Sunday, April 13, 2008

Friday, 13th July 2012, 12:00 GMT - the apocalypse is about 5 months closer than mayans believed


Maya were possibly the first to have their calendar end in 2012 , but sure they weren't last.
Today i found that popular internet telephony program Skype followed the trend.
On Friday, 13th July 2012, 12:00 GMT , the skype's time counter gonna overflow ! Or at least its gonna enter the New Byte Epoch, or how skype developers call their equivalent of mayan "Galactic Day".
(Unfortunately, skype seem to use server time to store timestamps, rather than client computer's own clock time. I tried setting time to past 13th July 2012, 12:00 GMT, but the times in the log were correct times of today. We'll either have to wait till 2012 to see what happens, or reverse engineer skype's binaries, or set up some fake server, or something like that.)
More on this:

There wasnt any good tools avaliable for converting skype logs (which are binary) to text, and i needed to convert a few logs, so i had to write tool myself.

On my website, you can get more information about skype chat log format.
Development of tool:
Extracting sender and messages themselves from logs was easy, the harder part was decoding message timestamps.
I found that timestamp is stored in 4 bytes, and all bytes have their first (sign) bit set, which looked quite weird. Ignoring first bits and interpreting it as 28-bit number, i got some number that looked like number of seconds since some date.
Then, comparing time to skype timestamp, i found that e.g. 2008-04-12 17:33:43 corresponds to skype timestamp 134276281
From now on finding times was easy job :-)
Standard unix epoch time (seconds since 1970) for [2008-04-12 17:33:43] is 1208021623, and the difference between standard and skype's timestamps is about 1073745342 . In other words, skype's timestamp is number of seconds since approximately Sat 10 Jan 2004 14:35:42 (the difference converted to human readable format).
That date and time looks like pretty strange choice of time to count seconds from. Not a midnight or midday...
I got curious, when does it overflow? As quick calculation showed, it overflows on friday 13th july 2012 , 12:00 GMT (my time was few seconds off, but thats allright). Which is obviously by design.
So, i thought, wow, thats first class blogging material! So there we go :)

This also explained weird thing about first bits of all bytes being set. If you interpret the bytes as signed 8 bit numbers, they're all negative. So if you add them like first byte + second byte*27 + third byte*214+fourth byte*221, you get negative number which is number of seconds to friday 13th july 2012 , 12:00 GMT

This also means that skype timestamps will probably continue working after friday 13th july 2012 , 12:00 GMT , just they wont have first bits set anymore.

For geek readers, in skype (version 2.0.0.13 for linux, at least) the timestamps in skype .dbb files are fairy easy to spot in hex viewer. Them are placed between list of people in the "chatroom", and the sender's skype name. The timestamp is prefixed with E5 03 . It is 4(?) bytes long. The fifth byte after those four is always equal to 4 so i dont know if fifth is part of timestamp and timestamp is actually 5 bytes long, or fifth byte is just some sort of delimeter or control character. It is followed by 03 , like all other skype's delimiters, so i think it probably is just a delimiter.

p.s. i used http://www.epochconverter.com/ to convert seconds to time and back during testing.

p.p.s if you found this interesting, visit my website on http://dmytry.pandromeda.com

No comments: