Decryption: The Dungeon of Despair

[moaBoBmArLeY]

But in my case (in the real world), it returns only [<Response [403]>]

print(response.text)

[PSXman_uk]

I have this error I'm trying to iron out from the script

v 4.4
#
# A_n_g_e_l_a 26:07:2023
#
'''
This program is a generic boltdns.net downloader.


'rm' is not recognized as an internal or external command,
operable program or batch file.
Invalid parameter(s)
RESET { SESSION }

Im also looking at changing the download directory from output to downloads in one directory higher than the WKS-Keys dir ive tried \downloads puts it in the rout of my hard disk im on Windows if that makes much difference

Thanks for looking and a great tutorial

[A_n_g_e_l_a]

'''
This program is a generic boltdns.net downloader.


'rm' is not recognized as an internal or external command,
operable program or batch file.
Invalid parameter(s)

I wrote those scripts in the hope that people might use them as a starting point on a journey to learn to code. It now seems I was very naive. No matter.

The line in question has a linux command which fails on Windows. I didn't realise that when the script was written and these days would write the code such that it works on both window and linux.

To answer your question 'rm' stands for remove and calling it in linux deletes files. The Windows command if I recall is 'del' so hopefully a substitution of del for rm will correct your issue. Secondly reset doesn't exist in Windows, it appears, so just delete that line - it only blanks and refreshes the terminal window. These are the last three lines of code:-

    os.system("rm -f ./output/*.m4a  ./output/*.srt ./output/*.mp4 ./output/*.ts") 
os.system("reset") # N_m3u8DL-RE sometimes leaves terminal unable to print text
exit(0)

I've updated the file for you https://files.videohelp.com/u/301890/boltgeneric.py

[PSXman_uk]

Thank you i am trying to learn but am finding it a bit hard seeing as the last time i coded was on an Amiga and at my age you lose a few grey cells thank you very much for looking at it for me I appreciate it.

[A_n_g_e_l_a]

Thank you i am trying to learn but am finding it a bit hard seeing as the last time i coded was on an Amiga and at my age you lose a few grey cells thank you very much for looking at it for me I appreciate it.

You give up too easily! I'm late 70's and first coded in BASIC on a BBC Micro. I started python two years ago. The brain is like a gymnasium; the more you exercise in it the better it is for you.

[PSXman_uk]

@A_n_g_e_l_a food for thought I'll take that on board and carry on thanks again

[Karoolus]

Thank you i am trying to learn but am finding it a bit hard seeing as the last time i coded was on an Amiga and at my age you lose a few grey cells thank you very much for looking at it for me I appreciate it.

You could always run the script from inside WSL

[Ademir]

The script still work? I'm getting this error after paste curcl as posix

Traceback (most recent call last):
File "D:\vdocypher\angel.py", line 369, in <module>
key_results = get_key(pssh, lic_url)
^^^^^^^^^^^^^^^^^^^^^^
File "D:\vdocypher\angel.py", line 188, in get_key
raise e
File "D:\vdocypher\angel.py", line 186, in get_key
license_response.raise_for_status()
File "C:\Python312\Lib\site-packages\httpx\_models.py", line 761, in raise_for_status
raise HTTPStatusError(message, request=request, response=self)
httpx.HTTPStatusError: Client error '400 Bad Request' for url 'https://license.vdocipher.com/auth'
For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/400

[A_n_g_e_l_a]

The script still work? I'm getting this error after paste curcl as posix

Traceback (most recent call last):
File "D:\vdocypher\angel.py", line 369, in <module>
key_results = get_key(pssh, lic_url)
^^^^^^^^^^^^^^^^^^^^^^
File "D:\vdocypher\angel.py", line 188, in get_key
raise e
File "D:\vdocypher\angel.py", line 186, in get_key
license_response.raise_for_status()
File "C:\Python312\Lib\site-packages\httpx\_models.py", line 761, in raise_for_status
raise HTTPStatusError(message, request=request, response=self)
httpx.HTTPStatusError: Client error '400 Bad Request' for url 'https://license.vdocipher.com/auth'
For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/400

Yes it does but recent changes to Chrome Browser means it only works for Firefox Browser. And if you keep attempting vdocipher, without getting a 200 OK response, you will get your CDM revoked.

[Ademir]

The script still work? I'm getting this error after paste curcl as posix

Traceback (most recent call last):
File "D:\vdocypher\angel.py", line 369, in <module>
key_results = get_key(pssh, lic_url)
^^^^^^^^^^^^^^^^^^^^^^
File "D:\vdocypher\angel.py", line 188, in get_key
raise e
File "D:\vdocypher\angel.py", line 186, in get_key
license_response.raise_for_status()
File "C:\Python312\Lib\site-packages\httpx\_models.py", line 761, in raise_for_status
raise HTTPStatusError(message, request=request, response=self)
httpx.HTTPStatusError: Client error '400 Bad Request' for url 'https://license.vdocipher.com/auth'
For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/400

Yes it does but recent changes to Chrome Browser means it only works for Firefox Browser. And if you keep attempting vdocipher, without getting a 200 OK response, you will get your CDM revoked.

That's a problem cause i am actually using firefox

[A_n_g_e_l_a]

You've checked with an easy site to make sure everything is installed ok?

[Ademir]

You've checked with an easy site to make sure everything is installed ok?

Yes, I tried with some easy sites and work perfectly. Maybe the script need to change some detail and I have no idea which

[A_n_g_e_l_a]

See https://forum.videohelp.com/threads/415130-Errors-Decrypting-VdoCipher-Keys#post2741590 for reply.

[JustSomeMotion]

Hello guys, just a question- I have downloaded some .mp4 video files from the Microsoft Store. Is it possible to remove the DRM from those .mp4 files from Microsoft Store? These files can only be played on the "Movies & TV" app in Windows. So is there any chance to remove DRM, or is there nothing that can be done with these specific files?

[A_n_g_e_l_a]

Hello guys, just a question- I have downloaded some .mp4 video files from the Microsoft Store. Is it possible to remove the DRM from those .mp4 files from Microsoft Store? These files can only be played on the "Movies & TV" app in Windows. So is there any chance to remove DRM, or is there nothing that can be done with these specific files?

Two things.
1. your question has nothing to do with this thread - so don't post here.
2. If ever you do post, some nebulous question about Microsoft and DRM will never get answers.
Give details - web url for the video at the very least.
Say what you've tried.
Say if you have a means of decrypting or are you begging for keys.
Have I said don't post here?

[IrishMarty]

This is so good. Can stop using CDRM project now.

Here is the grand-daddy of l3s, this L3.py gets everything.
It is a bold claim but any site that uses widevine and uses an mpd and cURL for its media delivery and encryption communications - this will download it.

[A_n_g_e_l_a]

This is so good. Can stop using CDRM project now?

Thanks and yes you should.

[arakelov2]

Hi!

Fist of all, a BIG THANKS A_n_g_e_l_a for your great guides and for all the stuff I'm discovering and learning.

Your "Noob Starter Pack" hellyes6.zip is just wonderful. Just in a week I was able to build a fresh new Ubuntu 24.04 in VirtualBox (the old 20.04 I usually work on was complaining with too old versions of Python modules and upgrading to 3.12 broke some things, so I decided to carry on a clean environment), install everything and make it work with the 'demo' sites of your guides (bitmovin.com/demos/drm and www.tg4.ie). It got the keys and downloaded the videos!

But now I moved to another site where things seem to get more difficult. With curlconverter I inspected the cURL of (what I think is) the POST call with the license request and I found that inside there are cookies = { .. }, headers = { .. }, params = { .. } and data = { .. }. And it seems that the interesting part is inside this data (I'm deleting a lot of it, it's quite long):

data = {
    'widevine2Challenge': 'CAESzwwK...***DELETED***',
    'includeHdcpTestKeyInLicense': 'true',
}

Well, looking at the copied cURL, before pasting it into curlconverter, this comes from something that says: --data-raw 'widevine2Challenge=CAESzwwK... (etc)

The thing is that when I run allhell3.py and I paste this cURL, it fails (I'm masking some parts with · not to reveal sensitive info):

Headers: {'User-Agent': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:129.0) Gecko/20100101 Firefox/129.0', 'Accept': '*/*', 'Accept-Language': 'ca,en-US;q=0.7,en;q=0.3', 'Accept-Encoding': 'gzip, deflate, br, zstd', 'Content-Type': 'application/x-www-form-urlencoded', 'Origin': 'https://www.··········.com', 'Connection': 'keep-alive', 'Referer': 'https://www.··········.com/', 'Cookie': 'session-id=261-·······-9967622; session-id-time=2082787201l; i18n-prefs=USD; lc-main-av=en_US; ubid-main-av=259-·······-1407026; session-token="FqU8rh96XJQX1/pY8OqdJjDzVP5EP·················long··············fGxNzWPeycNIXo7F/DM="; av-timezone=Europe/Madrid; x-main-av="i1F0W2HszC2eVvyiut1JC3UQUFJ@org8c5KoMAJDCjhLbZ60ah0JyAs3wHRsSwpE"; at-main-av=Atza|IwEBINF6avHNeQloJcZeNLPnzn6erraNUNJruZlvfD74········long··············xLYXn7EbZ6ELaPS6MY0MJ1G6Eaxas; sess-at-main-av="sJCmDL0GYPrXMGT···········zgeLaZgEwC2njJK0="; av-profile=cGlkPWFtem4xLmFjdG9yLnBl·························wPTE3MjY4NTA0NDM3NDcmdmVyc2lvbj12MQ.g6iVNXF_Cqf················cmF3AAAAAPgWC9WfHH8iB-olH_E9xQ', 'Sec-Fetch-Dest': 'empty', 'Sec-Fetch-Mode': 'cors', 'Sec-Fetch-Site': 'same-site', 'Pragma': 'no-cache', 'Cache-Control': 'no-cache'}
Data:
Traceback (most recent call last):
  File "/home/arakelov/Programes/HellYesGui/allhell3.py", line 430, in <module>
    key_results = get_key(pssh, lic_url)
                  ^^^^^^^^^^^^^^^^^^^^^^
  File "/home/arakelov/Programes/HellYesGui/allhell3.py", line 196, in get_key
    raise e
  File "/home/arakelov/Programes/HellYesGui/allhell3.py", line 194, in get_key
    license_response.raise_for_status()
  File "/usr/lib/python3/dist-packages/httpx/_models.py", line 759, in raise_for_status
    raise HTTPStatusError(message, request=request, response=self)
httpx.HTTPStatusError: Server error '500 Server Error' for url 'https://·········.··········.com/cdp/catalog/GetPlaybackResources?deviceID=···(long)
For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/500

Even though I'm not a Python expert I went inside allhell3.py to see what was going on around line 194 and I found that it's just after the httpx.post call. Just before the call I printed the passed parameters license_url, payload and headers. For your information, this was the result:

license_url = https://·········.··········.com/cdp/catalog/GetPlaybackResources?deviceID=···(long, as before)

payload = b'\x08\x01\x12\xee\x0e\n\xd8\r\x08···(a lot of hex stuff)

headers = {'User-Agent': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:129.0) Gecko/20100101 Firefox/129.0', 'Accept': '*/*', 'Accept-Language': 'ca,en-US;q=0.7,en;q=0.3', 'Accept-Encoding': 'gzip, deflate, br, zstd', 'Content-Type': 'application/x-www-form-urlencoded', 'Origin': 'https://www.··········.com', 'Connection': 'keep-alive', 'Referer': 'https://www.··········.com/', 'Cookie': 'session-id=261-·······-9967622; session-id-time=2082787201l; i18n-prefs=USD; lc-main-av=en_US; ubid-main-av=259-·······-1407026; session-token="FqU8rh96XJQX1/pY8OqdJjDzVP5EP·················long··············fGxNzWPeycNIXo7F/DM="; av-timezone=Europe/Madrid; x-main-av="i1F0W2HszC2eVvyiut1JC3UQUFJ@org8c5KoMAJDCjhLbZ60ah0JyAs3wHRsSwpE"; at-main-av=Atza|IwEBINF6avHNeQloJcZeNLPnzn6erraNUNJruZlvfD74········long··············xLYXn7EbZ6ELaPS6MY0MJ1G6Eaxas; sess-at-main-av="sJCmDL0GYPrXMGT···········zgeLaZgEwC2njJK0="; av-profile=cGlkPWFtem4xLmFjdG9yLnBl·························wPTE3MjY4NTA0NDM3NDcmdmVyc2lvbj12MQ.g6iVNXF_Cqf················cmF3AAAAAPgWC9WfHH8iB-olH_E9xQ', 'Sec-Fetch-Dest': 'empty', 'Sec-Fetch-Mode': 'cors', 'Sec-Fetch-Site': 'same-site', 'Pragma': 'no-cache', 'Cache-Control': 'no-cache'}

Interestingly, even though the data-raw section contains the string 'CAES', it seems not to be detected by none of the three regex searchs just above, so this piece of code

    if data:
        # deal with sites that need to return data with the challenge
        if match := re.search(r'"(CAQ=.*?)"', data):  # fix for windows
            challenge = data.replace(match.group(1), base64.b64encode(challenge).decode())
        elif match := re.search(r'"(CAES.*?)"', data):
            challenge = data.replace(match.group(1), base64.b64encode(challenge).decode())
        elif match := re.search(r'=(CAES.*?)(&.*)?$', data):
            b64challenge = base64.b64encode(challenge).decode()
            quoted = urllib.parse.quote_plus(b64challenge)
            challenge = data.replace(match.group(1), quoted)

is not executed at all. I have no idea if this is normal...
Even more, the "data" variable seems to be empty! So forget the 'CAES' search, it doesn't even enter the first if.

Then I searched where the "data" comes from and found it's built when parsing the cURL (lines 250-253). I put prints to find that

data_match = <re.Match object; span=(3143, 3155), match="--data-raw '">
raw_prefix = None
data =

Again, I have no idea if this is normal...

Any help will be greatly appreciated!
Best wishes.

[A_n_g_e_l_a]

Well, looking at the copied cURL, before pasting it into curlconverter, this comes from something that says: --data-raw 'widevine2Challenge=CAESzwwK... (etc)

The thing is that when I run allhell3.py and I paste this cURL, it fails (I'm masking some parts with · not to reveal sensitive info):

Anyone who mentions curlconverter.com when talking about allhell3 has me seriously concerned.
I assume you have arrived at the end of Dungeon of Despair having read it all. Well done; it is not an easy read.

For you and one other let me clear up the difference between l3.py and (all)hell3.py.

L3 takes for input three things

1. pssh
2. License URL
3. headers - found by importing a file called headers.py in l3.py. headers.py contains the SELECTED results of a lookup of the license URL at curlconverter.com

hell3 takes for input two things

1. mpd URL
2. License cURL (you obtain the license cURL directly from the browser)

Make sure you are using the correct attributes when calling each process. But in general use (all)hell3(gui).py has replaced l3.py

Now let me deal with the widevinechallenge - in your case it starts with 'CAES..'

The widevinechallenge is constructed data that contains the pssh and the public-key of the BROWSER's CDM, encrypted with the public-key of the license server.

It is of no use to us, for it is the BROWSER's response to get keys from the license server. We need to make our own widevinechallenge using OUR CDM to get our own keys.

So generally what is inside the widevinechallenge may be discarded. In the edited license cURL below, as an example, this particular site includes, as part of the widevine data-bundle, extra data - "releasePid":"11X9eqDq1HEc" which need returning to the license server to prove our bona-fides and confirm the video we want.

curl 'https://widevine.entitlement.eu.theplatform.com/wv/web/ModularDrm?token=eyJhbGciOiJSUzUxMiJ9.'
 -X POST -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0' -H 'Accept: */*' -H 'Accept-Language: en-GB,en;q=0.5' -H 'Accept-Encoding: gzip, deflate, br, zstd'
 -H 'Origin: https://www.rte.ie' 
-H 'DNT: 1' 
-H 'Connection: keep-alive'
 -H 'Sec-Fetch-Dest: empty' 
-H 'Sec-Fetch-Mode: cors' 
-H 'Sec-Fetch-Site: cross-site' 
-H 'Priority: u=4' 
--data-raw '{"getWidevineLicense":{"releasePid":"11X9eqDq1HEc","widevineChallenge":"CAES..."}}'

The regex will find the releasePid and discard the rest. The string starting CAES from the browser is dicarded but a new windevinechallenge is constructed using OUR CDM, and in this example the releasePid data.

You got a 500 server status code. Which means whatever you sent the server couldn't make sense of it broke the server's program,

The HTTP status code 500 is a generic error response. It means that the server encountered an unexpected condition that prevented it from fulfilling the request. This error is usually returned by the server when no other error code is suitable.

Only general help may be given if you do not provide the video url in your question. If allhell3.py is fed the correct data it will give you keys. Sometimes sites take steps to stop you presenting the correct data - timeouts and pre-shared-one-use-tokens being prime offenders.

[arakelov2]

Anyone who mentions curlconverter.com when talking about allhell3 has me seriously concerned.

Oh don't worry, I just use curlconverter.com to see more clearly the data that being sent, but I don't copy anything from there to allhell3.

I assume you have arrived at the end of Dungeon of Despair having read it all. Well done; it is not an easy read.

Yes I did (also the Temple of Doom!) but I need to do it again as there are parts that I need to understand better. I'm just a noob!
But I get the difference between l3.py and (all)hell3.py (at least regarding the input data it takes each one).

Now let me deal with the widevinechallenge - in your case it starts with 'CAES..'

The widevinechallenge is constructed data that contains the pssh and the public-key of the BROWSER's CDM, encrypted with the public-key of the license server.

It is of no use to us, for it is the BROWSER's response to get keys from the license server. We need to make our own widevinechallenge using OUR CDM to get our own keys.

So generally what is inside the widevinechallenge may be discarded. In the edited license cURL below, as an example, this particular site includes, as part of the widevine data-bundle, extra data - "releasePid":"11X9eqDq1HEc" which need returning to the license server to prove our bona-fides and confirm the video we want.

curl 'https://widevine.entitlement.eu.theplatform.com/wv/web/ModularDrm?token=eyJhbGciOiJSUzUxMiJ9.'
 -X POST -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0' -H 'Accept: */*' -H 'Accept-Language: en-GB,en;q=0.5' -H 'Accept-Encoding: gzip, deflate, br, zstd'
 -H 'Origin: https://www.rte.ie' 
-H 'DNT: 1' 
-H 'Connection: keep-alive'
 -H 'Sec-Fetch-Dest: empty' 
-H 'Sec-Fetch-Mode: cors' 
-H 'Sec-Fetch-Site: cross-site' 
-H 'Priority: u=4' 
--data-raw '{"getWidevineLicense":{"releasePid":"11X9eqDq1HEc","widevineChallenge":"CAES..."}}'

The regex will find the releasePid and discard the rest. The string starting CAES from the browser is dicarded but a new windevinechallenge is constructed using OUR CDM, and in this example the releasePid data.

Thanks a lot for clarifying all this! It was a big help for understanding all the process.

You got a 500 server status code. Which means whatever you sent the server couldn't make sense of it broke the server's program,

I discovered something: pasting the same mpd URL + License cURL to allhell3.py and allhell3gui.py produced different errors: the first, as I said, returned a 500 server error, while the GUI version said

"Could not parse license_message as SignedMessage, Error parsing message".

So I debugged it and I found that, in allhell3.py, if the variable curl_command is longer than 4096 bytes, it gets truncated (mine is 5706 bytes long!). So the server is receiving something trimmed and (I think) it causes the 500 error. On the other hand, the GUI version captures correctly all the 5706 bytes of the cURL. Look at the difference:

allhell3.py:

data_match = <re.Match object; span=(3143, 3155), match="--data-raw '">
raw_prefix = None
data =

allhell3gui.py:

data_match = <re.Match object; span=(3143, 5706), match="--data-raw 'widevine2Challenge=CAESzwwKvAsIARKeCg>
raw_prefix = '
data = widevine2Challenge=CAESzwwK... blah blah blah ...2B8jF%2F&includeHdcpTestKeyInLicense=true

To understand better the cause of the "Could not parse license_message as SignedMessage" error, I put a print(license_response.content) and I found these details:

b'{"errorsByResource":{"Widevine2License":{"downstreamReason":"untrusted_device","errorCode":"PRS.Dependency.DRM.Widevine.UnsupportedCdmVersion","message":"Cannot complete request.","type":"PRSWidevine2LicenseDeniedException"}},"returnedTitleRendition":{"asin":"·····.dv.gti.4ebbc57a-ac58-0a2c-·············ad","assetBundleVideoQuality":"HD","audioQuality":"Stereo","contentId":"·····.dv.vcid.175e6567-498f-46a6-···············7979","pid":"com.······.playback.object.vod.42FC0E05-C2D2-43CE-8E3E-20C0B8C21156","selectedEntitlement":{"benefit":"PRIME","consumptionExpiration":"1727135750531","entitlementType":"PRIME_SUBSCRIPTION","grantedByCustomerId":"A2··········5S"},"titleId":"·····.dv.gti.4ebbc57a-ac58-0a2c-····-f6ac6eb4c3ad","videoMaterialType":"Feature","videoQuality":"HD","videoResolution":"1080p"}}\n'

(some parts masked with ···)

Or, testing with another combination of mpd URL + License cURL,

b'{"errorsByResource":{"Widevine2License":{"message":"Cannot complete request.","type":"PRSWidevine2LicenseDeniedException"}},"returnedTitleRendition":{"asin":"·····.dv.gti.4ebbc57a-ac58-············-f6ac6eb4c3ad","assetBundleVideoQuality":"HD","audioQuality":"Stereo","contentId":"·····.dv.vcid.175e6567-498f-·····-df5e49797979","pid":"com.······.playback.object.vod.42FC0E05-·········-8E3E-20C0······6","selectedEntitlement":{"benefit":"PRIME","consumptionExpiration":"1727135876142","entitlementType":"PRIME_SUBSCRIPTION","grantedByCustomerId":"A2·············5S"},"titleId":"·····.dv.gti.4ebbc57a-ac58-········-f6ac6eb4c3ad","videoMaterialType":"Feature","videoQuality":"HD","videoResolution":"1080p"}}\n'

(some parts masked with ···)

Only general help may be given if you do not provide the video url in your question.

I think I can't because it's a paid site (surely you guess it even with the masking). Your general help will be enough and it's really appreciated.

Best regards.