doing some ICQ research and I found that LICQ's homepage is still online, with zero hint that it hasn't been updated in 11 years:

[foone@digipres.club]

how is this decryption supposed to work if it starts at offset 10 and then does it in 4-byte chunks but the packet is 28 bytes long?

[foone@digipres.club]

maybe I just need to pad all packets and they forgot to mention that

[foone@digipres.club]

wait! Wireshark DOES support ICQ, it just didn't detect it in this case. Awesome

[yuubi@furry.engineer]

@foone "For Admin Use"

[foone@digipres.club]

okay, my client is just sending the command CMD_NEW_USER_1 over and over, which is a "ask for permission to make a new user" command. I don't know what the reply is supposed to be

[foone@digipres.club]

@yuubi that lets you select what server to talk to. so I'm setting it to my local server running netcat -lu instead of the long dead icq server

[foone@digipres.club]

my code doesn't work yet, but I did find where it's implemented in wireshark, and there's some Suspicious offset checks:

wireshark-rtpmon/epan/dissectors/packet-icq.c at master · giuliano108/wireshark-rtpmon

Unofficial wireshark mirror. With couchbase protocol dissector - wireshark-rtpmon/epan/dissectors/packet-icq.c at master · giuliano108/wireshark-rtpmon

GitHub (github.com)

[foone@digipres.club]

I started to open up ICQ in Ghidra to see if I could find any info there, but there are 38 DLLs/EXEs here. HOW MUCH CODE DO YOU NEED, MAN?

[foone@digipres.club]

I missed the 11 that it dropped in C:\Windows\SysWOW64

[foone@digipres.club]

that's 49 executables, not counting the OCX

[foone@digipres.club]

not sure why it dropped a 16-bit DLL as well

[jpm@aus.social]

@foone so it works with Trumpet Winsock (may or may not be a shitpost)

[foone@digipres.club]

@jpm I don't think the rest of the software would work with win 3.1, though. Maybe an older version did, and they just forgot to remove the DLL?

[foone@digipres.club]

icqsock.dll has a lot of interesting functions, so I'm looking at that one first

[indigoparadox@mastodon.social]

@foone "I was going to call it System64, but in the middle of naming it I just thought, 'WOW! Nature is beautiful!'"

[foone@digipres.club]

this is complicated and involves a lot of DLLs.

I'm gonna need some kind of tracing system for this

[barubary@infosec.exchange]

@foone It's on the web: https://dflund.se/~pkj/

More specifically, https://dflund.se/~pkj/Projects.html links to https://dflund.se/~pkj/ICQServer.tgz.

[foone@digipres.club]

@barubary ooh, thanks!

[pzriddle@mstdn.io]

@foone @futurebird

I agree in principle, although as a vintage 20th-century programmer I don't know what half this stuff is.

But I'll tell you what I miss on phones and other locked-in devices: a shell prompt and full filesystem access.

[foone@digipres.club]

@pzriddle @futurebird amusingly I'm using most of this for 20th century programming: as in, I'm hacking old 80s and 90s programs by using 2020s tools