# The bizarre secrets I found investigating corrupt Winamp skins

**URL:** https://teo9i.com/t/the-bizarre-secrets-i-found-investigating-corrupt-winamp-skins/7002
**Category:** Science & Technology
**Created:** [July 26, 2024, 1:56pm UTC](https://teo9i.com/t/the-bizarre-secrets-i-found-investigating-corrupt-winamp-skins/7002 "2024-07-26T13:56:53Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![REALITY](https://teo9i.com/user_avatar/teo9i.com/reality/32/25124_2.png) [@REALITY](https://teo9i.com/u/REALITY)
#### Post date: [July 26, 2024, 1:56pm UTC](https://teo9i.com/t/the-bizarre-secrets-i-found-investigating-corrupt-winamp-skins/7002/1 "2024-07-26T13:56:53Z")

</div>

# The bizarre secrets I found investigating corrupt Winamp skins

In January of 2021 I was exploring the corpus of Skins I collected for the [Winamp Skin Museum](https://jordaneldredge.com/blog/winamp-skin-musuem/) and found some that seemed corrupted, so I decided to explore them. Winamp skins are actually just zip files with a different file extension, so I tried extracting their files to see what I could find.

This ended up leading me down a series of wild rabbit holes where I found:

- Encrypted files which I was able to crack to discover their secrets
- A gift a dad in Thailand had made for his two and a half year old son, but didn’t want published online
- Somebody’s email password
- A secret biography of Chet Baker
- Cryptic backwards audio files
- A file called `worm.exe` which held quite the surprise
- A host of extremely random images and files
- 56 previously unknown Winamp skins hidden inside other Winamp skins!

This all aligned perfectly with my love of [Winamp](https://jordaneldredge.com/tag/winamp/), my love of [found items](https://jordaneldredge.com/tag/found/) and was enabled by storing all the data I have about these skins [in an sqlite database](https://twitter.com/captbaritone/status/1535471373191028737) (as [discussed on Hacker News](https://news.ycombinator.com/item?id=31703874)).

Here’s the story:

* * *

The first corrupted file I looked at contained just a PDF advertising a rentable bowling pin mascot costume:

 ![](https://teo9i.com/uploads/default/original/3X/6/4/64caf3f9e14f89264d5f000033316edf3c797b30.jpeg)

* * *

Another was called `bobs_car.wsz` and, as advertised, contained just this picture, which I have to assume is the titular “Bob’s car”.

 ![](https://teo9i.com/uploads/default/original/3X/0/8/088a1a47a00213dbf73aba734df5c0aeae3edbca.jpeg)

_Update 2024/7/25:_ Someone on Hacker News [identified](https://news.ycombinator.com/item?id=41065196) this location as [Kilmacolm Road Viewpoint](https://www.google.com/maps/place/Kilmacolm+Road+Viewpoint/@55.9285659,-4.7106362,3a,75y,90t/data=!3m8!1e2!3m6!1sAF1QipPpt-joyGwDUQF1ZE44AaDN6NFZbmd87LGrERqZ!2e10!3e12!6shttps:%2F%2Fgz0.googleusercontent.com%2Fp%2FAF1QipPpt-joyGwDUQF1ZE44AaDN6NFZbmd87LGrERqZ%3Dw414-h552-k-no!7i3024!8i4032!4m7!3m6!1s0x4889b105a0b0d8bf:0xf62aa0cffb734fbe!8m2!3d55.9285659!4d-4.7106362!10e5!16s%2Fg%2F11fpn_qb67?entry=ttu) in Scotland.

* * *

But then things got interesting. I found one that was an encrypted zip archive.

[resubmitted.2003\_rsx.wsz](https://capt.dev/file/TCIZp9O6FQBS51QrxWj1d/resubmitted.2003_acura_rsx.wsz)

I took the opportunity to learn about tools for brute forcing passwords in zip files. Soon enough, I cracked it, and found its contents:

 ![](https://teo9i.com/uploads/default/original/3X/8/6/86b679df7b927c6a84a4dcf2b52c902444012042.png)

The password was "honda”. No idea why it might have been encrypted.

* * *

Another one had been created by a dad in Thailand who made an Adobe Illustrator mock up illustration of a Winamp skin he had designed as a gift to his two and a half year old son. But he didn’t know how to make it a skin, so he sent it to [winamp.com](http://winamp.com/) (along with a text file letter) asking that it be made into a skin that he could use. The letter was very touching but he asked them not to share the skin, so I have not included it here.

* * *

I found another encrypted zip file. This time the password was not in my wordlist. After a bit of fiddling with the cracking tool’s config file, I was able to brute force it as well. The result was a valid Winamp skin!

 ![](https://teo9i.com/uploads/default/original/3X/0/5/05d3d53e3f5c02539bae057744b6790fe519f98a.png)

Password was "nayane”.

I went ahead and uploaded the decrypted version [here](https://skins.webamp.org/skin/e880983b4c4597570b72041cb3dfac19/NIKE%20V10.wsz/).

* * *

This got me interested in other “sensitive” things that might be included in skins, so I started searching for things like “password” inside the files _inside_ all the Winamp skins.

I found one with a file called `E-mail passwords.txt` which contained… their email address and email password. Not great operational security.

* * *

[Another skin](https://skins.webamp.org/skin/bf47d3cee462143bb4549fee59f567b2/Marshall_Matters_Skin_2.wsz/) contained a text file with hundreds of blank lines and then, at the very bottom, the text:

```auto
YOU HAVE FOUND THE SUPRISE!!!USE THIS PASSWORD:KEWL16

```

Inside the skin was a file `Suprise!.zip` which was itself encrypted, but the password didn’t work! Eventually I figured out that the password needed to be lower case. Inside were a bunch of `.avs` files:

 ![](https://teo9i.com/uploads/default/original/3X/7/e/7e4384866bbd94fcb8b240dd417011f8bcf176f8.png)

* * *

[This skin](https://skins.webamp.org/skin/5447f1bdfd64ffa7b3abe051ad717bcb/Chet_Baker.wsz/) included a file named `secret.txt` which was just a biography of [Chet Baker](https://en.wikipedia.org/wiki/Chet_Baker).

 ![](https://teo9i.com/uploads/default/original/3X/f/7/f7a12ccb8cb17dd3c1aa14b372dca19d664475c8.jpeg)

* * *

Some skins included mp3s inside them:

```auto
sqlite> SELECT skin_md5, file_name FROM archive_files WHERE file_name LIKE "%.mp3";105a63846a068bcd2199f3921c006c99|winampme/MSNet d�marrage Win-Me.mp3125a87ff1e2b7bce537aa3126b1a80d8|cool.mp3329105cd7d11d3ec1236a7333a6b46e9|WILLIAM/Winamp Skin/MegaMan/Megaman/[MegaMan X] - X Theme.mp357a98f6b68236dd22a006fc8171f94b5|SPARKY.MP37653b2504bc3d9404a17c8eca7ba71af|Knuckle-Duster/hagmans_demo.mp386080023e53a798ccda91109d33abeb7|arrrrrrg.mp39f9c65a5d416d1a97f18dd8488e8cf7b|Blair Amp Project f/Heather_Sorry.mp3a5a3a08340feb5dae3aa87af698b0654|cool.mp3b6a51893dde10f4bcbee50a1fa24b217|(Adam Sandler - Billy Madison - Back 2 School).mp3b6a51893dde10f4bcbee50a1fa24b217|(Mike Myers - Huge Head).mp3b6cf670eb351e2e76f9048a25aeb639d|Diablo.mp3b8ba93a4d427d8fd4f4c5fba7bcba627|BROTHEL - Breathe Swallow.mp3b8ba93a4d427d8fd4f4c5fba7bcba627|BROTHEL - Fuck That Noise.mp3b8ba93a4d427d8fd4f4c5fba7bcba627|BROTHEL - SunScreen2000.mp3c647cd24f5809664e0d2e210a68310c1|SKATEBOARDING - Osiris ShoesTheme.mp3c9b348ae2b93471b76ee2634a12d1dce|The Mark, Tom and Travis show/Blink 182 - Dammit (Sample).mp3d54e166f5227967e153ec40783473c0b|cos-xenu.mp3d54e166f5227967e153ec40783473c0b|lrh-xenu.mp3e47edeecb002afecf1b30ebab8c8d1e9|Destroy v2.0.mp3fcf17a808fdb485bb3e95a64debea848|Diablo.mp3

```

For example this bizarre five second `cool.mp3`.

cool.mp3

* * *

[This skin](https://skins.webamp.org/skin/fb3b75ccbb49d5d08e54e4705d51bd56/Alien_Workshop_Sovergein_Sect.wsz/) included a file named `Sovergein Sect.wav`.

Sovergein\_Sect.wav

Upon listening it sounded like it was being played backwards, so I reversed the audio file:

Sovergein\_Sect\_mp3cut.net.mp3

I think it’s someone saying the name of the skin and some other information?

_Update 2024/7/25:_ [_@PenanceArkana on Twitter:_](https://x.com/PenanceArkana/status/1816349964701757718)

> The “Sovereign Sect” audio appears to say “Alien Workshop Sovereign Sect 2001”. “Sovereign Sect” is/was what appears to be a collaborative skate products effort between Habitat Skateboards and Alien Workshop Skateboards.

* * *

Some days later I found a skin that contained just one file: `WORM.EXE` That sounds dangerous!

I fed it to Virus Total but it didn’t detect any issues. So, someone in the Webamp Discord bravely tried running it in a VM and got this prompt:

 ![](https://teo9i.com/uploads/default/original/3X/a/f/af8e529a0bb30ead711d4396889ed786c57a44f3.png)

It was a worm _game_, like the game snake!

![](https://teo9i.com/uploads/default/original/3X/5/2/52fa98244cb1610de10b19cc4337c1c94cdb7f29.gif)

Here’s top speed:

![](https://teo9i.com/uploads/default/original/3X/8/d/8d857d4482026d94762a56d3fd6dee5bae957a18.gif)

* * *

Another skin had just one file `Standing around the hoop.jpg`

 ![](https://teo9i.com/uploads/default/original/3X/2/b/2b2c745e8df1992db754313c2f9d4e4627d678f0.jpeg)

* * *

Another one contained just a single file `ellie.bmp` Here’s Ellie I suppose?

 ![](https://teo9i.com/uploads/default/original/3X/f/f/ff45ce22e9c32110195836d38debb27e409807c3.jpeg)

Reencoded as `.png`

* * *

Another had two new born baby pictures and a text file:

> Here is a few pictures of Dom’s baby.
> 
> Joe

* * *

Finally, I thought to look for skins that contained other skins within them, and discovered 127 skins! 54 of which were not already in the museum, so I uploaded them.

 ![](https://teo9i.com/uploads/default/original/3X/8/6/863c458c789d7cc2861adc626548c73291765ec1.jpeg)

* * *

It’s so interesting how if you get a large enough number of things that were created by real people, you can end up finding all kinds of crazy stuff! This was such an amazingly strange and interesting ride!

> **[The bizarre secrets I found investigating corrupt Winamp skins / Jordan Eldredge](https://jordaneldredge.com/corrupted-skins/)**
>
> I started looking through corrupt Winamp skins and it lead me down some very strange rabbit holes