Dumping Your own L3 CDM with Android Studio

[XxDarkus101Xx]

[Attachment 73243 - Click to enlarge]
nvm wrong python command but now I have this

[HJPM]

dll or xr file? I'm confused.
Post your commands (and if you can, screenshots as well)

The Frida releases from the guide's link are archived dlls. The adb.exe push command doesn't work, at least on my end, without specifying the extension as well. Although both are successfully pushed, archived or not, they give the same type of error:

error: PS C:\Users\**redacted**\AppData\Local\Android\Sdk\platform-tools> ./adb shell
generic_x86_arm:/ $ mv /sdcard/frida-server_yourversionfrida-clr-16.1.3-windows-x86.dll.xr/data/local/tmp
/data/local/tmp/frida-clr-16.1.3-windows-x86.dll.xr
/data/local/tmp/frida-clr-16.1.3-windows-x86.dll.xrmv: Need 2 arguments (see "mv --help")
1|generic_x86_arm:/ $ chmod  +x /data/local/tmp/frida-clr-16.1.3-windows-x86.dll.xr
chmod: /data/local/tmp/frida-clr-16.1.3-windows-x86.dll.xr: No such file or directory
1|generic_x86_arm:/ $ /data/local/tmp/frida-clr-16.1.3-windows-x86.dll.xr
/system/bin/sh: /data/local/tmp/frida-clr-16.1.3-windows-x86.dll.xr: not found
127|generic_x86_arm:/ $ su
rida-clr-16.1.3-windows-x86.dll.xr /data/local/tmp
chmod  +x /data/local/tmp/frgeneric_x86_arm:/ # mv /sdcard/frida-clr-16.1.3-windows-x86.dll.xr /data/local/tmp
ida-clr-16.1.3-windows-x86.dll.xr
/data/local/tmp/frida-clr-16.1.3mv: bad '/sdcard/frida-clr-16.1.3-windows-x86.dll.xr': No such file or directory
-1|generic_x86_arm:/ # chmod  +x /data/local/tmp/frida-clr-16.1.3-windows-x86.dll.xr
windows-x86.dll.xrchmod: /data/local/tmp/frida-clr-16.1.3-windows-x86.dll.xr: No such file or directory
1|generic_x86_arm:/ # /data/local/tmp/frida-clr-16.1.3-windows-x86.dll.xr
/system/bin/sh: /data/local/tmp/frida-clr-16.1.3-windows-x86.dll.xr: not found
127|generic_x86_arm:/ #
PS C:\Users\**redacted**\AppData\Local\Android\Sdk\platform-tools>

You are downloading the wrong version.

You need frida-server-android-x86
Not the Windows version

Frida-server-android-x86 appears to only be source files. Regardless, the sample command "adb.exe push frida-server-16.0.2-android-x86 /sdcard" continues to not run unless I also specify the file extension. Once I get to the final, mv command, I get this error:

/system/bin/sh: /data/local/tmp/frida-core-devkit-16.1.3-android-x86.tar.xz: not executable: magic FD37

you're not reading what I said.. You need the SERVER files, not the core devkit.

This is the one you're after:
https://github.com/frida/frida/releases/download/16.1.3/frida-server-16.1.3-android-x86.xz

Unpack it first, you need to end up with a file "without an extension"

Then run the adb commands and the shell commands

[Attachment 73245 - Click to enlarge]
To be fair, it was collapsed.

[XxDarkus101Xx]

[Attachment 73246 - Click to enlarge]
I'll post it again, this is where im stuck at

[Magicians]

[Attachment 73246 - Click to enlarge]
I'll post it again, this is where im stuck at

You need to follow the instructions step by step. You are not running frida

[XxDarkus101Xx]

[Attachment 73246 - Click to enlarge]
I'll post it again, this is where im stuck at

You need to follow the instructions step by step. You are not running frida

I was running frida. I typed all this down

adb.exe shell
su
mv /sdcard/frida-server_yourversion /data/local/tmp
chmod +x /data/local/tmp/frida-server-yourversion
/data/local/tmp/frida-server-16.0.2-android-x86
I don’t know if you hit return or enter button but after that it says unable to connect to ip address. Address already in use or something like that and when I get to the dump python file that’s where the problem is

[ElCap]

You need to follow the instructions step by step. You are not running frida

I was running frida. I typed all this down

adb.exe shell
su
mv /sdcard/frida-server_yourversion /data/local/tmp
chmod +x /data/local/tmp/frida-server-yourversion
/data/local/tmp/frida-server-16.0.2-android-x86
I don’t know if you hit return or enter button but after that it says unable to connect to ip address. Address already in use or something like that and when I get to the dump python file that’s where the problem is

Add screenshots

[XxDarkus101Xx]

You need to follow the instructions step by step. You are not running frida

I was running frida. I typed all this down

adb.exe shell
su
mv /sdcard/frida-server_yourversion /data/local/tmp
chmod +x /data/local/tmp/frida-server-yourversion
/data/local/tmp/frida-server-16.0.2-android-x86
I don’t know if you hit return or enter button but after that it says unable to connect to ip address. Address already in use or something like that and when I get to the dump python file that’s where the problem is

Add screenshots

Yeah I show you when I get home from work.

[Karoolus]

adb.exe shell
su
mv /sdcard/frida-server_yourversion /data/local/tmp
chmod +x /data/local/tmp/frida-server-yourversion
/data/local/tmp/frida-server-16.0.2-android-x86

First of all, you did change the frida-server_yourversion to the correct version, right? You didn't just use the command as you typed it here, as that won't work for obvious reasons.

Second, connect to IP address? It should connect through ADB, has nothing to do with IP connectivity?

[XxDarkus101Xx]

adb.exe shell
su
mv /sdcard/frida-server_yourversion /data/local/tmp
chmod +x /data/local/tmp/frida-server-yourversion
/data/local/tmp/frida-server-16.0.2-android-x86

First of all, you did change the frida-server_yourversion to the correct version, right? You didn't just use the command as you typed it here, as that won't work for obvious reasons.

Second, connect to IP address? It should connect through ADB, has nothing to do with IP connectivity?

Um is there a way I can check to see which version I’m supposed to have? I just downloaded the same version that magician was using in the video. If not where do you change it?

[ElCap]

adb.exe shell
su
mv /sdcard/frida-server_yourversion /data/local/tmp
chmod +x /data/local/tmp/frida-server-yourversion
/data/local/tmp/frida-server-16.0.2-android-x86

First of all, you did change the frida-server_yourversion to the correct version, right? You didn't just use the command as you typed it here, as that won't work for obvious reasons.

Second, connect to IP address? It should connect through ADB, has nothing to do with IP connectivity?

Um is there a way I can check to see which version I’m supposed to have? I just downloaded the same version that magician was using in the video. If not where do you change it?

Karoolus is asking if you changed the command from

mv /sdcard/frida-server_yourversion /data/local/tmp
chmod +x /data/local/tmp/frida-server-yourversion

to

mv /sdcard/frida-server-16.0.2-android-x86 /data/local/tmp
chmod +x /data/local/tmp/frida-server-16.0.2-android-x86

[XxDarkus101Xx]

Yeah that’s exactly what I typed in the CMD window.

adb.exe shell
su
mv /sdcard/frida-server-16.0.2-android-x86 /data/local/tmp
chmod +x /data/local/tmp/frida-server-yourversion
/data/local/tmp/frida-server-16.0.2-android-x86

[ElCap]

chmod +x /data/local/tmp/frida-server-yourversion

Typo?
Anyway, I doubt anyone's going to be able to help without the screenshot, so we can wait for that.

[XxDarkus101Xx]

Yeah don’t worry I’ll show you everything I’m doing with screenshots when I get home

[jammesvx]

dump_keys.py", line 6, in <module>
from Helpers.Scanner import Scan

i cannot run python with code

[Karoolus]

dump_keys.py", line 6, in <module>
from Helpers.Scanner import Scan

i cannot run python with code

Did you unzip all the files and put them in the directory?

[jammesvx]

dump_keys.py", line 6, in <module>
from Helpers.Scanner import Scan

i cannot run python with code

Did you unzip all the files and put them in the directory?

no I haven't put it in the folder yet, please tell me which folder to put it in , thanks you so much

[Karoolus]

dump_keys.py", line 6, in <module>
from Helpers.Scanner import Scan

i cannot run python with code

Did you unzip all the files and put them in the directory?

no I haven't put it in the folder yet, please tell me which folder to put it in , thanks you so much

Just download the entire dumper repository as zip
unzip the downloaded zip file into a folder (it doesn't really matter which folder that is)
run dump_keys.py

[XxDarkus101Xx]

Alright just got home and I'm just starting from scratch. I'll let you know when im done

[XxDarkus101Xx]

[Attachment 73268 - Click to enlarge]
WOW it Worked!! I don't how but I just followed the steps and it actually worked!

[Karoolus]

That's what the steps are for...

[XxDarkus101Xx]

That's what the steps are for...

Well I don’t know what I did wrong last night so I just started from scratch and it went through smoothly. I just hope that the keys work with drm stuff

[jammesvx]

[Attachment 73275 - Click to enlarge]

dump_keys.py", line 6, in <module>
from Helpers.Scanner import Scan

i cannot run python with code

Did you unzip all the files and put them in the directory?

no I haven't put it in the folder yet, please tell me which folder to put it in , thanks you so much

Just download the entire dumper repository as zip
unzip the downloaded zip file into a folder (it doesn't really matter which folder that is)
run dump_keys.py

hic , i don't know it not working

[ElCap]

[Attachment 73275 - Click to enlarge]
hic , i don't know it not working

If only there was someone with the same problem on the first page of this thread......

[Karoolus]

Or, you know, just google it

[Mammut]

Hi!

Thanks for the detailed instructions!

[swappyison]

do this, pip install pycryptodomex

[Spy]

I have followed the steps here
https://forum.videohelp.com/threads/408031-Dumping-Your-own-L3-CDM-with-Android-Studio
and got the following 2 files :
private_key and client_id_blob
i have no idea what to do from here ?

[A_n_g_e_l_a]

I have followed the steps here
https://forum.videohelp.com/threads/408031-Dumping-Your-own-L3-CDM-with-Android-Studio
and got the following 2 files :
private_key and client_id_blob
i have no idea what to do from here ?

Continue your reading here https://forum.videohelp.com/threads/404994-Decryption-and-the-Temple-of-Doom - start at the heading, a few scrolls down, called Decryption.

[RHAtatouille]

Hi Everyone

so everything goes well until l3.py told me
no client ID blob available for this device....
I correctly renamed files

[Attachment 73319 - Click to enlarge]
And now i m stuck

(key generated with android studio , pixel 6 api28, my os win10 64, launched a cmd.exe and got the error)

[A_n_g_e_l_a]

Hi Everyone

so everything goes well until l3.py told me
no client ID blob available for this device....
I correctly renamed files

[Attachment 73319 - Click to enlarge]
And now i m stuck

(key generated with android studio , pixel 6 api28, my os win10 64, launched a cmd.exe and got the error)

Suggest you follow my post two above this. Make sure you've put your key and blob inside emulator_1. Clearly the system isn't finding it
Inside pywidevine/L3/cdm/ is deviceconfig.py check that has at least one device described and a devices_available line.

device_emulator_1 = {
    'name': 'emulator_1',
    'description': 'emulator',
    'security_level': 3,
    'session_id_type': 'android',
    'private_key_available': True,
    'vmp': False,
    'send_key_control_nonce': True
}
device_emulator_2 = {
    'name': 'emulator_2',
    'description': 'emulator',
    'security_level': 3,
    'session_id_type': 'android',
    'private_key_available': True,
    'vmp': False,
    'send_key_control_nonce': True
}
# original 
device_android_generic = {
    'name': 'android_generic',
    'description': 'TV Box',
    'security_level': 3,
    'session_id_type': 'android',
    'private_key_available': True,
    'vmp': False,
    'send_key_control_nonce': True
}
device_android_generic1 = {
    'name': 'android_generic',
    'description': 'TV Box',
    'security_level': 3,
    'session_id_type': 'android',
    'private_key_available': True,
    'vmp': False,
    'send_key_control_nonce': True
}

devices_available = [device_emulator_1, device_emulator_2, device_android_generic, device_android_generic1]

Then from the cdm folder cd to devices and make sure the folder with the files you listed is there as emulator_1

[Attachment 73322 - Click to enlarge]