KingAnt.net This space left blank intentionally. 
Oscar Protocol Documentation | Random Pidgin Files

Oscar Protocol Specification: Family 0x0017, Subtype 0x0005

unfinished

This is the SNAC sent back from the auth server after you request a new ICQ number. An empty channel 4 FLAP is also sent by the auth server directly after this SNAC (empty FLAPs are a signal to close the connection).

Thanks to Sean Egan and the licq source code for pretty much all of this.

Source: Server

LengthDescription
2 bytesFamily (0x0017)
2 bytesSubtype (0x0005)
2 bytesFlags
4 bytesSnac Request ID
2 bytes0x0001
2 bytesLength L of the following
L bytesThe ICQ registration info. All chunks are in, uh, network byte order, I guess. (The number "5" is sent as "x05 00")
LengthDescription
2 bytes0x0300
4 bytes0x0000 0000
2 bytes0x2d00
2 bytes0x0300
2 bytes0x0000
2 bytes0xff58
2 bytes0xd03d
2 bytes0xa7ba
2 bytes0x0000
2 bytes0x0004
2 bytes0xec38 0000 - The same random cookie from the request
4 bytes0x0000 0000
4 bytes0x0000 0000
4 bytes0x0000 0000
4 bytes0x0000 0000
4 bytes0x2dc5 2b09 - Your brand spankin' new ICQ number (remember, this is network byte order, so in real hexidecimal this is actually 0x092b c52d, which is 153,863,469 in decimal)
2 bytes0xec38 0000 - The same random cookie from the request
2 bytes0x0000

All material Copyright © 2000-2014, All Rights Reserved
Linux is a registered trademark of Linus Torvalds.
AIM is a registered trademark of America Online, Inc.
ICQ is a registered trademark of ICQ Inc.
All other trademarks are property of their respective owners.