yahoo! messenger archive format
———————————————-
yahoo messenger archive format
by: shinkaiho 8/06/2007 (no confrence support)
used: hex workshop v3.11 & archive logs
———————————————-
dword - timestamp
word - message or confrence (6 message)
word - padding
word - you or friend (0 = you 1 = friend)
word - padding
word - size of message
word padding
message - use ^ (xor) to decrypt the message… the key is the owner of the archives username
dword padding
repeat for each message
————-
c++ structure
————-
struct message
{
DWORD timestamp;
WORD type;
WORD pad1;
WORD who; //0 you 1 friend
WORD pad2;
WORD size;
WORD pad3;
};
———————————-
junk used to figure the format out
———————————-
04 5B 11 1E 43 1C 1C 17
f u c k
Bruce (8/6/2007 11:41:06 AM): fuck you
b.ruces
b ^ 4
r ^ 5b
f
1241B746060000000000000008000000045B111E431C1C1700000000
Bruce (8/6/2007 11:41:06 AM): fuck you