ICQ: 20 years is not the limit

A year ago, we recalled how, from release to release, ICQ was subjected to plastic surgery and facelift. But today is the anniversary - ICQ is 20 years old, this is not a cat sneezed! Already a whole generation has grown up with the progenitor of instant messengers. And in honor of such an event, we decided to look in retrospect, which technologies were used in ICQ for two decades.

Over the years, the network has not much information about the first years of ICQ development. The first version, released on November 15, 1996 by four Israeli high school students, was as simple as three rubles. In fact, she could only exchange messages. A client was connected to the server icq.mirabilis.com, to port UDP 4000.

A year later, by December 1997, there were client applications for Windows 3.1x, 95, NT and Macintosh. The total number of users exceeded 5 million, the daily audience reached 1.3 million, and 300,000 users were online at the same time. Today it seems ridiculous against the background of social networks and instant messengers in every mobile phone. But, for a minute - 1997, the Internet through dial-up, no broadband access to you, pagers are mostly available from a wide range of mobile gadgets.
')
In 1998, ICQ user base every three weeks increased by 1 million people. Almost explosive growth of the audience forced developers to quickly develop the client and the ICQ protocol. In the version of ICQ 98, the microblogging function appeared, in 98SE - the repeated sending of undelivered messages.

In mid-1998, Mirabilis was taken over by AOL (America Online) for $ 407 million.

Only 2.5 years after its appearance, ICQ Version 99a has finally acquired the minimum gentlemanly set of functions: saving the history of correspondence, searching for users, sending emails, creating groups in the contact list, and so on.

The ICQ protocol combined the features of p2p and client-server architectures. Initially, encryption was not used at all, that is, the data was transferred to the open. And indeed, the first few versions of the protocol were leaky, like a sieve .

By the time ICQ 99b was released, the fifth version of the protocol was already running. It is necessary to clarify that the very first version was not used in public releases, that is, ICQ was formally published with the second version of the protocol. The third version has a checksum check, an example of a packet header:

2 Bytes  - This is the Version of the protocol = 03 00 (Major, Minor) 
2 Bytes  - This is the Function code.  The ones I know are listed below. 
2 Bytes  - First Sequence Code    \ These are usually the same 
2 Bytes  - Second Sequence Code   / 
4 Bytes  - This is the user ID of the client user 
4 Bytes  - These four bytes are ICQ's weak attempt at security: 
           to get these do the following: 
    check1 = ( data[8] << 24) | ( data[4] << 16 ) | ( data[2] << 8 ) | ( data[6] ); 
    offs1 = Random % length;  // offset into packet 
    offs2 = Random % 256;     // offset into magic data 
    check2 = ( offs1 << 24 ) | !( data[offs1] << 16 ) | ( offs2 << 8) | !( magic[offs2] ); 
    check = check1 ^ check2;  // XOR the two checks

2 Bytes   - Version Number (not Encrypted) = 04 00 (Major, Minor) 
2 Bytes   - Random number (Not Encrypted) 
  ***** Everything from this point to the 1/4 mark is encrypted ***** 
2 Bytes   - Always 00 00 un-encrypted 
          - Since the key is xored to encrypt - whatever numbers are here 
            are the first 2 bytes of the encryption Key. 
2 Bytes   - Command Code. 
2 Bytes   - First Sequence Code 
2 Bytes   - Second Sequence Code 
4 Bytes   - User ID Number 
4 Bytes   - This is a Checksum. It is calculated the same as above 
          - The packet is encrypted by XORing 1/4 of the packet with a key 
          - The Key is calculated by multiplying the length * 0x66756B65 and 
            adding the check value.

                        1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3 
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
   |       4       |      0        |           RANDOM              | 
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
        Everything below this point is encrypted 
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
   |           ZEROS               |           COMMAND             | 
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
   |          SEQUENCE             |         SECOND SEQUENCE       | 
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
   |                              UIN                              | 
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
   |                             CHECK                             | 
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

, IP, TCP-, . - . UDP.

, , TCP- -. IP .