Wireshark-users: [Wireshark-users] Extracting Windows Live Messenger (Windows Live Call) Webcam S

From: "christian" <chr1123443@xxxxxx>
Date: Sun, 17 May 2009 19:06:58 +0200
Hello,
 
I sniffed some RTP-Dynamic Packets from a Webcam Session between me and a friend.
 
I Selected "Decode As" --> RTP on the RTP Packets. In "Statistics" -> "RTP" -> "Show all streams" I see 4 Streams. 2 Streams are Payload Type 121 the other 2 Streams are Payload Type 118.
 
I uses "save payload as" to save the Payload of the 4 streams. I always saved only the forward direction.
 
Someone Told me that the new MSN Messenger uses now the VC1 Codec and not longer the ml20.
I renamed the Payload Files to *.vc1. Now ffplay can play the stream Files with payload Type 121. But it can´t play the stream with Payload Type 118.
 
The Stream Files with PT 121 are playing very very fast. The Framerate is to high. And only the upper half of the video will be correcty displayed. The lower half is only a color and pixel mixture.
I Used a Hex Editor and removed the following Character Chains from the File. "CC000000" "DC000000" and "DF000000". These 3 Character Chains are very often in this file. I Used the "replace with" feature from my Hex Editor.Now i can see the lower half of the Video File too, but it runs still to fast.
 
Theres the Character Chain "CF000000" in the File, too.But if i delete this, ffplay is unable to play the Video File.
 
It seems, that there are only a Type of Key Frames in the PT 121 Video Stream. Perhaps theres the rest of the Video in the PT 118 stream.
 
Does anyone know, how to combine this 2 Streams to one Videofile ?
Is MSN 2009 Really using VC-1 for Webcam sessions ?
 
Greetings
 
Chris