Dumping Your own L3 CDM with Android Studio

[Karn]

[Attachment 80186 - Click to enlarge]

Everything is setup nicely but the ... Dumper dosent work when i navigate to the drm site given https://bitmovin.com/demos/drm

u can see that in the terminal !! why is it so ?? did i do anything wrong to setup ??

Use keydive. The entire process from root avd onwards gets automated and is a lot easier and gets completed in a few steps.

Note: Make sure the frida you download & push and the frida you install via pip are the same version. Newbies make this mistake too often(I did too ).

I think the avd architecture and frida needs to be the same. I created an 86_64 arch(google api) and downloaded the same frida version. Check yours. Do NOT select google play under any circumstance, or any other.

Thanks for the Reply:
My frida version is 16.3.3
[Attachment 80194 - Click to enlarge]



[Attachment 80195 - Click to enlarge]

As far as i know its x86 version of Frida server that i need to download right ??
[Attachment 80196 - Click to enlarge] this is the one i downloaded
Still the case remains the same ... on playing the drm video my dumper terminal has no response !!

So do i nee to implement the x86_64 arch ??

Also i dont have a clue about keydive can u suggest a sticky thread / forum thread using keydive for CDM

You installed v16.3.3 but you pushed frida 16.3.1


[Attachment 80212 - Click to enlarge]

uninstall that and run pip install frida~=16.3.3

For keydive, foxrefire has a an easy to follow tutorial https://github.com/FoxRefire/wvg/wiki/How-to-dump-CDM-key-pair-from-AVD

Create an avd. Do not select google play or aosp. Only Google api

Download frida latest. Rename the extracted file to just "frida-server"

Download keydive. Extract it.

Install requirements if nor already installed. Run pip

pip install frida~=16.3.3
pip install pathlib~=1.0.1
pip install coloredlogs~=15.0.1
pip install pycryptodomex~=3.20.0
pip install xmltodict~=0.13.0
pip install PyYAML~=6.0.1
pip install Flask~=3.0.3
pip install pywidevine~=1.8.0

Run your new avd


Put frida server in the same folder as keydive. Launch a new terminal from within that folder and run these commands:

adb root
adb push frida-server /data/local/tmp
adb shell "chmod +x /data/local/tmp/frida-server"
adb shell "/data/local/tmp/frida-server -D &"
python keydive.py -aw

Your avd should automatically fire a drm demo site within it while the code is running.

Once the extraction is complete, in that same folder where you opened the terminal to run the commands, there would be a folder created - "device". Inside you will find three files:

private_key.pem
client_id.bin
google_xxxx_xxxxx_xx_xxxx_l3.wvd

Rename these to

device_private_key
device_client_id_blob
device.wvd

[Shadee]

[Attachment 80186 - Click to enlarge]

Everything is setup nicely but the ... Dumper dosent work when i navigate to the drm site given https://bitmovin.com/demos/drm

u can see that in the terminal !! why is it so ?? did i do anything wrong to setup ??

Use keydive. The entire process from root avd onwards gets automated and is a lot easier and gets completed in a few steps.

Note: Make sure the frida you download & push and the frida you install via pip are the same version. Newbies make this mistake too often(I did too ).

I think the avd architecture and frida needs to be the same. I created an 86_64 arch(google api) and downloaded the same frida version. Check yours. Do NOT select google play under any circumstance, or any other.

Thanks for the Reply:
My frida version is 16.3.3
[Attachment 80194 - Click to enlarge]



[Attachment 80195 - Click to enlarge]

As far as i know its x86 version of Frida server that i need to download right ??
[Attachment 80196 - Click to enlarge] this is the one i downloaded
Still the case remains the same ... on playing the drm video my dumper terminal has no response !!

So do i nee to implement the x86_64 arch ??

Also i dont have a clue about keydive can u suggest a sticky thread / forum thread using keydive for CDM

You installed v16.3.3 but you pushed frida 16.3.1


[Attachment 80212 - Click to enlarge]

uninstall that and run pip install frida~=16.3.3

For keydive, foxrefire has a an easy to follow tutorial https://github.com/FoxRefire/wvg/wiki/How-to-dump-CDM-key-pair-from-AVD

Create an avd. Do not select google play or aosp. Only Google api

Download frida latest. Rename the extracted file to just "frida-server"

Download keydive. Extract it.

Install requirements if nor already installed. Run pip

pip install frida~=16.3.3
pip install pathlib~=1.0.1
pip install coloredlogs~=15.0.1
pip install pycryptodomex~=3.20.0
pip install xmltodict~=0.13.0
pip install PyYAML~=6.0.1
pip install Flask~=3.0.3
pip install pywidevine~=1.8.0

Run your new avd


Put frida server in the same folder as keydive. Launch a new terminal from within that folder and run these commands:

adb root
adb push frida-server /data/local/tmp
adb shell "chmod +x /data/local/tmp/frida-server"
adb shell "/data/local/tmp/frida-server -D &"
python keydive.py -aw

Your avd should automatically fire a drm demo site within it while the code is running.

Once the extraction is complete, in that same folder where you opened the terminal to run the commands, there would be a folder created - "device". Inside you will find three files:

private_key.pem
client_id.bin
google_xxxx_xxxxx_xx_xxxx_l3.wvd

Rename these to

device_private_key
device_client_id_blob
device.wvd

Thanks for the Explanation with the keydive but currently i am trying to work with the as described in the guide ...
I corrected the Frida Version 16.3.3 and then ran the virtual android ... all work good but when i open a drm site given to test in explanation ... the dumper dosent work the same way the issue remains the same ! lemme show u...
[Attachment 80215 - Click to enlarge]
[Attachment 80216 - Click to enlarge]
[Attachment 80217 - Click to enlarge]

Niether can i find a private_key folder in Dumper...
[Attachment 80219 - Click to enlarge]

Any one with fixes on waht the issue is and how to make it to the other side ??

[polkzhyzia]

I'm already running as root

[Attachment 79989 - Click to enlarge]

[Attachment 79990 - Click to enlarge]

I can see that, but that's an error from dump_keys.py, not from KeyDive. I'll say it for the third and last time: try to dump the CDM with KeyDive and see what happens.

i have this error.

[Attachment 80220 - Click to enlarge]

[white_snake]

i have this error.

[Attachment 80220 - Click to enlarge]

Try without the -aw switch.

[polkzhyzia]

i have this error.

[Attachment 80220 - Click to enlarge]

Try without the -aw switch.

same error .

[Attachment 80232 - Click to enlarge]

[Blacksiren]

same error .

[Attachment 80232 - Click to enlarge]

Make sure you have adb.exe in the same folder as the KeyDive script you are running or put the platform-tools folder into your PATH.

[Shadee]

[Attachment 80186 - Click to enlarge]

Everything is setup nicely but the ... Dumper dosent work when i navigate to the drm site given https://bitmovin.com/demos/drm

u can see that in the terminal !! why is it so ?? did i do anything wrong to setup ??

Use keydive. The entire process from root avd onwards gets automated and is a lot easier and gets completed in a few steps.

Note: Make sure the frida you download & push and the frida you install via pip are the same version. Newbies make this mistake too often(I did too ).

I think the avd architecture and frida needs to be the same. I created an 86_64 arch(google api) and downloaded the same frida version. Check yours. Do NOT select google play under any circumstance, or any other.

Thanks for the Reply:
My frida version is 16.3.3
[Attachment 80194 - Click to enlarge]



[Attachment 80195 - Click to enlarge]

As far as i know its x86 version of Frida server that i need to download right ??
[Attachment 80196 - Click to enlarge] this is the one i downloaded
Still the case remains the same ... on playing the drm video my dumper terminal has no response !!

So do i nee to implement the x86_64 arch ??

Also i dont have a clue about keydive can u suggest a sticky thread / forum thread using keydive for CDM

You installed v16.3.3 but you pushed frida 16.3.1


[Attachment 80212 - Click to enlarge]

uninstall that and run pip install frida~=16.3.3

For keydive, foxrefire has a an easy to follow tutorial https://github.com/FoxRefire/wvg/wiki/How-to-dump-CDM-key-pair-from-AVD

Create an avd. Do not select google play or aosp. Only Google api

Download frida latest. Rename the extracted file to just "frida-server"

Download keydive. Extract it.

Install requirements if nor already installed. Run pip

pip install frida~=16.3.3
pip install pathlib~=1.0.1
pip install coloredlogs~=15.0.1
pip install pycryptodomex~=3.20.0
pip install xmltodict~=0.13.0
pip install PyYAML~=6.0.1
pip install Flask~=3.0.3
pip install pywidevine~=1.8.0

Run your new avd


Put frida server in the same folder as keydive. Launch a new terminal from within that folder and run these commands:

adb root
adb push frida-server /data/local/tmp
adb shell "chmod +x /data/local/tmp/frida-server"
adb shell "/data/local/tmp/frida-server -D &"
python keydive.py -aw

Your avd should automatically fire a drm demo site within it while the code is running.

Once the extraction is complete, in that same folder where you opened the terminal to run the commands, there would be a folder created - "device". Inside you will find three files:

private_key.pem
client_id.bin
google_xxxx_xxxxx_xx_xxxx_l3.wvd

Rename these to

device_private_key
device_client_id_blob
device.wvd

Thanks for the Explanation with the keydive but currently i am trying to work with the as described in the guide ...
I corrected the Frida Version 16.3.3 and then ran the virtual android ... all work good but when i open a drm site given to test in explanation ... the dumper dosent work the same way the issue remains the same ! lemme show u...
[Attachment 80215 - Click to enlarge]
[Attachment 80216 - Click to enlarge]
[Attachment 80217 - Click to enlarge]

Niether can i find a private_key folder in Dumper...
[Attachment 80219 - Click to enlarge]

Any one with fixes on waht the issue is and how to make it to the other side ??

Anyone with some help ... on what's wrong here on using frida ?? OR i have to use keydive only ?? please if anyone can help

[Blacksiren]

Anyone with some help ... on what's wrong here on using frida ?? OR i have to use keydive only ?? please if anyone can help

As you can see on the bitmovin page, it says "Detected Chrome using NO DRM", that should say Widevine.. try deleting this AVD and creating old one from scratch.

Also, as stated before, make sure to triple check that you are using the correct version, use KeyDive for the dumping process with -aw switch, that way the bitmovin page will open by itself and you will end up with WVD file that you can use later.

[Shadee]

Anyone with some help ... on what's wrong here on using frida ?? OR i have to use keydive only ?? please if anyone can help

As you can see on the bitmovin page, it says "Detected Chrome using NO DRM", that should say Widevine.. try deleting this AVD and creating old one from scratch.

Also, as stated before, make sure to triple check that you are using the correct version, use KeyDive for the dumping process with -aw switch, that way the bitmovin page will open by itself and you will end up with WVD file that you can use later.

So i should create a new Virtual Android ?? maybe Pixel 6 the rooted one !! right ??

ya i am using the current version its just that i am not using keydive ... wanna make sure the tutorial thing works fine first then i can try other things

Thanks for the Reply

[Blacksiren]

So i should create a new Virtual Android ?? maybe Pixel 6 the rooted one !! right ??

ya i am using the current version its just that i am not using keydive ... wanna make sure the tutorial thing works fine first then i can try other things

Thanks for the Reply

Yeah, I'm more than sure that there is a proper fix to make the bitmovin page show the correct thing but creating new AVD will be far easier.
Just follow the sticky thread post #1 and follow the same steps in those screenshots, same version everything, check if you have correct API and so on.

I recommend using KeyDive, so definitely use that one.

So either use the tutorial in this post #1 or as already stated above use FoxRefire's guide.

[Shadee]

So i should create a new Virtual Android ?? maybe Pixel 6 the rooted one !! right ??

ya i am using the current version its just that i am not using keydive ... wanna make sure the tutorial thing works fine first then i can try other things

Thanks for the Reply

Yeah, I'm more than sure that there is a proper fix to make the bitmovin page show the correct thing but creating new AVD will be far easier.
Just follow the sticky thread post #1 and follow the same steps in those screenshots, same version everything, check if you have correct API and so on.

I recommend using KeyDive, so definitely use that one.

It worked how dumb can i be to not give chrome permissions and then cry about it not working !! LOl
Thanks for the help to everyone that replied ...

[Attachment 80235 - Click to enlarge]

Trying with keydive next Its fun learning here

[Blacksiren]

It worked how dumb can i be to not give chrome permissions and then cry about it not working !! LOl
Thanks for the help to everyone that replied ...

Yeah, forgot to tell you to check permissions, I'm glad you were able to figure it out, congrats.

[polkzhyzia]

same error .

[Attachment 80232 - Click to enlarge]

Make sure you have adb.exe in the same folder as the KeyDive script you are running or put the platform-tools folder into your PATH.

i already run it in root, but i have this error

[Attachment 80241 - Click to enlarge]

[Blacksiren]

same error .

[Attachment 80232 - Click to enlarge]

Make sure you have adb.exe in the same folder as the KeyDive script you are running or put the platform-tools folder into your PATH.

i already run it in root, but i have this error

[Attachment 80241 - Click to enlarge]

Are you sure that you run Frida as root? Also, try what it says "sudo sysctl kernel.yama.ptrace_scope=0" -- you have to run it in adb shell ofcourse.. Alternatively try rebooting the AVD first and run Frida and Keydive again.

[Shadee]

[Attachment 80186 - Click to enlarge]

Everything is setup nicely but the ... Dumper dosent work when i navigate to the drm site given https://bitmovin.com/demos/drm

u can see that in the terminal !! why is it so ?? did i do anything wrong to setup ??

Use keydive. The entire process from root avd onwards gets automated and is a lot easier and gets completed in a few steps.

Note: Make sure the frida you download & push and the frida you install via pip are the same version. Newbies make this mistake too often(I did too ).

I think the avd architecture and frida needs to be the same. I created an 86_64 arch(google api) and downloaded the same frida version. Check yours. Do NOT select google play under any circumstance, or any other.

Thanks for the Reply:
My frida version is 16.3.3
[Attachment 80194 - Click to enlarge]



[Attachment 80195 - Click to enlarge]

As far as i know its x86 version of Frida server that i need to download right ??
[Attachment 80196 - Click to enlarge] this is the one i downloaded
Still the case remains the same ... on playing the drm video my dumper terminal has no response !!

So do i nee to implement the x86_64 arch ??

Also i dont have a clue about keydive can u suggest a sticky thread / forum thread using keydive for CDM

You installed v16.3.3 but you pushed frida 16.3.1


[Attachment 80212 - Click to enlarge]

uninstall that and run pip install frida~=16.3.3

For keydive, foxrefire has a an easy to follow tutorial https://github.com/FoxRefire/wvg/wiki/How-to-dump-CDM-key-pair-from-AVD

Create an avd. Do not select google play or aosp. Only Google api

Download frida latest. Rename the extracted file to just "frida-server"

Download keydive. Extract it.

Install requirements if nor already installed. Run pip

pip install frida~=16.3.3
pip install pathlib~=1.0.1
pip install coloredlogs~=15.0.1
pip install pycryptodomex~=3.20.0
pip install xmltodict~=0.13.0
pip install PyYAML~=6.0.1
pip install Flask~=3.0.3
pip install pywidevine~=1.8.0

Run your new avd


Put frida server in the same folder as keydive. Launch a new terminal from within that folder and run these commands:

adb root
adb push frida-server /data/local/tmp
adb shell "chmod +x /data/local/tmp/frida-server"
adb shell "/data/local/tmp/frida-server -D &"
python keydive.py -aw

Your avd should automatically fire a drm demo site within it while the code is running.

Once the extraction is complete, in that same folder where you opened the terminal to run the commands, there would be a folder created - "device". Inside you will find three files:

private_key.pem
client_id.bin
google_xxxx_xxxxx_xx_xxxx_l3.wvd

Rename these to

device_private_key
device_client_id_blob
device.wvd

Thanks for the Tutorial ... passed it in the first go !!!!
[Attachment 80304 - Click to enlarge]

[Karn]

Thanks for the Tutorial ... passed it in the first go !!!!
[Attachment 80304 - Click to enlarge]

Glad you were able to get it working. Keydive is way simpler and lot easier. Thats why everyone suggests it on priority. You could dump a couple more if youd like to get used to it. Just create new avds on SDK33 & below.

[Shadee]

Thanks for the Tutorial ... passed it in the first go !!!!
[Attachment 80304 - Click to enlarge]

Glad you were able to get it working. Keydive is way simpler and lot easier. Thats why everyone suggests it on priority. You could dump a couple more if youd like to get used to it. Just create new avds on SDK33 & below.

with keydive we get a .wvd file extra which we dont get using frida ... or do we get it there too .. if not then how can we retrieve the same with frida ??

Also now as i have my own CDM can i proceed to the Decryption section of the Decryption and the Temple of doom thread by angela or is there anything left for me to do ??

I totally don't need to use magisk and work with it on virtual studio right as it is to root physical devices or do i need to ??

I mean just want to know the next steps ... i followed the angelas thread and landed here as it said have your own cdm first if u wanna continue

Would be very helpful if u or anyone else can guide me here !!! for the next steps thanks

[Karn]

with keydive we get a .wvd file extra which we dont get using frida ... or do we get it there too .. if not then how can we retrieve the same with frida ??

You have the cdm, thats basic to decrypt files.

You need other data to go alongwith that to get the keys. Temple of Doom details that information. ToD also details how to dump cdm from an actual physical device which is needed when certain platforms identify and reject your sdk cdm. This is where magisk comes into the picture during the dumping process.

The xxxxx.wvd is a decryption module. You can keep it or only use the blob and key files.

[Shadee]

with keydive we get a .wvd file extra which we dont get using frida ... or do we get it there too .. if not then how can we retrieve the same with frida ??

You have the cdm, thats basic to decrypt files.

You need other data to go alongwith that to get the keys. Temple of Doom details that information. ToD also details how to dump cdm from an actual physical device which is needed when certain platforms identify and reject your sdk cdm. This is where magisk comes into the picture during the dumping process.

The xxxxx.wvd is a decryption module. You can keep it or only use the blob and key files.

ooh thanks for these additional information ... So for now the Sdk CDM works until u encounter a case where its rejected by certain platforms ... thats the case then where i need to put in a physical device ... root process GOT IT !!

And ya i have the xxxx.wvd ... i will try to work with it but my question is it isn't generated when we try the frida method using Dumping ur L3 CDM process explained right ?? also angela described how to use the .wvd file to decrypt ... u said u can use the other 2 key files to do the same can u throw some light as to how to ... use the other 2 files to do the same ??

If my doubts are a bit annoying i am sorry for that .... any additional information would help me anyways thanks for the reply as always

[Hackerpcs]

Is it possible nowadays to dump L1 keys from maybe Nvidia Shield with publicly available exploits? Or they need private TEE exploits which aren't available?

[PSXman_uk]

Is it possible nowadays to dump L1 keys from maybe Nvidia Shield with publicly available exploits? Or they need private TEE exploits which aren't available?

I sure if you could we would there is no publicly available exploit for it been looking into it for ages with keydive you could possibly get an L2 from an android tv type device.

To answer another question if you go to the avd you created click the three dots and wipe data you do not need to create another device each time you want to create another wvd.

[colebri]

hello

I'm trying to use keydive but when downloading and extracting, I don't find any keydive.py in in the KeyDive-main folder, there is just a keydive.js in the KeyDive-main/keydive folder. So how is it possible to call to use it?

thank you for answer, I'm not use to work with these type of script

[PSXman_uk]

hello

I'm trying to use keydive but when downloading and extracting, I don't find any keydive.py in in the KeyDive-main folder, there is just a keydive.js in the KeyDive-main/keydive folder. So how is it possible to call to use it?

thank you for answer, I'm not use to work with these type of script

create a venv python -m venv env

activate it

C:\Scripts\key\Scripts\activate or whever you have it

Then pip install keydive installs the latest version

pip install keydive --upgrade will update it when you want

When your in the environment (key) PS C:\Scripts\key\KeyDive-main>

you just type keydive -a -w

When you have frida-server loaded -a is auto so it launches bitmovin and -w creates the .wvd as well as the other 2 files

client_id.bin

private_key.pem

samsung_sm-g398fn_16.0.0_ac95c382_22589_l3.wvd

The last was from a real device but yours will be the same layout


[Attachment 80904 - Click to enlarge]

Then reset the device and you can do it all again

https://files.videohelp.com/u/33133/4464.zip there's the file it creates for you wvd etc

[colebri]

thank you so much for your quick and detailled answer, I really appreciate!

did some tries tonight and here is the return I have when I type the "keydive -a -w" command:


[Attachment 80909 - Click to enlarge]

have really no idea on how solve this issue with libwvaidl.so

thanks for your help!

[PSXman_uk]

thank you so much for your quick and detailled answer, I really appreciate!

did some tries tonight and here is the return I have when I type the "keydive -a -w" command:


[Attachment 80909 - Click to enlarge]

have really no idea on how solve this issue with libwvaidl.so

thanks for your help!

Which android version are you trying to hook easiest to use version 9 or you need a ghidra xml creating to get the correct hook

[colebri]

I'm trying to hook the version 14 of android, "UpsideDownCake"

I was not able to access to the site I want to catch the videos with the "Pie" 9.0 version

and now I'm not able to boot any knew device I create with android studio, the message "starting up" is displayed indefinitely....

[colebri]

thank you for your help! I was able to generate the files with an android 9.0 AVD

unfortunately the videos on the site I try to reach seem not to be displayable with this type of device (this is why I tried on a android 14 for which it works). The site is https://eurovisionsport.com

thank you

[Karn]

unfortunately the videos on the site I try to reach seem not to be displayable with this type of device (this is why I tried on a android 14 for which it works). The site is https://eurovisionsport.com

Getting the cdm from Android 14+ requires an additional step. The ELF Binary needs to be imported from avd and functions.xml needs to be created from it using Ghidra. The process is detailed on Keydive page.

[colebri]

thanks you for answer. After some troubles I was able to install ghidra, but there are plenty of library on the device, so do you have an idea on which are related to Widevine CDM. I didn't find the libwvaidl.so which was mentioned on the capture I posted a few days ago, but I don't know if I should try to found it, or other, or how many are necessary to complete the process.

thanks for help

Edit: I found those, should I import all of it?


[Attachment 80980 - Click to enlarge]

thanks!

[PSXman_uk]

thanks you for answer. After some troubles I was able to install ghidra, but there are plenty of library on the device, so do you have an idea on which are related to Widevine CDM. I didn't find the libwvaidl.so which was mentioned on the capture I posted a few days ago, but I don't know if I should try to found it, or other, or how many are necessary to complete the process.

thanks for help

Edit: I found those, should I import all of it?


[Attachment 80980 - Click to enlarge]

thanks!

When you run keydive it points to the library it needs you to run through Ghydra