Help in getting HLS AES-128 encrypted video key

[tosay4]

The M3U8 file code is -

#EXTM3U
#EXT-X-VERSION:3
#EXT-X-TARGETDURATION:8
#EXT-X-MEDIA-SEQUENCE:0
#EXT-X-PLAYLIST-TYPE:VOD
#EXT-X-KEY:METHOD=AES-128,URI="1712904232-586072",IV=0xd0854c971130e95d3f1203c478465343
#EXTINF:8.333333,
master-1247451.1789848842-0.tsc
#EXTINF:2.333333,
master-1247451.1789848842-1.tsc
#EXTINF:8.333333,
master-1247451.1789848842-2.tsc
#EXTINF:1.566667,
master-1247451.1789848842-3.tsc
#EXT-X-ENDLIST

The m3u8 url is https://appx-transcoded-videos-mcdn.akamai.net.in/videos/temp-data/45784-1712904222/hl...789848842.m3u8

The video player can be accessed through - https://plum-maxie-29.tiiny.site/

I have tried using WidevineProxy2 browser extension it does not get any keys.
N_m3u8DL-RE-

[Attachment 85216 - Click to enlarge]

WidevineProxy2-

[Attachment 85217 - Click to enlarge]

[LZAA]

'HLS' is not working.
https://mega.nz/file/sfJTTIwQ#rxjC9mVAyrcZVu6LYjSWoFGR8z-fUtOMOpPb7Pj99NI

[2nHxWW6GkN1l916N3ayz8HQoi]

The m3u8 url is https://appx-transcoded-videos-mcdn.akamai.net.in/videos/temp-data/45784-1712904222/hl...789848842.m3u8

The video player can be accessed through - https://plum-maxie-29.tiiny.site/

Mp4 url for unencrypted content is in the html page. Network interceptor can help
https://appxcontent.kaxa.in/paid_course3/2024-04-12-0.9314872912079375.mp4

 <script id="__NEXT_DATA__" type="application/json">
            {
                "props": {
                    "pageProps": {
                        "token": "56893c0203c6b8c80bb2c92620efa32a",
                        "urls": [
                            {
                                "bitrate": "1080p",
                                "quality": "1080p",
                                "path": "https://appxcontent.kaxa.in/paid_course3/2024-04-12-0.9314872912079375.mp4",
.
.
.
                            },
                            {
.
.
.
.

[2nHxWW6GkN1l916N3ayz8HQoi]

@OP requested this video as well

https://aqua-christiane-58.tiiny.site/

[LZAA]

'404
Sorry, this content doesn't exist.'

[Jelov]

I'm facing similar issue, but unlike the one that is mentioned on this thread, the video is AES-128 encrypted
https://breezy-cyan.tiiny.site

(there are 2 demo free to watch videos both using AES-128 encryption, one can create an account using temp mail for testing)

[2nHxWW6GkN1l916N3ayz8HQoi]

Your link is messed up for some reason. The 2 videos are here
https://www.parmaracademy.in/courses/56-parmar-english-batch

I have no idea how to extract the key but here are your videos since I just skipped over their hls aes mechanism with js injection.
https://www.swisstransfer.com/d/1a98a0cd-3aba-435d-afdf-fb29a33cb5f5

It's best you wait for a kind capable user to write a script for you since that's the proper easy to use solution

[slayer36]

Your link is messed up for some reason. The 2 videos are here
https://www.parmaracademy.in/courses/56-parmar-english-batch

I have no idea how to extract the key but here are your videos since I just skipped over their hls aes mechanism with js injection.
https://www.swisstransfer.com/d/1a98a0cd-3aba-435d-afdf-fb29a33cb5f5

It's best you wait for a kind capable user to write a script for you since that's the proper easy to use solution

which streaming link you are using to get it download? the visible one is not working as it showing 8sec duration

[2nHxWW6GkN1l916N3ayz8HQoi]

which streaming link you are using to get it download?

None.

I don't know the decryption key, nor any mp4 URLs hidden in html. Uh, I don't think I made myself clear in the prev comment. By js injection I mean that I put my own code in their page, set the video to 8x-16x speed, and download their decrypted fragments one by one. I let the site do the decrypting client side since I can't understand their hls mechanism and do it myself. One video downloads in 15 min.

If it still doesn't make sense here's an example where I apply this strategy, just the code inserted and the context is different since there isn't 1 general working solution
https://forum.videohelp.com/threads/412993-how-to-download-a-video-of-higher-quality-f...x)#post2719620

Even if its' effective, it's convoluted and tedious. That's why I don't recommend it.

[slayer36]

which streaming link you are using to get it download?

None.

I don't know the decryption key, nor any mp4 URLs hidden in html. Uh, I don't think I made myself clear in the prev comment. By js injection I mean that I put my own code in their page, set the video to 8x-16x speed, and download their decrypted fragments one by one. I let the site do the decrypting client side since I can't understand their hls mechanism and do it myself. One video downloads in 15 min.

If it still doesn't make sense here's an example where I apply this strategy, just the code inserted and the context is different since there isn't 1 general working solution
https://forum.videohelp.com/threads/412993-how-to-download-a-video-of-higher-quality-f...x)#post2719620

Even if its' effective, it's convoluted and tedious. That's why I don't recommend it.

hi, i have a script.. it's downloading and decrypting, but the problem is i am not getting the audio, can you check the issue?? i am not good in python btw

[2nHxWW6GkN1l916N3ayz8HQoi]

Sure, you can post the script here or if you don't intend to publish it, private is good too.
Add use case example as well to know how to run it

[slayer36]

Sure, you can post the script here or if you don't intend to publish it, private is good too.
Add use case example as well to know how to run it

i will send privately in few minutes

[Jelov]

which streaming link you are using to get it download?

None.

I don't know the decryption key, nor any mp4 URLs hidden in html. Uh, I don't think I made myself clear in the prev comment. By js injection I mean that I put my own code in their page, set the video to 8x-16x speed, and download their decrypted fragments one by one. I let the site do the decrypting client side since I can't understand their hls mechanism and do it myself. One video downloads in 15 min.

If it still doesn't make sense here's an example where I apply this strategy, just the code inserted and the context is different since there isn't 1 general working solution
https://forum.videohelp.com/threads/412993-how-to-download-a-video-of-higher-quality-f...x)#post2719620

Even if its' effective, it's convoluted and tedious. That's why I don't recommend it.

JS wizard! thanks man for considering the request.
Regarding the m3u8 url, just look for

https://transcoded-videos-v2.classx.co.in/videos/parmaracademy-data/186695-1734629390/hls-drm-4a4610/1080p/master-5855334.521933213-0.tsc

and change it to

https://transcoded-videos-v2.classx.co.in/videos/parmaracademy-data/186695-1734629390/hls-drm-4a4610/1080p/master-5855334.521933213.m3u8

you'll have the m3u8 file containg the chunks

#EXTM3U
#EXT-X-VERSION:3
#EXT-X-TARGETDURATION:10
#EXT-X-MEDIA-SEQUENCE:0
#EXT-X-PLAYLIST-TYPE:VOD
#EXT-X-KEY:METHOD=AES-128,URI="1734630142-580710",IV=0x1476c0fc78a3d9b60bf23a4e358ef420
#EXTINF:3.958333,
master-5855334.521933213-0.tsc
#EXTINF:10.416667,
master-5855334.521933213-1.tsc
#EXTINF:10.416667,
master-5855334.521933213-2.tsc
#EXTINF:10.416667,
master-5855334.521933213-3.tsc
#EXTINF:5.458333,
master-5855334.521933213-4.tsc
#EXTINF:10.416667,
master-5855334.521933213-5.tsc
#EXTINF:10.416667,
master-5855334.521933213-6.tsc
#EXTINF:10.416667,
master-5855334.521933213-7.tsc
#EXTINF:10.416667,
master-5855334.521933213-8.tsc
#EXTINF:10.416667,
master-5855334.521933213-9.tsc
#EXTINF:10.416667,
master-5855334.521933213-10.tsc
#EXTINF:8.875000,
master-5855334.521933213-11.tsc
#EXTINF:10.416667,
master-5855334.521933213-12.tsc
#EXTINF:10.416667,
master-5855334.521933213-13.tsc
#EXTINF:10.416667,
master-5855334.521933213-14.tsc
#EXTINF:10.416667,
master-5855334.521933213-15.tsc
#EXTINF:10.416667,
master-5855334.521933213-16.tsc
#EXTINF:10.416667,
master-5855334.521933213-17.tsc
#EXTINF:10.416667,
master-5855334.521933213-18.tsc
#EXTINF:9.000000,
master-5855334.521933213-19.tsc
#EXTINF:10.416667,
master-5855334.521933213-20.tsc
...
...
#EXT-X-ENDLIST

[slayer36]

which streaming link you are using to get it download?

None.

I don't know the decryption key, nor any mp4 URLs hidden in html. Uh, I don't think I made myself clear in the prev comment. By js injection I mean that I put my own code in their page, set the video to 8x-16x speed, and download their decrypted fragments one by one. I let the site do the decrypting client side since I can't understand their hls mechanism and do it myself. One video downloads in 15 min.

If it still doesn't make sense here's an example where I apply this strategy, just the code inserted and the context is different since there isn't 1 general working solution
https://forum.videohelp.com/threads/412993-how-to-download-a-video-of-higher-quality-f...x)#post2719620

Even if its' effective, it's convoluted and tedious. That's why I don't recommend it.

JS wizard! thanks man for considering the request.
Regarding the m3u8 url, just look for

https://transcoded-videos-v2.classx.co.in/videos/parmaracademy-data/186695-1734629390/hls-drm-4a4610/1080p/master-5855334.521933213-0.tsc

and change it to

https://transcoded-videos-v2.classx.co.in/videos/parmaracademy-data/186695-1734629390/hls-drm-4a4610/1080p/master-5855334.521933213.m3u8

you'll have the m3u8 file containg the chunks

#EXTM3U
#EXT-X-VERSION:3
#EXT-X-TARGETDURATION:10
#EXT-X-MEDIA-SEQUENCE:0
#EXT-X-PLAYLIST-TYPE:VOD
#EXT-X-KEY:METHOD=AES-128,URI="1734630142-580710",IV=0x1476c0fc78a3d9b60bf23a4e358ef420
#EXTINF:3.958333,
master-5855334.521933213-0.tsc
#EXTINF:10.416667,
master-5855334.521933213-1.tsc
#EXTINF:10.416667,
master-5855334.521933213-2.tsc
#EXTINF:10.416667,
master-5855334.521933213-3.tsc
#EXTINF:5.458333,
master-5855334.521933213-4.tsc
#EXTINF:10.416667,
master-5855334.521933213-5.tsc
#EXTINF:10.416667,
master-5855334.521933213-6.tsc
#EXTINF:10.416667,
master-5855334.521933213-7.tsc
#EXTINF:10.416667,
master-5855334.521933213-8.tsc
#EXTINF:10.416667,
master-5855334.521933213-9.tsc
#EXTINF:10.416667,
master-5855334.521933213-10.tsc
#EXTINF:8.875000,
master-5855334.521933213-11.tsc
#EXTINF:10.416667,
master-5855334.521933213-12.tsc
#EXTINF:10.416667,
master-5855334.521933213-13.tsc
#EXTINF:10.416667,
master-5855334.521933213-14.tsc
#EXTINF:10.416667,
master-5855334.521933213-15.tsc
#EXTINF:10.416667,
master-5855334.521933213-16.tsc
#EXTINF:10.416667,
master-5855334.521933213-17.tsc
#EXTINF:10.416667,
master-5855334.521933213-18.tsc
#EXTINF:9.000000,
master-5855334.521933213-19.tsc
#EXTINF:10.416667,
master-5855334.521933213-20.tsc
...
...
#EXT-X-ENDLIST

nice find but still key needed to use this link

[Jelov]

nice find but still key needed to use this link

yes they are using AES-128 similar to graphy/spayee. I have sent a pm to larley since he has a repository on github regarding AES decryption.

[Heavenlive]

..

[Frieren]

Block the anti-debugger using ublock origin rule:

parmaracademy.in##+js(set, Function.prototype.constructor, function() { return function() {}; })
player.akamai.net.in##+js(set, Function.prototype.constructor, function() { return function() {}; })

Get the key and playlist directly from developer console (may have to wait very long due to errors):

var player = videojs.getPlayers()[Object.keys(videojs.getPlayers())[0]];
console.log(player.tech().hls.playlists.media_.segments);

The site is using video from akamai.net.in which is using appx.co.in and someone has already written script for such platform:

https://github.com/Santoshkurmi/hls_tts_bypass

[a__man]

Block the anti-debugger using ublock origin rule:

parmaracademy.in##+js(set, Function.prototype.constructor, function() { return function() {}; })
player.akamai.net.in##+js(set, Function.prototype.constructor, function() { return function() {}; })

Get the key and playlist directly from developer console (may have to wait very long due to errors):

var player = videojs.getPlayers()[Object.keys(videojs.getPlayers())[0]];
console.log(player.tech().hls.playlists.media_.segments);

[Attachment 85757 - Click to enlarge]

The site is using video from akamai.net.in which is using appx.co.in and someone has already written script for such platform:

https://github.com/Santoshkurmi/hls_tts_bypass

This script has been patched now. Any update regarding APPX?

[Frieza]

Block the anti-debugger using ublock origin rule:

parmaracademy.in##+js(set, Function.prototype.constructor, function() { return function() {}; })
player.akamai.net.in##+js(set, Function.prototype.constructor, function() { return function() {}; })

Get the key and playlist directly from developer console (may have to wait very long due to errors):

var player = videojs.getPlayers()[Object.keys(videojs.getPlayers())[0]];
console.log(player.tech().hls.playlists.media_.segments);

[Attachment 85757 - Click to enlarge]

The site is using video from akamai.net.in which is using appx.co.in and someone has already written script for such platform:

https://github.com/Santoshkurmi/hls_tts_bypass

The script has been patched, any updates?

[Frieren]

use debugger


[Attachment 88007 - Click to enlarge]

[Frieza]

use debugger


[Attachment 88007 - Click to enlarge]

Hi, thanks for your response, how did you find the key here exactly? The anti debugger script that you sent doesn't work for me , and if I disabled breakpoints, I will not be able to set the breakpoint at the memory address. Is there any updated version of the ublock script?

[Attachment 88020 - Click to enlarge]

Also the github repository you mentioned, required "kstr" and "jstr" values which needed to be decrypted, but for me it shows empty kstr, any clue whats going on?


[Attachment 88021 - Click to enlarge]

[Redvent]

use debugger


[Attachment 88007 - Click to enlarge]

Tried but couldn't decrypt, isn't that iv and not a key?

[premajee]

use debugger


[Attachment 88007 - Click to enlarge]

Hi, thanks for your response, how did you find the key here exactly? The anti debugger script that you sent doesn't work for me , and if I disabled breakpoints, I will not be able to set the breakpoint at the memory address. Is there any updated version of the ublock script?

[Attachment 88020 - Click to enlarge]

Also the github repository you mentioned, required "kstr" and "jstr" values which needed to be decrypted, but for me it shows empty kstr, any clue whats going on?


[Attachment 88021 - Click to enlarge]

in Readme they mention this:

Also, the URI path which is used to get key of the video by sending request is not used. Instead the jstr key is used returned in the html.

May be for some video(Not in the course i have tested), they may be use URI for key if kstr is not present in the html.

So far i have not encountered any other format, if found, then skip the first decryption process. To decrypt each segments after downloading,use this function for each type of extension for all the segments.