Some investigation on packets, mostly the same as rof2 / laurion but not entirely.

obr/packets/login/LoginAcceptedDecrypted.txt

@@ -0,0 +1,23 @@
+struct LoginBaseReply
+{
+    u8 success;
+    s32 error_string_id;
+    char error_string[];
+};
+
+struct Packet
+{
+    LoginBaseReply reply;
+    u8 unknown1;
+    u8 unknown2;
+    u32 loginserver_id;
+    char key[11];
+    u32 failed_attempts;
+    u8 show_player_count;
+    u32 offer_min_days;
+    s32 offer_min_views;
+    char username[];
+    char unknown[];
+};
+
+Packet p @ 0x00;

obr/packets/login/OP_ExpansionList.txt

@@ -1 +1,22 @@
-// 0x30
+// 0x31
+
+struct Expansion
+{
+    u32 index;
+    u8 owned;
+    s32 expansion_name_string_id;
+    s32 order_string_id;
+    s32 unknown_string_id;
+    u32 unknown17;
+    
+};
+
+struct Packet {
+    u32 unknown00;
+    u32 unknown04;
+    u16 unknown08;
+    u32 expansion_count;
+    Expansion expansions[expansion_count];
+};
+
+Packet packet @0x00;

obr/packets/login/OP_LoginAccepted.txt

@@ -0,0 +1,18 @@
+// 0x19
+
+#include <std/mem.pat>
+
+struct LoginBase
+{
+    u32 sequence_id;
+    u8 compressed;
+    u8 encrypt_type;
+    u32 unknown08;
+};
+
+struct Packet {
+    LoginBase base;
+    u8 payload[std::mem::size() - $];
+};
+
+Packet packet @0x00;

obr/packets/login/OP_PlayEverquestRequest.txt

@@ -0,0 +1,20 @@
+// 0xd
+
+struct LoginBase
+{
+    u32 sequence_id;
+    u8 compressed;
+    u8 encrypt_type;
+    u32 unknown08;
+};
+
+struct Packet {
+    LoginBase base;
+    u32 server_id;
+    char fingerprint[];
+    u32 unknown1;
+    u8 unknown2;
+    u32 unknown3;
+};
+
+Packet packet @0x00;

obr/packets/login/OP_PlayEverquestResponse.txt

@@ -0,0 +1,19 @@
+// 0x23
+
+struct LoginBase
+{
+    u32 sequence_id;
+    u8 compressed;
+    u8 encrypt_type;
+    u32 unknown08;
+};
+
+struct Packet {
+    LoginBase base;
+	u8 success;
+    u32 login_server_string_id;
+    char login_server_string;
+    
+};
+
+Packet packet @0x00;

obr/packets/login/OP_ServerListRequest.txt

@@ -0,0 +1,15 @@
+// 0x04
+
+struct LoginBase
+{
+    u32 sequence_id;
+    u8 compressed;
+    u8 encrypt_type;
+    u32 unknown08;
+};
+
+struct Packet {
+    LoginBase base;
+};
+
+Packet packet @0x00;

obr/packets/login/OP_ServerListResponse.txt

@@ -0,0 +1,44 @@
+// 0x1a
+// work in progress
+
+struct LoginBase
+{
+    u32 sequence_id;
+    u8 compressed;
+    u8 encrypt_type;
+    u32 unknown08;
+};
+
+struct Realm
+{
+    char address[];
+    u32 port;
+    u32 server_category;
+    //not sure yet, seen 289 on a lot of classic servers
+    //41 fangbreaker, teek, oakwynd, tormax
+    //31 yelniak
+    //33 vaniki, mischief
+    u32 status_code; 
+    u32 server_id;
+    char name[];
+    char language[];
+    char region[];
+    char server_type_desc[];
+    char server_desc[];
+    u32 server_flags;
+    u32 players_online;
+    u32 expansion; //I think
+    u32 truebox_max_clients;
+};
+
+struct Packet {
+    LoginBase base;
+    
+    u8 success;
+    u32 login_server_string_id;
+    char login_server_string[];
+    u32 realm_count;
+    Realm realms[realm_count];
+};
+
+Packet packet @0x00;

obr/packets/login/OP_Unknown03.txt

@@ -0,0 +1,17 @@
+// 0x03
+// I'm not sure what this packet is, it sends right after play everquest response it sent client->server
+
+struct LoginBase
+{
+    u32 sequence_id;
+    u8 compressed;
+    u8 encrypt_type;
+    u32 unknown08;
+};
+
+struct Packet {
+    LoginBase base;
+    
+};
+
+Packet packet @0x00;

obr/packets/login/decrypt.py

@@ -0,0 +1,27 @@
+import argparse
+from Crypto.Cipher import DES
+
+def decrypt_hex_string(hex_data):
+    raw_hex = "".join(hex_data).replace(" ", "")
+    
+    try:
+        encrypted_bytes = bytes.fromhex(raw_hex)
+    except ValueError:
+        return "Error: Input is not valid hexadecimal."
+
+    key = b'\x00' * 8
+    iv = b'\x00' * 8
+    
+    cipher = DES.new(key, DES.MODE_CBC, iv)
+    decrypted_bytes = cipher.decrypt(encrypted_bytes)
+    
+    return decrypted_bytes
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description="Decrypt EQ Default Encryption.")
+    parser.add_argument("data", nargs="+", help="The data hex string to decrypt")
+    args = parser.parse_args()
+    result = decrypt_hex_string(args.data)
+
+print("--- Decrypted Data ---")
+print(f"Data: {result.hex(' ').upper()}")