Wireshark-users: Re: [Wireshark-users] Extracting Windows Live Messenger (Windows LiveCall) Webca

From: "christian" <chr1123443@xxxxxx>
Date: Mon, 18 May 2009 21:47:59 +0200
 

Hello,
 
I sniffed some RTP-Dynamic Packets from a Webcam Session between me and a friend.
 
I Selected "Decode As" --> RTP on the RTP Packets. In "Statistics" -> "RTP" -> "Show all streams" I see 4 Streams. 2 Streams are Payload Type 121 the other 2 Streams are Payload Type 118.
 
I uses "save payload as" to save the Payload of the 4 streams. I always saved only the forward direction.
 
Someone Told me that the new MSN Messenger uses now the VC1 Codec and not longer the ml20.
I renamed the Payload Files to *.vc1. Now ffplay can play the stream Files with payload Type 121. But it can´t play the stream with Payload Type 118.
 
The Stream Files with PT 121 are playing very very fast. The Framerate is to high. And only the upper half of the video will be correcty displayed. The lower half is only a color and pixel mixture.
I Used a Hex Editor and removed the following Character Chains from the File. "CC000000" "DC000000" and "DF000000". These 3 Character Chains are very often in this file. I Used the "replace with" feature from my Hex Editor.Now i can see the lower half of the Video File too, but it runs still to fast.
 
Theres the Character Chain "CF000000" in the File, too.But if i delete this, ffplay is unable to play the Video File.
 
It seems, that there are only a Type of Key Frames in the PT 121 Video Stream. Perhaps theres the rest of the Video in the PT 118 stream.
 
Does anyone know, how to combine this 2 Streams to one Videofile ?
Is MSN 2009 Really using VC-1 for Webcam sessions ?
 
Greetings
 
Chris
 
 
 
I found some interesting Information in some BASE64 Coded MSN Protocol  Packtes. I found the SDP Information about the Stream. The PT 121 Stream is the Video Stream. The PT 118 Stream contains mostly PT 114 stream data. This is an audio Stream. (x-msrta) But we had no Audio Conversation ?!?
The Video Stream is encoded with "x-rtvc1" This is a type of VC-1 Stream.
Is there a Player for Windows or Linux which can play such Stream ? I tryed Mplayer for Windows and Linux and used a self created sdp File. But the player is unable to use the x-rtvc1 codec description in the sdp File.I tested ffplay and ffmpeg,too. But ffplay does nothing and ffmpeg always hangs if i enter a rtp adress in the command line.It doesn´t matter if theres a stream running or not. I hangs always. 
Iam Using rtpplay to replay the stream to a player or ffmpeg.
 
Sorry for my very very bad english :)
 
Greetings
 
Chris