diff --git a/handlers.ts b/handlers.ts
index e841b60..e7fb5d8 100644
--- a/handlers.ts
+++ b/handlers.ts
@@ -1,7 +1,8 @@
-import { Session } from "./server.js";
-import { ControlCommands, Commands, CommandsByValue } from "./datatypes.js";
 import { createWriteStream } from "node:fs";
-import { SendStartVideo, SendUsrChk, create_P2pRdy } from "./impl.js";
+
+import { Commands, CommandsByValue, ControlCommands } from "./datatypes.js";
+import { create_P2pRdy, SendStartVideo, SendUsrChk } from "./impl.js";
+import { Session } from "./server.js";
 
 let image_fds = [];
 let cur_image_index = 0;
@@ -36,7 +37,6 @@ export const handle_PunchPkt = (session: Session, dv: DataView) => {
 };
 
 export const createResponseForControlCommand = (session: Session, dv: DataView): DataView | null => {
-  const pkt_id = dv.add(6).readU16();
   const start_type = dv.add(8).readU16(); // 0xa11 on control; data starts here on DATA pkt
   const cmd_id = dv.add(10).readU16(); // 0x1120
 
@@ -46,20 +46,12 @@ export const createResponseForControlCommand = (session: Session, dv: DataView):
   }
 
   if (cmd_id == ControlCommands.ConnectUserAck) {
-    /*
-      00000000  f1 d0 00 18 d1 00 00 00 11 0a 20 11 0c 00 ff 00  .......... .....
-      00000010  00 00 00 00 34 54 63 4d fe 01 01 01              ....4TcM....
-                            ^^^^^^^^^^^
-                            some kind of challenge
-                            need to send the 0x3010
-                            command with these 4 bytes 'encrypted'
-      */
-    let challenge = [0, 0, 0, 0];
-    challenge[0] = dv.add(0x14).readU8();
-    challenge[1] = dv.add(0x15).readU8();
-    challenge[2] = dv.add(0x16).readU8();
-    challenge[3] = dv.add(0x17).readU8();
-    const buf = SendStartVideo(session.outgoingCommandId, challenge);
+    let c = new Uint8Array(dv.add(0x14).readByteArray(4).buffer);
+    session.ticket[0] = c[0] % 2 == 0 ? c[0] + 1 : c[0] - 1;
+    session.ticket[1] = c[1] % 2 == 0 ? c[1] + 1 : c[1] - 1;
+    session.ticket[2] = c[2] % 2 == 0 ? c[2] + 1 : c[2] - 1;
+    session.ticket[3] = c[3] % 2 == 0 ? c[3] + 1 : c[3] - 1;
+    const buf = SendStartVideo(session);
     return buf;
   }
 };
diff --git a/impl.ts b/impl.ts
index 17a98c9..ce86ae7 100644
--- a/impl.ts
+++ b/impl.ts
@@ -1,6 +1,7 @@
 import "./shim.ts";
 
 import { Commands } from "./datatypes.js";
+import { Session } from "./server.js";
 import { XqBytesEnc } from "./func_replacements.js";
 import { hexdump } from "./hexdump.js";
 import { u16_swap } from "./utils.js";
@@ -29,7 +30,7 @@ const DrwHdr = (cmd: number, len: number, d1_or_d2: 0xd1 | 0xd2, m_chan: number,
   return retret;
 };
 
-export const SendStartVideo = (pkt_id: number, challenge: number[]): DataView => {
+export const SendStartVideo = (session: Session): DataView => {
   // TODO: extract SendUsrChk
   let buf = new DataView(new Uint8Array(0x18).buffer);
   // console.log(hexdump(DrwHdr(0xf1d0, 0x0114, 0xd1, 0, pkt_id).buffer));
@@ -41,8 +42,8 @@ export const SendStartVideo = (pkt_id: number, challenge: number[]): DataView =>
     0x14, // len
     0xd1, // ?
     0x00, // chan
-    pkt_id >> 8,
-    pkt_id,
+    session.outgoingCommandId >> 8,
+    session.outgoingCommandId,
     0x11,
     0x0a,
     0x10,
@@ -51,10 +52,10 @@ export const SendStartVideo = (pkt_id: number, challenge: number[]): DataView =>
     0x01,
     0x00,
     0x00,
-    challenge[0] % 2 == 0 ? challenge[0] + 1 : challenge[0] - 1,
-    challenge[1] % 2 == 0 ? challenge[1] + 1 : challenge[1] - 1,
-    challenge[2] % 2 == 0 ? challenge[2] + 1 : challenge[2] - 1,
-    challenge[3] % 2 == 0 ? challenge[3] + 1 : challenge[3] - 1,
+    session.ticket[0],
+    session.ticket[1],
+    session.ticket[2],
+    session.ticket[3],
     0x01,
     0x01,
     0x01,
diff --git a/tests/fn.test.js b/tests/fn.test.js
index d992d9c..0285156 100644
--- a/tests/fn.test.js
+++ b/tests/fn.test.js
@@ -130,8 +130,9 @@ describe("make packet", () => {
     // output is 0x3010; 'start video'; hardcoded but shouldnt
     const expected = hstrToBA(_expected_str);
 
-    const sess = { outgoingCommandId: 0 };
+    const sess = { outgoingCommandId: 0, ticket: [0, 0, 0, 0] };
     const got = createResponseForControlCommand(sess, new DataView(hstrToBA(input_pkt_str)));
     assert.deepEqual(got.buffer, expected);
+    assert.deepEqual(sess.ticket, [0x65, 0x51, 0x46, 0x36]);
   });
 });