Trying to dump L3 CDM from Samsung Note4, Android 6

[zoran555]

So, Galaxy Note 4, rooted.
I got frida set up and working.
I forced it to use L3 instead of L1, by renaming /system/lib/liboemcrypto.so
Confirmed with DRM info and Kaltura.

Tried multiple python dumpers, no results.
They all just sit there while I play widevine content.

Different dumper:

python .\dump_keys.py --module-name libwvdrmengine.so libdrmwvmplugin.so
2026-02-04 03:28:13 PM - main - 32 - INFO - Connected to SM N910C
2026-02-04 03:28:13 PM - main - 33 - INFO - Scanning all processes
2026-02-04 03:28:15 PM - Helpers.Device - 54 - INFO - Hooking libdrmwvmplugin.so at 0xb6420000
2026-02-04 03:28:15 PM - Helpers.Device - 54 - INFO - Hooked destroy at 0xb6433285
2026-02-04 03:28:15 PM - Helpers.Device - 54 - INFO - Hooked create at 0xb6433315
2026-02-04 03:28:15 PM - Helpers.Device - 54 - INFO - Hooked gmutex at 0xb64411dc
2026-02-04 03:28:15 PM - main - 39 - INFO - Functions hooked, now open the DRM stream test on Bitmovin from your Android device! https://bitmovin.com/demos/drm

 python .\dump_keys.py --module-name libwvdrmengine.so libwvm.so libdrmwvmplugin.so
2026-02-04 02:51:47 PM - root - 16 - INFO - Connected to SM N910C
2026-02-04 02:51:47 PM - root - 17 - INFO - scanning all processes for the following libraries
2026-02-04 02:51:48 PM - root - 19 - DEBUG - Process(pid=1, name="init", parameters={})
2026-02-04 02:51:48 PM - root - 19 - DEBUG - Process(pid=1916, name="ueventd", parameters={})
2026-02-04 02:51:48 PM - root - 19 - DEBUG - Process(pid=2873, name="logd", parameters={})
2026-02-04 02:51:48 PM - root - 19 - DEBUG - Process(pid=2999, name="magisk_daemon", parameters={})
2026-02-04 02:51:48 PM - root - 19 - DEBUG - Process(pid=3004, name="logcat", parameters={})
2026-02-04 02:51:48 PM - root - 19 - DEBUG - Process(pid=3007, name="vold", parameters={})
2026-02-04 02:51:48 PM - root - 19 - DEBUG - Process(pid=3020, name="healthd", parameters={})
2026-02-04 02:51:48 PM - root - 19 - DEBUG - Process(pid=3021, name="lmkd", parameters={})
...
2026-02-04 02:51:48 PM - root - 19 - DEBUG - Process(pid=3058, name="drmserver", parameters={})
2026-02-04 02:51:49 PM - Helpers.Scanner - 82 - INFO - Running libwvdrm_L1.so at 0xb63ef000
2026-02-04 02:51:50 PM - Helpers.Scanner - 82 - INFO - Running libWVStreamControlAPI_L1.so at 0xb619e000
2026-02-04 02:51:51 PM - Helpers.Scanner - 82 - INFO - Running libdrmwvmplugin.so at 0xb6420000
2026-02-04 02:51:51 PM - root - 25 - INFO - Hooks completed

Any suggestions?

[forget]

I think it's an Android 6 issue, but I'm not sure. I also have an Android 6 device that reboots every time I start Frida, so I've given up.

Alternatively, you could try playing with the Widevine encrypted app