doing some ICQ research and I found that LICQ's homepage is still online, with zero hint that it hasn't been updated in 11 years:

[ericgus@mastodon.social]

@foone Well if you are going down a rabbit hole, why not see how far down it goes.. ?

[foone@digipres.club]

@ericgus I'm already going down too many of those!

[foone@digipres.club]

oh I can write lua (eww, for low level binary stuff?) dissectors. that'll make this slightly easier

[foone@digipres.club]

I'm gonna write python code to decode a packet from these docs and then I'll convert that to lua. writing it in lua the first time will be too painful, when I don't fully understand how this nonsense works

[foo@fosstodon.org]

@foone If it helps for reference, I once wrote a Wireshark lua dissector for 2ping, a low-level UDP binary protocol. Though as a warning, I haven't looked at it in about a decade, so it may not even work anymore.
https://github.com/rfinnie/2ping/tree/main/wireshark

[sundrop@gelatino.us]

@[email protected] @[email protected] is it strictly a proprietary archival protocol or is there a daemon available for it?

[foone@digipres.club]

@Sundrop @ericgus there's no daemon for this version, no

[foone@digipres.club]

@foo thanks!

[foone@digipres.club]

how is this decryption supposed to work if it starts at offset 10 and then does it in 4-byte chunks but the packet is 28 bytes long?

[foone@digipres.club]

maybe I just need to pad all packets and they forgot to mention that

[foone@digipres.club]

wait! Wireshark DOES support ICQ, it just didn't detect it in this case. Awesome

[yuubi@furry.engineer]

@foone "For Admin Use"

[foone@digipres.club]

okay, my client is just sending the command CMD_NEW_USER_1 over and over, which is a "ask for permission to make a new user" command. I don't know what the reply is supposed to be

[foone@digipres.club]

@yuubi that lets you select what server to talk to. so I'm setting it to my local server running netcat -lu instead of the long dead icq server

[foone@digipres.club]

my code doesn't work yet, but I did find where it's implemented in wireshark, and there's some Suspicious offset checks:

https://github.com/giuliano108/wireshark-rtpmon/blob/master/epan/dissectors/packet-icq.c#L428

[foone@digipres.club]

I started to open up ICQ in Ghidra to see if I could find any info there, but there are 38 DLLs/EXEs here. HOW MUCH CODE DO YOU NEED, MAN?

[foone@digipres.club]

I missed the 11 that it dropped in C:\Windows\SysWOW64

[foone@digipres.club]

that's 49 executables, not counting the OCX

[foone@digipres.club]

not sure why it dropped a 16-bit DLL as well

[jpm@aus.social]

@foone so it works with Trumpet Winsock (may or may not be a shitpost)