# m2ir > Evidence-backed YAML reference for MikroTik RouterOS binary protocols and data formats. Schema content is CC0-1.0. This file is a reading map; AGENTS.md governs repository contributions. Read canonical YAML before implementing behavior. Follow each entry's confidence, evidence, version scope, and revision history. Research notes can contain earlier beliefs that the schema has since corrected. A finding on RouterOS 6.49.23 or 7.25 is not a guarantee for other versions or devices. Links below fetch plain-text files from the main branch. In a local checkout, the path after `/main/` identifies the same file. For reproducible work, record the commit used alongside the RouterOS version. The three WinBox task paths below are examples. For file analysis, another protocol, or a topic that does not fit them, start with Other formats and protocol research below and the format/research index. Use Returning new discoveries to contribute what you learn. `physical/` defines bytes, `profiles/` assigns meaning in a usage context, and `concepts/` is a placeholder for shared semantic identity. The WinBox and Dude profiles have content; CDB and MNDP profiles remain placeholders. ## Packet capture and decoding For sniffing/TZSP/Wireshark/TShark work: 1. Read Transport, Handshake, and Session crypto below to identify framing and the encryption boundary; then use Wire grammar, System keys, and GUI handlers for plaintext M2 interpretation scoped to route and version. 2. Follow the entry's evidence to CHR analysis / Live probe findings and the fixture/replay trail under Native WinBox backends. Plaintext JSON/hex transcripts support decoding checks; they do not test TCP reassembly. 3. Read the [dissector proposal](https://raw.githubusercontent.com/tikoci/m2ir/main/work/2026-10-winbox-dissector/dissector-proposal.md) for existing upstream tooling, the implemented schema shape builder, and proposed Wireshark/TShark integration. The shape builder is not a functioning dissector. A session-secret exporter is also still proposed. Encrypted attributes require appropriate session secrets: a passive capture and password alone generally do not suffice because derivation depends on an ephemeral private scalar. Capture acquisition and TZSP encapsulation are separate from this WinBox reference. Preserve unknown IDs/types and report missing secrets or incomplete captures without inventing decoded fields. ## Patched WinBox client compatibility For patched winbox.exe / winbox64.exe, version gates, GUI descriptors, or parser failures: 1. Start with the [WinBox 3 patch review](https://raw.githubusercontent.com/tikoci/m2ir/main/work/2026-11-winbox3-patches/README.md). It separates client gates and descriptor/parser changes from evidence of wire changes, and links the client analysis plus schema promotion map. 2. Follow Client analysis below for the original 3.43 binary fingerprint and name oracle. Read the canonical YAML for the layer implicated by the failure: GUI handlers/keys/commands, or Transport/Handshake/Session crypto/Wire grammar if actual wire drift is demonstrated. 3. Follow that entry's version-scoped evidence, CHR analysis, fixtures, and replay tests. The native prober can reproduce router replies; it does not exercise a patched GUI client. Record the exact client hash/build, RouterOS version, operation, and result for any dynamic validation. The patch review is static source/forum analysis, with no patched binary executed by that review. Neither successful login nor native CHR queries establish full client compatibility. Its proposed promotions are not automatically canonical findings. ## Native WinBox backends For configuration-data access through native WinBox: 1. Read Profile and the transport/authentication files below, then GUI handlers, Processes, System keys, and Standard keys/commands/errors. Keep the process/handler route, field namespace, wire type, and exact version attached to every mapping. 2. Follow GUI handlers' request-shape and the per-handler entries for retrieval, server-issued pagination tokens, typed writes, persistence, and known gaps. Command names alone do not prove notification lifecycle. 3. Use the [attribute handoff](https://raw.githubusercontent.com/tikoci/m2ir/main/work/2026-11-winbox-attributes/handoff.yaml) for completed batches and remaining gaps; its historical execution plan supplies methodology. The [harness guide](https://raw.githubusercontent.com/tikoci/m2ir/main/work/2026-11-winbox-attributes/harness/README.md) links the implemented experimental codec/session, capture, correlation, paging, naming, and probes. The [fixtures guide](https://raw.githubusercontent.com/tikoci/m2ir/main/fixtures/README.md) explains sanitized plaintext evidence and links replay tests. Live probes require their stated dependencies and mutation controls. 4. Follow [existing consumers and implementation status](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/winbox-ipc/README.md) for centrs source, tests, docs, m2ir provenance, and the inspected main revision. Its shared EC-SRP5 code is implemented; WinBox terminal is not-started there, and native WinBox retrieval is not established by it. Native WinBox handler access, WinBox terminal execution, and RouterOS native API are distinct transports/behaviors. A native API listen test does not prove WinBox notifications. Measure efficiency for the workload, including request count, bytes, pagination, projection, and updates. ## Following evidence Read each YAML entry's `notes:`, `confidence:`, `evidence:`, version scope, `revision-history:`, and any `investigation-trail:` before reusing it. Confidence vocabulary lives in DESIGN.md: documented, inferred, observed-only, guessed, superseded. A documented source is evidence of its stated scope, not universal compatibility. Superseded research explains corrections; current canonical YAML takes precedence. Follow `evidence:` refs to sanitized fixtures, probes, binary analysis, or external sources; some private-source evidence is explicitly unavailable publicly. Record the repository revision, exact RouterOS/client build, and the named replay test or probe before claiming a reproduction. The repo's general CI is offline; a passing replay does not establish a fresh live result. ## Orientation - [README.md](https://raw.githubusercontent.com/tikoci/m2ir/main/README.md): Mission, coverage, WinBox compatibility context, and current research. - [WinBox profile guide](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/winbox-ipc/README.md): Human orientation, coverage, file index, implementation references, and limitations. - [AGENTS.md](https://raw.githubusercontent.com/tikoci/m2ir/main/AGENTS.md): Contributor instructions and pointers to path-scoped rules. - [DESIGN.md](https://raw.githubusercontent.com/tikoci/m2ir/main/DESIGN.md): Canonical YAML, physical/profile/concept layers, and confidence vocabulary. - [BOOTSTRAP.md](https://raw.githubusercontent.com/tikoci/m2ir/main/BOOTSTRAP.md): Bun setup, checks, and repository tooling. ## WinBox transport and messages Read these in order when implementing the wire conversation: - [Profile](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/winbox-ipc/profile.yaml): Context, namespaces, and schema references. - [Wire grammar](https://raw.githubusercontent.com/tikoci/m2ir/main/physical/nv-message.yaml): M2 types, lengths, compact encodings, and nesting. - [Transport](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/winbox-ipc/transport.yaml): TCP chunk framing. - [Handshake](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/winbox-ipc/ec-srp5-handshake.yaml): EC-SRP5 authentication and evidence-backed encoding details. - [Session crypto](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/winbox-ipc/session-crypto.yaml): Key derivation, encrypted envelopes, and message authentication. ## Handler and attribute file index For native handler work, continue here. The centrs implementation trail above distinguishes its existing authentication code from future WinBox retrieval and notification support. - [GUI handlers](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/winbox-ipc/gui-handlers.yaml): Selected handler routes, request/reply shapes, field mappings, and gaps. - [System keys](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/winbox-ipc/sys-keys.yaml): Routing, request correlation, and message envelope attributes. - [Standard keys](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/winbox-ipc/std-keys.yaml): Session/standard attributes and object-list metadata. - [Standard commands](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/winbox-ipc/std-commands.yaml): Command identities, including retrieval and notification operations. - [Standard errors](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/winbox-ipc/std-errors.yaml): Error identities and evidence. - [Processes](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/winbox-ipc/processes.yaml): Process identities, version differences, and unresolved conflicts. - [Private and legacy commands](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/winbox-ipc/commands.yaml): Handler-specific commands, including terminal-related evidence. - [mproxy](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/winbox-ipc/mproxy.yaml): Front-end proxy and handler-2 file-transfer evidence. - [Undo](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/winbox-ipc/undo.yaml): Seeded undo identities and remaining gaps. ## Active research and compatibility These are investigation trails and experimental tooling, not a replacement for the canonical schema. Consult them for reproductions and unresolved questions. RouterOS 7.25 lab queries do not prove full WinBox 3 compatibility; forum theories about future protocol changes are not established behavior. - [Client analysis](https://raw.githubusercontent.com/tikoci/m2ir/main/work/2026-10-winbox-client-re/README.md): WinBox 3.43 analysis using REA/Ghidra. - [CHR analysis](https://raw.githubusercontent.com/tikoci/m2ir/main/work/2026-10-chr-extraction/README.md): RouterOS extraction, binary analysis, quickchr probes, and promotion status. - [Live probe findings](https://raw.githubusercontent.com/tikoci/m2ir/main/work/2026-10-chr-extraction/ws3c-prober-findings.md): Version-scoped observations, transcript references, corrections, and open questions. - [Configuration attribute and verb plan](https://raw.githubusercontent.com/tikoci/m2ir/main/work/2026-11-winbox-attributes/attribute-discovery-plan.md): Methodology and historical execution sequence; completed work and remaining gaps are in the attribute handoff above. Later evidence includes 7.26beta4 and selected 7.26beta5 checks; read scope per entry. ## Other formats and protocol research - [Format and research index](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/README.md): Maintained routes across populated schemas, file-based formats, placeholder profiles, shared mechanisms, experimental tooling, and adjacent source leads. If a topic is missing, inspect the tracked physical/, profiles/, and work/ trees; an untracked local artifact is not a public source. - [The Dude profile](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/dude-on-disk/profile.yaml) → [object classes](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/dude-on-disk/object-classes.yaml) → [fields](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/dude-on-disk/fields.yaml): Initial populated schema for dude.db object blobs. Follow evidence to donny / TheDudeToHuman. Preserve object-class/tag identity and marker rules; WinBox naming and compact rules do not transfer unchanged. - [CDB saved-connections guide](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/winbox-cdb/README.md): Placeholder profile with pinned centrs reader/test references; use the source inventory below for WBX saved sessions and conversion leads. Saved RoMON neighbor/target records do not establish the RoMON tunnel protocol. - [MNDP guide](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/mndp/README.md): Placeholder for a separate TLV grammar; pinned external codec/tests provide implementation evidence. No canonical MNDP YAML is populated yet. - [CHR extraction](https://raw.githubusercontent.com/tikoci/m2ir/main/work/2026-10-chr-extraction/README.md) and [x3parse.ts](https://raw.githubusercontent.com/tikoci/m2ir/main/work/2026-10-chr-extraction/x3parse.ts): RouterOS image/.x3 metadata research and experimental decoding, not a standalone canonical file-format profile. - [SYS keys](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/winbox-ipc/sys-keys.yaml), especially SYS_OWNER / 0xff001e, and Live probe findings above: selected /rw/store/cfg.* persistence evidence; not a general store-file grammar. - [WinBox guide's implementation trail](https://raw.githubusercontent.com/tikoci/m2ir/main/profiles/winbox-ipc/README.md): Shared EC-SRP5 findings consumed by MAC-Telnet and bandwidth-test code. This does not constitute complete m2ir profiles for those protocols. Profile/Processes/mproxy/Private commands above route internal IPC and the seeded terminal surface. - [Source inventory](https://raw.githubusercontent.com/tikoci/m2ir/main/work/2026-05-winbox-nova-sources/winbox-nova-source-inventory.md): Dated public-source scouting for CDB/WBX, MAC-WinBox, service-specific nova, and adjacent NPK/backup/user-database/supout extraction. These are leads to investigate, not claims of canonical coverage or completed decoders. - [Credits](https://raw.githubusercontent.com/tikoci/m2ir/main/CREDITS.md): Major upstream sources; detailed citations live in the YAML. ## Returning new discoveries Issues and pull requests are welcome, including partial agent findings, unknown TLVs, negative results, and corrections. [Open an issue](https://github.com/tikoci/m2ir/issues/new) for an observation or reproduction; send a [pull request](https://github.com/tikoci/m2ir/compare) for proposed evidence, research, or schema changes. Maintainers reproduce or cross-check findings against sources and version scope before canonical promotion. Read [submission guidance](https://github.com/tikoci/m2ir/blob/main/README.md#submit-a-discovery) for the evidence checklist, sanitization, placement, and checks; contributing does not require a completed field mapping. For the TLV collection effort, start with GUI handlers' unknown fields and gaps, then the attribute handoff for completed work and remaining questions. The [candidate inventory](https://raw.githubusercontent.com/tikoci/m2ir/main/work/2026-11-winbox-attributes/candidates.yaml) and configuration discovery plan provide experiment leads; CLI metadata alone does not establish numeric native identities. Reuse the harness and fixture/replay trail above. For other formats, follow the format/research index and submit evidence against that context rather than assuming M2. Keep observed bytes separate from proposed semantics and include exact versions, route/tag/type, provenance, and reproducible steps. Never publish credentials, session secrets, or private capture/saved-file data.