Dumping Your own L3 CDM with Android Studio

[josemmc]

Thank you for the amazing tutorial

[Brcalnik]

Thank you for the tutorial

[seasonedwok]

i've followed the most recent 2025 guide and get to the part where i dump the keys, play the drm video and the key_dump directory should appear but it doesn't. Not sure what im doing wrong, would appreciate some help on this

[cokespoke]

Thank you for the fix using keydive. For those that are struggling.

Install Android Studio.
Install the Android Studio SDK for API34
In Android Studio go to File > Settings > Language & Frameworks > Android SDK
Select Android 14 API Level 34
This should install to your %localappdata%\Android\Sdk\ folder


[Attachment 87960 - Click to enlarge]

Create a new Pixel 4 XL device


[Attachment 87961 - Click to enlarge]

Use API 34 and select Google APIs Intel x86_64 Atom System Image
Create the device


[Attachment 87962 - Click to enlarge]

On your system install Python3 (im using 3.13)
Open CMD Prompt and Install frida-tools and keydive

pip install frida frida-tools keydive

When frida & frida-tools installs; check what version it is, and download the corresponding server version
Mine was 17.2.4 so I downloaded frida-server-17.2.4-android-x86_64.xz
Extract the archive so you have the binary

Next setup ADB so it is an Environmental Path
Open System > Advanced system settings > Environmental variables...
In User or System variables; select Path and Edit..
Enter the path to your Android SDK's "platform-tools" folder


[Attachment 87963 - Click to enlarge]

Reboot for the environment variable to take effect.
Open cmd and test its working by typing 'adb --version'


[Attachment 87964 - Click to enlarge]

Next we follow the same rooting and frida-server steps
Make sure the device is powered on in Android Studio

Check adb can see the emulated device

adb devices

Then root it; push frida-server and run it

adb root
adb push frida-server-17.2.4-android-x86_64 /sdcard

adb shell
mv /sdcard/frida-server_yourversion /data/local/tmp/frida-server
chmod 755 /data/local/tmp/frida-server
/data/local/tmp/frida-server &

Now open another cmd prompt window in the folder you want to save the files
Run keydive with this command

keydive -kw -a player

Look at your device and you will see the app open on the phone and a pink icon in the bottom corner
Click the icon then "Provision Widevine"


[Attachment 87965 - Click to enlarge]

You should see it successfully connect

2025-07-26 08:24:58 [I] keydive: Version: 3.0.5
2025-07-26 08:24:58 [I] Remote: Connected to device: Android Emulator 5556 (emulator-5556)
2025-07-26 08:24:58 [I] Remote: SDK API: 34
2025-07-26 08:24:58 [I] Remote: ABI CPU: x86_64
2025-07-26 08:24:58 [I] Core: Preparing DRM player: Kaltura Device Info (com.kaltura.kalturadeviceinfo)
2025-07-26 08:25:00 [I] Core: Starting application: Kaltura Device Info (com.kaltura.kalturadeviceinfo)
2025-07-26 08:25:01 [I] Core: Watcher delay: 1.0s
2025-07-26 08:25:01 [I] Core: Detected process: 420 (android.hardware.drm-service.widevine)
2025-07-26 08:25:02 [I] Core: Library found: android.hardware.drm-service.widevine (/apex/com.google.android.widevine/bin/hw/android.hardware.drm-service.widevine)
2025-07-26 08:25:02 [I] Core: Successfully attached hook to process: 420
2025-07-26 08:25:07 [I] Cdm: Received encrypted keybox:

Then it should display your output keys


[Attachment 87966 - Click to enlarge]


The keys output path is relative to your current working directory..so whichever folder you were in when you ran keydive.
Copy them as needed

This is still working and very straightforward to follow as of 10/25/25.

The one caveat is that I saw a warning in kaltura on API34 and was not able to successfully provision Widevine. Using API32 instead worked perfectly for me.

Thank you OP!

[1v0live]

when i try:

mv /sdcard/frida-server-17.4.1-android-x86_64 /data/local/tmp/frida-server

it says:

mv: /data/local/tmp/frida-server: Text file busy

can anyone help please?

[playstorekolagi]

i try for new version it doesnot seeme working can you guide for other andriod version or device ?

[slil]

I received the following massage when I tried adb.exe root

[gnondpom]

keydive: Frida server is not running on the device.
i don't know what i did wrong

adb.exe root

adb push frida-server /sdcard

adb shell
mv /sdcard/frida-server /data/local/tmp/frida-server
chmod 755 /data/local/tmp/frida-server
/data/local/tmp/frida-server &


C:\Users\Admin>keydive -kw -a player
2025-11-26 17:11:02 [I] keydive: Version: 3.0.5
2025-11-26 17:11:03 [I] Remote: Connected to device: Android Emulator 5554 (emulator-5554)
2025-11-26 17:11:04 [I] Remote: SDK API: 34
2025-11-26 17:11:04 [I] Remote: ABI CPU: x86_64
2025-11-26 17:11:04 [I] Core: Preparing DRM player: Kaltura Device Info (com.kaltura.kalturadeviceinfo)
2025-11-26 17:11:06 [I] Core: Starting application: Kaltura Device Info (com.kaltura.kalturadeviceinfo)
2025-11-26 17:11:08 [I] Core: Watcher delay: 1.0s
2025-11-26 17:11:10 [I] Core: Detected process: 385 (android.hardware.drm-service.widevine)
2025-11-26 17:11:10 [C] keydive: Frida server is not running on the device.
2025-11-26 17:11:10 [I] keydive: Exiting

[fulmanful]

help pleace.... and thanks




[Attachment 89973 - Click to enlarge]

[otters]

every time I try the

python3 dump_keys.py

I get this error message:

frida.ServerNotRunningError: unable to connect to remote frida-server: closed

I've made sure to install the right frida server and it should be running - everything up until this point is smooth sailing. Is there anyway to fix this?

[kalehrl]

Follow this guide:
https://forum.videohelp.com/threads/408031-Dumping-Your-own-L3-CDM-with-Android-Studio...26#post2766668

[joaobravo88]

every time I try the

python3 dump_keys.py

I get this error message:

frida.ServerNotRunningError: unable to connect to remote frida-server: closed

I've made sure to install the right frida server and it should be running - everything up until this point is smooth sailing. Is there anyway to fix this?

Same issue here. Anybody can help?

[nguer038]

Thank you for the fix using keydive. For those that are struggling.

Install Android Studio.
Install the Android Studio SDK for API34
In Android Studio go to File > Settings > Language & Frameworks > Android SDK
Select Android 14 API Level 34
This should install to your %localappdata%\Android\Sdk\ folder


[Attachment 87960 - Click to enlarge]

Create a new Pixel 4 XL device


[Attachment 87961 - Click to enlarge]

Use API 34 and select Google APIs Intel x86_64 Atom System Image
Create the device


[Attachment 87962 - Click to enlarge]

On your system install Python3 (im using 3.13)
Open CMD Prompt and Install frida-tools and keydive

pip install frida frida-tools keydive

When frida & frida-tools installs; check what version it is, and download the corresponding server version
Mine was 17.2.4 so I downloaded frida-server-17.2.4-android-x86_64.xz
Extract the archive so you have the binary

Next setup ADB so it is an Environmental Path
Open System > Advanced system settings > Environmental variables...
In User or System variables; select Path and Edit..
Enter the path to your Android SDK's "platform-tools" folder


[Attachment 87963 - Click to enlarge]

Reboot for the environment variable to take effect.
Open cmd and test its working by typing 'adb --version'


[Attachment 87964 - Click to enlarge]

Next we follow the same rooting and frida-server steps
Make sure the device is powered on in Android Studio

Check adb can see the emulated device

adb devices

Then root it; push frida-server and run it

adb root
adb push frida-server-17.2.4-android-x86_64 /sdcard

adb shell
mv /sdcard/frida-server_yourversion /data/local/tmp/frida-server
chmod 755 /data/local/tmp/frida-server
/data/local/tmp/frida-server &

Now open another cmd prompt window in the folder you want to save the files
Run keydive with this command

keydive -kw -a player

Look at your device and you will see the app open on the phone and a pink icon in the bottom corner
Click the icon then "Provision Widevine"


[Attachment 87965 - Click to enlarge]

You should see it successfully connect

2025-07-26 08:24:58 [I] keydive: Version: 3.0.5
2025-07-26 08:24:58 [I] Remote: Connected to device: Android Emulator 5556 (emulator-5556)
2025-07-26 08:24:58 [I] Remote: SDK API: 34
2025-07-26 08:24:58 [I] Remote: ABI CPU: x86_64
2025-07-26 08:24:58 [I] Core: Preparing DRM player: Kaltura Device Info (com.kaltura.kalturadeviceinfo)
2025-07-26 08:25:00 [I] Core: Starting application: Kaltura Device Info (com.kaltura.kalturadeviceinfo)
2025-07-26 08:25:01 [I] Core: Watcher delay: 1.0s
2025-07-26 08:25:01 [I] Core: Detected process: 420 (android.hardware.drm-service.widevine)
2025-07-26 08:25:02 [I] Core: Library found: android.hardware.drm-service.widevine (/apex/com.google.android.widevine/bin/hw/android.hardware.drm-service.widevine)
2025-07-26 08:25:02 [I] Core: Successfully attached hook to process: 420
2025-07-26 08:25:07 [I] Cdm: Received encrypted keybox:

Then it should display your output keys


[Attachment 87966 - Click to enlarge]


The keys output path is relative to your current working directory..so whichever folder you were in when you ran keydive.
Copy them as needed

Can someone please help me out? I followed the instructions exactly as listed. at first i wasn't able push frida, but then i was able to move the extracted folder the android sdk platform-tools folder. then used command prompt to cd to that folder. then i was able to run the command listed to push the frida server and it shows frida-server-17.7.3-android-x86_64\: 1 file pushed, 0 skipped. 184.0 MB/s (111428936 bytes in 0.578s) which i'm assuming means it worked.

However, I can't run the next command adb shell mv /sdcard/frida-server_17.7.3-android-x86_64 /data/local/tmp/frida-server i also tried mv /sdcard/frida-server_yourversion /data/local/tmp/frida-server but i keep getting "No such file or directory". Please please help, thank you very much

[DrDeft]

[Attachment 91367 - Click to enlarge]

[Attachment 91368 - Click to enlarge]

[Attachment 91366 - Click to enlarge]

[Attachment 91364 - Click to enlarge]

[Attachment 91365 - Click to enlarge]

Please help =)

Kaltura not starting:

C:\Windows\System32>keydive -kw -a player
2026-02-28 21:12:32 [I] keydive: Version: 3.0.5
2026-02-28 21:12:33 [I] Remote: Connected to device: Android Emulator 5554 (emulator-5554)
2026-02-28 21:12:33 [I] Remote: SDK API: 34
2026-02-28 21:12:33 [I] Remote: ABI CPU: x86_64
2026-02-28 21:12:33 [I] Core: Preparing DRM player: Kaltura Device Info (com.kaltura.kalturadeviceinfo)
2026-02-28 21:12:34 [E] Core: Could not install the APK from local path: tmp.apk (Error: Performing Streamed Install
adb.exe: failed to stat tmp.apk: No such file or directory)
2026-02-28 21:12:34 [I] Core: Watcher delay: 1.0s
2026-02-28 21:12:34 [I] Core: Detected process: 412 (android.hardware.drm-service.widevine)
2026-02-28 21:12:35 [I] Core: Library found: android.hardware.drm-service.widevine (/apex/com.google.android.widevine/bin/hw/android.hardware.drm-service.widevine)
2026-02-28 21:12:35 [I] Core: Successfully attached hook to process: 412

I tried to install kaltura-device-info-release.apk (release t3) manually:

[Attachment 91370 - Click to enlarge]

[Attachment 91371 - Click to enlarge]

Ok, I dit in manually! =))

[Attachment 91372 - Click to enlarge]

[jackc_1285]

It's definitely getting harder with the newer security patches tightening up memory access. Did you need to use a specific Android version for this, or did a stock recent build work? I've found that on some devices the latest updates break the hooking process entirely, so knowing the OS version would be helpful.

[mikevol]

having the same problem only with the last command: /data/local/tmp/frida-server-...."
getting the "No such file or directory". the file is there and i was able to mv the file and chmod the file

"However, I can't run the next command adb shell mv /sdcard/frida-server_17.7.3-android-x86_64 /data/local/tmp/frida-server i also tried mv /sdcard/frida-server_yourversion /data/local/tmp/frida-server but i keep getting "No such file or directory". Please please help, thank you very much[/QUOTE]"

[jhawkinson756]

FINALLY got successful video decryption working using KeyDive to extract fresh L3 keys (`client_id.bin` and `private_key.pem`) with (https://github.com/hyugogirubato/KeyDive). The older dump_keys.py method just doesn't work anymore - that script hasn't been updated in 5 years.

Setup used:

* Latest Android Studio
* Pixel 3a XL API 28 Pie (Android 9.0)
* Google APIs Intel x86_64 Atom System Image (API 28)
* ADB 1.0.41
* Python 3.11.9

I had to add `adb` to my System PATH so KeyDive could properly access it.

Just follow the few setup steps on the KeyDive GitHub under "Usage" (for Test DRM Playback, select "Google"). KeyDive injects itself into your virtual Android instance and automatically extracts fresh keys into a local `device` folder created in the same directory you're running KeyDive in.

Also, make sure you add the older version of FFMPEG 7.1.1 to your system PATH.

The latest FFmpeg builds were not properly decrypting videos for me, but 7.1.1 worked correctly.

FFmpeg 7.1.1 download: (https://www.videohelp.com/software?d=ffmpeg-7.1.1-full_build.7z)

Someone also made a more in-depth guide for this method here if you're starting from scratch: (https://forum.videohelp.com/threads/408031-Dumping-Your-own-L3-CDM-with-Android-Studio...28#post2779324)

I can confirm this method still works.

[evercise]

[Attachment 92333 - Click to enlarge] Hi, I Have a Problem