How to set rtmpdump's objectEncoding?(AMF0 or AMF3)

[yunhui4017864]

I am tring to download a rtmp stream using rtmpdump.
In theory, if rtmpdump packet is identical to the original packet, stream will be captured successfully.

But original packet's objectEncoding is AMF0, rtmpdump always sending AMF3 objectEncoding packet.
This will lead to server make diffrent response after rtmp connect.
If server receive AMF0 packet, server response with AMF0 packet.
If server receive AMF3 packet, server response with AMF3 packet, but the AMF3 object is broken, maybe this is a bug on their server, maybe server doesn't support AMF3 at all.

Anyway, this will cause rtmpdump error.

ERROR: AMF3 Object encapsulated in AMF stream does not start with AMF3_OBJECT!

rtmpdump log here:

DEBUG2: RTMP_ReadPacket: fd=312
DEBUG2:   0000:  03 00 00 00 00 00 4e 14  00 00 00 00               ......N.....
DEBUG2:   0000:  02 00 08 46 43 53 5f 53  54 41 54 00 40 00 00 00   ...FCS_STAT.@...
DEBUG2:   0010:  00 00 00 00 05 11 06 03  30 11 06 03 55 11 09 21   ........0...U..!
DEBUG2:   0020:  01 06 01 06 01 06 01 06  01 06 01 06 01 06 01 06   ................
DEBUG2:   0030:  03 33 06 03 35 06 05 32  30 06 13 e6 9c b4 e9 9b   .3..5..20.......
DEBUG2:   0040:  85 e7 86 99 06 01 06 01  06 01 06 01 06 04         ..............
DEBUG: RTMP_ClientPacket, received: invoke 78 bytes
ERROR: AMF3 Object encapsulated in AMF stream does not start with AMF3_OBJECT!
DEBUG: (object begin)
DEBUG: Property: <Name:            no-name, STRING:     FCS_STAT>
DEBUG: Property: <Name:            no-name, NUMBER:     2.00>
DEBUG: Property: NULL
DEBUG: Property: <Name:            no-name, OBJECT>
DEBUG: (object begin)
DEBUG: (object end)
DEBUG: (object end)
DEBUG: HandleInvoke, server invoking <FCS_STAT>

And here's original packet captured by WireShark.

0000   80 fa 5b 41 aa 59 10 44 00 cc b5 61 08 00 45 00   .ú[AªY.D.̵a..E.
0010   00 94 4f bb 40 00 36 06 26 9a 3c c7 cd 9d c0 a8   ..O»@.6.&.<ÇÍ.À¨
0020   03 02 07 8f 12 c5 18 37 4c 6e 38 61 cc 9b 50 18   .....Å.7Ln8aÌ.P.
0030   00 b5 92 12 00 00 03 00 00 00 00 00 60 14 00 00   .µ..........`...
0040   00 00 02 00 08 46 43 53 5f 53 54 41 54 00 40 00   .....FCS_STAT.@.
0050   00 00 00 00 00 00 05 02 00 01 30 02 00 01 55 0a   ..........0...U.
0060   00 00 00 10 02 00 00 02 00 00 02 00 00 02 00 00   ................
0070   02 00 00 02 00 00 02 00 00 02 00 01 33 02 00 01   ............3...
0080   35 02 00 02 32 30 02 00 09 e6 9c b4 e9 9b 85 e7   5...20...æ.´é..ç
0090   86 99 02 00 00 02 00 00 02 00 00 02 00 00 02 00   ................
00a0   01 34                                             .4

AMF3 object flag is 0x11
As you can see, there is no 0x11 in original packet, so no AMF3 object in original packet.
There is 0x11 in rtmpdump packet, but it's broken, rtmpdump can't parse it, so then error.

Original connect packet：

[Attachment 49781 - Click to enlarge]
rtmpdump connect packet：

[Attachment 49782 - Click to enlarge]
I compare original connect packet to rtmpdump connect packet.
I think this is the problem, 2 bytes after objectEncoding.
rtmpdump sends 0x40 0x08
original sends 0x00 0x00
rtmpdump sends AMF3 objectEncoding, orignal sends AMF0 objectEncoding.

So my best try is to make rtmpdump send AMF0 packet, and then server should response with correct AMF0 packet, just like original packet.
I have already googleing a lot, but still have no idea how to set rtmpdump's objectEncoding?
Anyone help?

[LZAA]

TubeDigger, IDM?