Rebuilding Windows Live Messenger, Part 3: The Specification
This post continues the investigation that began with “This is not RLE”.
If the first post was about dismantling assumptions, this one is about replacing them with certainty. Back then, we had a decoder that worked, a pile of strange patterns, and a growing suspicion that the name RLE was little more than a historical artifact. Now, after walking the bitstream one bit at a time and validating every rule against a real corpus, the format is no longer a black box. It has structure, semantics, and — finally — a specification.
When I started digging into this format, I expected some variation of classic run-length encoding. What I found instead was closer to a tiny virtual machine for pixels. Yes, there are runs, but there are also signed deltas, literal spans, and a single bit-cursor shared across colour channels. Nothing is byte-aligned, nor accidental: every bit participates in reconstructing UI artwork that was never meant to be seen outside its original renderer.
The Turning Point: Transparency
Up until then, decoding felt linear: read tokens, expand pixels, move forward.
Alpha changed the rules. Transparent spans emit pixels without consuming colour
data. Buffers persist across segments; the “previous value” never truly resets.
Suddenly the format stopped behaving like a simple stream and revealed itself as
a stateful decoding model layered on top of a bit-level language. Once that
behaviour became clear, the rest of the structure — row navigation,
token width B, palette post-processing — just snapped into place.
Verification
Hundreds of files were decoded and compared pixel-for-pixel against the original renderer. No heuristics, no guesses — just reproducible behaviour. At that point, the reverse engineering effort had effectively crossed a boundary: the goal was no longer to make a decoder work, but to describe why it works.
So instead of shipping another tool, I wrote the document I wish I had at the beginning: a complete, clean-room specification of the format. It defines the container, the payload, the bitstream grammar, channel interleaving, the alpha meta-decoder, palette semantics, DPI scaling, and the precise arithmetic rules that govern decoding. Every field is explained, every algorithm is explicit. Every edge case that once looked like noise now has a name.
The format is no longer folklore, no longer that “strange Messenger blob.” It is a fully described image format with a deterministic decoding model — and you can read it here:
The mystery is over. From here on, this format is something one can implement, reason about, and build against — and, perhaps most satisfying of all, the decoder is now far smaller than the puzzle that led to it. I validated the spec by implementing a Swift parser — aside from the Python parser included in the spec itself — that faithfully rendered assets on macOS.
Legal & Research Disclaimer
This material is intended strictly for academic research, reverse engineering for interoperability, and software preservation.
The author does not distribute, reproduce, or provide any proprietary software, including components originally developed by Microsoft.
This work is independent, clean-room in nature, and is not affiliated with, endorsed by, or supported by any original vendor.
Any trademarks, formats, or software referenced remain the property of their respective owners.