Comments on: Yahoo! messenger archive file format

By: Rajiv

Rajiv — Fri, 30 Apr 2010 07:48:43 +0000

Hi Kyle, thanks for the note!

The blog entry does not discuss the file format in detail. One of the details not documented being the format in which an integer is stored/read.

The attached file Parser.java is a more “complete reference” (to the extent I have understood). If you see the readInt method in the file you will notice the bytes are read in reverse like you mentioned.

By: Kyle E. Domingo

Kyle E. Domingo — Tue, 27 Apr 2010 06:04:21 +0000

Just to inform you guys, I tried to code a reader for YM archives but this format (though the segments are still the same) is already not applicable in my current YM version (9.0.0.1912). For this version, bytes in each segment is reversed.

For example, the four byte representation of the timestamp now (1272351546) is 4B D6 8B 3A. This is encoded in the archive file as 3A 8B D6 4B. same goes for the to_or_from, the message length (example, 0200 0000 for a 2 letter message), and i think, the message as well.

By: Joe Dassin

Joe Dassin — Sat, 26 Dec 2009 16:03:20 +0000

Ok can someone do it the other way around ? I mean a YIM! Archives ENCODER …..

By: KermodeBear

KermodeBear — Thu, 01 Oct 2009 03:39:09 +0000

It doesn’t make sense for the message length to be 1 byte, since messages can be over 256 characters in length. I’m also not convinced that the timestamp is 5 bytes either – it may be, but when I have decoded the archive files, the time stamps have always been accurate.

That said, I haven’t tested this on the newest versions of the Yahoo! IM software, so something might have changed. Maybe it’s time to give it another go around and see what happens. (o:

By: JSG

JSG — Thu, 06 Aug 2009 15:56:46 +0000

I think the format is actually:
———————————
1. timestamp (5 bytes)
2. padding (3 bytes)
3. toOrFrom (1 bytes)
4. padding (3 bytes)
5. mesg_len (1 bytes)
6. padding (3 bytes)

Some of that is up for debate but the timestamp is definitely 5 bytes.

By: KermodeBear

KermodeBear — Mon, 01 Dec 2008 05:48:13 +0000

Seems that the ‘code’ tag still hates less-than symbols inside. Tsk tsk. Giving this another try.

#/usr/bin/php /** * Usage: * ./decodeYahoo.php account contact file * * 'account' is the Y!M account name. * 'recipient' is the name of the contact * 'file' is the file to parse. * * Please note: There is no error checking * in the code below. If you want to use * this code for anything important, please * add some. Also, fopen/fread would be more * memory efficient than a file_get_contents, * but again, I'm being super lazy today. (o: */


$account = $argv[1];

$contact = $argv[2];

$data    = file_get_contents($argv[3]);

$p       = 0; // Position in the file's data.
while ($p < strlen($data)) {

    $result = array();
    $pieces = unpack('ltime/lunknown/ltoFrom/llength', substr($data, $p, $p + 16));
    $p += 16;
    $result['date'] = date('r', $pieces['time']);

    $result['to'] = $pieces['toFrom'] ? $contact : $account;

    $cypherText = substr($data, $p, $pieces['length']);
    $p += $pieces['length'];
    // Generates the XOR key by repeating the account name

    // then chopping off extra characters so the entire message

    // can be XOR in one operation.

    $key = str_repeat($to, ceil($pieces['length'] / strlen($to)));

    $key = substr($key, 0, strlen($cypherText));

    $result['text'] = $key ^ $cypherText;
    // There seems to be an extra 4 bytes of junk here.

    $p+=4;

// Nov 01, 2008 12:34 PersonTalking: That's what SHE said. echo "{$result['date']} {$result['to']}: {$result['text']}\n"; } ?>

By: KermodeBear

KermodeBear — Mon, 01 Dec 2008 05:46:21 +0000

Hey! Thank you VERY much for posting this information. I found it to be incredibly useful. I had been wanting to export my conversations with some friends to text files for quite a while, but was not interested in paying for utilities that do this. With your help I was able quickly write up some PHP to do the job. Yes, I know, PHP isn’t the ideal language for this kind of thing, but it is the language in which I am most adept.

decodeYahoo.php
#/usr/bin/php /** * Usage: * ./decodeYahoo.php account contact file * * 'account' is the Y!M account name. * 'recipient' is the name of the contact * 'file' is the file to parse. * * Please note: There is no error checking * in the code below. If you want to use * this code for anything important, please * add some. Also, fopen/fread would be more * memory efficient than a file_get_contents, * but again, I'm being super lazy today. (o: */


$account = $argv[1];

$contact = $argv[2];

$data    = file_get_contents($argv[3]);

$p       = 0; // Position in the file's data.

while ($p