Dumping Your own L3 CDM with Android Studio

[Karn]

[Attachment 80186 - Click to enlarge]

Everything is setup nicely but the ... Dumper dosent work when i navigate to the drm site given https://bitmovin.com/demos/drm

u can see that in the terminal !! why is it so ?? did i do anything wrong to setup ??

Use keydive. The entire process from root avd onwards gets automated and is a lot easier and gets completed in a few steps.

Note: Make sure the frida you download & push and the frida you install via pip are the same version. Newbies make this mistake too often(I did too ).

I think the avd architecture and frida needs to be the same. I created an 86_64 arch(google api) and downloaded the same frida version. Check yours. Do NOT select google play under any circumstance, or any other.

Thanks for the Reply:
My frida version is 16.3.3
[Attachment 80194 - Click to enlarge]



[Attachment 80195 - Click to enlarge]

As far as i know its x86 version of Frida server that i need to download right ??
[Attachment 80196 - Click to enlarge] this is the one i downloaded
Still the case remains the same ... on playing the drm video my dumper terminal has no response !!

So do i nee to implement the x86_64 arch ??

Also i dont have a clue about keydive can u suggest a sticky thread / forum thread using keydive for CDM

You installed v16.3.3 but you pushed frida 16.3.1


[Attachment 80212 - Click to enlarge]

uninstall that and run pip install frida~=16.3.3

For keydive, foxrefire has a an easy to follow tutorial https://github.com/FoxRefire/wvg/wiki/How-to-dump-CDM-key-pair-from-AVD

Create an avd. Do not select google play or aosp. Only Google api

Download frida latest. Rename the extracted file to just "frida-server"

Download keydive. Extract it.

Install requirements if nor already installed. Run pip

pip install frida~=16.3.3
pip install pathlib~=1.0.1
pip install coloredlogs~=15.0.1
pip install pycryptodomex~=3.20.0
pip install xmltodict~=0.13.0
pip install PyYAML~=6.0.1
pip install Flask~=3.0.3
pip install pywidevine~=1.8.0

Run your new avd


Put frida server in the same folder as keydive. Launch a new terminal from within that folder and run these commands:

adb root
adb push frida-server /data/local/tmp
adb shell "chmod +x /data/local/tmp/frida-server"
adb shell "/data/local/tmp/frida-server -D &"
python keydive.py -aw

Your avd should automatically fire a drm demo site within it while the code is running.

Once the extraction is complete, in that same folder where you opened the terminal to run the commands, there would be a folder created - "device". Inside you will find three files:

private_key.pem
client_id.bin
google_xxxx_xxxxx_xx_xxxx_l3.wvd

Rename these to

device_private_key
device_client_id_blob
device.wvd

[Shadee]

[Attachment 80186 - Click to enlarge]

Everything is setup nicely but the ... Dumper dosent work when i navigate to the drm site given https://bitmovin.com/demos/drm

u can see that in the terminal !! why is it so ?? did i do anything wrong to setup ??

Use keydive. The entire process from root avd onwards gets automated and is a lot easier and gets completed in a few steps.

Note: Make sure the frida you download & push and the frida you install via pip are the same version. Newbies make this mistake too often(I did too ).

I think the avd architecture and frida needs to be the same. I created an 86_64 arch(google api) and downloaded the same frida version. Check yours. Do NOT select google play under any circumstance, or any other.

Thanks for the Reply:
My frida version is 16.3.3
[Attachment 80194 - Click to enlarge]



[Attachment 80195 - Click to enlarge]

As far as i know its x86 version of Frida server that i need to download right ??
[Attachment 80196 - Click to enlarge] this is the one i downloaded
Still the case remains the same ... on playing the drm video my dumper terminal has no response !!

So do i nee to implement the x86_64 arch ??

Also i dont have a clue about keydive can u suggest a sticky thread / forum thread using keydive for CDM

You installed v16.3.3 but you pushed frida 16.3.1


[Attachment 80212 - Click to enlarge]

uninstall that and run pip install frida~=16.3.3

For keydive, foxrefire has a an easy to follow tutorial https://github.com/FoxRefire/wvg/wiki/How-to-dump-CDM-key-pair-from-AVD

Create an avd. Do not select google play or aosp. Only Google api

Download frida latest. Rename the extracted file to just "frida-server"

Download keydive. Extract it.

Install requirements if nor already installed. Run pip

pip install frida~=16.3.3
pip install pathlib~=1.0.1
pip install coloredlogs~=15.0.1
pip install pycryptodomex~=3.20.0
pip install xmltodict~=0.13.0
pip install PyYAML~=6.0.1
pip install Flask~=3.0.3
pip install pywidevine~=1.8.0

Run your new avd


Put frida server in the same folder as keydive. Launch a new terminal from within that folder and run these commands:

adb root
adb push frida-server /data/local/tmp
adb shell "chmod +x /data/local/tmp/frida-server"
adb shell "/data/local/tmp/frida-server -D &"
python keydive.py -aw

Your avd should automatically fire a drm demo site within it while the code is running.

Once the extraction is complete, in that same folder where you opened the terminal to run the commands, there would be a folder created - "device". Inside you will find three files:

private_key.pem
client_id.bin
google_xxxx_xxxxx_xx_xxxx_l3.wvd

Rename these to

device_private_key
device_client_id_blob
device.wvd

Thanks for the Explanation with the keydive but currently i am trying to work with the as described in the guide ...
I corrected the Frida Version 16.3.3 and then ran the virtual android ... all work good but when i open a drm site given to test in explanation ... the dumper dosent work the same way the issue remains the same ! lemme show u...
[Attachment 80215 - Click to enlarge]
[Attachment 80216 - Click to enlarge]
[Attachment 80217 - Click to enlarge]

Niether can i find a private_key folder in Dumper...
[Attachment 80219 - Click to enlarge]

Any one with fixes on waht the issue is and how to make it to the other side ??

[polkzhyzia]

I'm already running as root

[Attachment 79989 - Click to enlarge]

[Attachment 79990 - Click to enlarge]

I can see that, but that's an error from dump_keys.py, not from KeyDive. I'll say it for the third and last time: try to dump the CDM with KeyDive and see what happens.

i have this error.

[Attachment 80220 - Click to enlarge]

[white_snake]

i have this error.

[Attachment 80220 - Click to enlarge]

Try without the -aw switch.

[polkzhyzia]

i have this error.

[Attachment 80220 - Click to enlarge]

Try without the -aw switch.

same error .

[Attachment 80232 - Click to enlarge]

[Blacksiren]

same error .

[Attachment 80232 - Click to enlarge]

Make sure you have adb.exe in the same folder as the KeyDive script you are running or put the platform-tools folder into your PATH.

[Shadee]

[Attachment 80186 - Click to enlarge]

Everything is setup nicely but the ... Dumper dosent work when i navigate to the drm site given https://bitmovin.com/demos/drm

u can see that in the terminal !! why is it so ?? did i do anything wrong to setup ??

Use keydive. The entire process from root avd onwards gets automated and is a lot easier and gets completed in a few steps.

Note: Make sure the frida you download & push and the frida you install via pip are the same version. Newbies make this mistake too often(I did too ).

I think the avd architecture and frida needs to be the same. I created an 86_64 arch(google api) and downloaded the same frida version. Check yours. Do NOT select google play under any circumstance, or any other.

Thanks for the Reply:
My frida version is 16.3.3
[Attachment 80194 - Click to enlarge]



[Attachment 80195 - Click to enlarge]

As far as i know its x86 version of Frida server that i need to download right ??
[Attachment 80196 - Click to enlarge] this is the one i downloaded
Still the case remains the same ... on playing the drm video my dumper terminal has no response !!

So do i nee to implement the x86_64 arch ??

Also i dont have a clue about keydive can u suggest a sticky thread / forum thread using keydive for CDM

You installed v16.3.3 but you pushed frida 16.3.1


[Attachment 80212 - Click to enlarge]

uninstall that and run pip install frida~=16.3.3

For keydive, foxrefire has a an easy to follow tutorial https://github.com/FoxRefire/wvg/wiki/How-to-dump-CDM-key-pair-from-AVD

Create an avd. Do not select google play or aosp. Only Google api

Download frida latest. Rename the extracted file to just "frida-server"

Download keydive. Extract it.

Install requirements if nor already installed. Run pip

pip install frida~=16.3.3
pip install pathlib~=1.0.1
pip install coloredlogs~=15.0.1
pip install pycryptodomex~=3.20.0
pip install xmltodict~=0.13.0
pip install PyYAML~=6.0.1
pip install Flask~=3.0.3
pip install pywidevine~=1.8.0

Run your new avd


Put frida server in the same folder as keydive. Launch a new terminal from within that folder and run these commands:

adb root
adb push frida-server /data/local/tmp
adb shell "chmod +x /data/local/tmp/frida-server"
adb shell "/data/local/tmp/frida-server -D &"
python keydive.py -aw

Your avd should automatically fire a drm demo site within it while the code is running.

Once the extraction is complete, in that same folder where you opened the terminal to run the commands, there would be a folder created - "device". Inside you will find three files:

private_key.pem
client_id.bin
google_xxxx_xxxxx_xx_xxxx_l3.wvd

Rename these to

device_private_key
device_client_id_blob
device.wvd

Thanks for the Explanation with the keydive but currently i am trying to work with the as described in the guide ...
I corrected the Frida Version 16.3.3 and then ran the virtual android ... all work good but when i open a drm site given to test in explanation ... the dumper dosent work the same way the issue remains the same ! lemme show u...
[Attachment 80215 - Click to enlarge]
[Attachment 80216 - Click to enlarge]
[Attachment 80217 - Click to enlarge]

Niether can i find a private_key folder in Dumper...
[Attachment 80219 - Click to enlarge]

Any one with fixes on waht the issue is and how to make it to the other side ??

Anyone with some help ... on what's wrong here on using frida ?? OR i have to use keydive only ?? please if anyone can help

[Blacksiren]

Anyone with some help ... on what's wrong here on using frida ?? OR i have to use keydive only ?? please if anyone can help

As you can see on the bitmovin page, it says "Detected Chrome using NO DRM", that should say Widevine.. try deleting this AVD and creating old one from scratch.

Also, as stated before, make sure to triple check that you are using the correct version, use KeyDive for the dumping process with -aw switch, that way the bitmovin page will open by itself and you will end up with WVD file that you can use later.

[Shadee]

Anyone with some help ... on what's wrong here on using frida ?? OR i have to use keydive only ?? please if anyone can help

As you can see on the bitmovin page, it says "Detected Chrome using NO DRM", that should say Widevine.. try deleting this AVD and creating old one from scratch.

Also, as stated before, make sure to triple check that you are using the correct version, use KeyDive for the dumping process with -aw switch, that way the bitmovin page will open by itself and you will end up with WVD file that you can use later.

So i should create a new Virtual Android ?? maybe Pixel 6 the rooted one !! right ??

ya i am using the current version its just that i am not using keydive ... wanna make sure the tutorial thing works fine first then i can try other things

Thanks for the Reply

[Blacksiren]

So i should create a new Virtual Android ?? maybe Pixel 6 the rooted one !! right ??

ya i am using the current version its just that i am not using keydive ... wanna make sure the tutorial thing works fine first then i can try other things

Thanks for the Reply

Yeah, I'm more than sure that there is a proper fix to make the bitmovin page show the correct thing but creating new AVD will be far easier.
Just follow the sticky thread post #1 and follow the same steps in those screenshots, same version everything, check if you have correct API and so on.

I recommend using KeyDive, so definitely use that one.

So either use the tutorial in this post #1 or as already stated above use FoxRefire's guide.

[Shadee]

So i should create a new Virtual Android ?? maybe Pixel 6 the rooted one !! right ??

ya i am using the current version its just that i am not using keydive ... wanna make sure the tutorial thing works fine first then i can try other things

Thanks for the Reply

Yeah, I'm more than sure that there is a proper fix to make the bitmovin page show the correct thing but creating new AVD will be far easier.
Just follow the sticky thread post #1 and follow the same steps in those screenshots, same version everything, check if you have correct API and so on.

I recommend using KeyDive, so definitely use that one.

It worked how dumb can i be to not give chrome permissions and then cry about it not working !! LOl
Thanks for the help to everyone that replied ...

[Attachment 80235 - Click to enlarge]

Trying with keydive next Its fun learning here

[Blacksiren]

It worked how dumb can i be to not give chrome permissions and then cry about it not working !! LOl
Thanks for the help to everyone that replied ...

Yeah, forgot to tell you to check permissions, I'm glad you were able to figure it out, congrats.

[polkzhyzia]

same error .

[Attachment 80232 - Click to enlarge]

Make sure you have adb.exe in the same folder as the KeyDive script you are running or put the platform-tools folder into your PATH.

i already run it in root, but i have this error

[Attachment 80241 - Click to enlarge]

[Blacksiren]

same error .

[Attachment 80232 - Click to enlarge]

Make sure you have adb.exe in the same folder as the KeyDive script you are running or put the platform-tools folder into your PATH.

i already run it in root, but i have this error

[Attachment 80241 - Click to enlarge]

Are you sure that you run Frida as root? Also, try what it says "sudo sysctl kernel.yama.ptrace_scope=0" -- you have to run it in adb shell ofcourse.. Alternatively try rebooting the AVD first and run Frida and Keydive again.

[Shadee]

[Attachment 80186 - Click to enlarge]

Everything is setup nicely but the ... Dumper dosent work when i navigate to the drm site given https://bitmovin.com/demos/drm

u can see that in the terminal !! why is it so ?? did i do anything wrong to setup ??

Use keydive. The entire process from root avd onwards gets automated and is a lot easier and gets completed in a few steps.

Note: Make sure the frida you download & push and the frida you install via pip are the same version. Newbies make this mistake too often(I did too ).

I think the avd architecture and frida needs to be the same. I created an 86_64 arch(google api) and downloaded the same frida version. Check yours. Do NOT select google play under any circumstance, or any other.

Thanks for the Reply:
My frida version is 16.3.3
[Attachment 80194 - Click to enlarge]



[Attachment 80195 - Click to enlarge]

As far as i know its x86 version of Frida server that i need to download right ??
[Attachment 80196 - Click to enlarge] this is the one i downloaded
Still the case remains the same ... on playing the drm video my dumper terminal has no response !!

So do i nee to implement the x86_64 arch ??

Also i dont have a clue about keydive can u suggest a sticky thread / forum thread using keydive for CDM

You installed v16.3.3 but you pushed frida 16.3.1


[Attachment 80212 - Click to enlarge]

uninstall that and run pip install frida~=16.3.3

For keydive, foxrefire has a an easy to follow tutorial https://github.com/FoxRefire/wvg/wiki/How-to-dump-CDM-key-pair-from-AVD

Create an avd. Do not select google play or aosp. Only Google api

Download frida latest. Rename the extracted file to just "frida-server"

Download keydive. Extract it.

Install requirements if nor already installed. Run pip

pip install frida~=16.3.3
pip install pathlib~=1.0.1
pip install coloredlogs~=15.0.1
pip install pycryptodomex~=3.20.0
pip install xmltodict~=0.13.0
pip install PyYAML~=6.0.1
pip install Flask~=3.0.3
pip install pywidevine~=1.8.0

Run your new avd


Put frida server in the same folder as keydive. Launch a new terminal from within that folder and run these commands:

adb root
adb push frida-server /data/local/tmp
adb shell "chmod +x /data/local/tmp/frida-server"
adb shell "/data/local/tmp/frida-server -D &"
python keydive.py -aw

Your avd should automatically fire a drm demo site within it while the code is running.

Once the extraction is complete, in that same folder where you opened the terminal to run the commands, there would be a folder created - "device". Inside you will find three files:

private_key.pem
client_id.bin
google_xxxx_xxxxx_xx_xxxx_l3.wvd

Rename these to

device_private_key
device_client_id_blob
device.wvd

Thanks for the Tutorial ... passed it in the first go !!!!
[Attachment 80304 - Click to enlarge]

[Karn]

Thanks for the Tutorial ... passed it in the first go !!!!
[Attachment 80304 - Click to enlarge]

Glad you were able to get it working. Keydive is way simpler and lot easier. Thats why everyone suggests it on priority. You could dump a couple more if youd like to get used to it. Just create new avds on SDK33 & below.

[Shadee]

Thanks for the Tutorial ... passed it in the first go !!!!
[Attachment 80304 - Click to enlarge]

Glad you were able to get it working. Keydive is way simpler and lot easier. Thats why everyone suggests it on priority. You could dump a couple more if youd like to get used to it. Just create new avds on SDK33 & below.

with keydive we get a .wvd file extra which we dont get using frida ... or do we get it there too .. if not then how can we retrieve the same with frida ??

Also now as i have my own CDM can i proceed to the Decryption section of the Decryption and the Temple of doom thread by angela or is there anything left for me to do ??

I totally don't need to use magisk and work with it on virtual studio right as it is to root physical devices or do i need to ??

I mean just want to know the next steps ... i followed the angelas thread and landed here as it said have your own cdm first if u wanna continue

Would be very helpful if u or anyone else can guide me here !!! for the next steps thanks

[Karn]

with keydive we get a .wvd file extra which we dont get using frida ... or do we get it there too .. if not then how can we retrieve the same with frida ??

You have the cdm, thats basic to decrypt files.

You need other data to go alongwith that to get the keys. Temple of Doom details that information. ToD also details how to dump cdm from an actual physical device which is needed when certain platforms identify and reject your sdk cdm. This is where magisk comes into the picture during the dumping process.

The xxxxx.wvd is a decryption module. You can keep it or only use the blob and key files.

[Shadee]

with keydive we get a .wvd file extra which we dont get using frida ... or do we get it there too .. if not then how can we retrieve the same with frida ??

You have the cdm, thats basic to decrypt files.

You need other data to go alongwith that to get the keys. Temple of Doom details that information. ToD also details how to dump cdm from an actual physical device which is needed when certain platforms identify and reject your sdk cdm. This is where magisk comes into the picture during the dumping process.

The xxxxx.wvd is a decryption module. You can keep it or only use the blob and key files.

ooh thanks for these additional information ... So for now the Sdk CDM works until u encounter a case where its rejected by certain platforms ... thats the case then where i need to put in a physical device ... root process GOT IT !!

And ya i have the xxxx.wvd ... i will try to work with it but my question is it isn't generated when we try the frida method using Dumping ur L3 CDM process explained right ?? also angela described how to use the .wvd file to decrypt ... u said u can use the other 2 key files to do the same can u throw some light as to how to ... use the other 2 files to do the same ??

If my doubts are a bit annoying i am sorry for that .... any additional information would help me anyways thanks for the reply as always