9

I am trying to replay a WebEx stream I have previously watched from temp files that were created when I originally watched the stream.

The original link to the stream no longer works and there was never a download link to save an .arf file.

It appears that when you stream a WebEx session from a link (and perhaps live, I have not tried) it creates a folder in your %temp% location with an 8 digit name (52431122 for example). In that folder are a handful of files beginning with wbxcbr_ and wbxmcsr_ with .std, .dat, .conf and .idx extensions. Two of the .dat files are the largest by far and presumably contain the video and audio information.

I have tried renaming all of the files in the folder one at a time to .avi, .mp4, .mp3 and .arf for playback in VLC and the WebEx Network Recording Player with no luck. I have also tried converting them to .mp3 and .mp4 with ffmpeg for playback with no luck.

I am happy to play back the stream using the WebEx software if there is a way to convert the files into a .arf file, but am willing to save/convert the files in to any playable format at this point.

2 Answers 2

7

On Rooted CON 2015 Abel Valero presented great video with reversing WebEx data.

To simply get *.arf you can run Abel rebuild tool from GitHub.

After that you can use WebEx Network Recording Player to convert *.arf file to appropriate video format (.wmv, .swf or .mp4)


How to use steps

If you already have WebEx temp files - just start from Step 5. If not - start from Step 1.

  1. Open WebEx session in browser and follow the steps to install "WebEx Network Recording Player". Wait until video will be downloaded. There is a blue buffering indicator and it should be 100%
  2. Download Process Monitor - it's a program from SysInternals Suite and install it
  3. Run "Process Monitor" and adjust filters to show capturing from "Network Recording Player". I used following contains filter for that: "ProcessName" contains "NRB"
  4. Look into process nbrplay.exe disk activity and obtain temporary folder path. Usually it's folder: %windows%\Users\%username%\AppData\Local\Temp\<several digits>
  5. Copy contents of WebEx temp folder somewhere when full recording is downloaded (Step 2 - buffering indicator is 100%)
  6. Download util from here as a compiled executable (password is webex) or compile / adjust it to your needs
  7. Run rebuild.exe, provide path from Step 5 into field Ruta: and press Go (it's a Spanish utility)
  8. Wait for rebuild process - usually up to 10 sec. Util will save file with extension *.arf in the folder where utility itself is located
  9. Open resulted *.arf file in the Network Recording Player: File > Open
  10. Convert video to appropriate format for offline viewing File > Convert Format (usually *.wmv or *.mp4)
8
  • 3
    You really should include a quick summary of how to use the tool. Videos go down, and a consise, self contained answer is always so much better. The tool on github seems to lack any form of documentation
    – Journeyman Geek
    Nov 30, 2016 at 5:43
  • 1
    the tool worked for me. i then have an ARF file that can be converted further.
    – beta
    Jun 29, 2017 at 6:09
  • 1
    You can edit it into your answer
    – Journeyman Geek
    Jul 19, 2017 at 9:56
  • 2
    @journeyman-geek I agree - added "How to use" section Jul 19, 2017 at 10:09
  • 1
    Is it normal that playing the ARF file doesn't have any audio?
    – alex88
    Mar 5, 2018 at 18:24
-2

Saturnix, try https://github.com/Piriaco/rebuildwebex this is another fork for the original one

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .