How are you going to respond to widevine l3 decryptor's death at May 31st?

[gareth41]

Can someone tell me why this license request is encrypted? https://throwbin.in/51fn8b
It's not like other sites I use that I can get keys succesfully. But this one, can't get keys and license request is unusual like this. Anyone know what that means?

The license request is encrypted using the service certificate. If you look in the network tab in Chrome developer tools you'll see 2 requests to the license server, the first one contains a 2 byte payload of 0x08, 0x04 - this is a request for the license server to send the service certificate. The second request is the actual request for the license, and this is encrypted with the service certificate public key (as per your screenshot). Google is the only one who has the private key and decrypts the license request for processing on their end, they then send back the license encrypted with the public key of your CDM.

This is why you should never post any license requests or responses generated using your own CDM including encrypted. Chrome CDM is ok, but if you post anything generated using your own CDM then chances are it will be revoked.

[abhiramskrishna]

I am getting issue on SunNXT while requesting key from notaghost's wvkeys site.

MPD : https://suntvvod.s.llnwi.net/movies/ce54e7fed2437ab83854acfa56b1fc54/132819/132819_hd....nXtGW1Qx/uLg==

License URL : https://www.sunnxt.com/content/license/?content_id=132819

Headers : User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:97.0) Gecko/20100101 Firefox/97.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Length: 5723
Origin: https://www.sunnxt.com
Connection: keep-alive
Referer: https://www.sunnxt.com/malayalam-movie/detail/132819/jan-e-man?carouselAction=Latest%20Movies
Cookie: XSRF-TOKEN=eyJpdiI6InZnQzJJcTFcL0pZUExLdmRac25Ka2FBPT0i LCJ2YWx1ZSI6ImY0dEVvUFlHcXNDK3JlMHFrekRUb21zMzM2QW xKdWhaMXl4SVhJY1JUWERsYVdDcGtLM1dYWW9GYXJUSjR4UG9D VXR6S2twSzVnWkJmUVF2RnJXaWVBPT0iLCJtYWMiOiI3MGEzZT g5MWFjODgzNWRhZjY3ZmFmNWI3NDJiZTBjYTUzZDc3NDQ5ZGE1 MzExNzM5YmUwYTdiMWJmN2UzZjFkIn0%3D; laravel_session=iossWHnOVuD6ah14k7pwzMtyBmTYbhufwy Ew29xM; RT="z=1&dm=sunnxt.com&si=63db8e41-bf2c-4c27-a168-9c91aa5a27f2&ss=l03wqaxb&sl=1&tt=1nm&bcn=%2F%2Fbea con.s.llnwi.net%2Fstarling%2Fbeacon.txt&ld=1nn"
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

[fisfisa]

The license request is encrypted using the service certificate. If you look in the network tab in Chrome developer tools you'll see 2 requests to the license server, the first one contains a 2 byte payload of 0x08, 0x04 - this is a request for the license server to send the service certificate. The second request is the actual request for the license, and this is encrypted with the service certificate public key (as per your screenshot). Google is the only one who has the private key and decrypts the license request for processing on their end, they then send back the license encrypted with the public key of your CDM.

This is why you should never post any license requests or responses generated using your own CDM including encrypted. Chrome CDM is ok, but if you post anything generated using your own CDM then chances are it will be revoked.

Thanks, that's a good explanation. Yes I can see it first requests the certificate like you say. Do you have any idea why my licence requests fail to this server with tools like getwvkeys, wks-keys etc.? What should I do to make it work then? Is it because server only accepts encrypted requests? If so, is there a way to modify existing scripts to do that?

[filipino]

This is the issue:

"licenseRequest":"CAESxxxxxxxxxxxx"

  '{"keySystem":"widevine","licenseRequest":"CAES7R8SYApeCkg.....="}'

maybe it will work ??

try with header only, without data and response

same mistake
apparently it is impossible to get a key from xfinity, no one here has been able to do it

[adrian.1717]

hello everyone,

anyone able to get the keys for bein connect australia?
i'm unable to get the keys with wks although i already put the Authorization and X-CB-Ticket on the headers.

[adrian.1717]

Did someone tried to get keys from nostv.pt?

AAAAPXBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAAB0IARIQFA 3zxWFMSuC/Jp4UyO8cWCIHRVBHQzQxNw==

https://nos71zv1.anycast.nagra.com/NOS71ZV1/wvls/contentlicenseservice/v1/licenses

curl 'https://nos71zv1.anycast.nagra.com/NOS71ZV1/wvls/contentlicenseservice/v1/licenses' \
-H 'authority: nos71zv1.anycast.nagra.com' \
-H 'pragma: no-cache' \
-H 'cache-control: no-cache' \
-H 'sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="97", "Chromium";v="97"' \
-H 'accept: */*' \
-H 'nv-authorizations: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsImtpZCI6IjkxOT g2MCJ9.eyJ0eXAiOiJDb250ZW50QXV0aFoiLCJ2ZXIiOiIxLjA iLCJqdGkiOiJjZGE2ZmYxMC05NGYxLTQ1YmUtYjFiOS1iYzcyO DBmZGM2Y2UiLCJkZXZpY2UiOnsiYWNjb3VudElkIjoibm9zaTg 5RjEyQjgzN0MzQkQ1NEUxREM5NUUyRUU5MDkwMDMyODBEQ0ZFR DlDMzAwRjI5RUY4M0IxRDJFNjY3NjIzREMifSwiY29udGVudFJ pZ2h0cyI6W3sic2Vzc2lvbkNvbnRyb2wiOnsibWF4U2Vzc2lvb nMiOjd9LCJjb250ZW50SWQiOiJFUEdDNDE3IiwidXNhZ2VSdWx lc1Byb2ZpbGVJZCI6IkhEIiwiZHVyYXRpb24iOjg2NDAwfV0sI mV4cCI6MTY0Mzg0MzUzNH0.j58LftBSnC0RFj-4iT_GOJl6TROY5kdA0LBWQc9rAtY,eyJraWQiOiI5MTk4NjAiL CJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyZXF1ZXN0VG 9rZW5TaWduYXR1cmUiOiJqNThMZnRCU25DMFJGai00aVRfR09K bDZUUk9ZNWtkQTBMQldRYzlyQXRZIiwiYWNjb3VudElkIjoibm 9zaTg5RjEyQjgzN0MzQkQ1NEUxREM5NUUyRUU5MDkwMDMyODBE Q0ZFRDlDMzAwRjI5RUY4M0IxRDJFNjY3NjIzREMiLCJ2ZXIiOi IxLjAiLCJoZWFydGJlYXQiOjMwMCwic2hvcnRWYWxpZGl0eUR1 cmF0aW9uIjo0MjAsInRlbmFudElkIjoiTk9TNzFaVjEiLCJ0eX AiOiJTZXNzaW9uIiwic2Vzc2lvbklkIjoiM2ExOGJmNTEtMWFj MC00OTcwLTkyYTEtNWFiYjBmMmI3Y2FlIiwiZXhwIjoxNjQzOD QwMzU1fQ.DIpzzrHJcAWKmHaw6EajDc0Eya2vAXxWGn1oZEXpR 9s' \
-H 'sec-ch-ua-mobile: ?0' \
-H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36' \
-H 'sec-ch-ua-platform: "Windows"' \
-H 'content-type: application/json' \
-H 'origin: https://nostv.pt' \
-H 'sec-fetch-site: cross-site' \
-H 'sec-fetch-mode: cors' \
-H 'sec-fetch-dest: empty' \
-H 'referer: https://nostv.pt/' \
-H 'accept-language: hr-HR,hr;q=0.9,en-US;q=0.8,en;q=0.7' \
--data-raw '{"challenge":"CAESyh8SNQozCh0IARIQFA3zxWFMSuC/Jp4UyO8cWCIHRVBHQzQxNxABGhAFeqAW03DHJ97twZxINawQGA Eg8oPsjwYwFTiPi7zNCkKAHwoUbGljZW5zZS53aWRldmluZS5j b20SEBcFuRfMEgSGiwYzOi93KowawByftnBzLf0DFwePPyi2aY Pea9G8V3d+igjAwveZCFKJRJfHNUpuDRKW/zmtNZuwBpvUC0OKTivg8fr+NXJs+7Tsc08AUkrBIKiww4KssV9 RXUK5oIRoU9toXJA7gsTgq5euZ6IB2zXudNUmgrliqwqTYjyJO GF7Rsy69+2QqZ4cygDnDlb0p80T6KaeKNk0SPeAkeqqZ7+BUZQ XEqwtfxXM3WlZE3IS9soaVKZzLMEn5EZci9L9MIorZRdEGYBEz 7yPNigutRPWisuRO83j7RpFwPXM4J50ap15O0no5FCAcfpSc0M fqaCbC1FkvnV2K5GhzHdlJ1r3L8lEo7mZIK5ZO7micrM6PKr73 WF72ouVuhrR5VverGDJw8l7fLZ4R8AgRh9rmg+zXkpy5XxkbiC LKkNzKOLaYcU5pulmyIc2442qVAxnZbAV8ItizClw4AXf9Uhue 4jr5cXDq4Yh+nYJaGfhC3GI3QAbRSJDUwqrgNnVzSEro10wal8 bB9qb567rRBPjZ2aPjC94nMRTAAFaoq/bVvRSLc/8dBb2h7PAj3DB8or/b6FP04vOO3Ta9wHWOS5IW2L0SX0QcqR7zhRqIJpL7A0NhyS00w xqBZbzSroGxTsuEJMcrNSPxjQXTCrTxeIo+q30kEZKbykjamMm RShKWND8HXqKUeam2qS8I3/cg7cnV4cxtOSWyhjryBs1FjtV3gfPv5S/i4PaQqIMQSfb5KGkiaNNr39lPULCDBNivoxCGj4jtANNQW/0/7k2SdwQU3hEtXzXk/dQueRj1xf3WCOxXqeR+xa7nPP2ZBkzQ0cdkG7b5xZEUmisghxS gsfPMfXwHJbk7shSQBu1aKXvLHN+xcpAfYMndSIWZIRQpmM+ZC o1eb0VtX2UXWrtIx74chXKVye3fNMIvIDjXUFUNGrdRKoBIl0m uIc1NKM/NhPWStwPBJXSmQ7b8lVqWyx7eeXNJ7NKyZhvMdVuyO0s9kmfip dyR1IRYwdOSTojmQBQLsol+v3f+WMfNZNi8agdvL/OL0Um63ewIm5em2eOMnjR3Hcl7mhcd7GJAdHFrENMn3B6OXfkL F8qD9wnG206JRYzp3yBanP/tkuD+1iwBMVzU75o5cpT0R+Zxz8/wbDq15/4f0RJ7RWlMR8iTsDadxreMLi/3BPUeRCXLLO4G3ZlZ0YR1dt7298pQxx9OldspmqOsTcNbm62PA blrVr6KplvKyI9cnHq11L8hFeQGT1t8i55CFsSkvM0CqvfEBVr VRJNSm13flq9D9bj0DSRvj3wd081IOQzAQsGRkZXMbpB5zNA4w hikqyjfQbEPHcsxLuTF269ZKyL4Euwiwwm0MMd7RZqvrIpXSx+ OggiqVbPCJ+lF/eDnKt5fBzu0GWuQplriBS3eFGwbBD7R2cuHITnUl+ZmZCO8HGT 3vwBlBdhTs2SJ+gaTqLVjjk2v8YyQHlMAYRbB4kuVIvoN4p8eF Jxy6hmJBFbiiarzdoTK3+GmEUa0eackRM9QDB2vwkgfp+H32My/1LEt2odCCmHQJYzrfkDLIX3sHlBCBRBe8E3RR+GhVGwuhw6QdE z4ZShYHFHXJs5zIkZ20xBw/oUwi3OUmltSmdlET7PVK1HY85s4w6toqvD+NWuMsF5nM1a2M0J 4p3TfSjYS8b4wXyqd/JwQFgUVsyn74N3xZKYk5QGkHpYCPG6dz6P8VlJQDjtXh/QK6m40cx4rvnNXqajmvIygfURpoYJ0JzLANSuPQannPYFQipck zD1fsZFiYdlcndVzIsp/q7Y10gFhSLolRUPkHbRa3l715I5PvawEtH4EXVtWjQbstT0t/Ni6aAXjXQj9/mIGnD0LAbJx9BAteQI3yA8ffOxJ6MUnU46LrTMZZTqSGi83y2W EFcYCJH4pUP3NDMF1fpoPCkG9LQtKTprWeCRcBLYDlszqCuU4B OowK3weAjQgVR8N/PNtAIYnsSgvwB9+17gbgyB+xdMX7EQf3X9vFdogXNKtuM/2LIiOPyxfhZQOTeypj8Igd/2JHoeSFMxlDhSPndIbTUoilRDVGPdRcNskTqt4ANuYZK2JitbT bBYkUheWs9ZbglUbx1qKNM9EXQtxpe1MTED+yNT9I8bVunbbNR kuQrj70KO0lXc14C7cAt/FBlShIhLwTHQaIGwnoj500yBEhshFy+FnVKze7njP1H413mEpC j9sNOOA//7+UhfsKiWBs/ShJqZRj3zQNRwYJKMyiXgWYiIPQH8hu43veX4qoZD027n25u5W MssM6AAAlRFHxFsmyN4qJNQDRX8GXiBsxyjop1m5kLv2ov0UuW MvpLWHkapzBu5vHdmJsT8DHpF8ghpVyiiVweK2JGyuLRGdVYLf dIaHngGI81ShHnW4/2qtWtollGETDoyRCjhV0ZaWHrhZTMfxM+B8LwAF1G/RHBpR0bZ8dGDwXxldMjK34p4wqv/iOM5n6Eqa+Ms0IGeS0tWcjPvwELUO3Ux6Dv6cZGNbdiHszaprA oFkHsXJRY6ZRJAv/awJzPf5q6Rwin9EAnek3bWgMX7kv8IFQW5ybKu+Cs1eHQvRrwq SqIVTsNU2x6XTXwm/hP8JwaE64TwAzG66tjZfaoumk+yAf/7ISfbyQFWPp5Tmr6+rl2hsqks13jjnh8t9d6UkFENTw8cTOzZI 7cUE6/nOsMt51SuyKoFSymMAXBWXZfzljU/MXQK6akMs3eLyrDTX/uUkrXK0z5VyVzJyvaI/bUSadAeS1ZMKtNqmcMipiiTSpP+9312ln0i961aVPsmNxzM4sj h1asc2EnvU/q5B00RNzlfrHMSKraQoXnFsPHvyTRddqeqNBIwzmrkBVGEIX2i Mv0WmqwtGMSqv729aE2natlx6i+68RicHrc1qnibGJ3KuJlLa8 PCMnngKA7ENFrKlrPQ9X59jdhDNIEI2IEx/14I4bwGmwREfK5v+UxByT8tiIgPfbs6z2Ysh7/F7O7qNzUnTyq78K08T/Xfr8PuNJrTjDGKkvlV3E2DHStY/PK8HQUhBlEo7oTFhvGhTLQqy6BYHpLE33j8m7j7m1tfzv0dOXA GqrRVOBPzci8faNawyzGV5LiJxTFl19uZaOwc8aN+phG6dr3H2 PdcLTrSK+X5kCfQhX9NOtz6tuVOmXzg01G13cuFAsP9OMKWbrm d4stziBp6sZA2UWNZZD51UVF4x1K2jizUNXc/17nHhUmVjGoCaGC4mqoQhPyTpwC8nLhm+J0mAfVQ8I4xcAIbps LkkiDxc8hMM2ceCzeEa+ZJMne42xEdHKok19a8X2P9w/W9yLeUcLk+lyMQSJBI2I84o+QgWEPQhSHKmSKlqxM4iNs+iN10 3wGag8RHDvqWFsjgdUabcDmK1toIGaB3DXUJWcxJcYyRg43n6D 6Ac4GNjc90RPwu2XLuMnjivT23ieSqkQzJAnvnfNW48uoobfzI YHeGWHuKnX/emW4gpkglltw5Gq8R0jrM23W8S7YrFKooAJgq7pUjvIZTRwtGn QLp21l4BJV+z/hrANqepXefpibreH+lCvGB6a/cAQ1g2MpEUZVV3R5MAn+YAHl4+rwYM6eEv7UWPuUQisJLtrSsO sA1tUrnnjZjd0Onp+JZeuIE3oSHBtEpzenKgbY7QGvMMaXgIdI u7hmC48FYZsTLVjl8MhC2d1hgUckX/t5hk7SIKr1LpeJSsX1WA9BAxCW/yowBoNY9eT7nL/dNdgzvAKpdDer3mvaMUyuV1eRbqn9BRm88mW1Lycqkima126pf Xs7WoFyeWW+bWXRnYhMForvg8JRcYw/XUwVcATns9y5LhR8DDU2w8q/QZeHByL8MV0Rq4Iq5eYsLrbCvKaj+i1gmCwy0VVSlZtu3YFmW8 HFWc1wxwrZT8N3qTRcFwK8xQcS26d+XpU43jc2Ws7U8180brgP 3BDHT2EmWzNdJ2aKGCcEoV1KfxfiC+YWYcSb+QoEl6n9NNMUtP qMurVt8M3GsrOzCdTYyFLf9Dt9N+XKvWYFzHtcivQtbwyi+pZU Sc6nIlXEhQLvEyEUc2mpXNMCzl3Cbim/NzbENvPCgl3szm750FAhT5ShQIH+Uv0P/Tfws5y14yZQdNmV2EjwgXwi7ZITvAliAlSJvPmudWnBagumZRC zspYyiv2rQqS9hotBjrHY0/YSjoNiKa0bs3/otLnnjW5fW3VjsEQC99K0W7xAqsmzE5WUpZvjqs4JXnjUBRYoY HpyMK0SX6syPnMdGkHrO2Iomowo68V71GyDKJ9wQYff4vRGT2E 4UphX7SpCfdOSNPAoinF+9WxMnx2st9v9poN8H8LbM7MdhDWre o81+e8AAb+6at4XhZljWPhChpoAmxmlRrzqIfin7RycqyltRYA PmMCr4onWsn3zWjcvJwnbeRuoH7UbI4fZev4gY9+L1QULPZFpy uFA6sTzh9DgjKm/hEGRhGf2zjYWnOtyK7jI3+LAe7+hatwe7uZLucdQ9BHyoQ3qv7 VzQeJhzMwbZuDoCvbIBUwoqvMEpNyrlaF9setWRvOzJ3SrWNHy KCqNKVPwohUHtG0GEYbxrJlz6m9jo0wxaoTjXBLio7sse+4as3 GcPI9X2d75hAtEPJ/FBh0nNp306a6OBW8cNVNwCikV7dMuFubkEmp7fQADIIxUwq55C xf4k0qfkR1hyunWOL9JDYE9zaKWxx34HYqL2tVN+9GJB68PEDG eRx7Nax2g2mLnetB3aF5XKH7J8VYcVdxqVPxv0/UFpLCrbdsvIyW59oskYUA2Mm/U1tSiaPAaZDv+K50HV+JeCikVl77M9dSzDMKT8fqCEmW5kjo9A FWK+xelFPMdDDSEgB17RmuloVHJIKDATOTEiEPNrW5BnRFKg5k WM1pDH1iIqgAIW4zOkqFoXs1fjFwjWZoQ/aVGsMRBld26WyWxS3KksiYJjAmg11Vepn1edGKABG8lAM7Ryhs vAOfZbmZ84MlhV0cEdhULdwbqbLxLA+iXyJeQZsZxgbi0jGf4c i/YhNuxHn0sedltF4PVg8PXhL+xWk8v6CDC9be0/zIK9E/kGi2c6jCev4NR7YkfeMHNzWmSRvLvpwH0e0bg1GciZKSnFk2hE WYJ5DeM9BmemBbi1/IszfIuspAhTuXYJg/1zd7dlov5Iqq5eVJCYoHgqpwtk8nQ72CNBQJjQ4HcDlB4YPrlf/tb9oWfA6b54kZZA6qG8kHlSQGIDdCi/xACMeFwpGoABS7HS0y0b34jRMI406+Qf36sY6M0E1Nz9Ishpet W5n2gvHG/VocoBs02wZIDhajwsPrJmBpXw16uRp0aKgVqAFHdkJSuEk3FAw pR40rbaw+d+gpbExL3PelphXfQGyjcGU8K2BZtLMphZGjrJ74J bmtV4u2lCrk31I2row7s+L35KFAAAAAEAAAAUAAUAEKmvBY/VxbWU"}' \
--compressed

anyone have the script for this?

[gareth41]

The license request is encrypted using the service certificate. If you look in the network tab in Chrome developer tools you'll see 2 requests to the license server, the first one contains a 2 byte payload of 0x08, 0x04 - this is a request for the license server to send the service certificate. The second request is the actual request for the license, and this is encrypted with the service certificate public key (as per your screenshot). Google is the only one who has the private key and decrypts the license request for processing on their end, they then send back the license encrypted with the public key of your CDM.

This is why you should never post any license requests or responses generated using your own CDM including encrypted. Chrome CDM is ok, but if you post anything generated using your own CDM then chances are it will be revoked.

Thanks, that's a good explanation. Yes I can see it first requests the certificate like you say. Do you have any idea why my licence requests fail to this server with tools like getwvkeys, wks-keys etc.? What should I do to make it work then? Is it because server only accepts encrypted requests? If so, is there a way to modify existing scripts to do that?

It's easy to modify wks keys to do this. You just need to define a byte array with 0x08, 0x04, send it as a payload using requests.post, then base64 encode the response and pass to WvDecrypt as cert_data_b64

[maxteddy]

I wonder if songs on Amazon Music prime can be also ripped off using the method. I think there's no mpd there. I'm not sure though..

[demon]

I am getting issue on SunNXT while requesting key from notaghost's wvkeys site.

MPD : https://suntvvod.s.llnwi.net/movies/ce54e7fed2437ab83854acfa56b1fc54/132819/132819_hd....nXtGW1Qx/uLg==

License URL : https://www.sunnxt.com/content/license/?content_id=132819

WidevineDecryptor: Found key: 789b4cb771e270d255f0884cca8628f0 (KID=9d656054c01756e991d4e0bdf5eb43f9)
WidevineDecryptor: Found key: 20dbaf5b79bcbf92e80a5696d41659b6 (KID=32ce79a9dd32522a8d79102bdf7c1384)
WidevineDecryptor: Found key: 157ad8f0041f35e6044dfbeeedf83019 (KID=3f6468e14c9357c6a1100f619af1b613)

with wks header cookie like this example

    cookie: _ga=GA1.2.XXXXXXXX; WZRK_G=c7242CCCCCCCCCC; _gid=GA1.2.3XXXXXXXXX; _gat=1; laravel_session=WNIXXXXXXXXX; WZRK_S_WW6-54K-855Z=%7B%XXXXXXXXXXXXX; RT="z=1&dm=sunnxt.com&si=3XXXXXXXXXXXX"; XSRF-TOKEN=eyJpdiXXXXXXXXXX

try with those datas

[tugatomsk]

Hey, I always get Internal Server Error with https://getwvkeys.herokuapp.com. What can I do to fix it?

Information:
https://vtm.be/vtmgo/afspelen/eb7a0c853-6f5d-43af-b860-ad5e25a2ccf5
PSSH: AAACJnBzc2gAAAAAmgTweZhAQoarkuZb4IhflQAAAgYGAgAAAQ ABAPwBPABXAFIATQBIAEUAQQBEAEUAUgAgAHgAbQBsAG4AcwA9 ACIAaAB0AHQAcAA6AC8ALwBzAGMAaABlAG0AYQBzAC4AbQBpAG MAcgBvAHMAbwBmAHQALgBjAG8AbQAvAEQAUgBNAC8AMgAwADAA NwAvADAAMwAvAFAAbABhAHkAUgBlAGEAZAB5AEgAZQBhAGQAZQ ByACIAIAB2AGUAcgBzAGkAbwBuAD0AIgA0AC4AMAAuADAALgAw ACIAPgA8AEQAQQBUAEEAPgA8AFAAUgBPAFQARQBDAFQASQBOAE YATwA+ADwASwBFAFkATABFAE4APgAxADYAPAAvAEsARQBZAEwA RQBOAD4APABBAEwARwBJAEQAPgBBAEUAUwBDAFQAUgA8AC8AQQ BMAEcASQBEAD4APAAvAFAAUgBPAFQARQBDAFQASQBOAEYATwA+ ADwASwBJAEQAPgBqADQALwBNAEEAcQBYAGYAZABUAHAAcgArAH UAMwB1AFYARQBzACsAeAB3AD0APQA8AC8ASwBJAEQAPgA8AEMA SABFAEMASwBTAFUATQA+AHoAOQBEAGUAYQBnAHAAeABwAHcAMA A9ADwALwBDAEgARQBDAEsAUwBVAE0APgA8AC8ARABBAFQAQQA+ ADwALwBXAFIATQBIAEUAQQBEAEUAUgA+AA==
License:
https://drm.mp.lura.live/cenc?eqp=LPWrm5V14FMDsU7jKLj-Ch1zXFmJ5tlq4Dfc8-JZAD_A7SjfGSF9...6&t=1639331354
Headers:
curl 'https://drm.mp.lura.live/cenc?eqp=LPWrm5V14FMDsU7jKLj-Ch1zXFmJ5tlq4Dfc8-JZAD_A7SjfGSF9lvc065gz2vEEOE0Mq1ipmwXFkDXhXDXvjCLE F18Kb92HZhPZTiGPr7oDQ6k5fZ_-kCeoTbhSHDIOn1tbrqhh_zVL3ELIqAu3k83DASHF3IfOGxGH7f WnbGiNdWF2gGjTJdgtyDHhbzdoyWqRDPTzyTxxUt7NrbjHO03L jJra1Yk3fty23gExkOlWf7La1K6_FVSlFi543woEhI8GLIh5Ir WUW-pmXzemoEZajvcftbpLtUHH-Jt1kLK_bXvKkksMs4sokoQtOGzr_mw1i4OLWvk7QcfYyW1lTg& anvauth=tb=0~te=1639342154~sgn=24f92d1af487f89c2b2 b289d983b8161908a535044309c3a59747ef6108f8896&t=16 39331354' \
-H 'authority: drm.mp.lura.live' \
-H 'sec-ch-ua: "Chromium";v="96", "Opera GX";v="82", ";Not A Brand";v="99"' \
-H 'sec-ch-ua-mobile: ?0' \
-H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 OPR/82.0.4227.25' \
-H 'sec-ch-ua-platform: "Windows"' \
-H 'accept: /' \
-H 'origin: https://vtm.be/' \
-H 'sec-fetch-site: cross-site' \
-H 'sec-fetch-mode: cors' \
-H 'sec-fetch-dest: empty' \
-H 'referer: https://vtm.be/' \
-H 'accept-language: nl-NL,nl;q=0.9,en-US;q=0.8,en;q=0.7' \
--data-raw $'\u0008\u0004' \
--compressed

Hi, everyone. I wanted to have a go at https://getwvkeys.cc/ in order to get the keys of the videos of a national streaming site.

I have a manifest file as an example because I don't know what constitutes as header and license.

I also don't know what to look for in the debugging window on Firefox when searching for the license server.

(Fortunately, I learned how to get the PSSH from reading this thread, it's in the contents of the manifest between <cencssh>.)

[lomero]

how can you ask help if you don't write link to your video?
and you say to have mpd, but this is not enough to get key. if you need help write here your video link

[codehound]

I also don't know what to look for in the debugging window on Firefox when searching for the license server.

Keep reading son, its BASICS

[tugatomsk]

I also don't know what to look for in the debugging window on Firefox when searching for the license server.

Keep reading son, its BASICS

Well, it may be basic for you, an experienced user, but it is certainly not for me, otherwise I wouldn't be asking for help...

[tugatomsk]

how can you ask help if you don't write link to your video?
and you say to have mpd, but this is not enough to get key. if you need help write here your video link

The video is part of a paid streaming service.

Anyway, here's the link:

https://opto.sic.pt/#/play?sid=MTI6NTU5MGU2MDdjZjdmNGE4NzhjNmRjZWQ0MWNhMjE2NGE%3D&sNam...AyODZmZg%3D%3D

[codehound]

I also don't know what to look for in the debugging window on Firefox when searching for the license server.

Keep reading son, its BASICS

Well, it may be basic for you, an experienced user, but it is certainly not for me, otherwise I wouldn't be asking for help...

If you have read how to get the pssh, then you must have overlooked how to get lic url

A reminder:

Under Network tab in DevTools filter url for words like: WV, lic, widevine, auth, drm, etc

Type your word in FilterURL > Refresh stream (F5) > get video playing

If no results > repeat with different word > F5 again > get video playing

It may / may not have a long string attached to it, if it does, use this in your keys challenge

...............................

Once you have established the lic url, in FF, right click on the link in the debugger, select copy > copy as cURL (Windows)

open curlconverter.com

copy the content into left window > Py result is returned in right hand window > this is your headers.py for WKS-keys

...............................

WKS-Keys (with a working L3 cdm) - pssh + lic url + headers.py = keys

Notaghost getwvkeys online http://getwvkeys.cc/ - pssh + lic url + basic format headers = keys

[tugatomsk]

If you have read how to get the pssh, then you must have overlooked how to get lic url

A reminder:

Under Network tab in DevTools filter url for words like: WV, lic, widevine, auth, drm, etc

Type your word in FilterURL > Refresh stream (F5) > get video playing

If no results > repeat with different word > F5 again > get video playing

It may / may not have a long string attached to it, if it does, use this in your keys challenge

...............................

Once you have established the lic url, in FF, right click on the link in the debugger, select copy > copy as cURL (Windows)

open curlconverter.com

copy the content into left window > Py result is returned in right hand window > this is your headers.py for WKS-keys

...............................

WKS-Keys (with a working L3 cdm) - pssh + lic url + headers.py = keys

Notaghost getwvkeys online http://getwvkeys.cc/ - pssh + lic url + basic format headers = keys

Many thanks for that detailed explanation!

It actually worked; using getwvkeys online, I managed to get key 1.d5bf5bd73d162f4e0ec9166c54cb0b0c:9d29d4090053991 7a363f669967cd2af
Using mp4decrypt, I discovered that the working part of the key was 9d29d40900539917a363f669967cd2af.

However, this only worked for the MP4 video file that I had downloaded using yt-dlp and the add-on "The Stream Detector" for Firefox. The audio, an M4A file, can't be decrypted using either "d5bf5bd73d162f4e0ec9166c54cb0b0c" or "9d29d40900539917a363f669967cd2af". Not even changing the number of the key (key 1:, key 2:, and so forth) could accomplish the decryption of the audio.

EDIT: I found out that the original audio extension was "mp4a" instead of "m4a". I changed the file extensions in mp4decrypt and it worked perfectly.

[codehound]

It actually worked

Charming........

The audio, an M4A file, can't be decrypted using either "d5bf5bd73d162f4e0ec9166c54cb0b0c" or "9d29d40900539917a363f669967cd2af". Not even changing the number of the key (key 1:, key 2:, and so forth) could accomplish the decryption of the audio.

For decryption use:

mp4decrypt.exe --key kid:key "encrypted-video.mp4" "decrypted-video.mp4"

mp4decrypt.exe --key kid:key "encrypted-audio.aac" "decrypted-audio.m4a"

then merge with ffmpeg:

ffmpeg -i "decrypted-video.mp4" -i "decrypted-audio.m4a"  -c copy "output.mp4"

[tugatomsk]

That's strange... the next episode of the show I'm trying to decrypt - the follow-up to the video I had just successfully decrypted - has the exact same license and PSSH, which results in the same keyID and decryption key. This shouldn't be the case, right? Therefore, I can't decrypt the next episode... What am I missing?

[ElCap]

run mp4dump on the video and audio files to see what the Key IDs are for both episodes.

mp4dump <filename> | findstr /I /L "kid key_id"

(just press ctrl-c if it starts saying the line is too long, the key id will be at the top)

[Baldrick]

Okey. The fun is over. Please don't rip subscription video.

If you want to rip a video it should be available for everyone. Country block is okey but not subscriptions.