Replaying WebEx stream from %temp% files?

Solution 1:

On Rooted CON 2015 Abel Valero presented great video with reversing WebEx data.

To simply get *.arf you can run Abel rebuild tool from GitHub.

After that you can use WebEx Network Recording Player to convert *.arf file to appropriate video format (.wmv, .swf or .mp4)

How to use steps

If you already have WebEx temp files - just start from Step 5. If not - start from Step 1.

1. Open WebEx session in browser and follow the steps to install "WebEx Network Recording Player". Wait until video will be downloaded. There is a blue buffering indicator and it should be 100%
2. Download Process Monitor - it's a program from SysInternals Suite and install it
3. Run "Process Monitor" and adjust filters to show capturing from "Network Recording Player". I used following contains filter for that: "ProcessName" contains "NRB"
4. Look into process nbrplay.exe disk activity and obtain temporary folder path. Usually it's folder: %windows%\Users\%username%\AppData\Local\Temp\<several digits>
5. Copy contents of WebEx temp folder somewhere when full recording is downloaded (Step 2 - buffering indicator is 100%)
6. Download util from here as a compiled executable (password is webex) or compile / adjust it to your needs
7. Run rebuild.exe, provide path from Step 5 into field Ruta: and press Go (it's a Spanish utility)
8. Wait for rebuild process - usually up to 10 sec. Util will save file with extension *.arf in the folder where utility itself is located
9. Open resulted *.arf file in the Network Recording Player: File > Open
10. Convert video to appropriate format for offline viewing File > Convert Format (usually *.wmv or *.mp4)