howto-deal-with-HLS-128-bit-aes-encrypted-the-hard-one-2.0-version

[jora]

    if (i.decryptdata) {
                    var f = new Uint8Array(t.data),
                      v = f.subarray(0, 16),
                      g = f.subarray(48, 64);
                    (f = a(
                      o(g),
                      h(
                        window.apkId.substring(0, 8) +
                          window.apkId.substring(40)
                      ),

converted to this

 def _decrypt_key(data):
    tmp1 = data[0:16]
    tmp2 = data[48:64]

    apk_Id2 = '62393432393963303832626562616234'
    dec1 = AES.new(bytes.fromhex(apk_Id2), AES.MODE_ECB)
    tmp3 = dec1.decrypt(tmp1)
    dec2 = AES.new(tmp3, AES.MODE_ECB)
    return dec2.decrypt(tmp2)
result = _decrypt_key(data)
hex_result = binascii.hexlify(result)
base64key = (base64.b64encode(result).decode('utf-8'))

ERROR

hlsdl -b -k 214050d145df223767baaf9cdf46913d  https://dnqe0v482iyb1.cloudfront.net/spees/w/o/60e975430cf20278db21ff30/v/665abd11b31b884fc125383f/u/6225780a0cf29abe0345ee88/t/86a9c665cc3be9a04477165136957403/p/assets/videos/60e975430cf20278db21ff30/2024/06/01/665abd11b31b884fc125383f/index.m3u8
> START media_playlist_get_links
> END media_playlist_get_links
> START media_playlist_get_links
> END media_playlist_get_links
HLS Stream is AES-128 encrypted.
File already exists. Overwrite? (y/n) y
{"d_t":"vod"}
{"t_d":4447,"d_d":0, "d_s":0}
Downloading part 0
Error: Wrong length key-file. Expected 16 bytes but got 336.
Error: AES128_CBC_DecryptUpdate failed: 0, in_size: 16176, out_size: 16160

can anyone help

[slayer36]

    if (i.decryptdata) {
                    var f = new Uint8Array(t.data),
                      v = f.subarray(0, 16),
                      g = f.subarray(48, 64);
                    (f = a(
                      o(g),
                      h(
                        window.apkId.substring(0, 8) +
                          window.apkId.substring(40)
                      ),

converted to this

 def _decrypt_key(data):
    tmp1 = data[0:16]
    tmp2 = data[48:64]

    apk_Id2 = '62393432393963303832626562616234'
    dec1 = AES.new(bytes.fromhex(apk_Id2), AES.MODE_ECB)
    tmp3 = dec1.decrypt(tmp1)
    dec2 = AES.new(tmp3, AES.MODE_ECB)
    return dec2.decrypt(tmp2)
result = _decrypt_key(data)
hex_result = binascii.hexlify(result)
base64key = (base64.b64encode(result).decode('utf-8'))

ERROR

hlsdl -b -k 214050d145df223767baaf9cdf46913d  https://dnqe0v482iyb1.cloudfront.net/spees/w/o/60e975430cf20278db21ff30/v/665abd11b31b884fc125383f/u/6225780a0cf29abe0345ee88/t/86a9c665cc3be9a04477165136957403/p/assets/videos/60e975430cf20278db21ff30/2024/06/01/665abd11b31b884fc125383f/index.m3u8
> START media_playlist_get_links
> END media_playlist_get_links
> START media_playlist_get_links
> END media_playlist_get_links
HLS Stream is AES-128 encrypted.
File already exists. Overwrite? (y/n) y
{"d_t":"vod"}
{"t_d":4447,"d_d":0, "d_s":0}
Downloading part 0
Error: Wrong length key-file. Expected 16 bytes but got 336.
Error: AES128_CBC_DecryptUpdate failed: 0, in_size: 16176, out_size: 16160

can anyone help

what's the main url?

[white_snake]

    if (i.decryptdata) {
                    var f = new Uint8Array(t.data),
                      v = f.subarray(0, 16),
                      g = f.subarray(48, 64);
                    (f = a(
                      o(g),
                      h(
                        window.apkId.substring(0, 8) +
                          window.apkId.substring(40)
                      ),

converted to this

 def _decrypt_key(data):
    tmp1 = data[0:16]
    tmp2 = data[48:64]

    apk_Id2 = '62393432393963303832626562616234'
    dec1 = AES.new(bytes.fromhex(apk_Id2), AES.MODE_ECB)
    tmp3 = dec1.decrypt(tmp1)
    dec2 = AES.new(tmp3, AES.MODE_ECB)
    return dec2.decrypt(tmp2)
result = _decrypt_key(data)
hex_result = binascii.hexlify(result)
base64key = (base64.b64encode(result).decode('utf-8'))

ERROR

can anyone help

apkId = '623........'

def _decrypt_key(data):
    tmp1 = data[0:16]
    tmp2 = data[48:64]
    apk_Id = apkId[0:8] + apkId[40:]
    dec1 = AES.new(bytes.fromhex(apk_Id), AES.MODE_ECB)
    tmp3 = dec1.decrypt(tmp1)
    dec2 = AES.new(tmp3, AES.MODE_ECB)
    return dec2.decrypt(tmp2)

Btw that apkid looks shorter than usual, you better double-check it.

[jora]

slayer36 this is the

url :https://dnqe0v482iyb1.cloudfront.net/spees/w/o/60e975430cf20278db21ff30/v/665abd11b31b884fc125383f/u/6225780a0cf29abe0345ee88/t/1c655b29dc23c37d7287acad018d9f96/p/assets/videos/60e975430cf20278db21ff30/2024/06/01/665abd11b31b884fc125383f/index.m3u8

APKID

 3263396632633966346163346637656462303432346163346637656462303432

[white_snake]

slayer36 this is the

url :https://dnqe0v482iyb1.cloudfront.net/spees/w/o/60e975430cf20278db21ff30/v/665abd11b31b884fc125383f/u/6225780a0cf29abe0345ee88/t/1c655b29dc23c37d7287acad018d9f96/p/assets/videos/60e975430cf20278db21ff30/2024/06/01/665abd11b31b884fc125383f/index.m3u8

APKID

 3263396632633966346163346637656462303432346163346637656462303432

Your apkid changed and so did your decrypting function probably, so it's not possible to retrieve the right key with partial info from different sessions. Open the page again and retrieve apkid and decrypting function from the same sessions and post them here.

[jora]

  if (i.decryptdata) {
                    var f = new Uint8Array(t.data),
                      v = f.subarray(0, 16),
                      g = f.subarray(48, 64);
                    (f = a(
                      o(g),
                      h(
                        window.apkId.substring(0, 8) +
                          window.apkId.substring(40)

it is still the same
[Attachment 79573 - Click to enlarge] apkid

6634623566346235346361623265353961633064346361623265353961633064

[LittleSoldier]

it is still the same
[Attachment 79573 - Click to enlarge] apkid

6634623566346235346361623265353961633064346361623265353961633064

Try this script

import re
import base64
import requests
from Crypto.Cipher import AES
import binascii
import os


def _decrypt_key(data):
    tmp1 = data[0:16]
    tmp2 = data[48:64]
    apk_Id = apkId[0:8] + apkId[40:]
    dec1 = AES.new(bytes.fromhex(apk_Id), AES.MODE_ECB)
    tmp3 = dec1.decrypt(tmp1)
    dec2 = AES.new(tmp3, AES.MODE_ECB)
    return dec2.decrypt(tmp2)


def dowload():
    match = re.search(r"(https?://.*\/)", url_base)
    url_stream = match.group(1).strip()
    r=requests.get(url_base)
    matchs = re.findall(r"(h.*m3u8)", r.text)
    video = url_stream+matchs[-1]
    r=requests.get(video)
    matchs = re.search(r"AES-128,URI=\"(.*)\"", r.text)
    uri_url = url_stream+matchs.group(1).strip()
    res = requests.get(uri_url)
    res.encoding = "binary/octet-stream"
    key_data = _decrypt_key(res.content)
    base64_key = (base64.b64encode(key_data).decode('utf-8'))
    hex_key =(binascii.hexlify(key_data).decode('utf-8'))
    print(hex_key)
    os.system(f'hlsdl -K {hex_key} -o output.mp4 -b "{url_base}"')
if __name__ == '__main__':
    apkId = input("Enter the apkId : ")
    url_base = input("Enter Index.m3u8url : ")
    dowload()

How to use?
1. run the script
2. feed apkId & m3u8 url on terminal

[white_snake]

Running this on the previously downloaded timestamp file yields the wrong key. I'm guessing with the apkid, also the timestamp file changes/expires (in fact you can no longer download it from the same m3u8 as before). Basically, you should also provide a copy of the timestamp file that comes with the session (if apkid and function stay the same, then there's no need to copy-pasting them again).

Btw if you could provide an url where this video is freely accessible, it would make things easier.

[LZAA]

white_snake

https://dnqe0v482iyb1.cloudfront.net/spees/w/o/60e975430cf20278db21ff30/v/665abd11b31b...3f/k/timestamp

File 'timestamp'=985 Bt

[white_snake]

window.apkId.substring(0, 32)

turned out to be the right padding instead of

window.apkId.substring(0, 8) + window.apkId.substring(40)

Key:

--custom-hls-key 9a9639f30f3d79c52be40c48e9923ac0

white_snake

https://dnqe0v482iyb1.cloudfront.net/spees/w/o/60e975430cf20278db21ff30/v/665abd11b31b...3f/k/timestamp

File 'timestamp'=985 Bt

That timestamp url expired before I last posted. Not sure what you mean by `'timestamp'=985 Bt` btw.

[hoxabe5434]

Major changes in the code, can someone help me with this? Thanks.

P.S.: I have everything working for the previous version. I feel we need to modify the decrypt_key function in the python script. But due to lack of JS knowledge, I cant figure it out

(e.loadsuccess = function (t, e, r) {
                  var i = r.frag,
                    n = window.cjs,
                    a = n.AES.decrypt,
                    o = window.convertArrayToBase64,
                    u = n.mode.ECB,
                    d = n.enc,
                    h = d.Hex.parse,
                    c = n.pad.NoPadding;
                  if (i.decryptdata) {
                    var f = new Uint8Array(t.data),
                      pp = t.url.split('/timestamp/')[1] ?? '',
                      g = f.subarray(0, 16),
                      v = f.subarray(48, 64);
                  if (pp === 'aav') {
                      g = f.subarray(0, 16); 
                      v = f.subarray(32, 48);
                    } else if (pp === 'scw') {
                      v = f.subarray(16, 32); 
                      g = f.subarray(48, 64);
                    } else if (pp === 'scs') {
                      g = f.subarray(0, 16); 
                      v = f.subarray(48, 64);
                    } else if (pp === 'sdq') {
                      v = f.subarray(0, 16); 
                      g = f.subarray(32, 48);
                    } else if (pp === 'sxc') {
                      g = f.subarray(16, 32); 
                      v = f.subarray(48, 64);
                    } else if (pp === 'q1wq') {
                      v = f.subarray(8, 24); 
                      g = f.subarray(32, 48);
                    } else if (pp === 'w1q') {
                      v = f.subarray(0, 16); 
                        g = f.subarray(48, 64);
                    }
                    (f = a(o(g), h(window.apkId.substring(0, 32)), {
                      mode: u,
                      padding: c,
                    })),
                      (f = d.u8array.stringify(
                        a(o(v), f, { mode: u, padding: c })
                      )),
                      (this.decryptkey = i.decryptdata.key =
                        new Uint8Array(f.buffer)),
                      (i.loader = null),
                      delete this.loaders[i.type],
                      this.hls.trigger(s.Events.KEY_LOADED, { frag: i });
                  } else l.logger.error("after key load, decryptdata unset");
                })

[slayer36]

Major changes in the code, can someone help me with this? Thanks.

P.S.: I have everything working for the previous version. I feel we need to modify the decrypt_key function in the python script. But due to lack of JS knowledge, I cant figure it out

(e.loadsuccess = function (t, e, r) {
                  var i = r.frag,
                    n = window.cjs,
                    a = n.AES.decrypt,
                    o = window.convertArrayToBase64,
                    u = n.mode.ECB,
                    d = n.enc,
                    h = d.Hex.parse,
                    c = n.pad.NoPadding;
                  if (i.decryptdata) {
                    var f = new Uint8Array(t.data),
                      pp = t.url.split('/timestamp/')[1] ?? '',
                      g = f.subarray(0, 16),
                      v = f.subarray(48, 64);
                  if (pp === 'aav') {
                      g = f.subarray(0, 16); 
                      v = f.subarray(32, 48);
                    } else if (pp === 'scw') {
                      v = f.subarray(16, 32); 
                      g = f.subarray(48, 64);
                    } else if (pp === 'scs') {
                      g = f.subarray(0, 16); 
                      v = f.subarray(48, 64);
                    } else if (pp === 'sdq') {
                      v = f.subarray(0, 16); 
                      g = f.subarray(32, 48);
                    } else if (pp === 'sxc') {
                      g = f.subarray(16, 32); 
                      v = f.subarray(48, 64);
                    } else if (pp === 'q1wq') {
                      v = f.subarray(8, 24); 
                      g = f.subarray(32, 48);
                    } else if (pp === 'w1q') {
                      v = f.subarray(0, 16); 
                        g = f.subarray(48, 64);
                    }
                    (f = a(o(g), h(window.apkId.substring(0, 32)), {
                      mode: u,
                      padding: c,
                    })),
                      (f = d.u8array.stringify(
                        a(o(v), f, { mode: u, padding: c })
                      )),
                      (this.decryptkey = i.decryptdata.key =
                        new Uint8Array(f.buffer)),
                      (i.loader = null),
                      delete this.loaders[i.type],
                      this.hls.trigger(s.Events.KEY_LOADED, { frag: i });
                  } else l.logger.error("after key load, decryptdata unset");
                })

you downloading from that goclasses.in platform?

[white_snake]

Major changes in the code, can someone help me with this? Thanks.

P.S.: I have everything working for the previous version. I feel we need to modify the decrypt_key function in the python script. But due to lack of JS knowledge, I cant figure it out

Can you provide an HAR file of your session? (network tab -> right-click any request -> Save all as HAR)

[hoxabe5434]

Can you provide an HAR file of your session? (network tab -> right-click any request -> Save all as HAR)

Sent you in DM

[Sagnik]

https://www.futurly.com/s/preview/courses/blender-architecture#6337f80fe4b05a534f0e3d5a

The entire source code has now been modified. Don't suggest another thread because nothing else will work right now.

Now, how do I obtain the key to download videos from the above URL?

Try with this android app:- https://play.google.com/store/search?q=lj+video+downloader&c=apps&redirect=0&redirect=0

[hoxabe5434]

you downloading from that goclasses.in platform?

Yes

[Sagnik]

Yes[/QUOTE]

Use the script on Firefox. It will work.

[slayer36]

you downloading from that goclasses.in platform?

Yes

which video ?

[hoxabe5434]

which video ?

Any video from the free course link that I shared earlier. I need to know the procedure, so that I can replicate it for the paid courses.

[white_snake]

Can you provide an HAR file of your session? (network tab -> right-click any request -> Save all as HAR)

Sent you in DM

--custom-hls-key f9badf093868f00e1bc74e78f119b308

It's basically the same function as before, only that you have to invert tmp1 and tmp2 in these lines:

tmp3 = dec1.decrypt(tmp1)
dec2 = AES.new(tmp3, AES.MODE_ECB)
return dec2.decrypt(tmp2)

All those switches and additional checks are just clutter.

[hoxabe5434]

Use the script on Firefox. It will work.

Which script are you talking about?

[hoxabe5434]

--custom-hls-key f9badf093868f00e1bc74e78f119b308

It's basically the same function as before, only that you have to invert tmp1 and tmp2 in these lines:

tmp3 = dec1.decrypt(tmp1)
dec2 = AES.new(tmp3, AES.MODE_ECB)
return dec2.decrypt(tmp2)

All those switches and additional checks are just clutter.

Already tried doing that. Tried it again. Not working.

Could you please take a look again and share your decrypt_key function in full? Thanks.

[white_snake]

Already tried doing that. Tried it again. Not working.

Could you please take a look again and share your decrypt_key function in full? Thanks.

You must take all the values from the same session, these are the values from your HAR session.

import base64
from Crypto.Cipher import AES

apkId = '3135636563313662626137633030653531356365633136626261376330306535'
timestamp_b64 = 'Uz1lWmhAT3Jk3YzUxpM10qhP+XKNpBbXP1RnbS9IO04YEBL+/HVFHVLUKMgBugRD'
timestamp = base64.b64decode(timestamp_b64)


def decrypt_key(data, apkid):
    tmp1 = data[8:24]
    tmp2 = data[32:48]
    apkid = apkid[16:48]
    dec1 = AES.new(bytes.fromhex(apkid), AES.MODE_ECB)
    tmp3 = dec1.decrypt(tmp2)
    dec2 = AES.new(tmp3, AES.MODE_ECB)
    key = dec2.decrypt(tmp1)
    return key.hex()


result = decrypt_key(timestamp, apkId)
print('Hex key:', result)

[hoxabe5434]

You must take all the values from the same session, these are the values from your HAR session.

import base64
from Crypto.Cipher import AES

apkId = '3135636563313662626137633030653531356365633136626261376330306535'
timestamp_b64 = 'Uz1lWmhAT3Jk3YzUxpM10qhP+XKNpBbXP1RnbS9IO04YEBL+/HVFHVLUKMgBugRD'
timestamp = base64.b64decode(timestamp_b64)


def decrypt_key(data, apkid):
    tmp1 = data[8:24]
    tmp2 = data[32:48]
    apkid = apkid[16:48]
    dec1 = AES.new(bytes.fromhex(apkid), AES.MODE_ECB)
    tmp3 = dec1.decrypt(tmp2)
    dec2 = AES.new(tmp3, AES.MODE_ECB)
    key = dec2.decrypt(tmp1)
    return key.hex()


result = decrypt_key(timestamp, apkId)
print('Hex key:', result)

Thanks a lot, its working now. The decrypt_key function I was using earlier, was't taking the timestamp_64 value into consideration. Just a couple more questions:

1. Do we need to get the timestamp_64 value from HAR file for each video separately? (In the previous method I could just iterate over the m3u8 links in the python script and download multiple videos in one go)

2. How do I locate the timestamp_64 value in the HAR file in a systematic manner?


Again, thank you very much.

[white_snake]

Thanks a lot, its working now. The decrypt_key function I was using earlier, was't taking the timestamp_64 value into consideration. Just a couple more questions:

1. Do we need to get the timestamp_64 value from HAR file for each video separately? (In the previous method I could just iterate over the m3u8 links in the python script and download multiple videos in one go)

2. How do I locate the timestamp_64 value in the HAR file in a systematic manner?


Again, thank you very much.

I just used the timestamp response in base64 because Chrome only lets you copy the response as such, but you could have downloaded the timestamp file and opened that as bytes in your code.

1. Both timestamp files and AES function values could change from video to video or from time to time for the same video.

2. You don't have to, as I said before this is just how Chrome lets you save the response, but you can grab it any way you like. Edit: to answer your question, you simply have to right click on the timestamp network request and select "Copy response" or w/e.

[amigo]

You must take all the values from the same session, these are the values from your HAR session.

import base64
from Crypto.Cipher import AES

apkId = '3135636563313662626137633030653531356365633136626261376330306535'
timestamp_b64 = 'Uz1lWmhAT3Jk3YzUxpM10qhP+XKNpBbXP1RnbS9IO04YEBL+/HVFHVLUKMgBugRD'
timestamp = base64.b64decode(timestamp_b64)


def decrypt_key(data, apkid):
    tmp1 = data[8:24]
    tmp2 = data[32:48]
    apkid = apkid[16:48]
    dec1 = AES.new(bytes.fromhex(apkid), AES.MODE_ECB)
    tmp3 = dec1.decrypt(tmp2)
    dec2 = AES.new(tmp3, AES.MODE_ECB)
    key = dec2.decrypt(tmp1)
    return key.hex()


result = decrypt_key(timestamp, apkId)
print('Hex key:', result)

Thanks a lot, its working now. The decrypt_key function I was using earlier, was't taking the timestamp_64 value into consideration. Just a couple more questions:

1. Do we need to get the timestamp_64 value from HAR file for each video separately? (In the previous method I could just iterate over the m3u8 links in the python script and download multiple videos in one go)

2. How do I locate the timestamp_64 value in the HAR file in a systematic manner?


Again, thank you very much.

hoxabe, I would like to inquire about the process of downloading videos from the GoClass platform. Could you please provide detailed instructions on how to download videos?

[aqzs]

hoxabe, I would like to inquire about the process of downloading videos from the GoClass platform. Could you please provide detailed instructions on how to download videos?

Get the key using the script and run :

N_m3u8DL-RE --custom-hls-key KEY ".m3u8" -M mkv

[amigo]

hoxabe, I would like to inquire about the process of downloading videos from the GoClass platform. Could you please provide detailed instructions on how to download videos?

Get the key using the script and run :

N_m3u8DL-RE --custom-hls-key KEY ".m3u8" -M mkv

Padding is invalid and cannot be removed.

[aqzs]

Padding is invalid and cannot be removed.

Send video url.

[white_snake]

Padding is invalid and cannot be removed.

That means your key is wrong. Post an HAR file of the session if you can't post a link.