peacock keys

[gareth41]

Some info if anyone is interested

- They have a new v7 api endpoint now and the hmac key's for both web and android have changed - v6 is still working for now, both web and android...
- There is also no hmac keys buried in any of their obfuscated mess any longer
- They are now using custom SHA1 routines which begin hashing from preset states. These states both represent the hashed ipad and opad hmac values contained within the first 64byte block - so there is NO way to recover the hmac keys
- Their v7 api now only accepts chrome cdm when sending valid web hmac signature in headers, so if you want to get content keys you'll have to use the android hmac signature

Here are the SHA1 states for generating valid web hmac signatures for v7 api, works for all api end-points except for sending license requests with android cdm

ipad
[0x5D765C9D, 0x27C27EED, 0x1F822B68, 0xABDBE5D1, 0x19183D23]

opad
[0x7B5585AB, 0x01D1F56B, 0x912E7418, 0x493D4C08, 0xFF9085B0]

Android can be obtained using frida, please don't pm me asking how

[johns0]

Please don't ask for help on downloading videos from a subscription site,this thread is closed.