Skype chatlogs

Skype chatlogs

Introduction

Popular voice and chat messaging program Skype stores chat logs in some rather weird binary file format, some sort of database. I had to convert those logs to plain text (for some sort of "investigation")
While decoding the log file, i noticed some curious easter egg in skype: the timestamps gonna overflow (or change format) on Friday, 13th July 2012, 12:00 GMT. Which is pretty funny indeed :-) I posted about that on my blog.

Skype chatlogs (chatmsg256.dbb , chatmsg1024.dbb , and so on)

Different chat log files (chatmsg256.dbb , chatmsg1024.dbb) have same kind of data, but contain messages of different length. You need to combine messages extracted from all chatmsg*.dbb files to get full history.
The chat logs are not encrypted in any way, however, them contain binary data so you cannot view them with text editor.
Hex editor to the rescue :-)
Sample entry from chatmsg256.dbb, with highlighting of interesting portions:



003B:AAE0 | 6C 33 33 6C   C0 00 00 00   76 3E 00 00   41 0B 00 09 | l33lÀ...v>..A...
003B:AAF0 | 09 03 E0 03   23 64 6D 79   74 72 79 6C   6B 2F 24 65 | ..à.#dmytrylk/$e
003B:AB00 | 63 68 6F 31   32 33 3B 31   38 36 37 63   38 30 35 35 | cho123;1867c8055
003B:AB10 | 32 64 31 32   37 65 34 00   00 E5 03 85   A4 82 C0 04 | 2d127e4..å..¤.À.
003B:AB20 | 03 E8 03 65   63 68 6F 31   32 33 00 00   F1 03 03 03 | .è.echo123..ñ...
003B:AB30 | FC 03 64 6D   79 74 72 79   6C 6B 20 32   30 30 38 2E | ü.dmytrylk 2008.
003B:AB40 | 30 34 2E 31   32 20 31 32   3A 34 32 3A   32 32 20 33 | 04.12 12:42:22 3
003B:AB50 | 00 00 81 04   04 00 03 AF   E6 CB 84 05   03 EC 03 45 | .......¯æË...ì.E
003B:AB60 | 63 68 6F 20   2F 20 53 6F   75 6E 64 20   54 65 73 74 | cho / Sound Test
003B:AB70 | 20 53 65 72   76 69 63 65   00 04 E2 18   20 C7 22 FB |  Service..â. Ç"û
003B:AB80 | B9 36 CC 0C   86 3C AE 0D   70 13 2F B5   29 E6 12 8B | ¹6Ì..<®.p./µ)æ..
003B:AB90 | 56 92 37 EB   E2 2C 82 18   5B A5 7E D9   F0 03 D8 18 | V.7ëâ,..[¥~Ùð.Ø.
003B:ABA0 | 65 63 68 6F   31 32 33 00   00 00 00 00   00 00 00 00 | echo123.........
003B:ABB0 | 00 00 00 00   00 00 00 00   00 00 00 00   00 00 00 00 | ................

Please note that human-readable date here is merely part of message itself
. Skype sound test service (echo123) replies to chat messages with your name, time, and echo of your message
Highlighted parts: list of skype names of people in chatroom, skype's binary timestamp, sender's skype name, message text
Notably, the data seems to be prefixed with XX 03 markers.

"Parsing" the data

Algorithm:

While theres data to read:

Skip to and including "\xE0\x03\x23"
list of skype names of people in chatroom = Read until ";"
Skip to and including "\xE5\x03"
skype's binary timestamp = Read 4 bytes
Skip to and including "\xE8\x03"
sender's skype name, = read until zero char
Skip until and including "\xFC\x03"
message text = read until zero char

Optionally, you can read other stuff like assigned "full names" of people in chat, again just by skipping and reading until specific pattern.

Timestamp format

It is very weird. The highest bits of all 4 timestamp bytes are always 1.
After some more experimenting i determined that if i toss out first bits and interpret this as 28-bit number, it gives number of seconds from some pretty nonsentical time, approx Sat 10 Jan 2004 14:35:42 GMT (skype was released somewhere around 2004)
Then i got curious when those 28 bits gonna overflow. It overflows on Friday 13 July 2012 12:00:00 GMT.
Now that sure doesnt look like random nonsentical time! :-)
This also explains why first bits are 1 . It is negative signed chars.
I tried setting date on my computer to past 13 July 2012 12:00:00 GMT, however, in the chat logs, skype still used correct time from today. Apparently, skype timestamps use server time, or time based on sender's clock, rather than your computer's local time.

Notes:

This information applies to skype 2.0.13 . Other versions of skype might have slightly, or not so slightly different format
I am not affilated with Skype Inc. or eBay in any way, and this is not official documentation.
All the trademarks are property of their respective owners.

(C) 2004..2014 Dmytry Lavrov.
Want to say something or ask some question? Contact:

[an error occurred while processing this directive]