Vdocipher and Physical CDMs

[omarezeldin]

Hey currently I Was trying to install vdocipher videos using multiple methods, from my failure on all methods, I knew that the problem with my CDM (which was provided with the allhell3.py script) because it is from an android emulator.

I also knew that I need an physical rooted device to get my own physical CDM.

So, is this the only way to download VdoCipher videos? should I use a rooted device? Is there any alternatives? because I don't have access to a rooted device and I wanted to download multiple videos so I can't just ask someone to do it for me.

[2nHxWW6GkN1l916N3ayz8HQoi]

Having a real CDM is a minimum requirement and necessary. You also need the right script (I haven't seen any public scripts that still work). I don't think allhell3.py is meant to be used with vdocipher. You could post the video URLs and hope someone that knows what to do with vdo will help you.

[larley]

I'd love to create a module for WidevineFetch that supports VdoCipher, but I don't have a CDM from a physical device, so I can't.

[2nHxWW6GkN1l916N3ayz8HQoi]

but I don't have a CDM from a physical device, so I can't.

Somehow unrelated question, but could you generate lots of valid cdms from the same device if you install a fresh android custom OS each time? If that's the case, you could get lots of real cdms just from a single device. The problem with vdo isn't the tricky license call. It's just that you get banned for a bad call and your cdm gets toasted fast. Makes testing and developing a solution a nightmare.

[larley]

This is pure speculation:
The L3 CDM (because software based) is definitely not in the ROM (because huge security issue), must be generated while (re-)flashing the device.
So I don't think that the CDM will be different because the firmware is the same and the device is the same, so why should the CDM be different? This makes me believe that the CDM "version" is based on some kind of "hardware value".

[imr_saleh]

I have created a script for vdocipher long ago based on https://www.vdocipher.com/ "demo"
But I don't have a cdm from a real device to test it yet

from pywidevine.device import Device
from pywidevine.pssh import PSSH
from pywidevine.cdm import Cdm
from bs4 import BeautifulSoup
import requests
import base64
import json
import re


wv_CDM = "cdm_l3.wvd"   # <--- CDM LOCATION

input_token = input('Token: ')

json_data = json.loads(base64.b64decode(input_token).decode("utf-8"))


iframe = requests.get(f'https://player.vdocipher.com/v2/?otp={json_data['otp']}&playbackInfo={json_data['playbackInfo']}').content.decode()
soup = BeautifulSoup(iframe, 'html.parser')

script_tag = soup.find('script', {'type': 'application/json'})

mpd_path = json.loads(script_tag.string)

mpd_link = mpd_path['dash']['manifest']

get_pssh = re.search('<cenc:pssh>(.*)</cenc:pssh>', requests.get(mpd_link).text).group(1)

print('PSSH:',get_pssh)
print(f'\n[MPD]: {mpd_link}')

pssh = PSSH(get_pssh)
device = Device.load(wv_CDM)
cdm = Cdm.from_device(device)
session_id = cdm.open()
challenge = cdm.get_license_challenge(session_id, pssh)

json_data["licenseRequest"] = base64.b64encode(challenge).decode("utf-8")

token_value = json.dumps(json_data, separators=(',', ':'))

token = {
    "token": base64.b64encode(token_value.encode('utf-8')).decode('utf-8')
}

headers = {
    'content-type': 'application/json',
    'origin': 'https://player.vdocipher.com',
    'referer': 'https://player.vdocipher.com/',
    'vdo-sdk': 'VdoWeb/2.5.2'
}

response = requests.post("https://license.vdocipher.com/auth", headers=headers, json=token)
if not response.ok:
    print(f'{response}\n{response.text}')
    cdm.close(session_id)
    exit(0)

license = base64.b64decode(response.json()["license"])

cdm.parse_license(session_id, license)

for key in cdm.get_keys(session_id):
    if key.type != 'SIGNING':
        print(f"[KEY]: {key.kid.hex}:{key.key.hex()}")

cdm.close(session_id)

[aqzs]

I have created a script for vdocipher long ago based on https://www.vdocipher.com/ "demo"

Sorry to say that but posting a script like that will give you a loooot of DMs from vdocipher course resellers..

[imr_saleh]

I have created a script for vdocipher long ago based on https://www.vdocipher.com/ "demo"

Sorry to say that but posting a script like that will give you a loooot of DMs from vdocipher course resellers..

at first does it work?

[sarvo99]

<Response [403]>
{"code":2074,"message":"Please update app from Play Store","isErrorRecoverable":true}

[imr_saleh]

<Response [403]>
{"code":2074,"message":"Please update app from Play Store","isErrorRecoverable":true}

wondering what's wrong

don't burn your CDM

[aqzs]

<Response [403]>

{"code":2074,"message":"Please update app from Play Store","isErrorRecoverable":true}

That's the error I'm getting since a month.. I don't what they changed.. I tried using android headers too (because CDM is dumped from android device, maybe they are checking that too) but got :

{"code":2074,"message":"Please open in Android app","isErrorRecoverable":true}

or :

{"code":2074,"message":"Device not supported. Please try another device.","isErrorRecoverable":true}

[imr_saleh]

<Response [403]>

{"code":2074,"message":"Please update app from Play Store","isErrorRecoverable":true}

That's the error I'm getting since a month.. I don't what they changed.. I tried using android headers too (because CDM is dumped from android device, maybe they are checking that too) but got :

{"code":2074,"message":"Please open in Android app","isErrorRecoverable":true}

or :

{"code":2074,"message":"Device not supported. Please try another device.","isErrorRecoverable":true}

what if we used headers from an android browser like kiwibrowser?

{
    'authority': 'license.vdocipher.com',
    'accept': '/',
    'accept-language': 'ar-SA,ar;q=0.9,en-US;q=0.8,en;q=0.7',
    'content-type': 'application/json',
    'origin': 'https://player.vdocipher.com',
    'referer': 'https://player.vdocipher.com/',
    'sec-ch-ua': '"Not-A.Brand";v="99", "Chromium";v="124"',
    'sec-ch-ua-mobile': '?0',
    'sec-ch-ua-platform': '"Linux"',
    'sec-fetch-dest': 'empty',
    'sec-fetch-mode': 'cors',
    'sec-fetch-site': 'same-site',
    'user-agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36',
    'vdo-sdk': 'VdoWeb/2.5.2',
}

[aqzs]

what if we used headers from an android browser like kiwibrowser?

I tried with those one :

{
    "Content-Type": "application/json",
    "vdo-sdk": "Aegis/1.26.7",
    "User-Agent": "Dalvik/2.1.0 (Linux; U; Android 14; motorola edge 50 fusion Build/U2UUI34.40-64-1)",
    "Host": "license.vdocipher.com",
    "Connection": "Keep-Alive",
    "Accept-Encoding": "gzip",
    "Content-Length": "4716"
  }

[sarvo99]

{
    'authority': 'license.vdocipher.com',
    'accept': '/',
    'accept-language': 'ar-SA,ar;q=0.9,en-US;q=0.8,en;q=0.7',
    'content-type': 'application/json',
    'origin': 'https://player.vdocipher.com',
    'referer': 'https://player.vdocipher.com/',
    'sec-ch-ua': '"Not-A.Brand";v="99", "Chromium";v="124"',
    'sec-ch-ua-mobile': '?0',
    'sec-ch-ua-platform': '"Linux"',
    'sec-fetch-dest': 'empty',
    'sec-fetch-mode': 'cors',
    'sec-fetch-site': 'same-site',
    'user-agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36',
    'vdo-sdk': 'VdoWeb/2.5.2',
}

{"code":2074,"message":"Please open in Android app","isErrorRecoverable":true}