316
edits
Changes
Jump to navigation
Jump to search
smartypants
Line 2:
Line 2:
+
+
== Files ==
== Files ==
−Message board stores:
+Message board stores, 0-padded at end:
−* wc24recv.ctl
+* wc24recv.ctl - 32768
−* wc24recv.mbx
+* wc24recv.mbx - 7340032
−* wc24send.ctl
+* wc24send.ctl - 16384
−* wc24send.mbx
+* wc24send.mbx - 2097152
=== File Format ===
=== File Format ===
Line 13:
Line 13:
* table of contents for the mbox?
* table of contents for the mbox?
* [http://en.wikipedia.org/wiki/FourCC FourCC] id: WcTf
* [http://en.wikipedia.org/wiki/FourCC FourCC] id: WcTf
+* Offests 0x80 bytes
mbx files:
mbx files:
* FourCC id: "VFF "
* FourCC id: "VFF "
−* Data seems to be stored on page boundaries of 80. Erased messages do not appear to be zeroed out so it's easy to include cruft when you're manually extracting messages. The ctl file will probably yield clues to this.
+* Erased messages do not appear to be zeroed out so it's easy to include cruft when you're manually extracting messages. The ctl file will probably yield clues to this.
+mbx files:
+* FourCC id: "VFF "
+* Erased messages do not appear to be zeroed out so it's easy to include cruft when you're manually extracting messages. The ctl file will probably yield clues to this.
* Individual messages are in mime format using base64 encoding for attachments, line endings are pc style CRLF.
* Individual messages are in mime format using base64 encoding for attachments, line endings are pc style CRLF.
* Received emails with JPG attachments are easy to spot and decode because the full headers and mime boundaries are intact.
* Received emails with JPG attachments are easy to spot and decode because the full headers and mime boundaries are intact.
* A message "You've managed to collect every trophy in the game!" (Mario Kart achievement photo) was seen but I wasn't able to decode the attachment due to "munpack: warning: Premature EOF" error. It's possible these messages get moved somewhere else once received, then marked deleted in the mbx? Or the data may not necessarily be contiguous in the mbx.
* A message "You've managed to collect every trophy in the game!" (Mario Kart achievement photo) was seen but I wasn't able to decode the attachment due to "munpack: warning: Premature EOF" error. It's possible these messages get moved somewhere else once received, then marked deleted in the mbx? Or the data may not necessarily be contiguous in the mbx.
+
=== Dissection of individual messages ===
=== Dissection of individual messages ===
Line 35:
Line 42:
After decoding the base64 data chunk:
After decoding the base64 data chunk:
−* The first five characters inside the wii-picture file are always AJPG, hints at some kind of JPEG or other compression. ZIPping the file does not reduce it's size very much further.
+* The first four characters inside the wii-picture file are always AJPG, hints at some kind of JPEG or other compression. ZIPping the file does not reduce it's size very much further.
[http://www.tehskeen.com/forums/showpost.php?p=36586 tehskeen thread]
[http://www.tehskeen.com/forums/showpost.php?p=36586 tehskeen thread]