decode dat file wechat

[szcf-weiya]

• check the header of dat file

  ~/WX/Image/2023-05$ xxd 0b2ee99b31a51f0bbad125843a0b8537.dat | head -1
  00000000: 1433 140b ebfb a1ad a2ad ebea eaeb eba3  .3..............
  ~/WX/Image/2023-05$ xxd 0ae3ceaa0a0a1487dd0bb3db5b9ef767.dat | head -1
  00000000: 1433 140b ebfb a1ad a2ad ebea eaeb eba3  .3..............
  ~/WX/Image/2023-05$ xxd 000b7063da30fa022a53a9dd0afb98cc.dat | head -1
  00000000: 62bb a5ac e6e1 f1e1 ebeb ebe6 a2a3 afb9  b...............

1433 is frequent.

and note that the file header of different image files are:

• jpg: FF D8 (https://www.file-recovery.com/jpg-signature-format.htm
• png: 89 50 4E 47 (https://en.wikipedia.org/wiki/PNG#File_header
• ...

julia> xor(0xffd8, 0x1433)
0xebeb

julia> xor(0xffd8, 0x62bb)
0x9d63

0xeb works for jpg file, however, it still failed when the 2nd byte is 140a,

$ xxd 070cbb2d7d54169369680ce59ef9e573.dat | head -1
00000000: 1433 140a b5e9 ae93 828d ebeb a6a6 ebc1  .3..............

julia> xor(0xebeb, 0x140a)
0xffe1

julia> xor(0xebeb, 0x140b)
0xffe0