howto deal with HLS 128 bit aes encrypted - the hard one

[gilfoyle]

Browser console code:

function Uint8ToString(u8a){
  var CHUNK_SZ = 0x8000;
  var c = [];
  for (var i=0; i < u8a.length; i+=CHUNK_SZ) {
    c.push(String.fromCharCode.apply(null, u8a.subarray(i, i+CHUNK_SZ)));
  }
  return c.join("");
}

var u8 = new Uint8Array([42, 172, 97, 96, 19, 241, 135, 118, 25, 175, 138, 192, 26, 191, 240, 166]);

btoa(Uint8ToString(u8));

[Attachment 67172 - Click to enlarge]


Code credits: stackoverflow

[dark125]

You can use hlsdl to download the video.

import re
import base64
import requests
from Crypto.Cipher import AES
import binascii
import os


def _decrypt_key(data):
    tmp1 = data[0:16]
    tmp2 = data[32:48]
    dec1 = AES.new(base64.b64decode(spka),AES.MODE_ECB)
    tmp3 = dec1.decrypt(tmp1)
    dec2 = AES.new(tmp3,AES.MODE_ECB)
    return dec2.decrypt(tmp2)

headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36', 'Referer': 'https://www.futurly.com/'}

url_base = input("Enter URL index m3u8 : ")
spka = input("Enter the spka : ")
match = re.search(r"(https?://.*\/)", url_base)
url_stream = match.group(1).strip()

r=requests.get(url_base, headers=headers)
matchs = re.findall(r"(h.*m3u8)", r.text)
video = url_stream+matchs[-1]

r=requests.get(video, headers=headers)
matchs = re.search(r"AES-128,URI=\"(.*)\"", r.text)
uri_url = url_stream+matchs.group(1).strip()

res = requests.get(uri_url)
res.encoding = "binary/octet-stream"
key_data = _decrypt_key(res.content)
base64_key = (base64.b64encode(key_data).decode('utf-8'))
hex_key =(binascii.hexlify(key_data).decode('utf-8'))

os.system(f'hlsdl -K {hex_key} -o file_output.mp4 -b "{url_base}"')

[[ss]vegeta]

Aaaand here are our heroes.
Thanks guys.

[NBA456017]

You can use hlsdl to download the video.

import re
import base64
import requests
from Crypto.Cipher import AES
import binascii
import os


def _decrypt_key(data):
    tmp1 = data[0:16]
    tmp2 = data[32:48]
    dec1 = AES.new(base64.b64decode(spka),AES.MODE_ECB)
    tmp3 = dec1.decrypt(tmp1)
    dec2 = AES.new(tmp3,AES.MODE_ECB)
    return dec2.decrypt(tmp2)

headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36', 'Referer': 'https://www.futurly.com/'}

url_base = input("Enter URL index m3u8 : ")
spka = input("Enter the spka : ")
match = re.search(r"(https?://.*\/)", url_base)
url_stream = match.group(1).strip()

r=requests.get(url_base, headers=headers)
matchs = re.findall(r"(h.*m3u8)", r.text)
video = url_stream+matchs[-1]

r=requests.get(video, headers=headers)
matchs = re.search(r"AES-128,URI=\"(.*)\"", r.text)
uri_url = url_stream+matchs.group(1).strip()

res = requests.get(uri_url)
res.encoding = "binary/octet-stream"
key_data = _decrypt_key(res.content)
base64_key = (base64.b64encode(key_data).decode('utf-8'))
hex_key =(binascii.hexlify(key_data).decode('utf-8'))

os.system(f'hlsdl -K {hex_key} -o file_output.mp4 -b "{url_base}"')

This is useful, thank you!

[whs912km]

thanks dark125, a really useful tip!
but where can find spka value?

@ NBA456017
stupid question: how to have all value on right windows as your shot on your post#14?
which browser or which setting you have used for this?
with mouseover i can see all value, but it's not comfortable.i have this only (tested on brave and FF)


[Attachment 67178 - Click to enlarge]

[[ss]vegeta]

Click the 3 dots in the upper right corner and choose dock side

spka is here, I guess?

[Attachment 67179 - Click to enlarge]

[NBA456017]

thanks dark125, a really useful tip!
but where can find spka value?

@ NBA456017
stupid question: how to have all value on right windows as your shot on your post#14?
which browser or which setting you have used for this?
with mouseover i can see all value, but it's not comfortable.i have this only (tested on brave and FF)


[Attachment 67178 - Click to enlarge]

look here

[whs912km]

thanks NBA456017 i know how to find this value with CTRL+F

my question is another: on your post#14 you have 3 window: folder tree, window code, and on right side another window. how to have this window ?


[Attachment 67183 - Click to enlarge]

[A_n_g_e_l_a]

edit

[NBA456017]

thanks NBA456017 i know how to find this value with CTRL+F

my question is another: on your post#14 you have 3 window: folder tree, window code, and on right side another window. how to have this window ?


[Attachment 67183 - Click to enlarge]

That doesn't matter

[zackmark29]

thanks dark125, a really useful tip!
but where can find spka value?

The easiest way is just by typing spka in the console =D

[Attachment 67187 - Click to enlarge]

[whs912km]

thanks zack, nice tip

@NBA456017
it's a secret this window??

[jack_666]

Great job to all involved. Congrats.

[code47]

Guys pls help me on this thread
https://forum.videohelp.com/threads/407259-Need-help-finding-video-download-url-and-key

[naim2007]

Very awsome job done by true heros.
Thanks again guys...

[semop]

guys help me, I'm getting error "Uncaught ReferenceError: spka is not defined" using on here https://bitmovin.com/demos/drm

[cedric8528]

This is not AES128 Encrypted....

You have to use mp4decrypt to decrypt the video

[NBA456017]

widevine

[semop]

This is not AES128 Encrypted....

You have to use mp4decrypt to decrypt the video

How to decrypt after that I can able to download the audio and video file from the mpd "https://cdn.bitmovin.com/content/assets/art-of-motion_drm/mpds/11331.mpd" kindly help me to decrypt.

[NBA456017]

--key ccbf5fb4c2965be7aa130ffb3ba9fd73:9cc0c92044cb1d694 33f5f5839a159df

--key 9bf0e9cf0d7b55aeb4b289a63bab8610:90f52fd8ca48717b2 1d0c2fed7a12ae1

--key eb676abbcb345e96bbcf616630f1a3da:100b6c20940f779a4 589152b57d2dacb

--key 0294b9599d755de2bbf0fdca3fa5eab7:3bda2f40344c7def6 14227b9c0f03e26

--key 639da80cf23b55f3b8cab3f64cfa5df6:229f5f29b643e2030 04b30c4eaf348f4

[lomero]

@ NBA456017
simply suggestion: if you add keys into tag code tag


[Attachment 67404 - Click to enlarge]

avoid having spaces after 50 characters as the default forum add

[NBA456017]

@ NBA456017
if you add keys into tag code tag


[Attachment 67404 - Click to enlarge]

avoid having spaces after 50 characters as the default forum add

ok

[semop]

--key ccbf5fb4c2965be7aa130ffb3ba9fd73:9cc0c92044cb1d694 33f5f5839a159df

--key 9bf0e9cf0d7b55aeb4b289a63bab8610:90f52fd8ca48717b2 1d0c2fed7a12ae1

--key eb676abbcb345e96bbcf616630f1a3da:100b6c20940f779a4 589152b57d2dacb

--key 0294b9599d755de2bbf0fdca3fa5eab7:3bda2f40344c7def6 14227b9c0f03e26

--key 639da80cf23b55f3b8cab3f64cfa5df6:229f5f29b643e2030 04b30c4eaf348f4

appreciate your help, could you please share the process of getting the keys.

[aadrl]

OMG You guys are amazing!! I've been working for 3 weeks nonstop on this exact same issue! Thank god I found this post when I almost gave up, its never too late I hope.

So I wrote a detailed error report here. I used Streamlink and I posted the original js player, deobufscation, and my custom plugin
https://github.com/streamlink/streamlink/discussions/4947
I also attached my plugin below (change cloudfront.net to .py)

Its the same website from this post with video host cloudfront, my spka = "OThlMzVkNzQ1NDEyNjliNQ==" (line 21 in cloudfront.py posted below)
Panda's comment in that post was helpful but the solution was a little broad. (I also donated to them so hopefully got solved eventually lol, but probably by me lol)


So the Error is Padding is incorrect while decrypting segment
I think it probably has to do with Line 49 of cloudfront.py which pad the iv
iv = b"\x00" * (16 - len(iv)) + iv
I wrote this plugin and this line based on green cats code from https://github.com/streamlink/streamlink/issues/2253

I wonder how can I modify it at this moment, is this line another layer of decryption that I need to find in the original player.js?
Thank you so so much. I promise I'll help everyone else here with this issue in the future after I figure it out (which I'll just share my whole build of streamlink)
@[ss]vegeta @zackmark29 @dark125

[aadrl]

Thank you guys so much

[akshaysic]

i think this works

https://github.com/streamlink/streamlink/issues/2253

Find the spka on Futurly web and replace it in the script:

import re
import logging
import base64
import argparse

from Crypto.Cipher import AES
from streamlink import StreamError
from streamlink.plugin import Plugin
from streamlink.stream import HLSStream
from streamlink.stream.hls import HLSStreamWriter, HLSStreamReader

log = logging.getLogger(__name__)

spka = "REPLACE"


class FuturlyStreamWriter(HLSStreamWriter):
    def _decrypt_key(self,data):
        tmp1 = data[0:16]
        tmp2 = data[32:48]
        dec1 = AES.new(base64.b64decode(spka),AES.MODE_ECB)
        tmp3 = dec1.decrypt(tmp1)
        dec2 = AES.new(tmp3,AES.MODE_ECB)
        return dec2.decrypt(tmp2)
        
        
    def create_decryptor(self, key, sequence):
        if key.method != "AES-128":
            raise StreamError("Unable to decrypt cipher {0}", key.method)

        if not self.key_uri_override and not key.uri:
            raise StreamError("Missing URI to decryption key")

        key_uri = self.key_uri_override if self.key_uri_override else key.uri

        if self.key_uri != key_uri:
            res = self.session.http.get(key_uri, exception=StreamError,
                                        retries=self.retries,
                                        **self.reader.request_params)
            res.encoding = "binary/octet-stream"
            self.key_data = self._decrypt_key(res.content)
            self.key_uri = key_uri

        iv = key.iv or num_to_iv(sequence)

        # Pad IV if needed
        iv = b"\x00" * (16 - len(iv)) + iv

        return AES.new(self.key_data, AES.MODE_CBC, iv)


class FuturlyStreamReader(HLSStreamReader):
    __writer__ = FuturlyStreamWriter

class FuturlyStream(HLSStream):
    def open(self):
        reader = FuturlyStreamReader(self)
        reader.open()

        return reader


class Futurly(Plugin):
    url_re = re.compile(r"""https://d2qny97nu4rj64.cloudfront.net/.*.m3u8""")


    def __init__(self, url):
        super(Futurly, self).__init__(url)

    @classmethod
    def can_handle_url(cls, url):
        return cls.url_re.match(url) is not None

    def _get_streams(self):
        return {"live":FuturlyStream(self.session,self.url)}



__plugin__ = Futurly

not working now. Putting correct spka value but giving ' padding is incorrect error'. Can you help?

[akshaysic]

https://forum.videohelp.com/threads/408196-howto-deal-with-HLS-128-bit-aes-encrypted-t...ne-2-0-version

LETS'S DO IT AGAIN !

[osman]

i think this works

https://github.com/streamlink/streamlink/issues/2253

Find the spka on Futurly web and replace it in the script:

import re
import logging
import base64
import argparse

from Crypto.Cipher import AES
from streamlink import StreamError
from streamlink.plugin import Plugin
from streamlink.stream import HLSStream
from streamlink.stream.hls import HLSStreamWriter, HLSStreamReader

log = logging.getLogger(__name__)

spka = "REPLACE"


class FuturlyStreamWriter(HLSStreamWriter):
    def _decrypt_key(self,data):
        tmp1 = data[0:16]
        tmp2 = data[32:48]
        dec1 = AES.new(base64.b64decode(spka),AES.MODE_ECB)
        tmp3 = dec1.decrypt(tmp1)
        dec2 = AES.new(tmp3,AES.MODE_ECB)
        return dec2.decrypt(tmp2)
        
        
    def create_decryptor(self, key, sequence):
        if key.method != "AES-128":
            raise StreamError("Unable to decrypt cipher {0}", key.method)

        if not self.key_uri_override and not key.uri:
            raise StreamError("Missing URI to decryption key")

        key_uri = self.key_uri_override if self.key_uri_override else key.uri

        if self.key_uri != key_uri:
            res = self.session.http.get(key_uri, exception=StreamError,
                                        retries=self.retries,
                                        **self.reader.request_params)
            res.encoding = "binary/octet-stream"
            self.key_data = self._decrypt_key(res.content)
            self.key_uri = key_uri

        iv = key.iv or num_to_iv(sequence)

        # Pad IV if needed
        iv = b"\x00" * (16 - len(iv)) + iv

        return AES.new(self.key_data, AES.MODE_CBC, iv)


class FuturlyStreamReader(HLSStreamReader):
    __writer__ = FuturlyStreamWriter

class FuturlyStream(HLSStream):
    def open(self):
        reader = FuturlyStreamReader(self)
        reader.open()

        return reader


class Futurly(Plugin):
    url_re = re.compile(r"""https://d2qny97nu4rj64.cloudfront.net/.*.m3u8""")


    def __init__(self, url):
        super(Futurly, self).__init__(url)

    @classmethod
    def can_handle_url(cls, url):
        return cls.url_re.match(url) is not None

    def _get_streams(self):
        return {"live":FuturlyStream(self.session,self.url)}



__plugin__ = Futurly

[Attachment 68696 - Click to enlarge]


Is anyone able to assist with downloading AES-128 videos from CloudFront, as there seems to be no SPKA in the console?

[anandgpt75]

hey guys they have removed spka can anybodu know how to get spka from this url??

https://www.durgasoftonline.com/s/preview/courses/Core-Java-5e6e5cc40cf208a88ca3191d

[naim2007]

hey guys they have removed spka can anybodu know how to get spka from this url??

https://www.durgasoftonline.com/s/preview/courses/Core-Java-5e6e5cc40cf208a88ca3191d

Here we are again. another scammer & indian seller.
try to fish elswhere.