[monotreme]

Classic example of a glib unhelpful answer.

I KNOW it's done in class_core.php but that code is so forking obtuse and there's so many layers that it takes a couple of HOURS of intense code backtracing to find where the stuff actually originates.

idhash I have discovered.
it comes from SESSION_IDHASH
and to get that you md5 ($_SERVER['HTTP_USER_AGENT'] . $registry->alt_ip);

And if you want to know what alt_ip is you must duplicate the function fetch_alt_ip
which uses optional headers to see if a proxy requester leaked any info about where they really came from. But they are optional. Really sneaky people will turn it all off.

That's a reasonably good way to id people, but if you have a NAT'd group with RFC addys and they all have the same useragent and the same user is logged into several identical stations in a NAT
subnet it might cause trouble so you need the sessionhash.

I'm still working on actually COMPUTING the correct session hash. So far I've found that an alias for it is the 's' variable and that when its inserted in the db it is found in
$vbulletin->session->vars['sessionhash']

Now if I can just figure out how and when that forking thing is computed in the first place I'm home free.