Data type |
Content |
Name |
Description
|
TIME |
xx xx xx xx |
TIME |
Seems to be a time stamp in 1/1500 sec since 8am of that Sunday. ((time(NULL) - (8*60*60)) + DayOfWeek*60*60*24)) * 1500
|
WORD |
xx xx |
ID |
A seemingly random ID generated for each message.
|
DWORD |
00 00 xx xx |
TYPE |
The message type used:
0x00000001: "old" type
0x00000002: special messages
0x00000004: "new" type
|
BSTR |
xx ... |
UIN |
The sender's UIN.
|
WORD |
xx xx |
WARNING |
A warning level. Usually 0.
|
WORD |
xx xx |
COUNT |
The number of following TLVs.
|
TLV(1) |
00 01 00 02 00 50 |
UNKNOWN |
Unknown: 0x50 = 80.
|
TLV(4) |
00 04 00 02 00 00 |
UNKNOWN |
Unknown: 0.
|
TLV(6) |
00 06 00 04 xx xx xx xx |
STATUS |
The sender's online status.
|
TLV(15) |
00 0f 00 04 TIME |
TIME |
A timestamp.
|
TLV(2) |
00 02 00 04 TIME |
TIME |
The member since time.
|
TLV(3) |
00 03 00 04 TIME |
TIME |
The online since time.
|
TLV(2) |
00 02 xx xx ... |
MESSAGE1 |
Yes, TLV(2) again. Used for type-1.
|
TLV(1281) |
05 01 xx xx ... |
UNKNOWN |
Unknown.
|
TLV(257) |
01 01 xx xx ... |
MESSAGE |
This TLV contains the message.
|
DWORD |
xx xx xx xx |
UNKNOWN |
Unknown.
|
DATA |
... |
MESSAGE |
The actual message. Not null terminated.
|
TLV(5) |
00 05 xx xx ... |
MESSAGE2 |
Used for type-2. TLV(05) contains many seperate fields including the message itself, as follows:
|
WORD |
xx xx |
ACKTYPE |
0x0000 - normal message
0x0001 - abort request
0x0002 - file ack
|
TIME |
xx xx xx xx |
TIME |
A copy of the very first time in this packet.
|
WORD |
xx xx |
ID |
The random message ID again.
|
WORD |
00 00 |
UNKNOWN |
Unknown: 0.
|
TLV(11) |
00 0b 00 02 00 01 |
UNKNOWN |
Only if ACKTYPE is 1; then it will be the last TLV.
|
16 |
... |
CAPABILITY |
One of the capabilities sent in CLI_SETUSERINFO:
09 46 13 49 4C 7F 11 D1 82 22 44 45 53 54 00 00
|
TLV(10) |
00 0a 00 02 xx xx |
ACKTYPE2 |
0x0001 - normal message
0x0002 - file ack or file ok
|
TLV(5) |
00 05 00 02 xx xx |
PORT |
Only for file request or file ack packets: The listening port to which to connect.
|
TLV(3) |
00 03 00 04 IP |
IP |
Only for file request or file ack packets: The IP address to connect.
|
TLV(15) |
00 0f 00 00 |
UNKNOWN |
Unknown, emtpy.
|
TLV(10001) |
27 11 xx xx ... |
MESSAGE |
This is yet another message TLV that adds yet another layer of complexity as follows:
|
BYTE |
1b |
MSGFLAG |
If this value is not present, this is not a message packet. Also, ICQ2001b does not send an acknowledge, if this is not 0x1B.
|
WORD |
xx xx |
TCPVER |
This is the version of the TCP protocol that the sending client uses.
|
BYTE |
00 |
UNKNOWN |
Unknown.
|
16 |
... |
CAPABILITY |
Seen:
a0 e9 3f 37 4f e9 d3 11 bc d2 00 04 ac 96 dd 96
10 cf 40 d1 4f e9 d3 11 bc d2 00 04 ac 96 dd 96
|
3 |
00 00 03 |
UNKNOWN |
Unknown.
|
DWORD |
00 00 00 xx |
UNKNOWN |
0 = normal message, 4 = file ok or file request.
|
WORD |
xx xx |
SEQ1 |
A sequence that starts at 0xffff. I'm not sure yet when this decrements, most likely on each message send.
|
WORD |
xx xx |
UNKNOWN |
Unknown, seen: 0x1200 and 0x0e00.
|
WORD |
xx xx |
SEQ2 |
This is a copy of SEQ1.
|
12 |
00 ... 00 |
UNKNOWN |
Unknown, alwasy zero.
|
BYTE |
xx |
MSGTYPE |
What type of message this is:
1 - normal message
2 - char request
3 - file request
4 - URL.
|
BYTE |
xx |
MSGFLAGS |
00 - normal message
80 - multiple recipients
03 - auto reply message request.
|
WORD |
xx xx |
UNKNOWN |
Usually 0, seen 0x2000.
|
WORD |
xx xx |
PRIORITY |
Usually 0, seen 0x0002 in information request messages.
|
LNTS |
xx xx ... |
MESSAGE |
The message!
|
COLOR |
xx xx xx xx |
FOREGROUND |
Only present in actual real messages, this will be the text color of the message in RGB0 format.
|
COLOR |
xx xx xx xx |
BACKGROUND |
Only present in actual real messages, this will be the background color of the text box in RGB0 format.
|
DWORD |
xx xx xx xx |
GUIDLEN |
This is a little-endian string length of the following GUID. This is only present in real messages sent by the latest 2001b client build 3659.
|
DATA |
... |
GUID |
This GUID seems to indicate that the client is capable of handling Multibyte Wide Character Strings as messages. Only present in real messages sent by build 3659 2001b clients.
|