I plan on investigating this theory. Will update.
Update 2/11/10:1:37AM :
The rhapsody client:
- is not packed
- does not implement any drastic anti-debugger techniques
A quick Process Monitor 2.8 dump yielded that rhapsody downloads the audio file to a temp directory:
C:\Documents and Settings\Username\Local Settings\Temp\rhapdownloads\#########.rax*
before it moves it to your destination directory. I hopefully it wraps the audio before it moves to your destination directory.
A partial sample of .rax file streamed by rhapsody: 196607054.rax
*.rax file type is rhapsody's streaming/download format.