1, this means that it doesn't apply to that field. For instance if the response has a fixed number of records, or that the flag only indicates the version of the data requested. See the "Data Types" section for more information about the data types involved.
Bit |
Type |
RecordCountOffset/RecordDataOffest/RecordSize |
Description |
0 |
ObjectTypes |
4/8/384 |
Request a list of ObjectType records. Bits 6-10 have to be set as well (presumably these indicate the format of the data returned). |
1 |
UnknownDataType1 |
4/8/20 |
Unknown data type 1. |
2 |
UnknownDataType2 |
-1/4/8 |
Unknown data type 2. |
4 |
Volumes |
4/8/8 |
Request a list of Volume records. |
5 |
UnknownDataType4 |
-1/4/? |
Unknown data type 4. |
Response
Name |
Size |
Description |
... |
... |
Common response fields. |
MagicValue |
4 |
Magic value that must be 0xF0000001. |
Success |
4 |
A value that must be TRUE, probably signifying whether the command succeeded. |
HasBody |
4 |
A BOOL indicating if the response contains a body or is empty. |
... |
... |
A body if the previous field is TRUE. The content depends on the bitmask specified in the CommandRequest field of the request. |
The body contains 0 or more responses, depending on which were requested by the GetMask of the request. Each response chunk is layed out in bitwise order, from least to most significant bit, and each chunk takes the form:
Name |
Size |
Description |
ResponseTo |
4 |
Two to the power of the position of the bit to which this is a response. So for instance if this is the response to bit 4, this field contains the value 16. |
Data |
4 |
Start of data, or a value containing the number of fixed-size fields following this field. The size depends on the field, see GetMask documentation above. |
SetMetaData
Request
Name |
Size |
Description |
CommandType |
2 |
SetMetaData (112 / 0x70) |
CommandLength |
2 |
Number of bytes following this field. |
PayloadSize |
4 |
The number of bytes of payload following this field. |
MagicValue |
4 |
Magic value that must be 0xF0000001. |
SetOid |
4 |
The identifier of the object to set. |
ObjectData |
0..n |
Object-specific data (see below). |
SetOid
BORING_SSPIDS (2)
Set the list of SSPIds that we're not interested in synchronizing.
Name |
Size |
Description |
FourUnknownDWORDs |
16 |
Four unknown DWORDs. |
NumBoringObjects |
4 |
Number of boring objects following this field. |
BoringObjectId |
4 |
0..n boring object IDs. |
Response
The response doesn't have any payload and seems to have ResponseField1..3 all set to zero on success.
ChangeLog
Request
Name |
Size |
Description |
CommandType |
2 |
ChangeLog (105 / 0x69) |
CommandLength |
2 |
Number of bytes following this field. |
TODO
DeleteObject
Request
Name |
Size |
Description |
CommandType |
2 |
DeleteObject (102 / 0x66) |
CommandLength |
2 |
Number of bytes following this field. |
TODO
GetObject
Request
Name |
Size |
Description |
CommandType |
2 |
DeleteObject (103 / 0x67) |
CommandLength |
2 |
Number of bytes following this field. |
TODO
Ack
Request
Name |
Size |
Description |
CommandType |
2 |
ChangeLog (101 / 0x65) |
CommandLength |
2 |
Number of bytes following this field. |
TODO
Nack
Request
Name |
Size |
Description |
CommandType |
2 |
ChangeLog (110 / 0x6E) |
CommandLength |
2 |
Number of bytes following this field. |
TODO
Data Types
ObjectType
ObjectType (384 bytes)
Name |
Size |
Type |
Description |
Flags |
4 |
DWORD |
Unknown. |
Name1 |
200 (0-99 characters) |
WCHAR, zero-terminated |
Name of the object type. |
Name2 |
80 (0-39 characters) |
WCHAR, zero-terminated |
Name/description of the object type. |
Name3 |
80 (0-39 characters) |
WCHAR, zero-terminated |
Another name/description of the object type (usually blank). |
SSPId |
4 |
DWORD |
Identifier of the object type. |
Count |
4 |
DWORD |
Number of items of this object type on the device. |
TotalSize |
4 |
DWORD |
Total size of the items of this object type on the device. |
FileTime |
8 |
FILETIME |
Time of last modification of any of the items of this object type on the device (?). |