Luigi Auriemma

From what I gather from your code is that the password is xor'ed then base64 encoded into the .ini file , the key that is used for the xor, what is it in plaintext? also what is the old_mode used for

the password is simply xored with that sequence of 16 bytes and then encoded with base64.

I can't show it in "plain-text" because they are non-printable chars so that one used in the tool is the sequence in hexadecimal.

the old_mode was used in old versions of Trillian and the difference is in the fact that it wasn't encoded in base64

originally it was decoded this way,http://www.nettwerked.net/trillian.txt, so your saying that all I had to do was xor the password with that string and it would have decoded it without using a lookup table?

http://www.google.com/search?q=%22\xF3\x26\x81\xC4\x39\x86\xDB\x92\x71\xA3\xB9\xE6\x53\x7A\x95\x7C%22%2C

looks like that string is used for icq/aim signed on passwords too :D

also , i just downloaded Astra, I saved 2 IM accounts but I dont see where their passwords are saved to , the old version used to have aim.ini,yahoo.ini,msn.ini but i dont see those files in the new version, all I see is the Astra user/pass in accounts.ini in the global folder which can be base64 decoded to the old xor scheme. so im guessing it doesnt save the IM passwords locally anymore?

I don't remember if and where the singular IM passwords are saved because I worked on this stuff some months ago.
anyway yes it's a simple xor so is stupid to use a lookup table for something mathematical, and the recent versions of astra have base64 applied on the encoded password as I said in my previous post