Decryption: The Dungeon of Despair

[stabbedbybrick]

also regarding

4. If there's extra payload in the Payload tab of the license, that means you'll need to customize your script to handle the request in json format. This will require basic Python knowledge and some understanding of how the pywidevine module works in order to properly send a license request and parsing the response.

There is data in the response tab of the license beside response payload. Which script would I need to customize? l3.py?

A_n_g_e_l_a has written excellent examples of this in the first post in this very thread. There's even code snippets there that you can use as templates for other sites. Read through it carefully and test them out. Look over other scripts posted around the forum and compare them to each other. What are the similarities and differences between them? All these scripts work by sending a license request, so by pinpointing the difference in how it's formulated in each script will give you valuable knowledge. I know it's tempting to just run random code and look hungrily at the terminal, hoping that there will be juicy key there. But at best this will give you occasional and unintentional success, and at worst this could burn your CDM by making too many bad requests against the wrong server. Make intentional efforts to understand what you're doing, or this will be a very frustrating journey for you.

As for your other update, until you share more details about what service you're using, no one will be able to help you.

[Iridule]

@stabbedbybrick

I already have the files decrypted. The license server is correct. I've figured out the pattern to get keys for this site. It requires PSSH+LIC+token in headers.
Key decrypts full 1080p video fine with no error. Audio is decrypted in segments using yt-dlp. Video plays fine in entirety. Though no audio segments are downloaded with N_m3u8DL-RE downloader using the same MPD and the Audio file seems singular In size with much larger file size than yt-dlp, unable to decrypt I think? using that method. Or could be ffmpeg issue as I get aac bitstream errors of I try to join audio to video obtained using that method of download.

So to get around that I downloaded all 4 segments separately with yt-dlp decrypted them and renamed them and they match the video though for some reason vlc shows each separate file having a longer track length than it really does yet that longer length matches the video length.
There was no json needed. Now they only need to be joined together in one file. I suppose I could transfer them to phone and use a video editing tool and drop the audio files in.

[stabbedbybrick]

Since you are making it a point not to mention what site you're using, I'm just going to assume it's particularly embarrassing porn and move on.

I can't tell you what you're possibly doing wrong since I don't know where you're getting the files from, but if all you're looking to do is merging the segments, you can do that with ffmpeg:

ffmpeg -i audiofile1.m4a -i audiofile2.m4a -i audiofile3.m4a -i audiofile4.m4a -c copy audio.m4a
ffmpeg -i audio.m4a -i video.mp4 -c copy finalvideo.mp4

Theoretically, you should now have one final, working file.

[Iridule]

Since you are making it a point not to mention what site you're using, I'm just going to assume it's particularly embarrassing porn and move on.

I can't tell you what you're possibly doing wrong since I don't know where you're getting the files from, but if all you're looking to do is merging the segments, you can do that with ffmpeg:

ffmpeg -i audiofile1.m4a -i audiofile2.m4a -i audiofile3.m4a -i audiofile4.m4a -c copy audio.m4a
ffmpeg -i audio.m4a -i video.mp4 -c copy finalvideo.mp4

Theoretically, you should now have one final, working file.

In theory it should work. I tried last night it doesn't

$ffmpeg -i decrypted1.m4a -i decrypted2.m4a -i decrypted3.m4a -i decrypted4.m4a -c copy audio.m4a
[ipod @ 0x56041f198500] Could not find tag for codec eac3 in stream #0, codec not currently supported in container
Could not write header for output file #0 (incorrect codec parameters ?): Invalid argument
Error initializing output stream 0:0 --

The issue is with N_m38DL-RE i get one large audio file yet when trying to decrypt and merge It plays an ad then goes silent/garbled. If I run the same MPD through yt-dlp I get many parts with language markers which help but it is a pain to download all 4 english parts then decrypt each one one by one and then now merge them. Must be how the audio is segmented in the mpd to have advertisements. I tried passing the key through N_m3u8DL and merging like this

./N_m3u8DL-RE  -M format=mkv --key....

didn't work either...video decrypts fine but audio plays ad/or part of video in wrong time... then again goes silent. Maybe the MPD needs to be edited to remove ads?

[stabbedbybrick]

I know there are a few services out there that have ads baked in, but in most cases you can find an ad-free mpd or get the correct tracks through the manifests. But I can't give you blind advice, so I don't know. I guess you just have to experiment.

[Iridule]

I know there are a few services out there that have ads baked in, but in most cases you can find an ad-free mpd or get the correct tracks through the manifests. But I can't give you blind advice, so I don't know. I guess you just have to experiment.

Yt-dlp -F lists audio segments with no ads but it is a pain to get them all and in the right order for the video. Then decrypt each one individually. N_m3u8DL-RE does not show any way of which track is which and I have tried downloading/decrypting all it lists and the resulting file seems to play 1-5 second ad then garbled/silence...this must be a Server Side Advert Insertion ?
Yt-dl

[Attachment 70942 - Click to enlarge]
N_m3u8DL-RE

[Attachment 70943 - Click to enlarge]

[pram0dm]

I could give it a shot for you at my end using N_m3u8DL-RE if you can pass me the keys that you received from the license server, and the MPD URL.
Even the URL to the video would do just fine as long as it isn't behind a subscription.

[Iridule]

@pram0dm
I'll figure it out somehow...
I appreciate the offer, I think the issue is with the MPD. It needs to be edited to remove ad segments. At this point it may just be easier to transfer all to my phone and use playstore app to merge audio and video lol. Over I would say my progress to getting the key was a success which was my main goal. There is a way to properly do this im sure with N_m3u8DL I just haven't figured it out yet. But I will.

[Iridule]

@pram0dm
Got it...edited the MPD to remove ads Removed everything from <period>...roll-ad-blah-blah </period> until it started to say the second <period> line right before it talked about cenc...

<Period id="0" duration="PT11M56.716S">
    <AdaptationSet frameRate="24000/1001" id="0" contentType="video" par="16:9" maxWidth="1920" maxHeight="1080" segmentAlignment="true">
      <ContentProtection schemeIdUri="urn:mpeg:dash:mp4protection:2011" value="cenc"

then loaded with N_m3u8DL.

./N_m3u8DL-RE -M format=mkv --key 4884blahblah8848:80943846 ~/Downloads/manifest.mpd --save-name MergeSuccess

All works even subtitles. Not bad for 5 days of starting this project
Now I will take a break and go outside before I get carpel tunnel.
P.S. In my searching I found this article useful https://tutorials.hybrik.com/drm/
Fiat Lux et Lux fit

[Attachment 70946 - Click to enlarge]

[Attachment 70947 - Click to enlarge]

[stabbedbybrick]

@pram0dm
Got it...edited the MPD to remove ads Removed everything from <period>...roll-ad-blah-blah </period> until it started to say the second <period> line right before it talked about cenc...

<Period id="0" duration="PT11M56.716S">
    <AdaptationSet frameRate="24000/1001" id="0" contentType="video" par="16:9" maxWidth="1920" maxHeight="1080" segmentAlignment="true">
      <ContentProtection schemeIdUri="urn:mpeg:dash:mp4protection:2011" value="cenc"

then loaded with N_m3u8DL.

./N_m3u8DL-RE -M format=mkv --key 4884blahblah8848:80943846 ~/Downloads/manifest.mpd --save-name MergeSuccess

All works even subtitles. Not bad for 5 days of starting this project

Nice work! You seem determined and a fast learner, so you'll have all this figured out in no time

[Iridule]

@ stabbedbybrick

Nice work! You seem determined and a fast learner, so you'll have all this figured out in no time

Thanks, it was a fun project.

[paul92]

Is there anything specific guide to capturing, and decrypting live streams for own personal use? The majority of these guides seem to be for downloading from catch up and VOD videos.

[A_n_g_e_l_a]

Is there anything specific guide to capturing, and decrypting live streams for own personal use? The majority of these guides seem to be for downloading from catch up and VOD videos.

This is a guide for people starting out with decryption
Your more advanced needs have two threads on page 1 of this forum presently both of which you started. What do want? - World domination?
Don't double post, is is unnecessary.

[A_tinyman]

Hey I bit confused in the licence url
The below is the curl converter output

headers = {
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0',
'Accept': '*/*',
'Accept-Language': 'en-US,en;q=0.5',
# 'Accept-Encoding': 'gzip, deflate, br',
'Origin': 'http://localhost',
'Connection': 'keep-alive',
'Referer': 'http://localhost/',
'Sec-Fetch-Dest': 'empty',
'Sec-Fetch-Mode': 'cors',
'Sec-Fetch-Site': 'cross-site',
# Requests doesn't support trailers
# 'TE': 'trailers',
'Content-Type': 'application/x-www-form-urlencoded',
}

params = {
'CrmId': 'tatasky',
'AccountId': 'tatasky',
'ContentId': '400000119',
'ls_session': 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImNvb nRyb2xfc2lnbmluZ19rZXlfcHJvZHVjdGlvbl8xNjkyMjk1MDk 4NjMxIn0.eyJzdWIiOiIxMjY2MTI5NDc1IiwiaXNlIjp0cnVlL CJqdGkiOiIwZmYxYTc1Ni1lN2YyLTQ5NDQtOGM4Mi0xMzdjMGE zZWE4MjMiLCJhaWQiOiJ0YXRhc2t5IiwiZXhwIjoxNzAyNzAwO Tc3LCJuYW1lIjoidW5kZWZpbmVkIiwiaWF0IjoxNzAyNjE0NTc 3LCJlbnQiOlt7ImVwaWQiOiJTdWJzY3JpcHRpb25fQnJvd3Nlc l9TdHJlYW1pbmciLCJiaWQiOiIxMDAwMDAxNTIzIn0seyJlcGl kIjoiU3Vic2NyaXB0aW9uX0Jyb3dzZXJfU3RyZWFtaW5nIiwiY mlkIjoiMTAwMDAwMTAzOCJ9LHsiZXBpZCI6IlN1YnNjcmlwdGl vbl9Ccm93c2VyX1N0cmVhbWluZyIsImJpZCI6IjEwMDAwMDAwM zMifSx7ImVwaWQiOiJTdWJzY3JpcHRpb25fQnJvd3Nlcl9TdHJ lYW1pbmciLCJiaWQiOiIxMDAwMDAwMDAyIn0seyJlcGlkIjoiU 3Vic2NyaXB0aW9uX0Jyb3dzZXJfU3RyZWFtaW5nIiwiYmlkIjo iMTAwMDAwMTAzNSJ9LHsiZXBpZCI6IlN1YnNjcmlwdGlvbl9Cc m93c2VyX1N0cmVhbWluZyIsImJpZCI6IjEwMDAwMDAwMDEifV0 sImNzbW8iOnsibWFzIjoiNiIsImR0IjoidHBtYSIsIm1hc2QiO iIyIn0sImlzcyI6InRwbWFfd2ViIn0.qCGI5jAuRufLLbdB2Ls ohHeJASQaHiv0RxfZ-8zD7m0',
}

data = {it is encrypted I think}

response = requests.post('https://tataplay.live.ott.irdeto.com/Widevine/getlicense', params=params, headers=headers, data=data)

What is the thing I missed?
When I tried to run this it gives no response,

[Obo]

data needs to be generated by your local cdm - this is the license challenge data. You can't use the data block from your browser.

[A_tinyman]

Thanks for reply obo
How can I generate that data, 🤔

[Obo]

Begin with reading this thread from post #1. Use your own local cdm and a copy of the wks-keys scripts. Everything is explained here in detail the first post of the stickies.

[A_tinyman]

I generated the data when I try to run the license url it response 403 error did I messed up something

[A_tinyman]

*deleted*

[IrishMarty]

Can anyone give me a pip list that they have working for the Boltdnsnet downloader? Have it set up in a virtual environment but it keeps getting stuck on line 58.

" File "C:\Program Files\WKS-KEYS\boltdnsnet.py", line 58, in <module>
import pyfiglet as PF
ModuleNotFoundError: No module named 'pyfiglet'"

I've tried two different versions of Python (3.10 and 3.12), and also a couple of versions of pyfiglet. Can't wrap my head around it yet. Thanks.

[A_n_g_e_l_a]

Can anyone give me a pip list that they have working for the Boltdnsnet downloader? Have it set up in a virtual environment but it keeps getting stuck on line 58.

" File "C:\Program Files\WKS-KEYS\boltdnsnet.py", line 58, in <module>
import pyfiglet as PF
ModuleNotFoundError: No module named 'pyfiglet'"

I've tried two different versions of Python (3.10 and 3.12), and also a couple of versions of pyfiglet. Can't wrap my head around it yet. Thanks.

pip install pyfiglet==0.8.post1

boltdnsnet.py is quite old now; I no longer keep a copy for use. UKTVPlay and stv are provided for individually in UK-FTA.

If you wish to persist with boltdnsnet, pyfiglet is only responsible for the large text italic heading to the script and is not important to the script's function - just look at the code and comment out the lines that use pyfiglet but putting a # at the start of the line.

On windows using the terminal app from MS store gives better results for running scripts

[IrishMarty]

Thank you Angela. I didn't know UK-FTA actually existed so thanks a lot. I won't bother with the boltdns downloader as I was looking for something to use on UKTVPlay. I'll give it a whirl tomorrow. Again, thanks for your threads on here, I wouldn't have made it this far in such a short amount of time without them.

[A_n_g_e_l_a]

I've just re-visited the script - 'boltdnsnet.py' - at the second post in this thread - and checked it still works. I've edited pyperclip out and now just use a direct input.

[A_n_g_e_l_a]

ITV Batch downloader at post #2 updated and working now.

[BadgerHobbs]

First off, just want to say excellent work compiling the decryption threads together, they're a great resource to refer too.

My situation/context:

I've gone through the various threads and have been able to use a dumped Android Studio AVD device to decrypt a downloaded video from the test site tg4.ie, so I'm happy the basic implementation and setup I have is working as expected.

I've been attempting to retrieve a decryption key for the Freebie/free account videos on kayosports.com.au and have been coming across issues with the challenge POST request to the license server.

Here are the details for the test video I am trying to download for reference.

Title: GF: Cockburn v Willetton
Video Link: https://kayosports.com.au/event/sport!basketball/event-gf-cockburn-v-willetton!206774
PSSH: AAAARnBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAACYIARIQkTzS0LG0QvS8UtZhCdn4hiIOS0FZTzIwNjc3NC1BVkM4AA==
License URL: https://drm.content.foxtel.com.au/licenseServer/widevine/v1/foxtelott/license

(Australian VPN used to access)

I have verified that my CDM is not blacklisted/blocked by being able to stream the content through the AVD it was dumped from.

Looking at the network requests, two API calls (ignoring an initial options call) are made to the license server on the same URL.

The first always sends the same request with the same binary data and response, just different auth token, I presume (perhaps incorrectly) this is the service certificate.

curl 'https://drm.content.foxtel.com.au/licenseServer/widevine/v1/foxtelott/license' \
  -H 'authority: drm.content.foxtel.com.au' \
  -H 'accept: */*' \
  -H 'accept-language: en-GB,en-US;q=0.9,en;q=0.8' \
  -H 'authorization: Bearer eyJraWQi...' \
  -H 'dnt: 1' \
  -H 'origin: https://kayosports.com.au' \
  -H 'referer: https://kayosports.com.au/' \
  -H 'sec-ch-ua: "Not_A Brand";v="8", "Chromium";v="120", "Google Chrome";v="120"' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'sec-ch-ua-platform: "Windows"' \
  -H 'sec-fetch-dest: empty' \
  -H 'sec-fetch-mode: cors' \
  -H 'sec-fetch-site: cross-site' \
  -H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36' \
  --data-raw $'\u0008\u0004' \
  --compressed 

The second request is made to the same license server URL with a different payload, what I presume is the licence challenge.

curl 'https://drm.content.foxtel.com.au/licenseServer/widevine/v1/foxtelott/license' \
  -H 'authority: drm.content.foxtel.com.au' \
  -H 'accept: */*' \
  -H 'accept-language: en-GB,en-US;q=0.9,en;q=0.8' \
  -H 'authorization: Bearer eyJraWQi...' \
  -H 'dnt: 1' \
  -H 'origin: https://kayosports.com.au' \
  -H 'referer: https://kayosports.com.au/' \
  -H 'sec-ch-ua: "Not_A Brand";v="8", "Chromium";v="120", "Google Chrome";v="120"' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'sec-ch-ua-platform: "Windows"' \
  -H 'sec-fetch-dest: empty' \
  -H 'sec-fetch-mode: cors' \
  -H 'sec-fetch-site: cross-site' \
  -H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36' \
  --data-raw $'\u0008\u0001\u0012\u0090....' \
  --compressed 

I have the following code setup for sending the request using pywidevine, tested with the demo tg4.ie data. This code gets the response from the first API call (what I presume is the service certificate?) and applies it to the CDM, then making the second API call with the generated challenge.

Note: I am using cURL instead of requests as I have had issues with HTTP/2.

import pywidevine
import subprocess

pssh = pywidevine.pssh.PSSH(
    "AAAARnBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAACYIARIQkTzS0LG0QvS8UtZhCdn4hiIOS0FZTzIwNjc3NC1BVkM4AA=="
)
licence_url = "https://drm.content.foxtel.com.au/licenseServer/widevine/v1/foxtelott/license"
authentication = "eyJraWQi..."

device = pywidevine.device.Device.load(
    "device/google_aosp_on_ia_emulator_14.0.0_f5640ef1_4464_l3.wvd"
)

command = [
    "curl",
    "-H",
    'sec-ch-ua: "Not_A Brand";v="8", "Chromium";v="120", "Google Chrome";v="120"',
    "-H",
    "Referer: https://binge.com.au/",
    "-H",
    "sec-ch-ua-mobile: ?0",
    "-H",
    f"Authorization: Bearer {authentication}",
    "-H",
    'sec-ch-ua-platform: "Windows"',
    "--data-raw",
    "\u0008\u0004",
    "--output",
    "certificate.bin",
    licence_url,
]
process = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
stdout, stderr = process.communicate()

with open("certificate.bin", "rb") as file:
    certificate = file.read()

cdm = pywidevine.cdm.Cdm.from_device(device)
session_id = cdm.open()
cdm.set_service_certificate(session_id, certificate)

license_challenge = cdm.get_license_challenge(session_id, pssh)

with open("challenge.bin", "wb") as file:
    file.write(license_challenge)


command = [
    "curl",
    "-H",
    'sec-ch-ua: "Not_A Brand";v="8", "Chromium";v="120", "Google Chrome";v="120"',
    "-H",
    "Referer: https://binge.com.au/",
    "-H",
    "sec-ch-ua-mobile: ?0",
    "-H",
    f"Authorization: Bearer {authentication}",
    "-H",
    'sec-ch-ua-platform: "Windows"',
    "--data-raw",
    "@challenge.bin",
    "--output",
    "response.bin",
    licence_url,
]
process = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
stdout, stderr = process.communicate()


with open("response.bin", "rb") as file:
    response = file.read()


cdm.parse_license(session_id, response)

for key in cdm.get_keys(session_id):
    if key.type == "CONTENT":
        print(f"\n--key {key.kid.hex}:{key.key.hex()}")

cdm.close(session_id) 

This is the response which is returned.

{"code":170101,"message":"Invalid license challenge."} 

I have tried with both setting and not setting the CDM licence challenge, and am now unsure what I'm missing as find little reference to this issue elsewhere about sending two requests other than here.

[Obo]

The pywidevine module has everything to make your (widevine) life easy. You just need to use the tool. (Have you read the module documentation?)

In the end your function to get the keys could look as simple as:

from pywidevine import (
    Device,
    Cdm,
    PSSH
)

def obtain_keys(pssh, url, headers, params, cookies):
    device = Device.load('your.wvd')
    cdm = Cdm.from_device(device)
    session_id = cdm.open()
    challenge = cdm.get_license_challenge(session_id, PSSH(pssh))
    license = requests.post(url     = url,
                            data    = challenge,
                            headers = headers,
                            params  = params,
                            cookies = cookies)
    license.raise_for_status()
    cdm.parse_license(session_id, license.content)
    keys = cdm.get_keys(session_id)
    cdm.close(session_id)
    decryption_keys = [f'{key.kid.hex}:{key.key.hex()}' for key in keys if key.type == 'CONTENT']
    return decryption_keys

Feed the function with all the params it needs and let pywidevine do the job.

From the headers it seems you only need the "Authorization:" one.

[BadgerHobbs]

The pywidevine module has everything to make your (widevine) life easy. You just need to use the tool. (Have you read the module documentation?)

In the end your function to get the keys could look as simple as:

from pywidevine import (
    Device,
    Cdm,
    PSSH
)

def obtain_keys(pssh, url, headers, params, cookies):
    device = Device.load('your.wvd')
    cdm = Cdm.from_device(device)
    session_id = cdm.open()
    challenge = cdm.get_license_challenge(session_id, PSSH(pssh))
    license = requests.post(url     = url,
                            data    = challenge,
                            headers = headers,
                            params  = params,
                            cookies = cookies)
    license.raise_for_status()
    cdm.parse_license(session_id, license.content)
    keys = cdm.get_keys(session_id)
    cdm.close(session_id)
    decryption_keys = [f'{key.kid.hex}:{key.key.hex()}' for key in keys if key.type == 'CONTENT']
    return decryption_keys

Feed the function with all the params it needs and let pywidevine do the job.

From the headers it seems you only need the "Authorization:" one.

Yes, I had read the documentation and even read through much of the pywidevine code to understand many of the methods themselves work.

The code you have provided does not work for this video host, erroring with

403 Client Error: Forbidden for url:

because as I mentioned in my post it requires HTTP/2 and python requests uses HTTP/1.1 which is rejected by the license server (I can literally use curlconverter to convert to python and it will fail because of this).

Even if I make another cURL request using the challenge binary data from the code you provided and the original working cURL from the network logs, it doesn't work because it is an issue with the challenge being sent. It get's the following error again as I previously mentioned.

{"code":170101,"message":"Invalid license challenge."}

My original code successfully delivers the challenge binary data, it is just not valid against the server for some reason.

[iamghost]

enjoy

N_m3u8DL-RE -M format=mkv --key 913cd2d0b1b442f4bc52d66109d9f886:98adea6f977afbe3fc76b9fb63bc402b "https://107-strm-akm-vod-b2f407be3f3f01642b73d3205b71bc0e.akamaized.net/dash/out/v1/11a27ab5bb2c4f4986113ebd0c6e9395/ccd5ec934d0d4a539d28e9b6128818f9/d5975934dd564befbf43431290f4c804/index.mpd?aws.manifestfilter=trickplay_height%3A1-2" --save-name video

[BadgerHobbs]

enjoy

--key 913cd2d0b1b442f4bc52d66109d9f886:98adea6f977afbe3fc76b9fb63bc402b

While it's much appreciated you have gotten the key for me, I'm more interested in what's wrong with my implementation as would like to be able to get them myself.

Given you are able to retrieve one, would you be able to advice or correct my implementation?

I have interest in sites with near identical widevine implementations I am looking at.

[A_n_g_e_l_a]

My original code successfully delivers the challenge binary data, it is just not valid against the server for some reason.

#

As you are finding there are 'riffs' on the way the first challenge - to get permission to send a full licence challenge - is performed. Some sites encrypt the data sent with a key and initialise values (iv) which may be provided but hidden in javascript.

You really need someone with experience of the site in question and posting in a new thread in Video Streaming might ensure it is seen by more people. El Cap is probably the guy to ask.

From your post I think you have a good handle on the problem; it sounds similar to the way channel4 UK goes about providing its keys and maybe a look for c4 examples in the forum might help you move away from curl. C4 can only be an example as any encryption data is site specific, but the over-all flow of challenges can be seen. Tracing what the browser sends and decoding any sent base64 data will allow you to tell if it is encrypted before sending.