Ok, let's try again

[RandallFlagg]

Hi to you all!
So, I followed the cedric8528 tutorial about how to get keys with android studio and it worked! Now I have the 2 keys renamed. I jumped to A_n_g_e_l_a one and tried to decrypt the keys. Here comes troubles: when I execute l3.py it ask me PSSH and license URL. What are them and how do I get them?

Thanks in advance

[A_n_g_e_l_a]

Hi to you all!
So, I followed the cedric8528 tutorial about how to get keys with android studio and it worked! Now I have the 2 keys renamed. I jumped to A_n_g_e_l_a one and tried to decrypt the keys. Here comes troubles: when I execute l3.py it ask me PSSH and license URL. What are them and how do I get them?

Thanks in advance

https://forum.videohelp.com/threads/404994-Decryption-and-the-Temple-of-Doom I thought I'd covered all the bases but perhaps not at the level you need. PSSH is a long string of lettters starting AAAA that can be found in the mpd - usually. You find it by looking at the responses to the browser's requests in Developer Tools of your browser. Select F12 -> Network; filter on 'mpd' - looking through the response you will see <cenc;pssh> followed by AAAA..... copy all the string as your PSSH. Now be careful as there are other strings but you want the one starting with four 'A's. There will be two of them but both the same.

Licence is found in a similar way F12 -> Network -> filter on license. left click on the url and select copy url - that's your license url. As Temple of Doom suggests start at bitmovin.com/demos/drm and understand the process. The information given here is repeated ad-nauseam throughout this forum.

[codehound]

Hi to you all! Here comes troubles: when I execute l3.py it ask me PSSH and license URL. What are them and how do I get them?

Thanks in advance

Just so I dont have to read, or god forbid, actually use the search facility of the forum for info thats been posted hundreds of times, can someone just spoon feed me here in yet another fresh post about the same subject. Thanks in advance.

[RandallFlagg]

https://forum.videohelp.com/threads/404994-Decryption-and-the-Temple-of-Doom I thought I'd covered all the bases but perhaps not at the level you need. PSSH is a long string of lettters starting AAAA that can be found in the mpd - usually. You find it by looking at the responses to the browser's requests in Developer Tools of your browser. Select F12 -> Network; filter on 'mpd' - looking through the response you will see <cenc;pssh> followed by AAAA..... copy all the string as your PSSH. Now be careful as there are other strings but you want the one starting with four 'A's. There will be two of them but both the same.

Licence is found in a similar way F12 -> Network -> filter on license. left click on the url and select copy url - that's your license url. As Temple of Doom suggests start at bitmovin.com/demos/drm and understand the process. The information given here is repeated ad-nauseam throughout this forum.

Hi A_n_g_e_l_a, thanks for your kind answer. Tried looking around the forum for PSSh and license url but my level is really low and I can't figure it out.
Tried also to do what you said but console return me nothing, neither with mpd filter nor with license one...(left part of the image is black but I was running the movie).


[Attachment 68610 - Click to enlarge]

[andrewzhong]

Just follow Angela's guide, start with https://bitmovin.com/demos/drm...
Her guide is probably the best for beginners to start with...

[lomero]

write here your video link

[elfoeda]

Hi to you all!
So, I followed the cedric8528 tutorial about how to get keys with android studio and it worked! Now I have the 2 keys renamed. I jumped to A_n_g_e_l_a one and tried to decrypt the keys. Here comes troubles: when I execute l3.py it ask me PSSH and license URL. What are them and how do I get them?

Thanks in advance

https://forum.videohelp.com/threads/404994-Decryption-and-the-Temple-of-Doom I thought I'd covered all the bases but perhaps not at the level you need. PSSH is a long string of lettters starting AAAA that can be found in the mpd - usually. You find it by looking at the responses to the browser's requests in Developer Tools of your browser. Select F12 -> Network; filter on 'mpd' - looking through the response you will see <cenc;pssh> followed by AAAA..... copy all the string as your PSSH. Now be careful as there are other strings but you want the one starting with four 'A's. There will be two of them but both the same.

Licence is found in a similar way F12 -> Network -> filter on license. left click on the url and select copy url - that's your license url. As Temple of Doom suggests start at bitmovin.com/demos/drm and understand the process. The information given here is repeated ad-nauseam throughout this forum.

Hello everybody!

I've been trying to learn more with the help available here, in this post it talks about PSSH, the license URL, but about the header I think it's not treated.

I'm under study by bitmovin/demos/drm, I would appreciate it if you can indicate how I can get this header.

Many thanks to anyone who can help!

[A_n_g_e_l_a]

attachment didn't work.

[A_n_g_e_l_a]

my synopsis: "It's Too Hard!"

Try this.
The license url for bitmovin has changed and is a little more tricky to find. But my Temple of Doom thread gives the correct one and this video shows how to get it.

https://anonfiles.com/wbLcd0Rdya/Screencast_from_2023-01-10_15-53-36_webm

[A_n_g_e_l_a]

header [/COLOR]I think it's not treated.

I'm under study by bitmovin/demos/drm, I would appreciate it if you can indicate how I can get this header.

Many thanks to anyone who can help!

READ THIS!!!!

Just so I dont have to read, or god forbid, actually use the search facility of the forum for info thats been posted hundreds of times, can someone just spoon feed me here in yet another fresh post about the same subject. Thanks in advance.

AND READ THIS: https://forum.videohelp.com/threads/407216-Decryption-The-Dungeon-of-Despair It was linked at the end of the Temple of Doom post - WE EXPECT PEOPLE TO BE INDEPENDENT LEARNERS AND LARGELY HELP THEMSELVES. Now come on and get a grip for goodness sake!

[RandallFlagg]

attachment didn't work.

Here

[gnodde]

If the guides by A_n_g_e_l_a are not clear enough, and you have no clue what a header is, probably best to just go back to torrent imho. Those guides are as others have said, really well written and if you have a little background with this stuff very easy to follow.
If you need to be spoon fed every step of the way, and start a new topic for every error that you can easily google, and cant use the search button on the site, just go back to torrents, as this is just not the world for you.

[ampersand]

attachment didn't work.

Here

keep the developer options open and refresh the page
the mpd loads when you open the site, not when you press play

[A_n_g_e_l_a]

If the guides by A_n_g_e_l_a are not clear enough, and you have no clue what a header is, probably best to just go back to torrent imho. Those guides are as others have said, really well written and if you have a little background with this stuff very easy to follow.
If you need to be spoon fed every step of the way, and start a new topic for every error that you can easily google, and cant use the search button on the site, just go back to torrents, as this is just not the world for you.

Thank you!! I so wanted to say this! There has to be a starting level of knowledge below which we cannot go. And besides the Developer's Network Tool shows this:-

[Attachment 68623 - Click to enlarge]

And what does everyone do when a web-page doesn't load properly? Or we need to run it again? All this stuff is so basic; kids do it without thought; when my Granddaughter was aged 2 she was doing it automatically to replay Rupert Bear and the Frog Song.

[elfoeda]

header [/COLOR]I think it's not treated.

I'm under study by bitmovin/demos/drm, I would appreciate it if you can indicate how I can get this header.

Many thanks to anyone who can help!

READ THIS!!!!

Just so I dont have to read, or god forbid, actually use the search facility of the forum for info thats been posted hundreds of times, can someone just spoon feed me here in yet another fresh post about the same subject. Thanks in advance.

AND READ THIS: https://forum.videohelp.com/threads/407216-Decryption-The-Dungeon-of-Despair It was linked at the end of the Temple of Doom post - WE EXPECT PEOPLE TO BE INDEPENDENT LEARNERS AND LARGELY HELP THEMSELVES. Now come on and get a grip for goodness sake!

Believe me, yes, I have already read the indicated pastures, as well as countless others over the months here.

It happens that, reading a lot of content, something gets lost along the way and we are not able to memorize everything, that's what happened to me... because I had already seen something about headers + curlconverter.com, however, for Bitmovin for some reason it didn't work right, the process of obtaining the keys was accusing something wrong with the headers.

Well, I really don't feel comfortable coming here asking for help and bothering you about something perhaps so obvious to many at all times. I get inhibited and prefer to avoid bothering them.

The fact is that I have tended to various encrypted contents and posted here by users, in order to learn, as with each error, I search the forum and read about it, I try to arrive at the same results that the masters arrive here, but generally I am not successful. .

I already advance those who doubt my cognitive ability that I am much better than they think.

I apologize to everyone for the inconvenience.

Thank you very much for your guide and always kind help. You are someone I really appreciate and consider, as do many others here.

Nothing I've written that might sound rude actually isn't, and it wasn't directed at you Angela, or any other member. I repeat, I have nothing but admiration and esteem for you. It's just a way of saying that people have different limitations, either because of the language, because they don't understand programming and because they don't deal with constantly downloading video streams.

[A_n_g_e_l_a]

Believe me, yes, I have already read the indicated pastures, as well as countless others over the months here.

Well if that didn't work for you I conclude nothing I might say if the future will help you either. So I have absolutely no investment in adding to your memory problem.

Have you tried reading any of this:-
[Attachment 68636 - Click to enlarge]?? And perhaps making notes of the things that strike you as important?

And if you did read Temple of Doom, as you say, I do mention that the use of Bitmovin.com is chosen as headers are not needed on that site.
But, of course, l3.py expects at the very least a file called headers.py with this inside it

headers = {}

[ampersand]

It happens that, reading a lot of content, something gets lost along the way and we are not able to memorize everything, that's what happened to me... because I had already seen something about headers + curlconverter.com, however, for Bitmovin for some reason it didn't work right, the process of obtaining the keys was accusing something wrong with the headers.

open developer options (f12), go to network tab, play the video (or reload the page if it's already playing), find the license link, right click on it and choose "copy as curl (bash)"
open curlconverter.com, if the python tab isn't already selected select it, paste what you copied in the previous line and then look at the results

this is what you get when pasting the bitmovin data into curlconverter:

import requests

headers = {
    'authority': 'licensing.bitmovin.com',
    'accept': '*/*',
    'accept-language': 'en-US,en;q=0.9,hr;q=0.8',
    'content-type': 'text/plain;charset=UTF-8',
    'origin': 'https://bitmovin.com',
    'referer': 'https://bitmovin.com/',
    'sec-ch-ua': '"Not?A_Brand";v="8", "Chromium";v="108", "Google Chrome";v="108"',
    'sec-ch-ua-mobile': '?0',
    'sec-ch-ua-platform': '"Windows"',
    'sec-fetch-dest': 'empty',
    'sec-fetch-mode': 'cors',
    'sec-fetch-site': 'same-site',
    'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
}

data = '{"domain":"bitmovin.com","key":"29ba4a30-8b5e-4336-a7dd-c94ff3b25f30","version":"8.100.0"}'

response = requests.post('https://licensing.bitmovin.com/licensing', headers=headers, data=data)

now this is the simplest possible type of site - just copy the "headers = { ... }" part into headers.py (and that is all that should be in the headers.py file, not data or response). the license url is "https://licensing.bitmovin.com/licensing" which you can find by writing "lic" or "widevine" or "wide" into the search box in network tab of developer options (the naming of license links isn't universal so it might be one or the other or something else but generally it contains "lic" or "widevine" or "wide"). the pssh you can find in the mpd file like angela explained, or search on these forums for someone explaining eme logger which can be very useful.

full disclosure, bitmovin isn't working for me either with wks-keys, but some other sites are (just tested them now) so I know my CDM isn't dead.

[codehound]

open developer options (f12), go to network tab, play the video (or reload the page if it's already playing), find the license link, right click on it and choose "copy as curl (bash)"

If your using Firefox > copy > copy as curl (windows)

[codehound]

del

[A_n_g_e_l_a]

full disclosure, bitmovin isn't working for me either with wks-keys, but some other sites are (just tested them now) so I know my CDM isn't dead.

Bitmovin.com are playing at being tricky-dickies these days and it is probably not the best platform to start on any more.

If you filter on licence in Developer tools you actually get a url which isn't the license url. bitmovin have deliberately spoofed the license. And that probably caused your error. One imagines that they got fed-up having their server loaded with people checking out their new CDM!
The correct licence url can be found by filtering on 'method: POST' and is ;- https://cwip-shaka-proxy.appspot.com/no_auth
Your posted curl shows you've used the wrong license url (bitmovin made changes around June last year) - it should look like this.

import requests

headers = {
    'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0',
    'Accept': '*/*',
    'Accept-Language': 'en-GB,en;q=0.5',
    # 'Accept-Encoding': 'gzip, deflate, br',
    'Origin': 'https://bitmovin.com',
    'DNT': '1',
    'Connection': 'keep-alive',
    'Referer': 'https://bitmovin.com/',
    'Sec-Fetch-Dest': 'empty',
    'Sec-Fetch-Mode': 'cors',
    'Sec-Fetch-Site': 'cross-site',
    # Requests doesn't support trailers
    # 'TE': 'trailers',
    'Content-Type': 'application/x-www-form-urlencoded',
}

data = '\b\x01\x12\x87\f\n\x9f\v\b\x01\x12\x83\n\nÃ\x02\b\x02\x12\x10O\x01~©¦µ©ò>w\x15Ýù*ÈV\x18Àá§\x99\x06"\x8c\x010\x81\x89\x02\x81\x81\x00ÒÝîõèT\x94\x96S¦¿]\x95©\x901xø\x05*\x9bßÕðð\xadÐÒ¡Ì\x92òÛJ\x1c\x9fÒW¹Ú@È!ÿßó/¯ë\x81\x90ÝLã{hp\x7fQðøº¿rMÅè§\x01ù£·E3\x9euZ[!#Ó\x98Ë\x10¬\x16lâ*\x8fò\x87\x84\x84ìÖà\x89ÛRRDPñù\fáüP\x10\xa0R ÇÙ§\x18\xa0¿\x9e\x19°:Ç.À\x85\x81\x02\x03\x01\x00\x01(«Ô\x01H\x01Z\x91\x01\n\x8c\x010\x81\x89\x02\x81\x81\x00Õ\x8c¨È¨w|M\tÜã¾Eæ\xad\vJ`1\x82\'Þ»,+:\x1dßv/Ø\x0eý\x8b\x93íEØ\xa0\t¦£\x97o\x9c¯#=Ï\x9b\'TÁ¸ß$B\x95\x0e\a©º¥\x1bõe¶\x99q\x1bß²X²Î\x85èãHÿñìbʸÂk}l \xa0Ð\x9ey6©SVYG×zÛ»\x15â\xad0Ì\x88ãÊéTY\x9bJ¬\x86\x11õ\x82\x14\x041p\x1aÿ\x02\x03\x01\x00\x01\x10\x01\x12\x80\x02\\\x83\x18\x158ÃqRæw2ùæß&PÒ¤®æýaY¾fÄ\x1b\x0f¶TÏ\x13¹äûz5Hüó\x1eZ¯ëç\x94Øïʼ\x8d\x0eB\t!\x96¤\x1c+\x81 \x10ÈH\x1eÎd\x01n0Í\x85FÛ1\x13ÁÂ×\x9d\x8b\x89³ñ+\x19ÆÑF¶æ\x04¤§mBbú\x15ú¿XuG8#¸~\x90Äß]\x94ço\x1a6K\x01L¿\x96ç|ï>O\x91\x86\x1a¥\x1aèM\x05,"Ï\x16¬[^92K\x91\x03¹6ß\x05\x1d\x02\x98|½âD%\x9c\x86ÛÉRA´\x81r\x10ë\x80ì\x9eÉ\x99\x9dk¦\x02î®\x80.¤zhYË\'©A\x17M\x12\x8ayóë\n¿¤&{\x86Ö1ªx[^F2\x11¿Ù»hê<JªP\x9e¶ÛC\ruuO±çs4~i\x19¸"-é\x18M\xadÁ\x88Ú\x0e}ãÃAã×\x16ë\x1a·\x05\n±\x02\b\x01\x12\x10S±¦º4ñ9̳ØÆ\x89\x1eÊkx\x18\x9fÃ\x91\x97\x06"\x8e\x020\x82\x01\n\x02\x82\x01\x01\x00ÇÛ_\x7f\x87îRº\x84õ\'å:\x15Ã\x19`c@\x18¾\x061ÚOõÌÔHU;\x1e\x1a7ØW\x0eAaÒ-}l^\x192³øb\x1b\x0f;²#Â5S¡\x84#\aÆáå!Å&\x14Ýö\x01q\x10(-.Ï\x92e\x9aÁDtQÝ«[n}Û!\nÿº\x03Ç<d\x8abÎåò2·»·Òð]"Ý» (ÎB_û\x9e\x85`}ÍS3MzZ(0Â}\x97\x8feþHql)\x1d[Úä\x01Gì\\Ã\x1bÃ\x8e\x94Åݸª\x85NE\x9d\x01ÐÄÆ\x89SUH71NÃË\x9e$\x1eà\x9d\x98ë\x8eÂÞ*RD\aD¡R¯<A\x02Ã\x16\rGY(?Ù\x10\x11\x91Z\x89\x13VÛÚ\x9fà.£ß\x03\x0e°qB÷\x8cP\x90CÉ$ö\x04ñßÜë¤ØýaeªÊ\x19Ö²3ñDÕÝù¼\x13Û\x02\x03\x01\x00\x01(«Ô\x01H\x01\x12\x80\x03\x8eáØ)h\b«\x15\x9d~[\x8eêÔó.îA³¬\x02qcqj\x81Ò<áH÷Üâ[\xadܽ>`\x02×ëñ\x11ÖY\x1f\x04÷õB\x1d\x83Æ\x8f\x9eÞîåý̽æÌu¤ú\x94¤ \x8d\x91;.7¾ÒNU\x1eÇkù\x8eé\x1dð_\x82h`,ù\x9a\x16\x16ÔUõÑï! \\º\x8a[ùÒhë\x92"4\x033\x11ìRrnd2ð\vXàÝUwyQ\x9f°ª\x87R®EÄÚ\x95·\x9250\x10\x86\x06\x81\'KÚ\x00%Ú\x10Ý\x82å¢v\x13Ï\x19¾\x88ÖD4Á\x84\x85.Fó Äß´ aR\f\x18\vGîS°\x01Ì~ãç\tº\x84¹\x9f9ÒÆä¾Fd\x89n½\x7f\x8d[Î\f\x1dò\x13Ê´y®¶sLÅÁ=<µ\nÿàm\x82ÍSáB\\\x01¼\x17\x1d_U3q-ÿÔ\x1c\x94\x89Í@)9)l$\'eÑ\x04:8\x0f\x14\\8UýH4Ø\x8aÚ¯Ü\x9fçw|81ë\x81<þËcÏæVcþ\x11Ë\x97\x06X\\*\x933c\n\x98\x05ÔÔ\x83\x11|Ó\x06\x06K§QëÀÃÀ)åDPA¡,¡þ¥VÁpT\nè^ýñùJ»Ü[9É<0Ó¬\x12\x88ÊozÍÓ\x81>Pë¼_z¨´\x0f\bë uà\x1a¼ß欴\x1a\x1b\n\x11architecture_name\x12\x06x86-64\x1a\x16\n\fcompany_name\x12\x06Google\x1a\x17\n\nmodel_name\x12\tChromeCDM\x1a\x16\n\rplatform_name\x12\x05Linux\x1a#\n\x14widevine_cdm_version\x12\v4.10.2557.02\n\b\x00\x10\x00\x18\x01 \x00(\x10\x12S\nQ\n;\b\x01\x12\x10ëgj»Ë4^\x96»Ïaf0ñ£Ú\x1a\rwidevine_test"\x10fkj3ljaSdfalkr3j*\x02HD2\x00\x10\x01\x1a\x10¡¡\x13PÊ\x1fG§\x862d£\x1bÉü\x1f\x18\x01 á¯ÿ\x9d\x060\x158È«Ý\x8e\x04\x1a\x80\x01\x19\x8c\x0f\x7ftN\x9c7F±8Ý\x185Aq¶ÃÛ·\x0eûl\x84\x8d\nÜ\x96¹V\bH\x10Æ\a)¾-Í\x11"i°/´ë\x83ØnLd\x9bð)XBXñL«&ÿb$6¢\x1e©¤ýý×\x1da¬³M,DüVËy\x97Vg65¡Ô\x8br&ýÁý½<\x11øj\x9f-+\x15*|.ñi\x8dE\f\x0eÓÍÖ÷@?É\aE\x19í^\x89àJ\x14\x00\x00\x00\x01\x00\x00\x00\x14\x00\x05\x00\x10A×UÈêFCB'.encode()

response = requests.post('https://cwip-shaka-proxy.appspot.com/no_auth', headers=headers, data=data)

In Temple of Doom I noted these changes and a made a mid-Summer edit therein. And to be clear if you have a new and never-used l3.py in your WKS-KEYS, you do not need to change anything! Just plug in the PSSH and correct license URL and the CDM will provide 5 keys. (I can, again, only think the reason for five keys is bitmovin.com trying to make our life difficult - only one key works.) But chaining them all together, when decrypting, works fine.

[A_n_g_e_l_a]

May we try an alternative to bitmovin?

This Irish site - mainly Gaelic language - is easy for beginners - and I do not think it is geo-locked. Reports yes or no would be helpful!

1. Site URL
   

   https://www.tg4.ie/en/player/online-boxsets/play/?pid=6281115686001&series=An%20Cuan&genre=Faisneis

2. License URL - found by filtering on 'lic' in Network tab of Developer Tools carries a token which needs to be fresh each use. It looks similar to this - BUT DO NOT USE THIS ONE, get a fresh copy.
   

   https://manifest.prod.boltdns.net/license/v1/cenc/widevine/1555966122001/982ce523-a4b1-4a94-91c6-c7a9a8b082f8/f21353cd-e18e-4dac-9c90-3e4b738b0148?fastly_token=NjNlNGRjNDhfMzJmMTZhMWVmMmVlYTM1OTdmZTk4NjI0ZTI1M2E5ODYzZTY0NDAyOGEwZTc5MzVhYzkyZDNkZGNmNmY4OWJiNA%3D%3D

3. PSSH found by inspecting the mpd. Network tab - filter on 'mpd' click on the link and look under 'Response' for a string starting AAAA
   

   AAAAVnBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAADYIARIQ8hNTzeGOTayckD5Lc4sBSBoNd2lkZXZpbmVfdGVzdCIIMTIzNDU2NzgyB2RlZmF1bHQ=

   This will always be the same.

[[ss]vegeta]

Reports yes or no would be helpful!

Yeah, plays fine from south Europe.

f21353cde18e4dac9c903e4b738b0148:e564eb646db649ea07e85700765d2349

No headers needed.

[ehurdler]

May we try an alternative to bitmovin?

This Irish site - mainly Gaelic language - is easy for beginners - and I do not think it is geo-locked. Reports yes or no would be helpful!

1. Site URL
   

   https://www.tg4.ie/en/player/online-boxsets/play/?pid=6281115686001&series=An%20Cuan&genre=Faisneis

2. License URL - found by filtering on 'lic' in Network tab of Developer Tools carries a token which needs to be fresh each use. It looks similar to this - BUT DO NOT USE THIS ONE, get a fresh copy.
   

   https://manifest.prod.boltdns.net/license/v1/cenc/widevine/1555966122001/982ce523-a4b1-4a94-91c6-c7a9a8b082f8/f21353cd-e18e-4dac-9c90-3e4b738b0148?fastly_token=NjNlNGRjNDhfMzJmMTZhMWVmMmVlYTM1OTdmZTk4NjI0ZTI1M2E5ODYzZTY0NDAyOGEwZTc5MzVhYzkyZDNkZGNmNmY4OWJiNA%3D%3D

3. PSSH found by inspecting the mpd. Network tab - filter on 'mpd' click on the link and look under 'Response' for a string starting AAAA
   

   AAAAVnBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAADYIARIQ8hNTzeGOTayckD5Lc4sBSBoNd2lkZXZpbmVfdGVzdCIIMTIzNDU2NzgyB2RlZmF1bHQ=

   This will always be the same.

Yes this works in the US as well, no VPN needed, no headers.
A_n_g_e_l_a, is this a true test? If the CDM I went thru and created following cedric8528's post

https://forum.videohelp.com/threads/408031-Dumping-Your-own-L3-CDM-with-Android-Studio

Does that mean, for example my CDM will work for all/most sites as I was able to get correct keys from your example? CBS in particular?

[ampersand]

The way I understand it - CDMs work for any widevine encrypted streaming site until a site blocks them and even then they're usable on sites where they haven't been blocked?

I'm more interested in how a lot of different keys work for the same encrypted files. Do they encrypt the mp4/m4a with tens/hundreds/thousands of key pairs at once?

[elfoeda]

Thank you to everyone who kindly took the time to help me, especially A_n_g_e_l_a, ampersand, codehound, you were amazing guiding me in the most didactic way possible.

I managed to get 5 keys for Bitmovin, with post #20 from A_n_g_e_l_a warning us that he is playing at being tricky these days.

In Firefox, on the network tab, I filtered for "no_auth" to arrive at the same license result.

[ElCap]

The way I understand it - CDMs work for any widevine encrypted streaming site until a site blocks them and even then they're usable on sites where they haven't been blocked?

Yes, but most sites don't revoke cdms themselves, google (or at least the widevine part) does that and these sites use that information. So if it gets blocked by Google, then the cdm won't work on most sites (depending on how often each site updates their list of revoked cdms).
Bigger sites revoke cdms themselves and do it much faster than Google.

I'm more interested in how a lot of different keys work for the same encrypted files. Do they encrypt the mp4/m4a with tens/hundreds/thousands of key pairs at once?

They don't, each valid key request (from any cdm) for the same encrypted files gets the same kid:key response. And only that kid:key decrypts the encrypted files.

[ampersand]

Yes, but most sites don't revoke cdms themselves, google (or at least the widevine part) does that and these sites use that information. So if it gets blocked by Google, then the cdm won't work on most sites (depending on how often each site updates their list of revoked cdms).
Bigger sites revoke cdms themselves and do it much faster than Google.

They don't, each valid key request (from any cdm) for the same encrypted files gets the same kid:key response. And only that kid:key decrypts the encrypted files.

so I can, for instance, get the keys for a video today, download the encrypted files in six months and the keys will decrypt it correctly? and if someone else tries getting the keys, they will get the same keys I got from my CDM+WKS?

thanks for the info.

[ElCap]

so I can, for instance, get the keys for a video today, download the encrypted files in six months and the keys will decrypt it correctly?

Yes, as long as the site doesn't re-encrypt the files with new keys in the meantime (depends on the site, but afaik, most smaller sites don't do this)

and if someone else tries getting the keys, they will get the same keys I got from my CDM+WKS?

Correct.