Tuesday, December 1, 2015

WeChat: script to convert and play AUD files

Months ago I had to extract WeChat chats from an iPhone 5S. I extracted the data from the device using the UFED Physical Analyzer software.

Each parsed conversation contained hundreds of audio messages with AUD extension and so I ended up with thousands of AUD files.

I don't know if something has changed in the meantime, but these files are not directly playable with a media player as they lack the proper AMR header. I then came across a blog post in Chinese that explained how to make these files readable:
After adding the right header, the AUD files can be played for instance with VLC but not in Windows Media Player. WMP doesn't support this format. AUD files have to be converted to something else in order to be played in WMP. The author of the post uses SoX to convert to the WAV format. I found that SoX tends to crash a lot when dealing with corrupted AUD files.
I preferred to use libav instead.

I mentioned WMP because it's a preinstalled media player and sometimes I have to hand in the extracted data to somebody with no admin rights on his computer (that means no way to install new software - like VLC) and with aversion to learn something new (for instance how to use a portable program to open the selected file).

In this scenario, what I did was to export a report in HTML format for each WeChat conversation using the Physical Analyzer. I then wrote a python script to:
  • convert AUD files to WAV files
  • fix the links inside each HTML report by replacing the .aud string with .wav

[UPDATE 03/April/2016]

I updated the script in order to decode audio messages compressed with the SILK codec. I've found useful information here:
You can download the script from my Github repository.