Decrypt video using keys from Vdocipher’s license server.

[cam2211]

Here’s a step-by-step summary of what we’ve done so far and the current roadblock:

---

### Step 1: Extract DRM Metadata
1. **PSSH**: Extracted from the DASH manifest:
```xml
<cencssh>AAAAUnBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAADIiKn Zkb2NpcGhlcjpmNDZjMWM1ODUzYzM0ZjBmYWMwYmM1N2MwYjkw NGY2OEjj3JWbBg==</cencssh>
```
2. **Key IDs (KIDs)**:
- Audio: `14db0f93-302d-5939-b663-f2bd69c294f8`
- Video: `19f197b3-d495-5cda-8efd-b9667cbffce7`

---

### **Step 2: Construct License Request**
Sent a `POST` request to `https://license.vdocipher.com/auth` with:
```bash
curl -X POST "https://license.vdocipher.com/auth" \
-H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)..." \
-H "Origin: https://player.vdocipher.com" \
-H "Referer: https://player.vdocipher.com/" \
-H "Content-Type: application/json" \
-d '{"pssh": "AAAAUnBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAADIiKnZkb 2NpcGhlcjpmNDZjMWM1ODUzYzM0ZjBmYWMwYmM1N2MwYjkwNGY 2OEjj3JWbBg==", "otp": "YOUR_OTP"}'
```

---

### **Step 3: Error Received**
- **Response**: `403 Forbidden`
- **Body**: `{"code":2011,"message":"request unwrapping failed"}`
*(This means Vdocipher rejected the request due to invalid headers, token, or anti-bot measures).*

---

### **Step 4: Troubleshooting Attempts**
1. **Used Fresh OTP Tokens** (single-use, time-bound).
2. **Added Headers**: `User-Agent`, `Origin`, `Referer`.
3. **Validated JSON Payload**: Correct PSSH and token.

---

### **Current Roadblock**
- **Why the Error?**
Vdocipher likely enforces:
- Additional headers (e.g., `Sec-*`, `Accept`, `Accept-Language`).
- Token binding to IP/device.
- OTP signature/encryption (hidden in browser requests).
- Anti-automation checks (blocking non-browser tools like `curl`).

---

### **Next Steps to Try**
1. **Replicate Browser Headers**:
Copy **all headers** from the video segment request, including:
```bash
-H "Accept: */*" \
-H "Accept-Language: en-US,en;q=0.9" \
-H "Sec-Ch-Ua: ..." \
-H "Sec-Fetch-*: ..."
```

2. **Capture a Real License Request**:
Use Chrome DevTools to:
- Load the Vdocipher player.
- Filter network requests for `license.vdocipher.com/auth`.
- Copy the exact headers/payload from a **working request**.

3. **Check for Encryption**:
The license request might be encrypted/signed (observe browser behavior).

---

### **Final Summary**
**Goal**: Decrypt video using keys from Vdocipher’s license server.
**Stuck At**: License server rejects requests with `403: request unwrapping failed`.
**Need Help With**:
- Identifying missing headers or request modifications.
- Bypassing anti-bot mechanisms.
- Understanding if OTP tokens require encryption/signing.

Let me know if you need further clarification! ��