diff --git a/trunk/src/core/srs_core.hpp b/trunk/src/core/srs_core.hpp
index 06e0a2fde..a7961e84c 100644
--- a/trunk/src/core/srs_core.hpp
+++ b/trunk/src/core/srs_core.hpp
@@ -31,7 +31,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 // current release version
 #define VERSION_MAJOR "0"
 #define VERSION_MINOR "9"
-#define VERSION_REVISION "91"
+#define VERSION_REVISION "92"
 #define RTMP_SIG_SRS_VERSION VERSION_MAJOR"."VERSION_MINOR"."VERSION_REVISION
 // server info.
 #define RTMP_SIG_SRS_KEY "srs"
diff --git a/trunk/src/kernel/srs_kernel_stream.cpp b/trunk/src/kernel/srs_kernel_stream.cpp
index 4aa0caf3b..d32f3c9a6 100644
--- a/trunk/src/kernel/srs_kernel_stream.cpp
+++ b/trunk/src/kernel/srs_kernel_stream.cpp
@@ -232,3 +232,11 @@ void SrsStream::write_string(std::string value)
     p += value.length();
 }
 
+void SrsStream::write_bytes(char* data, int size)
+{
+    srs_assert(require(size));
+    
+    memcpy(p, data, size);
+    p += size;
+}
+
diff --git a/trunk/src/kernel/srs_kernel_stream.hpp b/trunk/src/kernel/srs_kernel_stream.hpp
index 1d1d95599..aace59d7b 100644
--- a/trunk/src/kernel/srs_kernel_stream.hpp
+++ b/trunk/src/kernel/srs_kernel_stream.hpp
@@ -129,6 +129,10 @@ public:
     * write string to stream
     */
     virtual void write_string(std::string value);
+    /**
+    * write bytes to stream
+    */
+    virtual void write_bytes(char* data, int size);
 };
 
 #endif
\ No newline at end of file
diff --git a/trunk/src/rtmp/srs_protocol_handshake.cpp b/trunk/src/rtmp/srs_protocol_handshake.cpp
index e61c2a7cb..9c1801d49 100644
--- a/trunk/src/rtmp/srs_protocol_handshake.cpp
+++ b/trunk/src/rtmp/srs_protocol_handshake.cpp
@@ -31,6 +31,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #include <srs_protocol_io.hpp>
 #include <srs_protocol_utility.hpp>
 #include <srs_protocol_rtmp.hpp>
+#include <srs_kernel_stream.hpp>
 
 #ifdef SRS_AUTO_SSL
 
@@ -230,6 +231,26 @@ namespace srs
         return ret;
     }
     
+    // read/write stream using SrsStream.
+    void __srs_stream_write_4bytes(char* pp, int32_t value) 
+    {
+        static SrsStream stream;
+        
+        int ret = stream.initialize(pp, 4);
+        srs_assert(ret == ERROR_SUCCESS);
+        
+        stream.write_4bytes(value);
+    }
+    int32_t __srs_stream_read_4bytes(char* pp)
+    {
+        static SrsStream stream;
+        
+        int ret = stream.initialize(pp, 4);
+        srs_assert(ret == ERROR_SUCCESS);
+        
+        return stream.read_4bytes();
+    }
+    
     // calc the offset of key,
     // the key->offset cannot be used as the offset of key.
     int srs_key_block_get_offset(key_block* key)
@@ -282,7 +303,7 @@ namespace srs
         char* pp = c1s1_key_bytes + 764;
         
         pp -= sizeof(int32_t);
-        key->offset = *(int32_t*)pp;
+        key->offset = __srs_stream_read_4bytes(pp);
         
         key->random0 = NULL;
         key->random1 = NULL;
@@ -373,7 +394,7 @@ namespace srs
     
         char* pp = c1s1_digest_bytes;
         
-        digest->offset = *(int32_t*)pp;
+        digest->offset = __srs_stream_read_4bytes(pp);
         pp += sizeof(int32_t);
         
         digest->random0 = NULL;
@@ -416,13 +437,13 @@ namespace srs
     void __srs_time_copy_to(char*& pp, int32_t time)
     {
         // 4bytes time
-        *(int32_t*)pp = time;
+        __srs_stream_write_4bytes(pp, time);
         pp += 4;
     }
     void __srs_version_copy_to(char*& pp, int32_t version)
     {
         // 4bytes version
-        *(int32_t*)pp = version;
+        __srs_stream_write_4bytes(pp, version);
         pp += 4;
     }
     void __srs_key_copy_to(char*& pp, key_block* key)
@@ -441,16 +462,17 @@ namespace srs
         }
         pp += key->random1_size;
         
-        *(int32_t*)pp = key->offset;
+        __srs_stream_write_4bytes(pp, key->offset);
         pp += 4;
     }
     void __srs_digest_copy_to(char*& pp, digest_block* digest, bool with_digest)
     {
         // 732bytes digest block without the 32bytes digest-data
         // nbytes digest block part1
-        *(int32_t*)pp = digest->offset;
+        __srs_stream_write_4bytes(pp, digest->offset);
         pp += 4;
         
+        // digest random padding.
         if (digest->random0_size > 0) {
             memcpy(pp, digest->random0, digest->random0_size);
         }
@@ -720,8 +742,9 @@ namespace srs
         
         destroy_blocks();
         
-        time = *(int32_t*)_c1s1;
-        version = *(int32_t*)(_c1s1 + 4); // client c1 version
+        
+        time = __srs_stream_read_4bytes(_c1s1);
+        version = __srs_stream_read_4bytes(_c1s1 + 4); // client c1 version
         
         if (_schema == srs_schema0) {
             if ((ret = srs_key_block_parse(&block0.key, _c1s1 + 8)) != ERROR_SUCCESS) {
@@ -766,9 +789,11 @@ namespace srs
         
         destroy_blocks();
         
+        // client c1 time and version
         time = ::time(NULL);
-        version = 0x00000000; // client c1 version
+        version = 0x80000702; // client c1 version
         
+        // generate signature by schema
         if (_schema == srs_schema0) {
             srs_key_block_init(&block0.key);
             srs_digest_block_init(&block1.digest);
@@ -779,6 +804,7 @@ namespace srs
         
         schema = _schema;
         
+        // generate digest
         char* digest = NULL;
         
         if ((ret = calc_c1_digest(digest)) != ERROR_SUCCESS) {
diff --git a/trunk/src/rtmp/srs_protocol_rtmp.cpp b/trunk/src/rtmp/srs_protocol_rtmp.cpp
index 4b3e4d6c2..03add4f12 100644
--- a/trunk/src/rtmp/srs_protocol_rtmp.cpp
+++ b/trunk/src/rtmp/srs_protocol_rtmp.cpp
@@ -31,6 +31,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #include <srs_protocol_handshake.hpp>
 #include <srs_protocol_rtmp_stack.hpp>
 #include <srs_protocol_utility.hpp>
+#include <srs_kernel_stream.hpp>
 
 using namespace std;
 
@@ -268,9 +269,13 @@ int SrsHandshakeBytes::create_c0c1()
     srs_random_generate(c0c1, 1537);
     
     // plain text required.
-    c0c1[0] = 0x03;
-    *(int32_t*)(c0c1 + 1) = ::time(NULL);
-    *(int32_t*)(c0c1 + 1 + 4) = 0x00;
+    static SrsStream stream;
+    if ((ret = stream.initialize(c0c1, 9)) != ERROR_SUCCESS) {
+        return ret;
+    }
+    stream.write_1bytes(0x03);
+    stream.write_4bytes(::time(NULL));
+    stream.write_4bytes(0x00);
     
     return ret;
 }
@@ -287,11 +292,15 @@ int SrsHandshakeBytes::create_s0s1s2(const char* c1)
     srs_random_generate(s0s1s2, 3073);
     
     // plain text required.
-    s0s1s2[0] = 0x03;
-    *(int32_t*)(s0s1s2 + 1) = ::time(NULL);
+    SrsStream stream;
+    if ((ret = stream.initialize(s0s1s2, 9)) != ERROR_SUCCESS) {
+        return ret;
+    }
+    stream.write_1bytes(0x03);
+    stream.write_4bytes(::time(NULL));
     // s2 time2 copy from c1
     if (c0c1) {
-        *(int32_t*)(s0s1s2 + 1 + 4) = *(int32_t*)(c0c1 + 1);
+        stream.write_bytes(c0c1 + 1, 4);
     }
     
     // if c1 specified, copy c1 to s2.
@@ -315,10 +324,14 @@ int SrsHandshakeBytes::create_c2()
     srs_random_generate(c2, 1536);
     
     // time
-    *(int32_t*)(c2) = ::time(NULL);
+    SrsStream stream;
+    if ((ret = stream.initialize(c2, 8)) != ERROR_SUCCESS) {
+        return ret;
+    }
+    stream.write_4bytes(::time(NULL));
     // c2 time2 copy from s1
     if (s0s1s2) {
-        *(int32_t*)(c2 + 4) = *(int32_t*)(s0s1s2 + 1);
+        stream.write_bytes(s0s1s2 + 1, 4);
     }
     
     return ret;
@@ -455,6 +468,7 @@ int SrsRtmpClient::connect_app(string app, string tc_url)
         SrsConnectAppPacket* pkt = new SrsConnectAppPacket();
         
         pkt->command_object->set("app", SrsAmf0Any::str(app.c_str()));
+        pkt->command_object->set("flashVer", SrsAmf0Any::str("WIN 12,0,0,41"));
         pkt->command_object->set("swfUrl", SrsAmf0Any::str());
         pkt->command_object->set("tcUrl", SrsAmf0Any::str(tc_url.c_str()));
         pkt->command_object->set("fpad", SrsAmf0Any::boolean(false));