How are you going to respond to widevine l3 decryptor's death at May 31st?

[[ss]vegeta]

Has anyone been able to use WVClient3 to get keys? https://github.com/fotile96/WVClient3
or is it also affected by this change?

It's also affected.

[muppler]

you could always try the dvdfab streaming downloader - https://www.dvdfab.cn/downloader.htm?ad=forum_downloader
has support for Netflix & Amazon HBO max funamation and adult websites !!

Not 100% sure but DVDFab doesnt download the stream, it records.
So i guess AnyStream is the best choice.

[Khal1d]

Has anyone been able to use WVClient3 to get keys? https://github.com/fotile96/WVClient3
or is it also affected by this change?

It's also affected.

So this is it?
No other alternative to get the keys?

[servese]

Has anyone been able to use WVClient3 to get keys? https://github.com/fotile96/WVClient3
or is it also affected by this change?

It's also affected.

So this is it?
No other alternative to get the keys?

Doesn't look like it at the present moment. WVClient3 has different keys to widevine-l3-decryptor, but seeing as it was last updated in November 2020, they're probably even older than the ones that just expired.

[tamagoyaki]

Widevine-l3-decryptor uses device public and private keys in PEM format.
WVClient3 uses the same keys but in DER format. (convert the base64 part of PEM to binary hex and you'll see the same code)
Without the new device private key, none of the alternatives will work.

[servese]

Oh, I see. Didn't think of that.

[Jon1771]

you could always try the dvdfab streaming downloader - https://www.dvdfab.cn/downloader.htm?ad=forum_downloader
has support for Netflix & Amazon HBO max funamation and adult websites !!

Not 100% sure but DVDFab doesnt download the stream, it records.
So i guess AnyStream is the best choice.

DVDFab downloader does actually download the stream. I've used it and the decryptor tool, compared file sizes, and mediainfo. They matched up.

[jamkiya]

so sad is there any hope in next days?

[moni]

so sad is there any hope in next days?

it would be amazing if there happened to be solution in the next months not days...

[lfer94]

So this is it?
No other alternative to get the keys?

If there was an alternative, I think no one would want to share it with others. Because if the Widevine L3 Decryptor extension had been kept "secret", today we would not be waiting for another way to be able to decrypt DRM-protected content. I guess we all have a bit of guilt for this.

[lomero]

yes, right.
people talk too much

[moni]

yes, right.
people talk too much

And the previous solution have been public so "people" have no other chance than to talk about it. Had it been private all the time it would have worked until now.

[moni]

Just to let you know guys.
Do NOT pay any amount to the DVDFab team
Here is what happens with their latest StreamFab software (version 4.0.0.0)

[Attachment 59351 - Click to enlarge]
They're starting a virtual machine with the obviously old hacked DLL

[Khal1d]

Just to let you know guys.
Do NOT pay any amount to the DVDFab team
Here is what happens with their latest StreamFab software (version 4.0.0.0)

[Attachment 59351 - Click to enlarge]
They're starting a virtual machine with the obviously old hacked DLL

same issue, with me says "please enable protected content in your browser"

[SoConfused]

This is very sad, and i do not think there will be a nice tool like we had, again. There is a lot of talk about things, but one that seems to be correct, is they keys will never be static again, like they were, they now have an expire key flag, so say every 14 days the key will become invalid. Also seen a lot of changes in the DLL, if i am seeing the unobfusicated code, looks about right in the dis-assembler.

But we had a lot of fun while it lasted, and i am still licking my wounds a bit, i had just got my personal project, that i have been chatting about on here, finished while on vacation (wife was not happy with that LOL), to have it work for a day, and then get the dreaded "DENIED".

[SoConfused]

interested in seeing the keys
dsfdsfsdfsdfsdfsdfsd@gmail.com
I only sell it is not free

i have doubt you have them, the new version it a lot different, and if you do have them, like to see PoC. Also there could be many keys, depending on if the site is hosting its own license server, or if they are using cloud based such as from AWS. from what i have seen, the public/private is no longer static, so you would need to white or grey box it every time, and that takes a long time.

[ChezBompaLawijt]

Do not fall for the scammers guys do not buy anything from anyone!

[notaghost]

Do not fall for the scammers guys do not buy anything from anyone!

I agree do not fall for scammers I got everything for free you can get it for free too.

[moni]

This is very sad, and i do not think there will be a nice tool like we had, again. There is a lot of talk about things, but one that seems to be correct, is they keys will never be static again, like they were, they now have an expire key flag, so say every 14 days the key will become invalid. Also seen a lot of changes in the DLL, if i am seeing the unobfusicated code, looks about right in the dis-assembler.

Hmm but shouldn't Google release a new DLL every 2 weeks after the new private key is applied? That's most unlikely to be true.
Weird.

we had a lot of fun while it lasted, and i am still licking my wounds a bit, i had just got my personal project, that i have been chatting about on here, finished while on vacation (wife was not happy with that LOL), to have it work for a day, and then get the dreaded "DENIED".

Same here. Unbeknownst of it I dumped all countries' The Masked Singer series I could find - lucky I succeeded, but it seems to me that I'll record the next seasons either via satellite or with screen capturing programs

[lordsmurf]

Every time I see this thread on pg 1, at a glance, I swear it says WOLVERINE.
Gets me every time.

[[ss]vegeta]

Every time I see this thread on pg 1, at a glance, I swear it says WOLVERINE.
Gets me every time.

Ha ha.
Speaking of which, how exactly is Widevine pronounced?
is it wide vine
or
why devine
?

[tripnikk]

Every time I see this thread on pg 1, at a glance, I swear it says WOLVERINE.
Gets me every time.

Ha ha.
Speaking of which, how exactly is Widevine pronounced?
is it wide vine
or
why devine
?

I always pronounced it Wide Vine, but I might start saying why devine for kicks

[SoConfused]

[QUOTE=moni;2622425]

This is very sad, and i do not think there will be a nice tool like we had, again. There is a lot of talk about things, but one that seems to be correct, is they keys will never be static again, like they were, they now have an expire key flag, so say every 14 days the key will become invalid. Also seen a lot of changes in the DLL, if i am seeing the unobfusicated code, looks about right in the dis-assembler.

Hmm but shouldn't Google release a new DLL every 2 weeks after the new private key is applied? That's most unlikely to be true.
Weird.

I came to it making sense that the key(s) can change, from digging into a write-up on the new features, but it could be for the private license severs. If i can find the page again i will post. All this stuff is so confusing, because like what you said, it would take a lot of time to change all the files, but, since i know very little on how it all comes together, i was thinking the files are stored in the clear on the source server, then when a request to the server is made, it encrypts on the stream.

If only i can find a white paper on the new DLL =(.

[jack_666]

@SoConfused, you wrote ...

i was thinking the files are stored in the clear on the source server, then when a request to the server is made, it encrypts on the stream.

Don't think so. The files on the media server are already encrypted and the KID (public key) is stored in the manifest. The communicating software sends the public key (KID) to the license server which then returns the private key. It would take too much resources to encrypt the file on every file access.

[SoConfused]

@Jack, very true, it would be a bandwidth hog. Still confused on this, i know the "new keys" were sent to hosting sites long before the flip, so if the key changed, all of those sites would have had to re-encrypt the files, and on some sites that could be Petrabytes, that would take a lot of time.

So i guess staying on topic here, how did the flip happen, from the hosting side, since on May 30th, the old DLL, with the old keys worked fine, then on the 31st, out of luck. So at some point, they had to have the old and new files stored, and that is a lot of storage. I am going to have to see if the KID on an old MPD file, is the same now.

I have soooo many questions, on what goes on under the hood with this stuff.

[jack_666]

@SoConfused, you wrote ...

i know the "new keys" were sent to hosting sites long before the flip, so if the key changed, all of those sites would have had to re-encrypt the files, and on some sites that could be Petrabytes, that would take a lot of time.

These are vey good questions. You are thinking. Excellent.

Ok I think I understand some of your confusion. These are more keys involved than just the Kid:Key. The KId:Key did not change so these was no need for media sites to re-encode anything. Understand me so far? No re-encrypting of any files. You can verify this by downloading a video that you had downloaded in the past. Download the encrypted file now and use the Kid:key that you used to decrypt previously.

The key that is suppose to have be changed is the key associated with Chrome Browser (ver 1610 et al). This is a totally different key. This is the key that is used to verify to the license server (LS) that it (the LS) is communicating with a authentic device and at what level (L1, L2 or L3)

I hope that I was able to clarify your understanding.

[tamagoyaki]

The stream is encrypted once and stored on the server. The steam can be so large and the server doesn't need to encrypt it every time you request for it.

What server does every time when you request is to encrypt the KEY (content key).

There seems to be some confusion on KID/KEY and public/private key. Based on the source code of that chrome extension, the process is like the following:

1. The client sends request message to the license server. It includes video/audio KID and some client information.

2. The server searches the content key that matches up the KID and sends back the response message. The message includes the encrypted content key and an encrypted session key.

3. The device private key is used to decrypt the session key. And the decrypted session key is then used to combine with client request message and calculate the CMAC tag (it is like a fingerprint of request message mixed with session key).

4. The CMAC tag is served again as a key and is used to decrypt the content key.

5. Finally what you see on the console output is the pair of KID and content key (the KEY that can decrypt the video/audio).

The public key is not used and is not important. The extension only uses it to confirm that the private key is the correct one. And the extension doesn't work now because the private key is changed.

To be short, the private key is involved in the decryption process of the content key, and the content key is what you need to decrypt the video/audio.

I think KID and KEY (content key) stay the same for the same encrypted stream.

[staszek1503]

Do not fall for the scammers guys do not buy anything from anyone!

I agree do not fall for scammers I got everything for free you can get it for free too.

@notaghost

Can I ask for more information on how to get free on priv?
If not, does any of the users already have a solution to this problem (even paid?)

You may disagree with me, but such things should not be public because then we have situations like this.

[lfer94]

I think KID and KEY (content key) stay the same for the same encrypted stream.

I have some KIDs and content keys from a FB Watch broadcast from December 17th that I saved before this tragedy (?) happened, and I can confirm that they still working. So I guess this is correct.

[moni]

I can confirm that too. I have lotsa videos which have been downloaded way before the deadline of 31.05.2021. I have logged the MPD links and the pairs KID:Content key.
I am _NOW_ downloading one of these and am able to decrypt it with the _OLD_ keys.