PlayReady Key

[nadya86]

A couple of months ago I found a script Playready.py for key extraction.

from pyplayready.cdm import Cdm
from pyplayready.device import Device
from pyplayready.system.pssh import PSSH

import requests

device = Device.load("C:\laragon\www_beta\wks-keys_v2_test\MTC-ATV-PlayReady-SL3000\mtc_mtc_atv_atv_sl3000.prd")
cdm = Cdm.from_device(device)
session_id = cdm.open()

pssh = PSSH(
    "AAADfHBzc2gAAAAAmgTweZhAQoarkuZb4IhflQAAA1xcAwAAAQABAFIDPABXAFIATQBIAEUAQQBEAEUAUgAgAHgAbQBsAG4AcwA9ACIAaAB0AH"
    "QAcAA6AC8ALwBzAGMAaABlAG0AYQBzAC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAEQAUgBNAC8AMgAwADAANwAvADAAMwAvAFAAbABh"
    "AHkAUgBlAGEAZAB5AEgAZQBhAGQAZQByACIAIAB2AGUAcgBzAGkAbwBuAD0AIgA0AC4AMAAuADAALgAwACIAPgA8AEQAQQBUAEEAPgA8AFAAUg"
    "BPAFQARQBDAFQASQBOAEYATwA+ADwASwBFAFkATABFAE4APgAxADYAPAAvAEsARQBZAEwARQBOAD4APABBAEwARwBJAEQAPgBBAEUAUwBDAFQA"
    "UgA8AC8AQQBMAEcASQBEAD4APAAvAFAAUgBPAFQARQBDAFQASQBOAEYATwA+ADwASwBJAEQAPgA0AFIAcABsAGIAKwBUAGIATgBFAFMAOAB0AE"
    "cAawBOAEYAVwBUAEUASABBAD0APQA8AC8ASwBJAEQAPgA8AEMASABFAEMASwBTAFUATQA+AEsATABqADMAUQB6AFEAUAAvAE4AQQA9ADwALwBD"
    "AEgARQBDAEsAUwBVAE0APgA8AEwAQQBfAFUAUgBMAD4AaAB0AHQAcABzADoALwAvAHAAcgBvAGYAZgBpAGMAaQBhAGwAcwBpAHQAZQAuAGsAZQ"
    "B5AGQAZQBsAGkAdgBlAHIAeQAuAG0AZQBkAGkAYQBzAGUAcgB2AGkAYwBlAHMALgB3AGkAbgBkAG8AdwBzAC4AbgBlAHQALwBQAGwAYQB5AFIA"
    "ZQBhAGQAeQAvADwALwBMAEEAXwBVAFIATAA+ADwAQwBVAFMAVABPAE0AQQBUAFQAUgBJAEIAVQBUAEUAUwA+ADwASQBJAFMAXwBEAFIATQBfAF"
    "YARQBSAFMASQBPAE4APgA4AC4AMQAuADIAMwAwADQALgAzADEAPAAvAEkASQBTAF8ARABSAE0AXwBWAEUAUgBTAEkATwBOAD4APAAvAEMAVQBT"
    "AFQATwBNAEEAVABUAFIASQBCAFUAVABFAFMAPgA8AC8ARABBAFQAQQA+ADwALwBXAFIATQBIAEUAQQBEAEUAUgA+AA=="
)

request = cdm.get_license_challenge(session_id, pssh.wrm_headers[0])

response = requests.post(
    url="https://test.playready.microsoft.com/service/rightsmanager.asmx?cfg=(persist:false,sl:2000)",
    headers={
        'Content-Type': 'text/xml; charset=UTF-8',
    },
    data=request,
)

cdm.parse_license(session_id, response.text)

for key in cdm.get_keys(session_id):
    print(f"{key.key_id.hex}:{key.key.hex()}")

cdm.close(session_id)

I ran the script, and it gave me the keys. 6f651ae1dbe44434bcb4690d1564c41c:88da852ae4fa2e1e3 6aeb2d5c94997b1
I thought the script was working. But when I had to extract the keys myself with this

from pyplayready.cdm import Cdm
from pyplayready.device import Device
from pyplayready.system.pssh import PSSH

import requests

device = Device.load("C:\laragon\www_beta\wks-keys_v2_test\MTC-ATV-PlayReady-SL3000\mtc_mtc_atv_atv_sl3000.prd")
cdm = Cdm.from_device(device)
session_id = cdm.open()

pssh = PSSH(
    "AAADjnBzc2gAAAAAmgTweZhAQoarkuZb4IhflQAAA25uAwAAAQABAGQDPABXAFIATQBIAEUAQQBEAE"
    "UAUgAgAHgAbQBsAG4AcwA9ACIAaAB0AHQAcAA6AC8ALwBzAGMAaABlAG0AYQBzAC4AbQBpAGMAcgBv"
    "AHMAbwBmAHQALgBjAG8AbQAvAEQAUgBNAC8AMgAwADAANwAvADAAMwAvAFAAbABhAHkAUgBlAGEAZA"
    "B5AEgAZQBhAGQAZQByACIAIAB2AGUAcgBzAGkAbwBuAD0AIgA0AC4AMAAuADAALgAwACIAPgA8AEQA"
    "QQBUAEEAPgA8AFAAUgBPAFQARQBDAFQASQBOAEYATwA+ADwASwBFAFkATABFAE4APgAxADYAPAAvAE"
    "sARQBZAEwARQBOAD4APABBAEwARwBJAEQAPgBBAEUAUwBDAFQAUgA8AC8AQQBMAEcASQBEAD4APAAv"
    "AFAAUgBPAFQARQBDAFQASQBOAEYATwA+ADwATABBAF8AVQBSAEwAPgBoAHQAdABwAHMAOgAvAC8AZA"
    "ByAG0ALQBsAHMALgBtAGUAZwBvAGcAbwAuAG4AZQB0AC8AcABsAGEAeQByAGUAYQBkAHkALwByAGkA"
    "ZwBoAHQAcwBtAGEAbgBhAGcAZQByAC4AYQBzAG0AeAA8AC8ATABBAF8AVQBSAEwAPgA8AEQAUwBfAE"
    "kARAA+AFIAcwBtAEQARgBNAHoAaABPAEUATwB2AFAAbgBoADcAeQBRAFgAZQBkAGcAPQA9ADwALwBE"
    "AFMAXwBJAEQAPgA8AEsASQBEAD4AaAByAGoAMQBGAHoAaAArAEIAVgAyAGwAbwBjAEgASABFAFkAcQ"
    "BoAHIAdwA9AD0APAAvAEsASQBEAD4APABDAEgARQBDAEsAUwBVAE0APgBFAGMAQgArADIASQAzAGoA"
    "MgBnADgAPQA8AC8AQwBIAEUAQwBLAFMAVQBNAD4APABDAFUAUwBUAE8ATQBBAFQAVABSAEkAQgBVAF"
    "QARQBTAD4APABDAE8ATgBUAEUATgBUAF8ASQBEAD4AQgBoAEQAcQBjAHcAPQA9ADwALwBDAE8ATgBU"
    "AEUATgBUAF8ASQBEAD4APAAvAEMAVQBTAFQATwBNAEEAVABUAFIASQBCAFUAVABFAFMAPgA8AC8ARA"
    "BBAFQAQQA+ADwALwBXAFIATQBIAEUAQQBEAEUAUgA+AA=="
)

request = cdm.get_license_challenge(session_id, pssh.wrm_headers[0])

response = requests.post(
    url="https://drm-ls.megogo.net/cenc/getlicense/megogo?ref=/a3a4fc6053936004fb1b0ab7d16c8bd0_mgg/vod/mpd/b/450_900_1350_1500_2000_5000/u_sid/0/o/101771891/rsid/7b7b0f59-bf40-41cd-9698-c5eb4581583c/u_uid/1546846946/u_vod/4/u_device/android_tv_4k/u_devicekey/_android_tv_drm_4k_20/u_srvc/2741/te/1760354712/u_did/MToxNTQ2ODQ2OTQ2OjE3NTk1MDY0MDI6MTAwNzI4MTUwNzo3OGYwMWZjMjE2YjZjMDU5MTRlNzhlMzVmY2VmNjU5MA==/wtrmrk/0/manifest.mpd",
    headers={
        'Content-Type': 'text/xml; charset=UTF-8',
    },
    data=request,
)

cdm.parse_license(session_id, response.text)

for key in cdm.get_keys(session_id):
    print(f"{key.key_id.hex}:{key.key.hex()}")

cdm.close(session_id)

The script gave an error.

Traceback (most recent call last):
  File "C:\laragon\www_beta\wks-keys_v2_PlayReady\PlayReady.py", line 40, in <module>
    cdm.parse_license(session_id, response.text)
  File "I:\TEMP\Y2MATE~1\PYthon37\lib\site-packages\pyplayready\cdm.py", line 287, in parse_license
    raise InvalidLicense("Cannot parse an empty licence message")
pyplayready.misc.exceptions.InvalidLicense: Cannot parse an empty licence message

$header= @{
"authority" = "drm-ls.megogo.net"
"user-agent" = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36"
"accept" = "*/*"
"origin" = "https://megogo.net"
"referer" = "https://megogo.net/"
"sec-fetch-site" = "same-site"
"sec-fetch-mode" = "cors"
"sec-fetch-dest" = "empty"
"accept-language" = "en-US,en;q=0.9"
"Content-Type" = "application/octet-stream"
}

Should I add this $header to the script? Can you tell me what's wrong?

[lfer94]

For that script to work the Content-Type value should be "text/xml; charset=UTF-8" or simply "text/xml" instead of "application/octet-stream".

[shellcmd]

obviously you cant use mpd url as license url.

[nadya86]

For that script to work the Content-Type value should be "text/xml; charset=UTF-8" or simply "text/xml" instead of "application/octet-stream".

Here I have reworked it.

from pyplayready.cdm import Cdm
from pyplayready.device import Device
from pyplayready.system.pssh import PSSH

import requests

device = Device.load("C:\laragon\www_beta\wks-keys_v2_test\MTC-ATV-PlayReady-SL3000\mtc_mtc_atv_atv_sl3000.prd")
cdm = Cdm.from_device(device)
session_id = cdm.open()

pssh = PSSH(
    "AAADjnBzc2gAAAAAmgTweZhAQoarkuZb4IhflQAAA25uAwAAAQABAGQDPABXAFIATQBIAEUAQQBEAE"
    "UAUgAgAHgAbQBsAG4AcwA9ACIAaAB0AHQAcAA6AC8ALwBzAGMAaABlAG0AYQBzAC4AbQBpAGMAcgBv"
    "AHMAbwBmAHQALgBjAG8AbQAvAEQAUgBNAC8AMgAwADAANwAvADAAMwAvAFAAbABhAHkAUgBlAGEAZA"
    "B5AEgAZQBhAGQAZQByACIAIAB2AGUAcgBzAGkAbwBuAD0AIgA0AC4AMAAuADAALgAwACIAPgA8AEQA"
    "QQBUAEEAPgA8AFAAUgBPAFQARQBDAFQASQBOAEYATwA+ADwASwBFAFkATABFAE4APgAxADYAPAAvAE"
    "sARQBZAEwARQBOAD4APABBAEwARwBJAEQAPgBBAEUAUwBDAFQAUgA8AC8AQQBMAEcASQBEAD4APAAv"
    "AFAAUgBPAFQARQBDAFQASQBOAEYATwA+ADwATABBAF8AVQBSAEwAPgBoAHQAdABwAHMAOgAvAC8AZA"
    "ByAG0ALQBsAHMALgBtAGUAZwBvAGcAbwAuAG4AZQB0AC8AcABsAGEAeQByAGUAYQBkAHkALwByAGkA"
    "ZwBoAHQAcwBtAGEAbgBhAGcAZQByAC4AYQBzAG0AeAA8AC8ATABBAF8AVQBSAEwAPgA8AEQAUwBfAE"
    "kARAA+AFIAcwBtAEQARgBNAHoAaABPAEUATwB2AFAAbgBoADcAeQBRAFgAZQBkAGcAPQA9ADwALwBE"
    "AFMAXwBJAEQAPgA8AEsASQBEAD4AaAByAGoAMQBGAHoAaAArAEIAVgAyAGwAbwBjAEgASABFAFkAcQ"
    "BoAHIAdwA9AD0APAAvAEsASQBEAD4APABDAEgARQBDAEsAUwBVAE0APgBFAGMAQgArADIASQAzAGoA"
    "MgBnADgAPQA8AC8AQwBIAEUAQwBLAFMAVQBNAD4APABDAFUAUwBUAE8ATQBBAFQAVABSAEkAQgBVAF"
    "QARQBTAD4APABDAE8ATgBUAEUATgBUAF8ASQBEAD4AQgBoAEQAcQBjAHcAPQA9ADwALwBDAE8ATgBU"
    "AEUATgBUAF8ASQBEAD4APAAvAEMAVQBTAFQATwBNAEEAVABUAFIASQBCAFUAVABFAFMAPgA8AC8ARA"
    "BBAFQAQQA+ADwALwBXAFIATQBIAEUAQQBEAEUAUgA+AA=="
)

request = cdm.get_license_challenge(session_id, pssh.wrm_headers[0])

response = requests.post(
    url="https://drm-ls.megogo.net/cenc/getlicense/megogo?ref=/a3a4fc6053936004fb1b0ab7d16c8bd0_mgg/vod/mpd/b/450_900_1350_1500_2000_5000/u_sid/0/o/101771891/rsid/7b7b0f59-bf40-41cd-9698-c5eb4581583c/u_uid/1546846946/u_vod/4/u_device/android_tv_4k/u_devicekey/_android_tv_drm_4k_20/u_srvc/2741/te/1760354712/u_did/MToxNTQ2ODQ2OTQ2OjE3NTk1MDY0MDI6MTAwNzI4MTUwNzo3OGYwMWZjMjE2YjZjMDU5MTRlNzhlMzVmY2VmNjU5MA==/wtrmrk/0/manifest.mpd=(persist:false,sl:2000)",
    headers={
        'Content-Type': 'text/xml; charset=UTF-8',
        'authority': 'drm-ls.megogo.net',
        'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36',
        'accept': '*/*',
        'origin': 'https://megogo.net',
        'referer': 'https://megogo.net/',
        'sec-fetch-site': 'same-site',
        'sec-fetch-mode': 'cors',
        'sec-fetch-dest': 'empty',
        'accept-language': 'en-US,en;q=0.9',
    },
    data=request,
)

cdm.parse_license(session_id, response.text)

for key in cdm.get_keys(session_id):
    print(f"{key.key_id.hex}:{key.key.hex()}")

cdm.close(session_id)

Still an error -
>PlayReady.py
Traceback (most recent call last):
File "C:\laragon\www_beta\wks-keys_v2_PlayReady\PlayReady.py", line 49, in <module>
cdm.parse_license(session_id, response.text)
File "I:\TEMP\Y2MATE~1\PYthon37\lib\site-packages\pyplayready\cdm.py", line 287, in parse_license
raise InvalidLicense("Cannot parse an empty licence message")
pyplayready.misc.exceptions.InvalidLicense: Cannot parse an empty licence message

obviously you cant use mpd url as license url.

This is not a link to a .mpd file, it is a license file. I have a .mpd file and it is different, from it it is possible to get the structure of video and audio track extensions.

Thanks everyone, it works! The license file was wrong!
17f5b8867e385d05a5a1c1c7118aa1af:10855281f368685dc 78f03a47b7602cd

https://drm-ls.megogo.net/playready/rightsmanager.asmx?ref=/a3a4fc6053936004fb1b0ab7d1...0/manifest.mpd

[nadya86]

Help me understand where and how the KID comes from, because in PSSH there is <KID>hrj1Fzh+BV2locHHEYqhrw==</KID> but when decoding the data there is 86b8f517387e055da5a1c1c7118aa1af but not 17f5b8867e385d05a5a1c1c7118aa1af ? Can the KID be taken from the response from the server? WE1SAAAAAAN0BIlcK6p9dPdAR8fqCnXdAAMAAQAAAXAAAwACAA AAMgABAA0AAAAKAAEAAAAzAAAACgABAAEMgAAAAwAAABTAAEAN AAAAAAoH0AACAAQAAAAoAAIANgAAACA AAAA5AAAAGNgnZnimwr5Ej4gIriVbAacAAwAJAAAAA8gABAAoA AACehrj1Fzh+BV2locHHEYqhrwABAAMAgJkGoSUdjhJ2/d0tCqwpY30mFfIb5UNFTld+pnXmb19fPrPHWC BqiGNFTidqTFfDQBUHtykY+i/vGTELD2WNIbXmT0nHQa63nVr6ZMu1hFV38bgPRmPe1BALtWdum TGFz2Z4pFPBh8HJTYwheKbHk1QUtwy9Ehn0yQQc/3S/avxdAAAAKgAAAEwAAQBABC80V9MrJxa1b8FWyDETc2VDsY6Cu8 9pJHCDyyKReeT03FaheIPHItGEm5NriQntY1yiUOnETOkR6AF2 b41eEQABAAsAAAAcAAEAEKx7qTeF8hUaE1wgdAGbWk0= , help me understand?

[nadya86]

No need anymore, I guessed it myself!