Hacking Bulletin Board/Mail Photo storage location

[berger20]

Are the pictures games 'mail' to your Wii mailbox stored on the permanent memory?
You can't send pics to a PC (if it let you I wouldn't need to ask), tried making a copy and sending that (didn't work)
Searched for homebrew that can extract/save pics to SD or local network (no-one wrote one)

So Ihad a mini-brain-wave, NAND dump the memory and search through the pics in there.
It's not completed yet but I'm near certain it will be encrypted and hard to find, that where I'm gonna need the help:
- Where is the location of the Images
- And how do I convert them to normal PC images; .jpeg/.bmp/.gif/.png etc...
(Hopefully they use the same encryption from SSB Brawl)

Thanks (p.s. Sorry if asked before, it's just no-one had an answer)

p.p.s: Can some clever person please write some homebrew that can copy the Bulletin board/wii mail images to an SD card!!!
(Whilst searching for a solution i found others wanting to do the same thing, atleast 7 people (+ me) are desperate for an easy solution)

 

[FGOD]

you can at least put your mail into your wii contacts and send it to pc that way...

 

[bdr9]

/shared2/wc24/mbox/wc24recv.mbx
/shared2/wc24/mbox/wc24send.mbx

Hope this helps...

 

[berger20]

I does help bdr9.

Though still no luck, tried Novasoft Extractor, 7-Zip, renaming to image formats and SSB Brawl Snapshot Decryper creates a .jpg 4 times biger than the original, buta sadly not view-able.

Now I know a file type and found my mail I can do some more googling, I'll report back if i find anything.

 

[berger20]

OK update:

I found another person who wants a converter, he wants it for metroid prime 3 pics (this doubles my needs as i'm get the trilogy disc in sept)
anyways:
- Wii game messages we're in the WC24RECV.MBX file (joy, its maxed out to 7Mb even if its empty, it nearly gave Notepad a heart attack)
- Someones post mention decoding base64, it created a .bin but still no image when run through SSBBrawl Decrypter
Website if it helps: "http://www.opinionatedgeek.com/dotnet/tools/Base64Decode/"
- From the stuff Notepad could make out, i found out the images are called a0000???.wii, possibly the higher the number the more recent the game the image is from)

Some success:
- Filext.com said that .mbx is an Eurdora mailbox file, i downloaded the program and added the .mbx's to the directory where the programs pre-configured .mbx's
were.
Then open the program (PC or Mac) and the mailboxes are readable, but its only the text
But it does get rid of the filler data, arranges the text properly and retains addresses/details of the mailer. So if you just want text copies Eudoras a good program for it.

........Off to do more research

 

[bdr9]

Try getting the jpeg data encoded in base64, paste it into the site you mentioned above, and rename the .bin file to a .jpg file. Let me know.

 

[SifJar]

that's the site he linked above.

 

[bdr9]

that's the site he linked above.

Oh you're right. Let me edit it.

 

[Helsionium]

You're barking up the wrong tree. The two files posted earlier in this thread contain only the most recent messages - it's some sort of temporary mailbox. All message board data is actually archived in the 20MB file cdb.vff, which is in the System Menu data folder (IIRC, that was /title/00000001/00000002). The author of Playstats has done some work reverse-engineering the format of cdb.vff (but not the images and messages contained therein). If the message board data archive grows too big, the oldest content can be archived to an SD slot, where all messages are stored in seperate files in a more easily understandable folder structure.

 

[bdr9]

You're barking up the wrong tree. The two files posted earlier in this thread contain only the most recent messages - it's some sort of temporary mailbox. All message board data is actually archived in the 20MB file cdb.vff, which is in the System Menu data folder (IIRC, that was /title/00000001/00000002). The author of Playstats has done some work reverse-engineering the format of cdb.vff (but not the images and messages contained therein). If the message board data archive grows too big, the oldest content can be archived to an SD slot, where all messages are stored in seperate files in a more easily understandable folder structure.

Oh. Is that file formatted similar to the way those two flies are formatted?

 

[Helsionium]

Sorry, I don't have my NAND FS dump with me now, but I believe it's another format. At the very least, it's not encrypted and messages are still base-64 encoded IIRC. You should be able to extract the images manually with a hex-editor, if there are no other tools available.

 

[bdr9]

Well I find things like this:

.…,Ç.....T.o.d.a.y.'.s. .A.c.c.o.m.p.l.i.s.h.m.e.n.t.s...T.o.d.a.y.'.s. .P.l.a.y. .H.i.s.t.o.r.y.....S.u.p.e.r. .M.a.r.i.o. .6.4... . . . . .0.0.:.2.1.....W.i.i. .S.p.o.r.t.s... . . . . .0.0.:.1.4.....M.a.r.i.o. .P.a.r.t.y. .8... . . . . .0.1.:.3.2.....T.o.t.a.l. .P.l.a.y. .T.i.m.e... . . . . .0.2.:.0.7................03_0.çÔ0........ßèy..S.u.p.e.r. .M.a.r.i.o. .6.4.........................................................5'.yY+Ç.5'$å.¼'NAAE01..........................+%¥¶.W.i.i. .S.p.o.r.t.s.................................................................5'%N“ÐÄ.5'1W.4yRSPE01..........................è‰L..M.a.r.i.o. .P.a.r.t.y. .8...........................................................5'4.7Uö.5'‚\Èm:RM8E01..

How would I search for jpeg image areas?

 

[Helsionium]

The JPEG files are probably base-64 encoded. Base-64 encoded data looks like random strings of characters (only capital and small letters, numbers, +, / and =). They always end with "=" and do NOT have spaces in between the characters (that's Unicode encoding for text!).

You should try to decode images from wc24rcv.mbx first. The encoding should be the same, because base-64 is the standard encoding for email attachments.

 

[Helsionium]

sry, double post

 

[bdr9]

No they actually are not encoded in base64 in cdb.vff. It's not encoded at all. I am looking at them right now. Each image starts with "41 4A 50 47 5A", which is "AJPGZ", and then a bunch of other stuff. How can I get the image into a viewable format from here?

 

[Helsionium]

I don't have the file right now and it's getting pretty late here, too. I'm going to bed now, but maybe someone else can help you. Sorry...

 

[bdr9]

Ok. ANYONE? Who knows how to get the AJPGZ files????????

 

[berger20]

Wow, i'm so impressed my question has got so much of a response.

Replies:

"If the message board data archive grows too big, the oldest content can be archived to an SD slot, where all messages are stored in seperate files in a more easily understandable folder structure."

- I could pad out my mailbox until the images i want get pushed to the SD card, but my god is that gonna be a lot of work. I don't fancy editing my NAND either.


One thing, it's late-ish here in England so i'll save this either til the morn but a little search popped up this:
"AJPG is a "22fps JPEG-based codec used for movie capture by some digital cameras." --------- Could the image infact be a single frame video?
It could explain why it decrypts 4 times larger than it original form....?
= ("http://wiki.multimedia.cx/index.php?title=AJPG")

Finally for tonight, places that are also researching/discussing this:
- http://wiibrew.org/wiki//shared2/wc24/mbox
- http://softdev.tehskeen.com/forums/showthread.php?p=38409
- http://bigredpimp.wordpress.com/2008/01/22...age-header-fun/
- http://wiibrew.org/wiki/Playstats

It's so sad that it's not been cracked, homebrew has come so far on the Wii...:'o(

 

[berger20]

More details:

- .VFF's mainly relate to pictures but the file contains more than just pictures so it's not a image format, but it could be a: Vextus Factor Compiled Storage File.
It certainly is a storage of some type; it continas both text and images

- Tried JPEG Recovery v2.0 on both images from WC24RECV.MBX and CDB.VFF = no luck, they weren't even recognized

- Longshot but I tried treating them as 1 frame videos, VLC couldn't play them

- I think looking towards SSB Brawl Snapshot Decrypter isn't going to work either, the .bins from SSBB look completely different to the onces posted in mail

- Despite someones earlier post, images can and are encoded in base64 format (in the.MBX's only), the following website details base64 encoded images and states that they can be decrypted live in some web browsers, but I have no idea how, plus it still probably won;t generate a viewable image.
(http://dean.edwards.name/weblog/2005/06/base64-ie/)

- Tried 'Base64 De-Encoder v1.2' but it only converts away from base64 images and not the encoding the AJPG's are,
the results were not a displayable image

- Intresting but perhaps not useful; from WC24RECV.MBX, I found only 1 image, encrypted in base64, but from CDB.VFF i found both images (decrypted) even though I had received both minutes between each other, so the mail in the WC24RECV.MBX must be a very temporary storage, CDB.VFF is the way to go.

Finally reply:

bdr9 = 'Who knows how to get the AJPGZ files?'
My files are AJPGPB, this string turned up nothing via google so it's safe to assume that AJPG is as far as the specific image information goes,
anything beyond that is either data of the image or other details stored in headers