9

I am trying to replay a WebEx stream I have previously watched from temp files that were created when I originally watched the stream.

The original link to the stream no longer works and there was never a download link to save an .arf file.

It appears that when you stream a WebEx session from a link (and perhaps live, I have not tried) it creates a folder in your %temp% location with an 8 digit name (52431122 for example). In that folder are a handful of files beginning with wbxcbr_ and wbxmcsr_ with .std, .dat, .conf and .idx extensions. Two of the .dat files are the largest by far and presumably contain the video and audio information.

I have tried renaming all of the files in the folder one at a time to .avi, .mp4, .mp3 and .arf for playback in VLC and the WebEx Network Recording Player with no luck. I have also tried converting them to .mp3 and .mp4 with ffmpeg for playback with no luck.

I am happy to play back the stream using the WebEx software if there is a way to convert the files into a .arf file, but am willing to save/convert the files in to any playable format at this point.

Giacomo1968
  • 53,069
  • 19
  • 162
  • 212
1hit1der
  • 91
  • 1
  • 1
  • 5

2 Answers2

7

On Rooted CON 2015 Abel Valero presented great video with reversing WebEx data.

To simply get *.arf you can run Abel rebuild tool from GitHub.

After that you can use WebEx Network Recording Player to convert *.arf file to appropriate video format (.wmv, .swf or .mp4)

How to use steps

If you already have WebEx temp files - just start from Step 5. If not - start from Step 1.

  1. Open WebEx session in browser and follow the steps to install "WebEx Network Recording Player". Wait until video will be downloaded. There is a blue buffering indicator and it should be 100%
  2. Download Process Monitor - it's a program from SysInternals Suite and install it
  3. Run "Process Monitor" and adjust filters to show capturing from "Network Recording Player". I used following contains filter for that: "ProcessName" contains "NRB"
  4. Look into process nbrplay.exe disk activity and obtain temporary folder path. Usually it's folder: %windows%\Users\%username%\AppData\Local\Temp\<several digits>
  5. Copy contents of WebEx temp folder somewhere when full recording is downloaded (Step 2 - buffering indicator is 100%)
  6. Download util from here as a compiled executable (password is webex) or compile / adjust it to your needs
  7. Run rebuild.exe, provide path from Step 5 into field Ruta: and press Go (it's a Spanish utility)
  8. Wait for rebuild process - usually up to 10 sec. Util will save file with extension *.arf in the folder where utility itself is located
  9. Open resulted *.arf file in the Network Recording Player: File > Open
  10. Convert video to appropriate format for offline viewing File > Convert Format (usually *.wmv or *.mp4)
Yuriy Kramar
  • 71
  • 1
  • 2
  • 5
  • 3
    You really should include a quick summary of how to use the tool. Videos go down, and a consise, self contained answer is always so much better. The tool on github seems to lack any form of documentation – Journeyman Geek Nov 30 '16 at 05:43
  • 1
    the tool worked for me. i then have an ARF file that can be converted further. – beta Jun 29 '17 at 06:09
  • 1
    You can edit it into your answer – Journeyman Geek Jul 19 '17 at 09:56
  • 2
    @journeyman-geek I agree - added "How to use" section – Yuriy Kramar Jul 19 '17 at 10:09
  • 1
    Is it normal that playing the ARF file doesn't have any audio? – alex88 Mar 05 '18 at 18:24
  • 1
    rebuild.exe is pretty straightforward - run the tool - small winform pops; in "ruta" put path to the folder with webex temp files; click "go" - it will create rebuild.arf file;... "Acera de" button - "About", the other one "Salir" - Exit. about webex temp files - when you started to play webex from the web, pause recording and wait till buffer is completed, you can move play indicator, but do not close the window and do not let to play till the very end. - your webex temp files will be in %tmp%/[some 9 digit folder] - copy that folder to your safe location and convert from there. – Sasha Bond Mar 05 '18 at 21:26
  • There's an updated version with working audio. See the pull request on the github repo – JavierG Nov 18 '18 at 23:22
  • The github repository is no longer online. Anyone has a working copy? – Saturnix Feb 18 '19 at 15:51
-2

Saturnix, try https://github.com/Piriaco/rebuildwebex this is another fork for the original one

televisi
  • 7
  • 2