Talk:/shared2/wc24/mbox

theorbtwo may be working on a vff extractor. vff is used for the wc24(recv|sent).mbx files. Apparently it's like a FAT filesystem, minus a table at the beginning, and some extra stuff -- just far enough from a normal FAT to make it annoying. CarstenK 03:12, 22 August 2008 (UTC)

---

Sample base64 decoded x-wii-picture: Media:X-wii-picture-sample1.zip

I don't think this is a quasi-jpeg with a simple transformation like GC THP Video.

Some repeating 7-nybbles in a base64 decoded x-wii-picture, nothing exciting yet. --CarstenK 05:16, 14 August 2008 (UTC)

$ xxd -c7 -g7 b0000268a.wii
0000000: 414a5047460e42 AJPGF.B
...
0000069: bf47ed3c78f1e3 .G.<x..
0000070: c78f1e3c78f1e3 ...<x..
0000077: c78f1e3c78f1e3 ...<x..
000007e: c78f1e3c78f1e3 ...<x..
0000085: c78f1e3c78f1e3 ...<x..
000008c: c78f1e3c78f1e3 ...<x..
0000093: c78f4e552a1317 ..NU*..

RGB4A...2??

...
0000157: bed05ecc62f37c ..^.b.|
000015e: fcbc78f1e3c78f ..x....
0000165: 1e3c78f1e3c78f .<x....
000016c: 1e3c78f1e3c794 .<x....
0000173: 68d1470ae413c7 h.G....

...
00001ce: 3cdc85e4abc838  <.....8
00001d5: 60a35ebe3c79be  `.^.<y.
00001dc: 3c78f1e3c78f1e  <x.....
00001e3: 3c78f1e3c78f1e  <x.....
00001ea: 3c78f1e3c78f1e  <x.....
00001f1: 5e5e708288209e  ^^p.. .
00001f8: 3c2af28be05e5e  <*...^^
...
00002ca: 4846404a4c395a  HF@JL9Z
00002d1: 46463878a2c882  FF8x...
00002d8: 08abe828b24912  ...(.I.
00002df: b286abcbca4e56  .....NV
00002e6: 262b0f10613918  &+..a9.
00002ed: e231c288aaa838  .1....8
00002f4: 45417c8ccd0834  EA|...4
00002fb: 12b206ac5e7e8b  ....^~.
0000302: da78f1e3c78f1e  .x.....
0000309: 3c78f1e3c78f1e  <x.....
0000310: 3c78f1e3c78f1e  <x.....
0000317: 3c78f1e3c78f1e  <x.....
000031e: 3c78f1e9488b44  <x..H.D
0000325: c4022a118f1468  ..*...h
...
0000690: 5f76fbc6284a86  _v..(J.
0000697: 3f47e3d3e3c78f  ?G.....
000069e: 1e3c78f1e3c78f  .<x....
00006a5: 1e3c78f1e3c7bb  .<x....
...
00006f9: 1e3c78f1e3c78f  .<x....
0000700: 1e3c78f1e3c78f  .<x....
0000707: 1e3c78f1e3c78f  .<x....
000070e: 1e3c78f1e3c78f  .<x....
0000715: 1e3c78f1e3c78f  .<x....
000071c: 1e3c78f1e3c78f  .<x....
...
00007b6: 9f1e3c78f1e3c7  ..<x...
00007bd: 8f1e3c78f6b186  ..<x...
00007c4: 63139ae5b1a404  c......
...
0000a6b: e47a7bf37c79f8  .z{.|y.
0000a72: f1e3c78f1e3c78  .....<x
0000a79: f1e3c78f1e3c79  .....<y
0000a80: 7978f3f3f1e3c7  yx.....
0000a87: 8f1e3c78f1e3c7  ..<x...
0000a8e: 8f1e3c78f1e3c7  ..<x...
0000a95: 8f1e3c78f1e3c7  ..<x...
0000a9c: 8f1e3c78f1ede3  ..<x...
0000aa3: 00c6338d7183c8  ..3.q..

xxd -c7 -b -g7 b0000268a.wii

Another base-64 decoded email from N containing a (nested?) U8 archive with what looks like a compressed text message and photo thumbnail:

• letter_LZ.bin
• thumbnail_LZ.bin

$ xxd  a0000268.wii 
0000000: 55aa 382d 0000 0020 0000 0044 0000 0080  U.8-... ...D....
0000010: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000020: 0100 0000 0000 0000 0000 0003 0000 0001  ................
0000030: 0000 0080 0000 5d80 0000 000f 0000 5e00  ......].......^.
0000040: 0000 08dc 006c 6574 7465 725f 4c5a 2e62  .....letter_LZ.b
0000050: 696e 0074 6875 6d62 6e61 696c 5f4c 5a2e  in.thumbnail_LZ.
0000060: 6269 6e00 0000 0000 0000 0000 0000 0000  bin.............
0000070: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000080: 1080 7b01 0055 aa38 2d00 0000 200b 0000  ..{..U.8-... ...
0000090: 0119 0003 4000 0ba0 025a 0170 100b 000b  ....@....Z.p....
00000a0: 500e 0b00 3305 a030 2f12 1033 1500 0013  P...3..0/..3....
00000b0: 8010 0000 6c10 3f25 0000 7f43 c040 1735  ....l.?%...C.@.5
00000c0: 0000 9210 1e10 570a 4500 00a7 005f 7e10  ......W.E...._~.
00000d0: 6355 1800 0125 002f 2017 6500 0150 3a00  cU...%./ .e..P:.
00000e0: 2f08 107b 7500 0143 a100 8e30 1087 8500  /..{u..C...0....
00000f0: 0173 008f 8000 1769 6d67 006d 795f 004c  .s.....img.my_.L
0000100: 6574 7465 725f 610a 2e74 706c 800f 62c0  etter_a..tpl..b.