On Monster Codec

There is one codec unrivaled in its monstrosity. I’m talking about GoToMeetingAndNeverReturn.

First of all, look at its size. The oldest version I could find (it decodes only G2M2 and G2M3) occupies 6196600 bytes. Newer one with G2M4 support (and that’s an additional compressor too) is 8247160 bytes, Current version (with seemingly the same functionality) is 15665528 bytes.

What does it contain? Everything. I kid you not, All (maybe except one) GoToUnpleasantPlace utilities refer this small file and actually export their real main() function out from it. And their size is about forty kilobytes each.

What does it contain from code point of view? Some libraries for networking, cryptography, speech codecs library, libjpeg, zlib, some internal code and tons of C++-induced crap. When you see wrapper calling wrapper calling wrapper calling something trivial (and the wrappers just pass arguments as is and do nothing else), or when you see that 90% of any function is used for exception handling, then we’re talking about enterprise-grade C++ indeed. And of course absolute bloatedness (including making indirect calls where unneccessary) and inability to run on Linux (not with Wine or MPlayer2 loader) greatly help debugging.

Now to the codec details: every frame consists of chunks which hold different kind of data — frame information, mouse cursor shape, mouse cursor position, image data, etc. Frame is divided into tiles (usually 8×8 tiles in frame) and each tile is coded separately.

There are two compression methods, known by their numbers stored in frame header. For G2M2 and G2M3 it’s compression method 2, for G2M4 it’s compression method 3. Both are horrible.

Method 2 seems to have some completely unrelated submethods.

Here’s the call graph from method 2 decompression function.

Looks like there are several possibilities when coding with this method.

There is a possibility to use JPEG compression but I don’t know under what circumstances it’s used.
Also I’ve discovered that MSA1(MSS3) and MTS2(MSS4) actually use standard recommended quantisation tables from ITU T.81 Appendix K.1 (they are not used by libavcodec JPEG decoder though) and quality to quantisation mapping from libjpeg6.

Another coding method employs ELS codes I’ve described in the previous post and uses it to code some bit plane and RGB triplet in dependent form (i.e. with prediction from two previous pixels and using R-G, G, B-G components).

For method 3 so far I know only a few facts. First byte contains image type and depending on it decoding may vary a bit. For example, for image type 0 and 3 three following bytes contain some RGB value, other image types don’t have it. And internally it’s called MPCCoder or SMPCCoder.

In conclusion I want to say that this codec is too large and horrible to use only static reverse-engineering (because it’s very hard even to determine what is the next function called indirectly) and debugging it requires Windows, so don’t expect me to RE it. But if you do you’ll get many thanks and some money from these guys. Good luck!

8 Responses to “On Monster Codec”

  1. compn says:

    you created decoder for 4!!! popular screen codecs recently, and yet everyone still wants just one more codec. it never ends.

    is lavc’s jpeg quantizer better/worse than ITU T.81 Appendix K.1 recommendations?

    ls -la g2m*
    -rw-rw-rw- 1 user group 8247160 Nov 3 2011 G2M.dll
    -rw-rw-rw- 1 user group 4921136 Dec 4 2008 G2M.dllx

    oops, looks like i replaced the g2m dll on samples repo instead of keeping the older 5mb version. i forgot we need to keep old codecs for RE. like old real.so with debug symbols. at least i kept it on my windows box…

    5mb g2m.dll here (just tested, it decodes g2m2 and g2m3 on win32 mplayer:
    http://samples.ffmpeg.org/V-codecs/G2M2/G2M.dll

    well , it doesnt help much, but 1mb smaller! 🙂

  2. compn says:

    using ftp search i found version 4.1
    ftp://93.190.206.160/public/m/mefodei/BOOK/SEO/SEO%20Video%20One/codec/g2m_codec.exe

    did not test , maybe virus.

    maybe there are older versions hiding in different filenames like G2MCoreInstExtractor.exe or G2MInstallerExtractor.exe

  3. Kostya says:

    @compn – that file seems legit and contains ~4.9 MB G2M.dll

    And in any case it remains too bloated. Sigh.

  4. durandal_1707 says:

    Vivo siren (ADPCM G.723?) decoder would be nice.

  5. Peter says:

    @durandal_1707: that reminds me to post a libsiren decoder patch

  6. compn says:

    hmm, was there ever a g2m codec for mac or android ?

  7. compn says:

    nevermind, i’m going to try to find gotomeeting2 and gotomeeting version 3 instead…

  8. compn says:

    http://web.archive.org/web/20060329151413/https://www.gotomeeting.com/downloads/11732390/48AE8A2109D47E3/null/manualFull/InstallCodec/g2m_codec.exe

    go to meeting codec version 2.0.0.127
    -rw-rw-rw- 1 user group 2511976 Jul 18 13:11 G2M.dll

    hah! 2.5mb ! success! is that small enough?
    it only decodes g2m2 tho. not g2m3… 😉

    http://wayback.archive.org/web/*/https://www.gotomeeting.com/codec
    for other versions