doing some ICQ research and I found that LICQ's homepage is still online, with zero hint that it hasn't been updated in 11 years:

[foone@digipres.club]

I'm gonna write python code to decode a packet from these docs and then I'll convert that to lua. writing it in lua the first time will be too painful, when I don't fully understand how this nonsense works

[foo@fosstodon.org]

@foone If it helps for reference, I once wrote a Wireshark lua dissector for 2ping, a low-level UDP binary protocol. Though as a warning, I haven't looked at it in about a decade, so it may not even work anymore.
https://github.com/rfinnie/2ping/tree/main/wireshark

[sundrop@gelatino.us]

@[email protected] @[email protected] is it strictly a proprietary archival protocol or is there a daemon available for it?

[foone@digipres.club]

@Sundrop @ericgus there's no daemon for this version, no

[foone@digipres.club]

@foo thanks!

[foone@digipres.club]

how is this decryption supposed to work if it starts at offset 10 and then does it in 4-byte chunks but the packet is 28 bytes long?

[foone@digipres.club]

maybe I just need to pad all packets and they forgot to mention that

[foone@digipres.club]

wait! Wireshark DOES support ICQ, it just didn't detect it in this case. Awesome

[yuubi@furry.engineer]

@foone "For Admin Use"

[foone@digipres.club]

okay, my client is just sending the command CMD_NEW_USER_1 over and over, which is a "ask for permission to make a new user" command. I don't know what the reply is supposed to be

[foone@digipres.club]

@yuubi that lets you select what server to talk to. so I'm setting it to my local server running netcat -lu instead of the long dead icq server

[foone@digipres.club]

my code doesn't work yet, but I did find where it's implemented in wireshark, and there's some Suspicious offset checks:

wireshark-rtpmon/epan/dissectors/packet-icq.c at master · giuliano108/wireshark-rtpmon

Unofficial wireshark mirror. With couchbase protocol dissector - wireshark-rtpmon/epan/dissectors/packet-icq.c at master · giuliano108/wireshark-rtpmon

GitHub (github.com)

[foone@digipres.club]

I started to open up ICQ in Ghidra to see if I could find any info there, but there are 38 DLLs/EXEs here. HOW MUCH CODE DO YOU NEED, MAN?

[foone@digipres.club]

I missed the 11 that it dropped in C:\Windows\SysWOW64

[foone@digipres.club]

that's 49 executables, not counting the OCX

[foone@digipres.club]

not sure why it dropped a 16-bit DLL as well

[jpm@aus.social]

@foone so it works with Trumpet Winsock (may or may not be a shitpost)

[foone@digipres.club]

@jpm I don't think the rest of the software would work with win 3.1, though. Maybe an older version did, and they just forgot to remove the DLL?

[foone@digipres.club]

icqsock.dll has a lot of interesting functions, so I'm looking at that one first

[indigoparadox@mastodon.social]

@foone "I was going to call it System64, but in the middle of naming it I just thought, 'WOW! Nature is beautiful!'"