I'd just like to understand: how can an offline application obtain a key?

[video58339]

Hello everyone,

I am a beginner and english is not my first language: I apologize if the reading is tedious.

Thanks to the help of this forum, I was able to understand how to recover a wvd file, download and decrypt a 540x960 pixels video on a lambda site thanks to the WidevineProxy2 extension.

I don't know exactly how WidevineProxy2 works, but I understand that it can recover 2 pairs of keys from a wvd file (one pair for the image and one pair for the sound) of the form key1:key2

In my case, but perhaps in all cases, my lambda video site offers several video.mp4 files of different resolution and several sound.mp4 files of different quality or language for the same video.

In my case, each mp4 file (image or sound) has a KID identifier.

On my site, a single video can have several KIDs

• a KID1 for all video.mp4 files with a resolution of 540x960 pixels or less
• a KID2 for video.mp4 files with a resolution of 720x1280
• a KID3 for video.mp4 files with a resolution of 1920x1080

The first key in a pair of video keys is the KID of the mp4 file (image or sound).

Thus, we have the following key pairs:

• KID1:key1? for a video432x768.mp4 file
• KID1:key2? for a video540x960.mp4 file
• KID2:key3? for a video720x1280.mp4 file
• KID3:key4? for a video1080x1920.mp4 file

With the key pair retrieved by WidevineProxy2 :

• mp4decrypt --key KID1:key1 video432x768.mp4 decrypts the video
• mp4decrypt --key KID1:key1 video540x960.mp4 decrypts the video
• mp4decrypt --key KID2:key1 video720x1280.mp4 does not decrypt the video
• mp4decrypt --key KID3:key1 video1080x1920. mp4 does not decrypt the video

I therefore deduce that key1<>key2<>key3

In the case of a web browser, I think I've understood that it uses CDM software installed on the PC or smartphone, and that this CDM provides the browser with a pair of keys from its own wvd file. This key is sent to a license server, which then sends back the KID:key pair to decrypt the video.

This brings me to my current misunderstanding.

My lambda site provides an application that lets you download a video to watch it locally, without an Internet connection.

For each video downloaded, the following files appear on my hard disk:

• one or more sound files of different quality
• a video file with a resolution of 432x768, 540x960 or 720x1280, depending on the quality selected when downloading
• an xml file containing the various KIDs of the video: KID_432x768|540x960, KID_720x1280, KID_1920x1080
• a text file containing various information, including the KID of the video at the downloaded resolution

Of course, the video and sound files are encrypted : they can be played back in VLC, but no image is displayed and no sound is heard.

With Mp4decrypt and WidevineProxy2 (which provides the key pair), I can decrypt the downloaded video432x768.mp4 and video540x960.mp4 files, as well as the sound files.

What I don't understand is that when I disconnect my PC from the Internet, the application has no way of accessing any license server. This doesn't prevent it from correctly playing video with image and sound, especially 720x1280 resolution videos!

So how does the application obtain the 2nd key?

1. Is the request made when the video is downloaded, and is the key then stored in the application's memory?
2. or is the key calculated from the CDM on the PC?
3. or is the key hidden/encrypted in the two downloaded text files? (obviously I'd be surprised)

Thank you in advance for your answers.

[lomero]

maybe first case, stored in application memory
but i don't know your request/doubt: you get keys with WidevineProxy2 ext, also you can play your video trough app offline ... so what else do you want ?

[larley]

probably a persistent license

[video58339]

Thank lomero and larley for your answers.

maybe first case, stored in application memory
but i don't know your request/doubt: you get keys with WidevineProxy2 ext, also you can play your video trough app offline ... so what else do you want ?

Sorry, I thought it was implied: get the video key for higher resolution : 720x1280 or 1998x1080.

In fact, I probably haven't fully digested everything I've read here, or I haven't read enough yet : I have the impression that with a wvd file coming from an Android device, it's illusory to be able to obtain the key for a higher resolution.

On the other hand, if a wvd file from an Android device can get the key for a higher resolution, then I can spend time understanding how pywidevine works to be able to provide it with the right license server that will allow me to get this key. Because for now, while I can download the keys for bitmovin.com/demos/drm with pywidevine, for the site I'm interested in, I only get the message "Failed to sens challenge".

If, as I fear, a wvd file from an Android device does not allow to obtain the video key for a higher resolution, then I was just wondering if, in the case where the site provides an offline application, there is another method to obtain this key, offline. But if my first hypothesis is correct (the key request is made when launching the download from the application), then the problem remains the same.

What surprises me is that when I play the video from a browser, the player's debugging information displays "Security level: L3". The player's debugging information is not available when I play the video in the offline application, but the 720x1280 and 1998x1080 video is playable. So :

1. either the application has a security level L1 or L2 which allows it to obtain the key needed to play the video at a higher resolution,
2. or it also has the security level L3 but unlike the browser it is able to obtain the key to play the video at a higher resolution. So in this case, why Widevineproxy2 can't do it ?

Hence my initial question.

probably a persistent license

Which means that unless I'm skilled at reverse engineering, obtaining the key to a higher resolution is too complex?

Thank you very much for your help and for clarifying my doubts.