Dumping Your own L3 CDM with Android Studio

[imr_saleh]

For those who got Bad Mode in frida server setup, here is how I fix it,
Follow the instructions here "https://frida.re/docs/android/" and of curse you need root access

Rename "frida-server-16.4.8-android-arm" to "frida-server" and use the command line below

adb root 
adb push frida-server /data/local/tmp/
adb shell "su -c chmod 755 /data/local/tmp/frida-server"
adb shell "su -c /data/local/tmp/frida-server &"

[PSXman_uk]

For those who got Bad Mode in frida server setup, here is how I fix it,
Follow the instructions here "https://frida.re/docs/android/" and of curse you need root access

Rename "frida-server-16.4.8-android-arm" to "frida-server" and use the command line below

adb root 
adb push frida-server /data/local/tmp/
adb shell "su -c chmod 755 /data/local/tmp/frida-server"
adb shell "su -c /data/local/tmp/frida-server &"

Ill try this next time thanks i normally do 777

[crippled]

Android studio gives an error when I start a virtual deviice (the emulator process for AVD pixel 6 has terminated). Anyone willing to grab a cdm from a avd for me?

[imr_saleh]

Android studio gives an error when I start a virtual deviice (the emulator process for AVD pixel 6 has terminated). Anyone willing to grab a cdm from a avd for me?

https://forum.videohelp.com/threads/413719-Ready-to-use-CDMs-available-here%21

[crippled]

Android studio gives an error when I start a virtual deviice (the emulator process for AVD pixel 6 has terminated). Anyone willing to grab a cdm from a avd for me?

https://forum.videohelp.com/threads/413719-Ready-to-use-CDMs-available-here%21

thanks, I wrongly assumed they were revoked, some are, hellyes did the job for me.

[Sentinel89]

Can someone help me? I don't know what I'm doing wrong... what does this "magic 4D5A" error mean?

[Teredic]

@sentinel i don't know, but i think you didn't take the right frida-server file...Try the android version ?

[hesses]

The problem im having, after getting everything setup and working is apparently some out of date code.
[Attachment 82528 - Click to enlarge] anyone can help?

[ziv]

Hi
thanks for this post.
i need help...

i try do like this guide and i get this files

[Attachment 82793 - Click to enlarge]

but now, what i need to do?

thanks again and sorry if its the wrong place ..

[cherty759]

The problem im having, after getting everything setup and working is apparently some out of date code.
[Attachment 82528 - Click to enlarge] anyone can help?

You can do:

pip install --force-reinstall -v "protobuf==3.20.0"

This is just a quick workaround but works great for me

[Karoolus]

Hi
thanks for this post.
i need help...

i try do like this guide and i get this files

[Attachment 82793 - Click to enlarge]

but now, what i need to do?

thanks again and sorry if its the wrong place ..

That's it, you dumped a CDM. Now read the other stickies to figure out how to use those files to obtain keys to videos you want to download.

[fregasuelos]

Hello everyone, where can I download this WKS-KEYS program?
to get movistar

[cedric8528]

https://github.com/SASUKE-DUCK/WKS-KEY/releases/tag/WKS-KEY

If you read the sticky threads (top of the forum), you will have new tools to get keys.

[GilbertA83]

Hi to all and thanks to try to help me here.
I can't continue with this strange CMD results:

PS D:\Android\dumper-main> pip uninstall protobuf
Found existing installation: protobuf 4.25.3
Uninstalling protobuf-4.25.3:
  Would remove:
    c:\users\xxxxxxxx\appdata\roaming\python\python312\site-packages\google\_upb\_message.pyd
    c:\users\xxxxxxxx\appdata\roaming\python\python312\site-packages\google\protobuf\*
    c:\users\xxxxxxxx\appdata\roaming\python\python312\site-packages\protobuf-4.25.3.dist-info\*
Proceed (Y/n)? Y
  Successfully uninstalled protobuf-4.25.3
PS D:\Android\dumper-main> pip install protobuf==3.19
Defaulting to user installation because normal site-packages is not writeable
Collecting protobuf==3.19
  Downloading protobuf-3.19.0-py2.py3-none-any.whl.metadata (807 bytes)
Downloading protobuf-3.19.0-py2.py3-none-any.whl (162 kB)
Installing collected packages: protobuf
ERROR: pip's dependency resolver does not currently take into account all the packages that are installed. This behaviour is the source of the following dependency conflicts.
pywidevine 1.8.0 requires protobuf<5.0.0,>=4.25.1, but you have protobuf 3.19.0 which is incompatible.
Successfully installed protobuf-3.19.0
PS D:\Android\dumper-main> python dump_keys.py
Traceback (most recent call last):
  File "D:\Android\dumper-main\dump_keys.py", line 14, in <module>
    device = frida.get_usb_device()
             ^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\xxxxxxxx\AppData\Roaming\Python\Python312\site-packages\frida\__init__.py", line 137, in get_usb_device
    return get_device_manager().get_usb_device(timeout)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\xxxxxxxx\AppData\Roaming\Python\Python312\site-packages\frida\core.py", line 1229, in get_usb_device
    return self.get_device_matching(lambda d: d.type == "usb", timeout)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\xxxxxxxx\AppData\Roaming\Python\Python312\site-packages\frida\core.py", line 86, in wrapper
    return f(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^
  File "C:\Users\xxxxxxxx\AppData\Roaming\Python\Python312\site-packages\frida\core.py", line 1252, in get_device_matching
    return Device(self._impl.get_device_matching(lambda d: predicate(Device(d)), raw_timeout))
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
frida.InvalidArgumentError: device not found
PS D:\Android\dumper-main>

I have Android Studio, the Pixel 6 virtual device, Frida, dumper-main, old Protopuf, but a little problem with new pywidevine 1.8.0...

What else ?

Thanks to help me to find with these elements i've just giving to you.

[GilbertA83]

Hi to all and thanks to try to help me here.
I can't continue with this strange CMD results:

(...)
  File "C:\Users\xxxxxxxx\AppData\Roaming\Python\Python312\site-packages\frida\core.py", line 1252, in get_device_matching
    return Device(self._impl.get_device_matching(lambda d: predicate(Device(d)), raw_timeout))
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
frida.InvalidArgumentError: device not found
PS D:\Android\dumper-main>

I have Android Studio, the Pixel 6 virtual device, Frida, dumper-main, old Protopuf, but a little problem with new pywidevine 1.8.0...

What else ?

Thanks to help me to find with these elements i've just giving to you.

Now the result is correct: I have to move the directory place of dumper-main.

C:\Users\xxxxxxx\Downloads\Vid\DownloadVid\dumper-main

instead of

PS D:\Android\dumper-main

[Bluesoul]

Thank you for sharing!

[Jhony_84]

Hi, I need help. When I try to start the created device for the first time, I get this error. Can you help me? Thank you.
[Attachment 83246 - Click to enlarge]

[SpyguySC]

Can someone assist in setting this up for me? I have no coding skills whatsoever. And this looks all gibberish to me. I just need the 2 device files

[2nHxWW6GkN1l916N3ayz8HQoi]

Can someone assist in setting this up for me? I have no coding skills whatsoever. And this looks all gibberish to me. I just need the 2 device files

There's no coding involving this. You just run a bunch of commands

[catsanddownload]

Hi All hoping someone can help me.

Im trying to do this on mac with apple silicone. Im stuggling to get frida running on my demo phone. Im guessing i need the arm version of frida.

Two things im seeing is odd i cant SU

emu64a:/ $ su
/system/bin/sh: su: inaccessible or not found

Then when i try and run frida

emu64a:/ $ /data/local/tmp/frida-server-16.0.8-android-arm64
Unable to load SELinux policy from the kernel: Failed to open file ?/sys/fs/selinux/policy?: Permission denied

I get this error could be related to not being su ? Theres not metion i can see online about needing to jailbreak the android phone. Im a bit lost now.

Thanks

Extra info

My terminal is below

also im following this guide orginally https://www.ismailzai.com/blog/picking-the-widevine-locks hence old version of Frida

I did try and run x86_64 demo emulator in android studio but it doesnt start guessing i can only run arm ones on apple silcione when i tried the x86_64 emulator got this error "The emulator process for AVD Pixel_7_Pro_x86_64 has terminated."

➜ ~ adb shell
emu64a:/ $ su
/system/bin/sh: su: inaccessible or not found
127|emu64a:/ $ mv /sdcard/frida-server-16.0.8-android-arm64 /data/local/tmp
emu64a:/ $ chmod +x /data/local/tmp/frida-server-16.0.8-android-arm64
emu64a:/ $ /data/local/tmp/frida-server-16.0.8-android-arm64
Unable to load SELinux policy from the kernel: Failed to open file ?/sys/fs/selinux/policy?: Permission denied
exit
«^\Quit

131|emu64a:/ $ exit
➜ ~ adb push frida-server-16.0.8-android-arm /sdcard
frida-server-16.0.8-android-arm: 1 file pushed, 0 skipped. 61.6 MB/s (21414856 bytes in 0.331s)
➜ ~ adb shell
emu64a:/ $ su
/system/bin/sh: su: inaccessible or not found
127|emu64a:/ $ mv /sdcard/frida-server-16.0.8-android-arm /data/local/tmp
emu64a:/ $ chmod +x /data/local/tmp/frida-server-16.0.8-android-arm
emu64a:/ $ /data/local/tmp/frida-server-16.0.8-android-arm
/system/bin/sh: /data/local/tmp/frida-server-16.0.8-android-arm: not executable: 32-bit ELF file
1|emu64a:/ $

[catsanddownload]

Ok i have solved the prior post by going back to alot earlier version of android - Android 9 (Google APIs) but will leave post here to help other people !

Though the dump looks sucessful from the logs there is no .pem file, i got a bin ( or two if you count that request file ) and a json any ideas


[Attachment 84104 - Click to enlarge]

EDIT: Doing my own debug today this solves this issue for users os Mac Sonoma, simple one line to replace in the dumper script.

https://github.com/wvdumper/dumper/issues/31

[marco2178]

You don't have an Android Device or don't want to buy one to get the two magic files to decrypt your video with drm?

No problem! you can use Android Studio available for Windows, Linux and Mac.

It's totally free...You just need a computer with good processor and 12Go of ram.....
It's not impossible to run it with a little pc, but obviously, it will be more slow and you will have to take your time to launch your virtual Device and to use it.


https://developer.android.com/studio


[Attachment 68344 - Click to enlarge]

We Want to create a Virtual Android Device ....So click on "Create Device"
I have not tested with all Android Devices but the first three work fine


[Attachment 68345 - Click to enlarge]

Choose for example "Pixel 6" and click on "next"



[Attachment 68346 - Click to enlarge]

Here again I have not test all the Version of the OS but Android Pie works fine.
Download the Android Version you want for your virtual device, choose it and click on "next"



[Attachment 68347 - Click to enlarge]

Click On "Finish"



[Attachment 68348 - Click to enlarge]


Your phone is going to be created...It make takes a long time to be created and to boot...



[Attachment 68349 - Click to enlarge]


Your beautilful and free Phone is ready !


Let's play with the terminal....
Open a Command Prompt in Windows.

pip install frida

pip install frida-tools

[Attachment 68369 - Click to enlarge]


Now Go to https://github.com/frida/frida/releases

Download The Frida Server for Androïd. and put it on C:\Users\yourname\AppData\Local\Android\Sdk\platfo rm-tools

Verify that the frida-server version you download is the same that the one you have install via pip.


you can show my frida-server file on the screenshot below...

[Attachment 68350 - Click to enlarge]


put yourself in the right directory and type

adb.exe devices

We can see that our virtual device is recongnized.


[Attachment 68351 - Click to enlarge]

Put the Frida-server file we have downloaded In our virtual phone

adb.exe push frida-server-16.0.2-android-x86 /sdcard

[Attachment 68352 - Click to enlarge]

So let's communicate with our Virtual device
Put the Frida server in the good directory of our device
Give permission to execute the file
Execute frida-server!

adb.exe shell
su
mv /sdcard/frida-server_yourversion /data/local/tmp
chmod  +x /data/local/tmp/frida-server-yourversion
/data/local/tmp/frida-server-16.0.2-android-x86

[Attachment 68356 - Click to enlarge]


Keep this Terminal Open !


Now Download Dumper-main on Github

https://github.com/wvdumper/dumper

Open a new command prompt


Place yourself in the Directory (cd /....) of dumper main and launch dump_keys

Python dump_keys.py

[Attachment 68354 - Click to enlarge]


[Attachment 68355 - Click to enlarge]

Keep this Terminal Open !

We have now 2 Commands prompt open.

Go back to our phone

Open Google Chrome and go to

https://bitmovin.com/demos/drm or another site using drm.


[Attachment 68357 - Click to enlarge]

As we can see, the video on Bitmovin is launch and dumper-main do his job.

Let's have a look in dumper-main directory.

You will find a directory (private-keys) containing the 2 files


[Attachment 68358 - Click to enlarge]


you just have to rename the 2 files respectively in :
device_client_id_blob
device_private_key


If you want another couple of fresh L3 cdm, you just have to create a new device and do the same process.

Please questions and problems in this thread and not via PM...so as to help all people who comes from Google, Mars Planet or somewhere else to find what they search

Thank you to everyone on this forum who taught me so much

I was able to follow the whole tutorial and download the 2 files

client_id.bin

private_key.pem

I am trying to apply the same by playing this video tv.youtube

in the emulated android phone using android studio, but I can't manage to log into the webpage/stream.

I even tried to sideload to the android phone the yttv apk, but with no luck.

How can I handle this page/stream in the virtual android?

Thanks!

[marco2178]

Hi guys, I have a question about the dumped "device_client_id_blob and device_private_key" files .


The new created files, the CDM's client ID and private key, client_id.bin and client_id.pem respectively, are those specific to what played in https://bitmovin.com/demos/drm, or are they master files to use for decrypting other things?

I generated the files doing these step:

" launch the Google Chrome browser on the emulated Android device and navigate to a site that triggers the Widevine DRM workflow, for instance, https://bitmovin.com/demos/drm "

[october262]

Hi guys, I have a question about the dumped "device_client_id_blob and device_private_key" files .


The new created files, the CDM's client ID and private key, client_id.bin and client_id.pem respectively, are those specific to what played in https://bitmovin.com/demos/drm, or are they master files to use for decrypting other things?

I generated the files doing these step:

" launch the Google Chrome browser on the emulated Android device and navigate to a site that triggers the Widevine DRM workflow, for instance, https://bitmovin.com/demos/drm "

they can be used on other sites like tubi roku & crackle just to name a few.

[marco2178]

Hi guys, I have a question about the dumped "device_client_id_blob and device_private_key" files .


The new created files, the CDM's client ID and private key, client_id.bin and client_id.pem respectively, are those specific to what played in https://bitmovin.com/demos/drm, or are they master files to use for decrypting other things?

I generated the files doing these step:

" launch the Google Chrome browser on the emulated Android device and navigate to a site that triggers the Widevine DRM workflow, for instance, https://bitmovin.com/demos/drm "

they can be used on other sites like tubi roku & crackle just to name a few.

Ah! Thanks! I should save them then. Do they expire and I need to have to re-dump them again at some point in time?

[ErikDB]

I was able to complete the process! Encountered a few road blocks, but the comments in this thread helped me in overcoming them. Many thanks to all! ❤️

One thing I wonder though... If we all use the same script, and the obtained files work for lots of sites, which variables go into this process? It's not the Android, because we ditch the virtual machine once we have the files. I hope it's not the pc we use, because I want to use the files on another Linux box. Is it our location?

Because if none of the variables matter, wouldn't it be possible to just upload these two files somewhere, and have people download them?

I'm not advocating for this, I'm just trying to understand...

Is the idea that just having them up there for everyone to download is too 'dangerous', and would lead to faster encryption development, making the files useless? And the hope being that having people jump through these hoops makes the amount of people that have these files smaller, so the encryption industry cares less?

[Karn]

Hi guys, I have a question about the dumped "device_client_id_blob and device_private_key" files .


The new created files, the CDM's client ID and private key, client_id.bin and client_id.pem respectively, are those specific to what played in https://bitmovin.com/demos/drm, or are they master files to use for decrypting other things?

I generated the files doing these step:

" launch the Google Chrome browser on the emulated Android device and navigate to a site that triggers the Widevine DRM workflow, for instance, https://bitmovin.com/demos/drm "

they can be used on other sites like tubi roku & crackle just to name a few.

Ah! Thanks! I should save them then. Do they expire and I need to have to re-dump them again at some point in time?

No expiry. You can use and reuse them excepting rare occasion when they might get blocked/revoked. Thats rare(never happened to me, kinda rare) Then all you need to do is re-acquire the files following the same process, but on a new avd.

Also, emu cdms wont work on certain sites that require a real device cdm.

[Karn]

I was able to complete the process! Encountered a few road blocks, but the comments in this thread helped me in overcoming them. Many thanks to all! ❤️

One thing I wonder though... If we all use the same script, and the obtained files work for lots of sites, which variables go into this process? It's not the Android, because we ditch the virtual machine once we have the files. I hope it's not the pc we use, because I want to use the files on another Linux box. Is it our location?

Because if none of the variables matter, wouldn't it be possible to just upload these two files somewhere, and have people download them?

I'm not advocating for this, I'm just trying to understand...

Is the idea that just having them up there for everyone to download is too 'dangerous', and would lead to faster encryption development, making the files useless? And the hope being that having people jump through these hoops makes the amount of people that have these files smaller, so the encryption industry cares less?

If you are asking if the files are transferrable, then yes. You can give them to an acquaintence and they can use those too. However greater the number of "acquaintences" using the same cdm simultaneously, chance of it getting revoked increases slightly.

[RedPenguin]

you ruin your life:
why to choose a device with google play if you have one who dont need to root?
google play need to root device after making , or use frida gadget instead, but this is complicated solution for major part of user.
Make your life better, use simple things!

Does anybody have more info on this?

I have some old (7.1) non-rootable phones and would like to just screw around with this method even though I have adequate CDMs.

[eloxole]

[Attachment 84781 - Click to enlarge]

I'm wondering if anyone can help me with this. Getting this error early in the steps.