How are you going to respond to widevine l3 decryptor's death at May 31st?

[bekam]

Hi guys,
I know it's rude but can we stop talking about cdm or license url, headers... Many people are asking ths same problem that already has been discussed. Read this thread again, looking back for 20 pages, I assume is enough. All things are there.

No, we can not.

Not all problems are solved.

No one is forcing to come and look at this topic.

[bekam]

@minegroasprilla

You wrote "... many of us don't speak English and understanding that is much more complicated for us"

I know where you are coming from and I empathize with you. There is a forum strictly for Chinese speakers that I sometime visit. I must admit that as soon as a non Chinese speaker posts an English to Chinese translated message, he/she is detected immediately. The AI of these translators is not up to par.

The key is perseverance.

The key to success is action, and the essential in action is perseverance. (Sun Yat-sen)

(Well to to tell the truth, much of this information is also incomprehensible to English speaking users. lol)

I don't speak English too, and Chrome's translator is bad.
It is not trustworthy.

[jack_666]

I did an experiment. I copied what I wrote and pasted into Google Translate ... Spanish translation

Escribiste "... muchos de nosotros no hablamos inglés y entender eso es mucho más complicado para nosotros".

Sé de dónde vienes y siento empatía contigo. Hay un foro estrictamente para hablantes de chino que visito a veces. Debo admitir que tan pronto como una persona que no habla chino publica un mensaje traducido del inglés al chino, es detectado de inmediato. La inteligencia artificial de estos traductores no está a la altura.

La clave es la perseverancia.

La clave del éxito es la acción, y lo esencial en la acción es la perseverancia. (Sun Yat-sen)

(Bueno, a decir verdad, gran parte de esta información también es incomprensible para los usuarios de habla inglesa. Jajaja)

------------------------------

I then pasted this Spanish into the translator and got this English output

You wrote "... many of us don't speak English and understanding that is much more difficult for us."

I know where you come from and I empathize with you. There is a strictly Chinese speaking forum that I visit sometimes. I must admit that as soon as a non-Chinese speaker posts a message translated from English to Chinese, they are immediately detected. The artificial intelligence of these translators is not up to the task.

The key is perseverance.

The key to success is action, and what is essential in action is perseverance. (Sun Yat-sen)

(Well, truth be told, much of this information is also incomprehensible to English-speaking users. Hahaha)

(The translation is fairly accurate)

[jack_666]

@bekam

" ... and Chrome's translator is bad."

Maybe you would like to do the same experiment and demonstrate what trials you have to overcome.

[Mm879]

Could someone share the WKS-KEYS Zip with me?
I will send you L3 CDM that I am using personally


[Attachment 62555 - Click to enlarge]

I sent CDM to the people who shared the file with me.
Thank you for your help :디

Please don't leak it!!

[darkw4v3]

I have to ask - where are you folks getting the token.bin file from in the CDM files? Dumper isn't producing that - and as far as I can tell by analyzing the Python script - it won't. The device client id blob and PK both exported fine. My understanding is that the token.bin file is required for VMP to work when requesting a license.

Update: Looks like for VMP to be used, you need the device_vmp_blob as well as to pass a base64 encoded cert for the service_certificate of the session. Not sure where either of these are supposed to be coming from.

Thanks for any assistance.

[Mahrous199]

Deleted

[naim2007]

I sent CDM to the people who shared the file with me.
Thank you for your help :디

Please don't leak it!!

It's already leaked mate in github

[Mm879]

I sent CDM to the people who shared the file with me.
Thank you for your help :디

Please don't leak it!!

It's already leaked mate in github

It's a CDM extracted from my phone.
Only those who received the file will know

[mostyle]

I've been following this thread for about two months now and the amount of repeatedly asked questions is absolutely absurd. People, please understand the following:

• First and foremost, this form isn't about '..can you get for me?' It's about sharing knowledge and enabling you to help yourself.

• Second, this thread is HUGE... As has already been stated, the answers are likely here but will require effort to read and sometimes reread messages until you grasp the concepts

• Third, and this is very important, is that these tools use technologies (python, c#, etc) that if you don't have a basic understanding of you will be confused before you even get started. An example of this is having to be explained how to address python errors, ie, missing imports, etc. Helping someone learn the basics of python isn't what this thread is about and having loads of messages like that only further clutters the thread making it harder to find valuable information. Though it may sound harsh to some if you don't understand the technologies in use, it is likely that you were not the targeted audience of said tool.

• Finally, understand that trust on the internet is a myth. If you share something publicly it will get spread and eventually deactivated. Your best hope is to get your own private copies and keep them to yourself. I spent $20 USD and got a first-gen pixel off of eBay to use with wvdumper. Your experience will likely be better if you acquire your own CDM.

Now having said all of that, please know it isn't my intent to be rude. Far from it. I repeatedly come here to learn and further my understanding of the technologies involved with the ultimate goal of being self-sufficient. I just believe the information could be better shared if we all grasped the basics and kept the thread focused.

Apologies to those who may have found this offensive.

[darkw4v3]

I've been following this thread for about two months now and the amount of repeatedly asked questions is absolutely absurd. People, please understand the following:

• First and foremost, this form isn't about '..can you get for me?' It's about sharing knowledge and enabling you to help yourself.

• Second, this thread is HUGE... As has already been stated, the answers are likely here but will require effort to read and sometimes reread messages until you grasp the concepts

• Third, and this is very important, is that these tools use technologies (python, c#, etc) that if you don't have a basic understanding of you will be confused before you even get started. An example of this is having to be explained how to address python errors, ie, missing imports, etc. Helping someone learn the basics of python isn't what this thread is about and having loads of messages like that only further clutters the thread making it harder to find valuable information. Though it may sound harsh to some if you don't understand the technologies in use, it is likely that you were not the targeted audience of said tool.

• Finally, understand that trust on the internet is a myth. If you share something publicly it will get spread and eventually deactivated. Your best hope is to get your own private copies and keep them to yourself. I spent $20 USD and got a first-gen pixel off of eBay to use with wvdumper. Your experience will likely be better if you acquire your own CDM.

Now having said all of that, please know it isn't my intent to be rude. Far from it. I repeatedly come here to learn and further my understanding of the technologies involved with the ultimate goal of being self-sufficient. I just believe the information could be better shared if we all grasped the basics and kept the thread focused.

Apologies to those who may have found this offensive.

Well said. Although, I hope I didn't trigger that. I've been observing for a long time, and scoured the internet before joining and asking my question here.

[Fogue]

I get my first cdm last week with dumper and frida, about 2 weeks ago, before nf change something, we can get main profile with that generic android, but with my personal cdm i only get High profile, Main don't generate keys, even changing esn, there's some L3 that get Main on netflix or only L1?! Thanks.

[mostyle]

I've been following this thread for about two months now and the amount of repeatedly asked questions is absolutely absurd. People, please understand the following:


Apologies to those who may have found this offensive.

Well said. Although, I hope I didn't trigger that. I've been observing for a long time and scoured the internet before joining and asking my question here.

No, that wasn't directed to anyone. Just observations.

[[ss]vegeta]

I have to ask - where are you folks getting the token.bin file from in the CDM files? Dumper isn't producing that - and as far as I can tell by analyzing the Python script - it won't. The device client id blob and PK both exported fine. My understanding is that the token.bin file is required for VMP to work when requesting a license.

Update: Looks like for VMP to be used, you need the device_vmp_blob as well as to pass a base64 encoded cert for the service_certificate of the session. Not sure where either of these are supposed to be coming from.

Thanks for any assistance.

You don't need anything besides the blob and private key, no matter what you see in other CDMs.

[Quint]

And what about the config.json and token.bin that are present? Leave or delete, so that you have a directory with only privete key and blob?

[minegroasprilla]

(The translation is fairly accurate)

The translation is not always accurate because it also depends on what topics you speak. You want to show us that Google Translator is the best but in reality it is not but I don't understand why in this topic we talk about these translation issues.

[minegroasprilla]

Apologies to those who may have found this offensive.

For me, your comment is offensive. You assume that people know everything and that is not the case, and that we do not have the right to ask.
These forums are for learning because no one is born knowing everything.

Just because you know everything does not mean that we all know it.

[bekam]

Apologies to those who may have found this offensive.

For me, your comment is offensive. You assume that people know everything and that is not the case, and that we do not have the right to ask.
These forums are for learning because no one is born knowing everything.

Just because you know everything does not mean that we all know it.

I agree with you.

[STRiCK3R]

Hi all,
I have learned a lot coming here regularly and some members like @[ss] vegeta, @jack_666, @T33V33, @Codehound, @Notaghost, have helped a lot to move forward and I want to thank you guys for that. is great your knowledge sharing. It is not easy for them to follow all the thread and the various problems to be solved besides I would like to apologize if sometimes I asked too much whereas by seeking more the answer would come to me by itself. Sorry also for the translations lol you spoke about it a little higher in the discussion ... Good day to you all and long life to the forum

[darkw4v3]

I have to ask - where are you folks getting the token.bin file from in the CDM files? Dumper isn't producing that - and as far as I can tell by analyzing the Python script - it won't. The device client id blob and PK both exported fine. My understanding is that the token.bin file is required for VMP to work when requesting a license.

Update: Looks like for VMP to be used, you need the device_vmp_blob as well as to pass a base64 encoded cert for the service_certificate of the session. Not sure where either of these are supposed to be coming from.

Thanks for any assistance.

You don't need anything besides the blob and private key, no matter what you see in other CDMs.

Thanks for your response. Amzn doesn't accept license requests without Verified Media Path being used. As far as I can see in pywidevine, VMP isn't used unless you specify a service certificate (which sets privacy_mode to true) and have the device_vmp_blob. This is the bit of code I'm referencing:

        if session.privacy_mode:
            if session.device_config.vmp:
                self.logger.debug("vmp required, adding to client_id")
                self.logger.debug("reading vmp hashes")
                vmp_hashes = wv_proto2.FileHashes()
                with open(session.device_config.device_vmp_blob_filename, "rb") as f:
                    try:
                        vmp_bytes = vmp_hashes.ParseFromString(f.read())
                    except DecodeError:
                        self.logger.error("vmp hashes failed to parse as protobuf")
                        return 1
                client_id._FileHashes.CopyFrom(vmp_hashes)
            self.logger.debug("privacy mode & service certificate loaded, encrypting client id")
            self.logger.debug("unencrypted client id:")
            for line in text_format.MessageToString(client_id).splitlines():
                self.logger.debug(line)
            cid_aes_key = get_random_bytes(16)
            cid_iv = get_random_bytes(16)

            cid_cipher = AES.new(cid_aes_key, AES.MODE_CBC, cid_iv)

            encrypted_client_id = cid_cipher.encrypt(Padding.pad(client_id.SerializeToString(), 16))

            service_public_key = RSA.importKey(session.service_certificate._DeviceCertificate.PublicKey)

            service_cipher = PKCS1_OAEP.new(service_public_key)

            encrypted_cid_key = service_cipher.encrypt(cid_aes_key)

            encrypted_client_id_proto = wv_proto2.EncryptedClientIdentification()

            encrypted_client_id_proto.ServiceId = session.service_certificate._DeviceCertificate.ServiceId
            encrypted_client_id_proto.ServiceCertificateSerialNumber = session.service_certificate._DeviceCertificate.SerialNumber
            encrypted_client_id_proto.EncryptedClientId = encrypted_client_id
            encrypted_client_id_proto.EncryptedClientIdIv = cid_iv
            encrypted_client_id_proto.EncryptedPrivacyKey = encrypted_cid_key

            license_request.Msg.EncryptedClientId.CopyFrom(encrypted_client_id_proto)

[darkw4v3]

Upon further investigation, it seems as though it's just not possible without obtaining a legit VMP signing cert and signature file. So I guess AMZN is off the table. Bummer.

[elprimo]

Upon further investigation, it seems as though it's just not possible without obtaining a legit VMP signing cert and signature file. So I guess AMZN is off the table. Bummer.

I thought "device_vmp_blob" is the same as "token.bin" as I read in another thread in this forum. I still wonder how it's obtained next to the cdm dump.

[darkw4v3]

Upon further investigation, it seems as though it's just not possible without obtaining a legit VMP signing cert and signature file. So I guess AMZN is off the table. Bummer.

I thought "device_vmp_blob" is the same as "token.bin" as I read in another thread in this forum. I still wonder how it's obtained next to the cdm dump.

I saw the same post that linked those two things as well. However, even if you have a token.bin file - it's useless without the g00gl3 issued service certificate.

[mostyle]

For me, your comment is offensive. You assume that people know everything and that is not the case and that we do not have the right to ask.
These forums are for learning because no one is born knowing everything.

Just because you know everything does not mean that we all know it.

Wow, if that's what you took from my comment then... I feel you missed the point friend. Never will I ever imply that I know 'everything' because that's the moment you truly stop learning. I'll put it this way and then drop it because I don't wanna clutter the thread myself:

In college or UNI, when you start on a learning path, traditionally one takes intro courses, like 100, 101, etc. You cannot take a 104 class without having completed the prior courses. What I was (am) saying is that there has been a lot of basic intro questions (101) in regards to tools that have advanced knowledge (104) requirements. It's going to be extraordinarily difficult to follow and understand the advanced concepts if the fundamentals aren't in place first.

Never would I say to someone that they don't have the right to inquire but rather if your question pertains to the current topic, and if so, has it been asked prior. Knowledge is meant to be shared but it's also meant to inspire.

Form title: Video streaming download
Not: Basic python or introductory to programming

FWIW, I am sorry it offended you however I believe the logic is sound. The comments are observations, not targeted attacks.

[[ss]vegeta]

Amzn doesn't accept license requests without Verified Media Path being used.

Oh well, I hate Amazon and haven't played with it for a while. Like, 30 other services I used, never needed anything besides blob and private key.
So, [insert shameful verb here] Amazon!

[EatThis]

Amazon only requires vmp on web browser based CDM's like Chrome. It's irrelevant for an Android based CDM regarless if is L1 or L3. Amazon fails because it does not use L3 at all.

[darkw4v3]

Amazon only requires vmp on web browser based CDM's like Chrome. It's irrelevant for an Android based CDM regarless if is L1 or L3. Amazon fails because it does not use L3 at all.

Not exactly. AMZN failed only because the WV challenge wasn't VMP signed. The error was quite specific. Besides, any browser based CMD is L3 (it will never be considered a TEE), so they clearly support it L3. There is a legitimate way to get around the VMP problem, but it's too rich for my blood. That said, on Android, in desktop mode it won't let you view the video at all, and in mobile view, playing the video just switches over to the g00gl3 Play app. I'm assuming because it wants you to download their app to watch it. Their APIs must allow the content to be streamed to Android (probably at SD quality) - I'm just too lazy to setup a proxy and intercept the HTTP calls from their app.

[jack_666]

Amazon only requires vmp on web browser based CDM's like Chrome. It's irrelevant for an Android based CDM regardless if is L1 or L3. Amazon fails because it does not use L3 at all.

For all who asked the question, the above is the correct answer.

token.bin is part of the chrome browser dump.

It's the same thing that [ss]vegeta said
... You don't need anything besides the blob and private key, no matter what you see in other CDMs.

If you feel that you really need config.json and token.bin,
then get it from find some old cdm for chrome.

[EatThis]

Yeah, I don't think you know what you're talking about, why don't you research what VMP means and what it is for? While you are at it, why don't you just do that, setup a proxy and intercept network traffic to the Amazon Prime app specially when doing license request instead of speculating.

[EatThis]

Yeah, I don't think you know what you're talking about, why don't you research what VMP means and what it is for? While you are at it, why don't you just do that, setup a proxy and intercept network traffic to the Amazon Prime app specially when doing license request instead of speculating.