Decrypting Live streams

[paul92]

Is there anything specific guide to capturing, and decrypting live streams for own personal use? The majority of these guides seem to be for downloading from catch up and VOD videos.

Thanks

[lomero]

maybe

N_m3u8DL-RE "http://mpd" --mp4-real-time-decryption --live-real-time-merge --live-pipe-mux --use-shaka-packager --key xxxx --save-name xxxx

[paul92]

Attempts to generate a license key using wks-keys failed

PSSH: hidden
unable to parse license - check protobufs


python l3.py

PSSH: hidden
License URL: https://licensev2.dstv.com/widevine/getLicense?CrmId=afl&AccountId=afl&ContentId=KHD&ls
unable to parse license - check protobufs

[lomero]

share pssh. and headers too

[paul92]

share pssh. and headers too

pssh AAAAMnBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAABISEOCJHJ PutkzCgrRAKsBs5kk=

headers converted to curl

import requests

headers = {
'authority': 'licensev2.dstv.com',
'accept': '*/*',
'accept-language': 'en-US,en;q=0.9',
'origin': 'https://dstv.stream',
'referer': 'https://dstv.stream/',
'sec-ch-ua': '"Google Chrome";v="119", "Chromium";v="119", "Not?A_Brand";v="24"',
'sec-ch-ua-mobile': '?0',
'sec-ch-ua-platform': '"Windows"',
'sec-fetch-dest': 'empty',
'sec-fetch-mode': 'cors',
'sec-fetch-site': 'cross-site',
'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36',
'content-type': 'application/x-www-form-urlencoded',
}

params = {
'CrmId': 'afl',
'AccountId': 'afl',
'ContentId': 'HDT',
'ls_session': 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ijg5M GVmMzRhLTAxNzItNDA0NC05NmI3LWY1OWM0OGI0NzA1OCJ9.ey Jpc3MiOiJBdXRob3JpemF0aW9uIElyZGVydG8gU2Vzc2lvbiBJ c3N1ZXIiLCJzdWIiOiI3N2ZiMjlmYi1hMjI1LTQ4ZTQtYTEyNS 1mOGQ5NTBhZjUzOWYiLCJqdGkiOiIyMWRlNmE2MS0xYTc3LTQ2 MjctYTI5My00NjQwYmZjOTcyZDEiLCJpYXQiOjE2OTk4NjQzNz YsImV4cCI6MTY5OTg3MTU3NiwiYWlkIjoiYWZsIiwiaXNlIjp0 cnVlLCJlbnQiOlt7ImJpZCI6IlBSRU0iLCJlcGlkIjoic2Qtc2 luZ2xlLXN0cmVhbS1lcCJ9XSwiY3NtbyI6eyJtYXMiOjEsImR0 IjoiTU9CSUxFIiwibWFzZCI6MX19.dTNm82BtWb0Ol_rEz6u8O wB5v_Y1v77da8-LANqLDA31WzQ6R_CbhDd6XZSz8YevKMrXNw-WKFBCMhRfjctTOVuCg5Pj0utIONalIUqEQA8fEb_8VGo69E6Gr u-Ln03fmTAty7J-Qsej3GoZHblbRPHf-23AO7eaB6TMOC2zu4aCyrb4PS-sOMm4CcgK8Pxx5jO4kTcMQ0ko6sEaV2oGLuK8Pc7L1aIUIaigz EEy34Ysa4hpSHjlLGD6JA0PjKLcgKZHdcDcE40Oe0moKreYYof 8sA5xEg-4vDvoKldojYiJPu44CV8dIaEtrs2s-Ivbs_Pir0WknwKLO1hFy4qYgQ',
}

data = '\b\x01\x12ø\x0e\x12E\x1aC\n<\n\x10së\x18(\x89\x0e Îlb_Z`\x1fɽÝ\x12\x18c+sYKIkOzmxiX1pgH8m93Q== \x01(\x048\x00@ðÄ\x01H·¾Çª\x06\x10«\x02\x18\x00\x1 8\x02 ãÀǪ\x060\x16B¤\x0e\n\x18alcatraz_test_drm_server\ x12\x10\x1dÈ°ç?\x05ê\x9a\x9exm¿e@ý\x01\x1aà\v¥Ä#ÕÈ]@´ô9\x13\x9adnGS× T¥+U¶¿Z\rUî¬ÀXa\x1a\x99i^G(\x90"\x15ì³\x11v¿¶«\x7f/á0ø\x01öbÐ\x99éÝ1{©\x9fm\x1c\x12Ä!:,\b\bÏD¡f6üãö\ x91ϼ_½ì[\x8bðç&?\x8c¡$~Qé×yýL\xad\x86(×Ȥ\x04Î\x80÷¹ô\x94\ x19H\x96gbx¨þ_û`Ò7É\x02\x9d#XM+)®Ì®Ìèzî0\x17\x0fk¶ %É\x03Úy\x95åAöJu«\x1aUªûp\xadG\x82È\x88»30©Ê|=IÏê ©ð¥O\x19Ûå\x00\x12`¤aw®\x9e\rÁ(\x12Ñ\x1føì¦ô\x1a|u \x94èàÎÇ6¥\x04\rûô]O\x84Æ\x80[\x82~´G«0t\x1f96ÌU+Ô\xa0¢\bðm(6J\x85Ï,ªñæé¤\x97½\x 99\x8aN\x03DWRZæcÊ9^Í\x966¿ª\x8ay(fºô£ï²!\xa0ÿöP©M \x8e\x96\x82Zeí¯\x8a«~\x99<½é¸·K~ÃöT\x14!6Ìò\x1aàÕ ÚqÆ@#\x9aç\x92\x93|}\x8b¶ð+jo²í$\x8fnãã8á\x8b«Ú\t# ÊBØf(]JÀ¹\x1dy\a\x1eÁê\x9dÝB\x8bm5^\x03ôÙ\x8fÁ8\x81y\xa0 ã÷|æ\xad\x1bw`t\x9eO\x18Ë´\x83ðC¼üÁ®Ê\x1aF\tRäÑ7 ׬í@Àß_?Àè\x82ôþôÔ\x10C?Ê\x83\x9b0Zcàu Â\x94aÌ#\b.ÎxhÑoz\x92@\x7fFz{\x05\x86\x96\x13vT"\x 14_í9Ð\x98àµig¿\x83\x02\x94¹«øzhÃù}Z\xadË?®ìצ\x15 #±º\x84oöàF¯¬ØUá\x9f|ê·\x99î\x92\x1f\x90N\x06²\x91 \x1cWçW0ÕqÈ\x16"T²\aÉ\x9fÙ\x975×m\x9aN?,¸é"®4\x04³ Æ\x80\x80æf\x8c[\x00HªäoºR{f#\xa0ZEx\x8a\x93À\t3\tº\x99¨àÏYê\x8eß\ r\x12Îã&"µ*\x1bÎ\x8d\x8bÅE1e²Û\xad&ɸCèJ<È°\x9a\x1 40\x9a%ëd¿ð÷âúm¥»¦£;\n\x89J¥äpÉ\x99\x90Mi?¡\\3\x86 |\x18øOÙª)éÚÎ(\x18`\xad\x95.:a=·>\x13¦&\'åõ\a0©\xa dÃÈV\xad¬ÙÏ\x98dþÂѲ]+\x86Fb!(Ð\x87\x01\x98QP"1ìdgP1êòbk\x90Tl\x9a9E<\x 13\x80Å\n\x9dàLæ\x9bT¹S#S\x93Â\x89·¬~\x95ô-VÎ\x15\aM/¡\x85ö´\aÐ@Eþ; \'Â\x9aw7ýÞÓCåWlѪ\x8fZ\x03B¢ï1\x14RS\x17ãÓÖßï \x13\x9db)!*7«ûÛ\x06\b\t%nÄþs§¦ïs/\xa0\x19¢\x10\b\x95\x16\x89 ¶\x0ew\x97ª\x8b\x12P\x1eJÃ\x81ð\x01)#ðWÃ\x83¶N4\x9 6²E?\x9b2\x8fH¼\x95X?Ýg\x1d\x11Cî³°\x85vat\x02ÚO.G м¢èàÖ¾ó\v\r(\x04QIÔMÛï\x10y!\nº\n_\x1a<\x19Ô¼\x87 \x88\x1f,\x03s[Ýwþ¦|¤T~òÚì¸^¾\x9bÝU\nij3g¦_\x86ãn1øðÈ]ËZa¶ÑíT»kÑh\x17\x17(#t¶ÖgÃ@æQ¸}²\x13\x98#|zs\x0fþî ¢®¦ª\x82ü¦1§\x1fÂç\x86Bd\x86\x18\x14\x7fÝl±|Y\x8c\ x01ÿ<ºJ7\x11\x8dµ\x1a\x86\x97l\x9eE"NÅjø,G*Ì\x93Ô¬ \x92\x17dç>T`IÓD¢Sè¯G@Ê=ÏrpºâÊ\x19.WÝI±²½\x03\x0e) öÔ\x9a\x0fõ\x90ØA\x85$¿y\x94J&YI¥ÙlõÞ~L\x12!Ø\x85é ý\x85n\v>ã«Â\t\x8dýܽ¯Û\x89\x13\x1e\xad\x12\x03Ã\x 91¤×@\x19\x84\ay"\x00¤\x1f¬\x17#)gúpà\a¾P\x1e\x11½ íÆÐYVFÓ\x05,ûèÍÁ8à\x1e7½\x1f.\x17mf6ÄqÈ)\x89²þãö¥\ '\x9dfÜèH(~\x91*\x8dDÍ3ðX×µ\x06?ð:ó,à\x9b7yf\x91\x 91+mg\x95è¸öãgÂq`{\x9a¿¼kÕ;Vÿºâx\x8fÙ¦ß÷\x06\x97\x 19Åhàæg/²;\x1beÖÄ\x17Üí%\x97\x17åd±â²ð.½*H\x13V\x13\x81ß\x 8e«U\x98\x97ÌÊ.¡n5È»z|m\x1fàGB*V¬Ú0JÈ\x858\x86\x18 \x88¼ÊõÎ2æ:f{m©RÀ\x7fó\x1fSK\x86\x9ey\x17çiýá\x9a9 \x13\x86\x82\x17áH¼¿=§ÿ\x9b¼ËQR\x0f9õ\fk?o&¥«[Û ÅÎ!°\x18\x85ùÅ\x91íë\x89~¬ö\x0fÓ\x03§ê5\x880©\x96T `P¢Ê\x93\x82°\x98xMʬ¨ð@Ös¢õ\x95mÓ\x9cðÇ\x92F\x1dQ qþÆDÑ\x96É°±¦\x8d5ê\bäm\x87Òs\x16û\f/\xa0\'$Ü\x8dãäìïT7:[m\x96\x18ZOlÎt`\x8co6«#¬Í£Úã\x92é\x82\x8dg\x03½ÐdÙ ÇÀÞÈÔ@F\rýQy\x8a"\x10ê´*/£)L\x1e¶\x14³\f\bHV»*\x80\x02±Ó\x0f¾)0\x10D\x94\x9 9h÷K:ý>°iÛ\xadq%R\x17[ó.Q,\x05³¥iC\x06§ðÙÕ\x1d¡ø\x84\x976oj8=·@\x06¶=\x1 f\x12\x03?N\x83\\$×À£\x9dô¤h¸\x95\x9cðé\x1eìáø\x86 JÔLýt\x8bÜ\x06gÉ\x14k{!\x18v\x87íùËë¤\x1e\x1cIÔÛÓË \x14r\x93è\x04\ts\x8a0\x96¯FD]\x96ÌT\a¾h\x13\x9b\x92\x12\x06\x94³@¯~&ö\xadß\xa0\x93î¥JØ´üHüZâ\x81õª+Õ\n§ ¬Ï\n\x9a\x86Mýï\x05ÃL$?#¤\x03-í\r-\x87\x951\x98Ø\bÊ7ïUU\x9fVó¯BÍo±Ø8Æä`^\x1aãðGßnÒjâ ª\b9\x80\v-\x94С]\x8dè\x12%ud\võ¶®æ\x8b\x8fÎ48~ó\b\x94C\x06\x05j\x1 9æȬ\x1a ]ϸ+%啕ÆÛu\x8dL\vNû\x15`\x86e\x9a¯å\x85º8TÜ\x10\x1 c\x01é'.encode()

response = requests.post('https://licensev2.dstv.com/widevine/getLicense', params=params, headers=headers, data=data)

[shellcmd]

this site looks like a china site, uaually just send challenge and license url with that params, if you handle correct, you will get license. but that china site with a json response in license url , i dont know if they are all the same, can you send license response?

[paul92]

this site looks like a china site, uaually just send challenge and license url with that params, if you handle correct, you will get license. but that china site with a json response in license url , i dont know if they are all the same, can you send license response?

{"code":100102,"message":"Method 'GET' not allowed for 'http://dstv-ctrl.live.ott.irdeto.com/widevine/getLicense?CrmId=afl&AccountId=afl&ContentId=HDT&l s_session=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtp ZCI6Ijg5MGVmMzRhLTAxNzItNDA0NC05NmI3LWY1OWM0OGI0Nz A1OCJ9.eyJpc3MiOiJBdXRob3JpemF0aW9uIElyZGVydG8gU2V zc2lvbiBJc3N1ZXIiLCJzdWIiOiI3N2ZiMjlmYi1hMjI1LTQ4Z TQtYTEyNS1mOGQ5NTBhZjUzOWYiLCJqdGkiOiJkNWZjMDRlMS1 hMGYwLTQxNGEtOGI1MS0xYjM5NjU5NWJmM2IiLCJpYXQiOjE2O Tk4NzUzNTAsImV4cCI6MTY5OTg4MjU1MCwiYWlkIjoiYWZsIiw iaXNlIjp0cnVlLCJlbnQiOlt7ImJpZCI6IlBSRU0iLCJlcGlkI joic2Qtc2luZ2xlLXN0cmVhbS1lcCJ9XSwiY3NtbyI6eyJtYXM iOjEsImR0IjoiTU9CSUxFIiwibWFzZCI6MX19.QPAAWCx3V196 e5tSLXh0h5AmlHmC24R_EkK0OLdPut-YI6v26xr9eapt1ZVK-iSH-5qLHjH5E9Gn4cKfL784akBFDrWRuBfwNBiTkPpxgKjwdj2_SYm l9q-WtDENTTjmdZS8-B3nesR4XW5XqgqRZCm5O9HVV3W28Wf7QkCqE2d2kibpfx8CHOJ 38gl-dZneYDNrIk3qeasrhn-kT9sq5hDP0fA-Wsq-BsI1U2ampaCkb-2pDlfzLJ07KS_aQHDIHf7tbwugH7VopKYVMmMvg_2nIah7osuU TJP8C77GwUUqr5gvYKDDLywU66eQRsZGgxHnyVgCx_hFi5eXiF Smwg'."}

[shellcmd]

then i dont know why, if the video can play in your browser, the license response status should be "success" , or a json or a raw data.

[paul92]

did some digging, and did find a channel token {"access_token":"exp=1699882579~acl=*/HDT/*~id=77fb29fb-a225-48e4-a125-f8d950af539f~hmac=c27857dd1ec96c95ba057a9ff35b53ab bfd18e12ae01d0d5547e45edfdf17d9b"} need to figure how to implement this to wks-keys

[jckzz]

can you share request header of license url?
but stream using firefox
just right click on license url and "Copy Request Headers"

i'm just curious

like be*n
we need Authorization & X-CB-Ticket as header to get the key

Authorization: Bearer MRpXjwkodu5Ti05BzttguryPvJJz9q9ej5G1VC5WVcve2Vz3GishTP5Exxxx

X-CB-Ticket: iyqZs4c1PdgO9bm1NbLM38RWsjXM+1rV8OcAdQ35xF7QeV4yj9R0mRHHSfXw0csMLU/NUAPsR79D8gxXV8DxJhqeqm3z/OrHlexxxxxx

[paul92]

can you share request header of license url?
but stream using firefox
just right click on license url and "Copy Request Headers"

i'm just curious

like be*n
we need Authorization & X-CB-Ticket as header to get the key

Authorization: Bearer MRpXjwkodu5Ti05BzttguryPvJJz9q9ej5G1VC5WVcve2Vz3GishTP5Exxxx

X-CB-Ticket: iyqZs4c1PdgO9bm1NbLM38RWsjXM+1rV8OcAdQ35xF7QeV4yj9R0mRHHSfXw0csMLU/NUAPsR79D8gxXV8DxJhqeqm3z/OrHlexxxxxx

How do I find the authorization and X-CB ticket?

[jckzz]

can you share request header of license url?
but stream using firefox
just right click on license url and "Copy Request Headers"

i'm just curious

like be*n
we need Authorization & X-CB-Ticket as header to get the key

Authorization: Bearer MRpXjwkodu5Ti05BzttguryPvJJz9q9ej5G1VC5WVcve2Vz3GishTP5Exxxx

X-CB-Ticket: iyqZs4c1PdgO9bm1NbLM38RWsjXM+1rV8OcAdQ35xF7QeV4yj9R0mRHHSfXw0csMLU/NUAPsR79D8gxXV8DxJhqeqm3z/OrHlexxxxxx

How do I find the authorization and X-CB ticket?

maybe there is no auth & xbc ticket in your license url header
those i post just sample from another streaming platfrom

i mean
can you "Copy Request Header" from your license url
and share it here

[paul92]

can you share request header of license url?
but stream using firefox
just right click on license url and "Copy Request Headers"

i'm just curious

like be*n
we need Authorization & X-CB-Ticket as header to get the key

Authorization: Bearer MRpXjwkodu5Ti05BzttguryPvJJz9q9ej5G1VC5WVcve2Vz3GishTP5Exxxx

X-CB-Ticket: iyqZs4c1PdgO9bm1NbLM38RWsjXM+1rV8OcAdQ35xF7QeV4yj9R0mRHHSfXw0csMLU/NUAPsR79D8gxXV8DxJhqeqm3z/OrHlexxxxxx

How do I find the authorization and X-CB ticket?

maybe there is no auth & xbc ticket in your license url header
those i post just sample from another streaming platfrom

i mean
can you "Copy Request Header" from your license url
and share it here

POST /widevine/getLicense?CrmId=afl&AccountId=afl&ContentId=HDT&l s_session=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtp ZCI6Ijg5MGVmMzRhLTAxNzItNDA0NC05NmI3LWY1OWM0OGI0Nz A1OCJ9.eyJpc3MiOiJBdXRob3JpemF0aW9uIElyZGVydG8gU2V zc2lvbiBJc3N1ZXIiLCJzdWIiOiI3N2ZiMjlmYi1hMjI1LTQ4Z TQtYTEyNS1mOGQ5NTBhZjUzOWYiLCJqdGkiOiJkM2Q3MTE0MC0 xZmYyLTQ0ZjItOTFjNy0zNTkzMjVhYTBmMmYiLCJpYXQiOjE2O Tk4ODY3NDYsImV4cCI6MTY5OTg5Mzk0NiwiYWlkIjoiYWZsIiw iaXNlIjp0cnVlLCJlbnQiOlt7ImJpZCI6IlBSRU0iLCJlcGlkI joic2Qtc2luZ2xlLXN0cmVhbS1lcCJ9XSwiY3NtbyI6eyJtYXM iOjEsImR0IjoiTU9CSUxFIiwibWFzZCI6MX19.W5W8UNfgBsJ9 Dts3zwUK9C9SPP6LXiprV7j9KlkzdJ95zobI1aafDjlNAeEuLK F_jeZ1nFgNGGgbChgwJApcZYlam9we1K3BhrCdTW96ZXozKpSW RG281EgSM1fiJCvarFAdHHQrF_j1iP2CSVWWX5rxZtuaMes0jF Q4U8k6eJ8mt139GLiplFehiKtAahBnZq6VbAFULtFqFGoNUpAb NXYJS6Oel1g_77ew3sCe0NShKr2NMUMa0ypyuAeTpqBVUNPeeU BAJPeY_RIvVbWA4HM_xYrTym2XDT1_ZkgsC9sAYPpYxX0Bi5S4 NZpdsdgKIdZfePZ5NZ5kH1Urzbnmqg HTTP/2
Host: licensev2.dstv.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dstv.stream/
Content-Length: 2
Origin: https://dstv.stream
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

[jckzz]

sorry still not work for me

ERROR
Error 403: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <TITLE>ERROR: The request could not be satisfied</TITLE> </HEAD><BODY> <H1>403 ERROR</H1> <H2>The request could not be satisfied.</H2> <HR noshade size="1px"> Request blocked. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner. <BR clear="all"> If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation. <BR clear="all"> <HR noshade size="1px"> <PRE> Generated by cloudfront (CloudFront) Request ID: F9kmFFzYMKyTdounbZ_0rRjNQF01oQ7xzcRkRD44IG0DlqR3qT8UjQ== </PRE> <ADDRESS> </ADDRESS> </BODY></HTML>

[paul92]

sorry still not work for me

ERROR
Error 403: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <TITLE>ERROR: The request could not be satisfied</TITLE> </HEAD><BODY> <H1>403 ERROR</H1> <H2>The request could not be satisfied.</H2> <HR noshade size="1px"> Request blocked. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner. <BR clear="all"> If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation. <BR clear="all"> <HR noshade size="1px"> <PRE> Generated by cloudfront (CloudFront) Request ID: F9kmFFzYMKyTdounbZ_0rRjNQF01oQ7xzcRkRD44IG0DlqR3qT8UjQ== </PRE> <ADDRESS> </ADDRESS> </BODY></HTML>

May be geoblocked.

Try UrbanVPN and select South Africa as the country.