Search code examples
fiddler

How to open .saz websocket dump?

I know .saz files are just a zip archive. However, when i try to open websocket session file (the .w file in .saz) most of values are in unknown binary format. How i can read them? when i view same .saz file in fiddler, it works well (i see normal text data from websocket session). But when i open it in notepad i get the following:

‚ю —Ѓ]CИСњЎr0ја)6»ЎњСrrж°PIЂо.7тЎ/0жв<1Єо3$©м80жв2.Е‹0­уpЇд37тЎ,§кfqюІisуП< ¤·icЕ‹,¦х8-ј¬   :ёдgc©с-/Ўв<7Ўо3l°¬*4ї¬;,ємp6єн8-«о9&¬ЊW §п)&¦хp­п:7 »}sЕ‹PI
Request-Length: 17
ID: 17
BitFlags: 0
DoneRead: 2015-02-14T09:47:35.1427680+03:00
BeginSend: 2015-02-14T09:47:35.1427680+03:00
DoneSend: 2015-02-14T09:47:35.1427680+03:00

How i can decode this?

Solution

  • The WebSocket file's format is not currently documented and direct manipulation is not supported.

    As of Fiddler 2.5.0.1, the format is as follows:

    [File Headers]\r\n
[Message 0 Headers]\r\n
[Message 0 raw bytes]\r\n
[Message 1 Headers]\r\n
[Message 1 raw bytes]\r\n
[Message 2 Headers]\r\n
[Message 3 raw bytes]\r\n
<eof>

    Obviously, parsing this requires that you have code that can parse the raw bytes of a WebSocket message.

    Rather than writing all of that code yourself, you'd probably be better off just using Fiddler's Script or Extension model to interact with the WebSocketMessage objects that Fiddler builds when reloading a SAZ file.