Re: Mozilla Cloud non-Decryptable Download?

On Sun, Nov 1, 2015, at 07:22 AM, [email protected] wrote:
> I'll be greateful for any clues helpful to my decrpyting of that
> download.

It's likely a MAR file.  If it is, the file header should start with the
magic keyword "MAR1".  See https://wiki.mozilla.org/Software_Update:MAR
for more details and a link to a file at the bottom that understands
them.

You make reference to a "GET" inside the HTTPS data-stream.  It may be
worth manually downloading that URL separately using wget/curl/other and
seeing what is extracted from that.  It's possible that in the
hexediting you extracted part of the framing around the file, and this
would likely help shed light on that.  Alternately, from brief
searching, it sounds like wireshark should already be able to save the
decompressed content streams from HTTP  via "File -> Export Objects ->
HTTP"?

Andrew