9

I am trying to replay a WebEx stream I have previously watched from temp files that were created when I originally watched the stream.

The original link to the stream no longer works and there was never a download link to save an .arf file.

It appears that when you stream a WebEx session from a link (and perhaps live, I have not tried) it creates a folder in your %temp% location with an 8 digit name (52431122 for example). In that folder are a handful of files beginning with wbxcbr_ and wbxmcsr_ with .std, .dat, .conf and .idx extensions. Two of the .dat files are the largest by far and presumably contain the video and audio information.

I have tried renaming all of the files in the folder one at a time to .avi, .mp4, .mp3 and .arf for playback in VLC and the WebEx Network Recording Player with no luck. I have also tried converting them to .mp3 and .mp4 with ffmpeg for playback with no luck.

I am happy to play back the stream using the WebEx software if there is a way to convert the files into a .arf file, but am willing to save/convert the files in to any playable format at this point.

Giacomo1968
  • 58,727
1hit1der
  • 91

2 Answers2

7

On Rooted CON 2015 Abel Valero presented great video with reversing WebEx data.

To simply get *.arf you can run Abel rebuild tool from GitHub.

After that you can use WebEx Network Recording Player to convert *.arf file to appropriate video format (.wmv, .swf or .mp4)

How to use steps

If you already have WebEx temp files - just start from Step 5. If not - start from Step 1.

  1. Open WebEx session in browser and follow the steps to install "WebEx Network Recording Player". Wait until video will be downloaded. There is a blue buffering indicator and it should be 100%
  2. Download Process Monitor - it's a program from SysInternals Suite and install it
  3. Run "Process Monitor" and adjust filters to show capturing from "Network Recording Player". I used following contains filter for that: "ProcessName" contains "NRB"
  4. Look into process nbrplay.exe disk activity and obtain temporary folder path. Usually it's folder: %windows%\Users\%username%\AppData\Local\Temp\<several digits>
  5. Copy contents of WebEx temp folder somewhere when full recording is downloaded (Step 2 - buffering indicator is 100%)
  6. Download util from here as a compiled executable (password is webex) or compile / adjust it to your needs
  7. Run rebuild.exe, provide path from Step 5 into field Ruta: and press Go (it's a Spanish utility)
  8. Wait for rebuild process - usually up to 10 sec. Util will save file with extension *.arf in the folder where utility itself is located
  9. Open resulted *.arf file in the Network Recording Player: File > Open
  10. Convert video to appropriate format for offline viewing File > Convert Format (usually *.wmv or *.mp4)
Yuriy Kramar
  • 71
-2

Saturnix, try https://github.com/Piriaco/rebuildwebex this is another fork for the original one

televisi
  • 7