Dumping Your own L3 CDM with Android Studio

[josemmc]

Thank you for the amazing tutorial

[Brcalnik]

Thank you for the tutorial

[seasonedwok]

i've followed the most recent 2025 guide and get to the part where i dump the keys, play the drm video and the key_dump directory should appear but it doesn't. Not sure what im doing wrong, would appreciate some help on this

[cokespoke]

Thank you for the fix using keydive. For those that are struggling.

Install Android Studio.
Install the Android Studio SDK for API34
In Android Studio go to File > Settings > Language & Frameworks > Android SDK
Select Android 14 API Level 34
This should install to your %localappdata%\Android\Sdk\ folder


[Attachment 87960 - Click to enlarge]

Create a new Pixel 4 XL device


[Attachment 87961 - Click to enlarge]

Use API 34 and select Google APIs Intel x86_64 Atom System Image
Create the device


[Attachment 87962 - Click to enlarge]

On your system install Python3 (im using 3.13)
Open CMD Prompt and Install frida-tools and keydive

pip install frida frida-tools keydive

When frida & frida-tools installs; check what version it is, and download the corresponding server version
Mine was 17.2.4 so I downloaded frida-server-17.2.4-android-x86_64.xz
Extract the archive so you have the binary

Next setup ADB so it is an Environmental Path
Open System > Advanced system settings > Environmental variables...
In User or System variables; select Path and Edit..
Enter the path to your Android SDK's "platform-tools" folder


[Attachment 87963 - Click to enlarge]

Reboot for the environment variable to take effect.
Open cmd and test its working by typing 'adb --version'


[Attachment 87964 - Click to enlarge]

Next we follow the same rooting and frida-server steps
Make sure the device is powered on in Android Studio

Check adb can see the emulated device

adb devices

Then root it; push frida-server and run it

adb root
adb push frida-server-17.2.4-android-x86_64 /sdcard

adb shell
mv /sdcard/frida-server_yourversion /data/local/tmp/frida-server
chmod 755 /data/local/tmp/frida-server
/data/local/tmp/frida-server &

Now open another cmd prompt window in the folder you want to save the files
Run keydive with this command

keydive -kw -a player

Look at your device and you will see the app open on the phone and a pink icon in the bottom corner
Click the icon then "Provision Widevine"


[Attachment 87965 - Click to enlarge]

You should see it successfully connect

2025-07-26 08:24:58 [I] keydive: Version: 3.0.5
2025-07-26 08:24:58 [I] Remote: Connected to device: Android Emulator 5556 (emulator-5556)
2025-07-26 08:24:58 [I] Remote: SDK API: 34
2025-07-26 08:24:58 [I] Remote: ABI CPU: x86_64
2025-07-26 08:24:58 [I] Core: Preparing DRM player: Kaltura Device Info (com.kaltura.kalturadeviceinfo)
2025-07-26 08:25:00 [I] Core: Starting application: Kaltura Device Info (com.kaltura.kalturadeviceinfo)
2025-07-26 08:25:01 [I] Core: Watcher delay: 1.0s
2025-07-26 08:25:01 [I] Core: Detected process: 420 (android.hardware.drm-service.widevine)
2025-07-26 08:25:02 [I] Core: Library found: android.hardware.drm-service.widevine (/apex/com.google.android.widevine/bin/hw/android.hardware.drm-service.widevine)
2025-07-26 08:25:02 [I] Core: Successfully attached hook to process: 420
2025-07-26 08:25:07 [I] Cdm: Received encrypted keybox:

Then it should display your output keys


[Attachment 87966 - Click to enlarge]


The keys output path is relative to your current working directory..so whichever folder you were in when you ran keydive.
Copy them as needed

This is still working and very straightforward to follow as of 10/25/25.

The one caveat is that I saw a warning in kaltura on API34 and was not able to successfully provision Widevine. Using API32 instead worked perfectly for me.

Thank you OP!

[1v0live]

when i try:

mv /sdcard/frida-server-17.4.1-android-x86_64 /data/local/tmp/frida-server

it says:

mv: /data/local/tmp/frida-server: Text file busy

can anyone help please?

[playstorekolagi]

i try for new version it doesnot seeme working can you guide for other andriod version or device ?

[slil]

I received the following massage when I tried adb.exe root
[Attachment 89736 - Click to enlarge]