How are you going to respond to widevine l3 decryptor's death at May 31st?

[kienkzz]

It possible with U-Next, Crunchyroll?

Probably. Have you tried?

No, but how to work with it?

[birbal1]

Hey guys and girls, quick question.
Since ghosts site now requires us to upload CDMs
i need to resort into (finally) buying CDMs (if people even sell them)
Or possibly buying an old android device.
If i went with the ladder any recommendations? thank you!

You can use the CURL API on some sites which bypasses the need for a CDM to be used along with most header information as well. I suppose it just depends on where you want to use it.

Thank you for the help!
I ran this code in my Command Prompt

curl http://getwvkeys.herokuapp.com/api -d "{\"license\": \"https://wv.service.expressplay.com/hms/wv/rights/?ExpressPlayToken=BQAiqQLiKdMAJGVhMWI4MzIyLTE0NGYt NGI5My1hYzRmLTE0NDg1YjEzOTE5YQAAAGCjOVhrKGbRexDkev oVHxusAp0tmHoXAjXZ2LUk4_hOTZtI-ofjg7s7l3wu4RhIwErKmHWADgCzs1aXB2kawFrL5ewj0RdNy8F Bg98jsfuFvn9tjvJ-UGHzkXQwh7pHYMFMAZCj67C1GVCNTj1t9EXIojRiAg\",\"pss h\":\"AAAANHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAABQI ARIQvy6Ye3m0ARa/rwUo4f72zA==\"}" -H 'Referer:http://getwvkeys.herokuapp.com'

annd i get

{"Error": "Error 404:<br>{\"error\":{\"code\":-7008,\"message\":\"[-7008] Failed to generate Widevine license\"}}"}

Any idea if this site just not going to work with the Curl API? Or am I incorrectly inputting something in the code?

Thanks again!

Because the pssh is not valid base64, the licence url also has a space in it

Edit: I took all the spaces out of the pssh and license url, then it worked

bf2e987b79b40116bfaf0528e1fef6cc:34efd0d8f6774bdd9 2f1a25178751029

man can u help with this

api url

https://api-a0.marrow.com/v3.1/gtoken/android/NUxBTkkrSHF4dUgwbVVZTG9OaWxMMXVLQU1tVlpkaW1vN3d4TEx5THQ3STBNN2poMmlkUFJKN2lzZTlYLzBRcjdhSi9NeVMxZXZmbHR1RnRHMG9YVncvWi9OOUkydzRhQ2lpc2svZXdCZjg0MTlpemhqaTVQb0FIU0ZpOERON1FDZkwvajBPaVVIcmVvalBWaW15Q0NyS25yZ0s2YzRlenFUT1Zqbk4rTlhIWWZRdkdseWRCdmhpVGVRRERZR0xMWUlkbDZUSVcwWHRyQWdESkhJWUFPWWJSRmlsSDdCRDRaMlVFTnVHUjFhejlxR3JGTmRDYmd5Ti9lZU9kSFBaNVdLZmg2WGxzcDFtOUxXYkQzbDh0enRSZ3V4UnB3SjhROVlCRVYzLzc4cWxGMlR4dTJBWVMyZkF0b0VvdEJBNlpleXI3aWxGTHJvMXY4aTFNZ2J3eDh2az0=

license url

https://drvideo.keydelivery.mediaservices.windows.net/Widevine/?kid=fd74a351-a387-4084-a0aa-cda6c4bab4a1

mpd url

https://drvideo-ak.akamaized.net/video-sg2/bd75c35f-e24c-45cc-8212-e466c266d3c8/5943.ism/manifest(format=mpd-time-csf)

pssh

AAAAMnBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAABISEP10o1Gjh0CEoKrNpsS6tKE=

headers

Dr-Platform: android
Dr-Dv: m.2061a6e23daeed98
course-id: 1
Dr-UID: 6197bdf7aa8ded1766241523 - MFREE
Dr-App: marrow
Dr-Dv-ENC: UDW/ko7L7tq1MvPm2kCcQUP0XgcaqMjZ8B0v+yyMej815hq1NyWkIx QtiW1Wl4Wipg==
Dr-Dv-Model: M2007J17I
Dr-Token: .eJxVzNEKgzAMheF3ybUM285UfZmSLREKakoc7mLs3ddNGHj75 T95QcoMI6Ab4o2nSNSzsIuI_uo6H6ABtsSy57vUbLn4Fh2h-MAkwkN_BGWmx6S21IRWNq0_f06lfFdkps-_pF1sy7rWS2i7g3U7Kbw_1GEvnA.FMs7Jg.9eq3YKTPQtkoo-XmXHkiwryATzM
Dr-App-Version: 308
Dr-Dv-Ts: 1644268191446
Content-Type: application/octet-stream
User-Agent: Marrow/7.15.1 (com.marrow; build:308; Android 11(30); Device)
Accept-Encoding: gzip
Content-Length: 2114
Host: api-a0.marrow.com
Connection: Keep-Alive


please show me how to use curl api for this
help me i have been trying in vain for 4 months?????

[jack_666]

@birbal1

Double post

https://forum.videohelp.com/threads/401717-How-are-you-going-to-respond-to-widevine-l3...58#post2647451
https://forum.videohelp.com/threads/404699-api-request#post2647449

[magicsp00n]

Kind of a hail mary here. The license server I'm trying to get keys from is spitting this out:

{"licenseData":["CAISqAIKNAoQv1GeqGe1O7h3D1UCWfPHC..."]}

Have tried a myriad of things, starting from adding "licenseData" as one of the lic_field_names fields in l3.py (widevine-keys of course) and other things, can't get it to work. Would be grateful for any help. Admittedly I am a python noob so maybe this is something very simple that I'm not able to recognize or implement, perhaps base64 related. Decoding the string via base64 shows text very similar to raw license responses I've seen elsewhere.

The l3.py error is:

Traceback (most recent call last):
File "l3.py", line 121, in <module>
correct, keys = WV_Function(pssh, lic_url)
File "l3.py", line 116, in WV_Function
wvdecrypt.update_license(license_b64)
File "C:\Users\Admin\Desktop\widevine_keys-main\wvdecryptcustom.py", line 58, in update_license
self.cdm.provide_license(self.session, license_b64)
File "C:\Users\Admin\Desktop\widevine_keys-main\cdm\cdm.py", line 270, in provide_license
license.ParseFromString(base64.b64decode(license_b 64))
File "C:\Users\Admin\AppData\Local\Programs\Python\Pyth on37\lib\base64.py", line 80, in b64decode
s = _bytes_from_decode_data(s)
File "C:\Users\Admin\AppData\Local\Programs\Python\Pyth on37\lib\base64.py", line 46, in _bytes_from_decode_data
"string, not %r" % s.__class__.__name__) from None
TypeError: argument should be a bytes-like object or ASCII string, not 'list'

[gareth41]

@magicsp00n

You need to parse the json to array in the py script, the pull the license data out from array. You should also redact that license response as it contains unique identifying (encrypted) information relating to the cdm you used - this could potentially lead to it being revoked.

[magicsp00n]

@magicsp00n

You need to parse the json to array in the py script, the pull the license data out from array. You should also redact that license response as it contains unique identifying (encrypted) information relating to the cdm you used - this could potentially lead to it being revoked.

Thanks for the heads up about the license response info.

I've now fixed the json parsing of the response with a little bit of help from someone more knowledgeable than me and now this come up

PSSH obtained.
AAAAOHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAABgSEPFKZn P3Ds+wWYpDGS1YM0lI88aJmwY=

license response status: <Response [200]>

Traceback (most recent call last):
File "l3.py", line 108, in <module>
correct, keys = WV_Function(pssh, lic_url)
File "l3.py", line 103, in WV_Function
wvdecrypt.update_license(license_b64)
File "C:\Users\Admin\Desktop\widevine_keys-main\wvdecryptcustom.py", line 58, in update_license
self.cdm.provide_license(self.session, license_b64)
File "C:\Users\Admin\Desktop\widevine_keys-main\cdm\cdm.py", line 285, in provide_license
session.session_key = oaep_cipher.decrypt(license.SessionKey)
File "C:\Users\Admin\AppData\Local\Programs\Python\Pyth on37\lib\site-packages\Cryptodome\Cipher\PKCS1_OAEP.py", line 167, in decrypt
raise ValueError("Ciphertext with incorrect length.")
ValueError: Ciphertext with incorrect length.

The licenseData is parsed correctly now but this comes up. Not sure what the problem is to be honest. I should mention that there's a series of required json fields for the request, which I've hardcoded, one including a licenseChallenge. I've hardcoded it to the l3.py and it can get a license response but I'm thinking that the challenge originating from a browser and l3.py using an android CDM to process the response might be a reason why it's not working, not entirely sure though.

[[ss]vegeta]

ValueError: Ciphertext with incorrect length.

You might have toasted your CDM. Do you have another one to try?
I failed too many times with license request on udemy and this happened.

You can thank ElCap for the toast phrase. It's perfect. Even though he first used it for my poor little CDM baby.
I propose a change for revoke. Everyone, please start using toasted instead of revoked.

[zeosle]

Hi,

These two have totally refused to yield their key extraction secrets. If anyone manages to get keys from them, kindly give me a shout-out in PM or herein. Kindly. They are essentially my remaining sites. I will appreciate.

-Peacock TV (USA)

-Virgin media Go Tv (UK)

[joasis]

ValueError: Ciphertext with incorrect length.

This also comes up if you're using the hardcoded CAES message instead of your own to make the request. Make sure you replace it with the one generated by yourself (with wvdecrypt.get_challenge()).

[jack_666]

[ss]vegeta wrote

You might have toasted your CDM. Do you have another one to try?
I failed too many times with license request on udemy and this happened.

You can thank ElCap for the toast phrase. It's perfect. Even though he first used it for my poor little CDM baby.
I propose a change for revoke. Everyone, please start using toasted instead of revoked.

I think a better idea is to coin the term vegeta

You might have vegeta your CDM.

vegeta will be immortalized.

[Jordi22]

hi, i'm trying to download from blimtv

i know that uses the same KID:KEY so... what's the problem?

D:\python bad37.py --url https://www.blim.com/asset/13084 -c playready

VIDEO - Bitrate: 5805kbps - Profile: H264 - Size: 1.87GB - Dimensions: 1920x1080

AUDIO - Bitrate: 160kbps - Profile: AACL - Size: 52.85MB - Language: es-la

Name: Teresa S01E01 - Salir de pobre

Teresa S01E01 - Salir de pobre [1080p].mp4
100%|█████████████████████████████████████████████ ███████████████████████████████████| 279/279 [00:53<00:00, 5.25it/s]
Done!

Teresa S01E01 - Salir de pobre (es-la).mp4
100%|█████████████████████████████████████████████ ███████████████████████████████████| 279/279 [00:04<00:00, 60.17it/s]
Done!

No subtitles available.

Muxing...
Error: The type of file 'Teresa S01E01 - Salir de pobre [1080p].mp4' could not be recognized.
Done!


anyone know something?

thanks in advance

[magicsp00n]

ValueError: Ciphertext with incorrect length.

You might have toasted your CDM. Do you have another one to try?
I failed too many times with license request on udemy and this happened.

You can thank ElCap for the toast phrase. It's perfect. Even though he first used it for my poor little CDM baby.
I propose a change for revoke. Everyone, please start using toasted instead of revoked.

I also suspected that but I just played the bitmovin demo on my phone (where I got my keys from) and it plays. The site I'm trying to get keys from is really finnicky it seems like.

This also comes up if you're using the hardcoded CAES message instead of your own to make the request. Make sure you replace it with the one generated by yourself (with wvdecrypt.get_challenge()).

Thanks for that tidbit, someone also pointed me in that direction, tried it and it spits out "mismatched DeviceID".

license response status: <Response [403]>
server reports: {"errorReason":"10062","description":"Mismatch in request information - Device","message":"DRM DeviceID Mismatch"}
server did not issue license, make sure you have correctly pasted all the required headers in the headers.py. Also check json/raw params of POST request.

Seems like whatever challenge widevine-keys is sending doesn't take into the account my device's details. I just noticed there's a deviceconfig.py file, is that what I have to edit to fix the challenge? If so, how and where do I get the exact details? deviceconfig.py seems like a summary of the devices in cdm\devices, I only have the generic_android folder and I overwrote my blob/key over the ones already there, not sure if I should've moved my CDM files in a different way and it's why it's now screwing up.

[[ss]vegeta]

I also suspected that but I just played the bitmovin demo on my phone (where I got my keys from) and it plays. The site I'm trying to get keys from is really finnicky it seems like.

Aha. So, because you can play the bitmovin demo that has nothing to do with the site you are trying to get keys from, your conclusion is that your CDM is not revoked on the site you are trying?
Alright, go on.

[magicsp00n]

I also suspected that but I just played the bitmovin demo on my phone (where I got my keys from) and it plays. The site I'm trying to get keys from is really finnicky it seems like.

Aha. So, because you can play the bitmovin demo that has nothing to do with the site you are trying to get keys from, your conclusion is that your CDM is not revoked on the site you are trying?
Alright, go on.

What's with the sass? Anyways, I see what you're saying now, thought CDMs were revoked in their entirety rather than specific for one site, thanks for that tidbit. I just tested playing a video on the Android app of the site I'm trying to get keys from, using the same phone where I got my CDM from, and it plays so I don't think it's that. How do you think I should go about solving the mismatched DeviceID error widevine-keys spits out that I described earlier? Appreciate the help.

[[ss]vegeta]

What's with the sass?

Sorry.

How do you think I should go about solving the mismatched DeviceID error widevine-keys spits out that I described earlier?

I'm not sure...

[filipino]

hi, i'm trying to download from blimtv

i know that uses the same KID:KEY so... what's the problem?

D:\python bad37.py --url https://www.blim.com/asset/13084 -c playready

VIDEO - Bitrate: 5805kbps - Profile: H264 - Size: 1.87GB - Dimensions: 1920x1080

AUDIO - Bitrate: 160kbps - Profile: AACL - Size: 52.85MB - Language: es-la

Name: Teresa S01E01 - Salir de pobre

Teresa S01E01 - Salir de pobre [1080p].mp4
100%|█████████████████████████████████████████████ ███████████████████████████████████| 279/279 [00:53<00:00, 5.25it/s]
Done!

Teresa S01E01 - Salir de pobre (es-la).mp4
100%|█████████████████████████████████████████████ ███████████████████████████████████| 279/279 [00:04<00:00, 60.17it/s]
Done!

No subtitles available.

Muxing...
Error: The type of file 'Teresa S01E01 - Salir de pobre [1080p].mp4' could not be recognized.
Done!


anyone know something?

thanks in advance

can i check your blimtv.py file? Maybe I can help

[gareth41]

Hi,

These two have totally refused to yield their key extraction secrets. If anyone manages to get keys from them, kindly give me a shout-out in PM or herein. Kindly. They are essentially my remaining sites. I will appreciate.

-Peacock TV (USA)

-Virgin media Go Tv (UK)

Peacock needs scripting, you cant just copy+paste the headers as there appears to be a "one time" token being used, meaning once Chrome makes a request to the license server and the video starts playing, you can't just go sending more license requests using the same token and headers etc... you need to request a new token from their api, then make another call for a license using that token.

[zeosle]

Hi,

These two have totally refused to yield their key extraction secrets. If anyone manages to get keys from them, kindly give me a shout-out in PM or herein. Kindly. They are essentially my remaining sites. I will appreciate.

-Peacock TV (USA)

-Virgin media Go Tv (UK)

Peacock needs scripting, you cant just copy+paste the headers as there appears to be a "one time" token being used, meaning once Chrome makes a request to the license server and the video starts playing, you can't just go sending more license requests using the same token and headers etc... you need to request a new token from their api, then make another call for a license using that token.

Ok. Thanks. Noted.

[[ss]vegeta]

Peacock needs scripting
"one time" token being used

Are you sure about that? Is that the only problem with Peacock?
By the explanation you gave, last time I saw something like that was some NBA site.
What I did then, was using debugger to stop the license exchange at some point (OPTIONS I think), before the video starts playing, and was able to get the one time token and use it to get the key.

[RedPenguin]

Are you sure about that? Is that the only problem with Peacock?
By the explanation you gave, last time I saw something like that was some NBA site.
What I did then, was using debugger to stop the license exchange at some point, before the video starts playing, and was able to get the one time token and use it to get the key.

I would be curious to know myself.

That sounds like a very clever technique.

I don't have much experience with debugger but have heard it mentioned at times before.

[Ish Kabibble]

Just spent the last 7 hours trying to dump keys from an old Samsung tablet and from an x86 virtual machine. No luck. And from what I've read in this thread, the platform isn't easy to work with once the keys are obtained. Can someone reach out to me privately and help point me in the right direction? I know it's possible...

[WelleTy]

hellos previously "http://getwvkeys.cc/" on this site "JS FETCH REQUEST" had such a button and I could get a smooth key. Now I'm getting headrs 404 again. I wonder if there's any way I can help solve this problem.

[rana382]

I came across this amazing learning platform Upgrad, i was wondering if i could download the videos in my laptop
URL to one of the videos is this
https://players.brightcove.net/4744899836001/default_default/index.html?videoId=5207449446001

Note: This code will work only in FireFox, if you want to make a webpage to load this video, you may use this code

<!DOCTYPE html>
<html lang="en" >
<head>
</head>

<body translate="no" >
<video-js
id="bcplayer"
data-video-id="5670931150001"
data-account="4744899836001"
data-player="default"
data-embed="default"
data-application-id
class="video-js"
controls
playsinline
width="960"
height="540"></video-js>
<script src="https://players.brightcove.net/4744899836001/default_default/index.js"></script>
</body>

</html>

[jack_666]

I came across this amazing learning platform Upgrad, i was wondering if i could download the videos in my laptop
URL to one of the videos is this
https://players.brightcove.net/4744899836001/default_default/index.html?videoId=5207449446001

I suspect that this may work.

License:https://manifest.prod.boltdns.net/license/v1/cenc/widevine/4744899836001/e9b925dd-efc4...M4ZDBlMWU3OQ==

PSSH:AAAAVnBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAADYIA RIQ+CkKpRxSRuCtIFtV+8Ne8RoNd2lkZXZpbmVfdGVzdCIIMTI zNDU2NzgyB2RlZmF1bHQ=

Headers:{'accept': '*/*', 'content-length': '316', 'Connection': 'keep-alive'}

f8290aa51c5246e0ad205b55fbc35ef1:5c99aaee06321edef 931999e9b5a33b3


pssh - from mpd
license url - from dev tools

key from - well, you know from where.

[rana382]

I came across this amazing learning platform Upgrad, i was wondering if i could download the videos in my laptop
URL to one of the videos is this
https://players.brightcove.net/4744899836001/default_default/index.html?videoId=5207449446001

I suspect that this may work.

License:https://manifest.prod.boltdns.net/license/v1/cenc/widevine/4744899836001/e9b925dd-efc4...M4ZDBlMWU3OQ==

PSSH:AAAAVnBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAADYIA RIQ+CkKpRxSRuCtIFtV+8Ne8RoNd2lkZXZpbmVfdGVzdCIIMTI zNDU2NzgyB2RlZmF1bHQ=

Headers:{'accept': '*/*', 'content-length': '316', 'Connection': 'keep-alive'}

f8290aa51c5246e0ad205b55fbc35ef1:5c99aaee06321edef 931999e9b5a33b3


pssh - from mpd
license url - from dev tools

key from - well, you know from where.

Can you please provide me more information here, which tool or application to be used here, it will be more helpful if you could attach any screenshots. as i tried using that url directly in browser but i did not work. i would really appreciate your help. Thanks in advance.

[T33V33]

Can you please provide me more information here, which tool or application to be used here, it will be more helpful if you could attach any screenshots. as i tried using that url directly in browser but i did not work. i would really appreciate your help. Thanks in advance.

Read back through this thread. All of the information you require has already been posted in it

[giorey]

I also suspected that but I just played the bitmovin demo on my phone (where I got my keys from) and it plays. The site I'm trying to get keys from is really finnicky it seems like.

Aha. So, because you can play the bitmovin demo that has nothing to do with the site you are trying to get keys from, your conclusion is that your CDM is not revoked on the site you are trying?
Alright, go on.

What's with the sass? Anyways, I see what you're saying now, thought CDMs were revoked in their entirety rather than specific for one site, thanks for that tidbit. I just tested playing a video on the Android app of the site I'm trying to get keys from, using the same phone where I got my CDM from, and it plays so I don't think it's that. How do you think I should go about solving the mismatched DeviceID error widevine-keys spits out that I described earlier? Appreciate the help.

I tried that site too before like a year ago If I remember the problem has to do with the Identity Cookie or the AuthToken someone told me that the one I copied belong to browser cdm and I was using an android so I had to get the correct token from the android app also he told me if that's not the problem maybe was the cert.bin the site have so I couldn't make it work and I had to wait for the wv guesser to get the keys

[[ss]vegeta]

I tried that site too before like a year ago If I remember the problem has to do with the Identity Cookie or the AuthToken someone told me that the one I copied belong to browser cdm and I was using an android so I had to get the correct token from the android app also he told me if that's not the problem maybe was the cert.bin the site have so I couldn't make it work and I had to wait for the wv guesser to get the keys

Ha!
Like-minded individual, that guy...


[Attachment 63270 - Click to enlarge]

[giorey]

I tried that site too before like a year ago If I remember the problem has to do with the Identity Cookie or the AuthToken someone told me that the one I copied belong to browser cdm and I was using an android so I had to get the correct token from the android app also he told me if that's not the problem maybe was the cert.bin the site have so I couldn't make it work and I had to wait for the wv guesser to get the keys

Ha!
Like-minded individual, that guy...


[Attachment 63270 - Click to enlarge]

Right I tried to inspect the traffic but I had no luck since my ip don't belong to US and I had to connect by vpn the inspect program didn't give me the lic url since I think that was passed through the vpn app

[UKK]

Followed all the posts and find out All4 is impossible for me to do it.
May I ask your guy for the KID:KEY of this one:
https://www.channel4.com/programmes/boobs/on-demand/72842-001
Also as I use n_m3u8dl-cli to download it, the videos and audios are ts files
They are merged to an unplayable mp4.
Is it correct to use mp4decrypt to decrypt this file or I need to decrypt the ts files?
in that case, how can I do it as there are so many files....