How To Dump L3 CDM From Android Device's (ONLY Talk About Dumping L3 CDMS)

[amb3r]

hi

I'm looking for an answer.
I have:
SM-G930F - Samsung Galaxy S7

I hope you can afford to brick it if it goes wrong.

Dont undertake this task lightly.

I have already done on:
samsung J3 2016
samsung S5NEO
it comes to
INFO - Hooks completed
and finally - no L3

but that's not the problem with the post at the top: I'm looking for an answer.
I have:
SM-G930F - Samsung Galaxy S7

[nickomaru]

hi


frida.NotSupportedError: unable to handle 64-bit processes due to build configuration
PS C:\Users\USER\Desktop\L3\dumper-main\dumper-main>

install Python no 64-bit

[amb3r]

hi


frida.NotSupportedError: unable to handle 64-bit processes due to build configuration
PS C:\Users\USER\Desktop\L3\dumper-main\dumper-main>

install Python no 64-bit

2022-01-10 09:27:41 PM - root - 16 - INFO - Connected to SM G930F
2022-01-10 09:27:41 PM - root - 17 - INFO - scanning all processes for the following libraries
Traceback (most recent call last):
File "C:\Users\USER\Desktop\L3\dumper-main\dumper-main\dump_keys.py", line 18, in <module>
for process in device.enumerate_processes():
File "C:\Users\USER\AppData\Local\Programs\Python\Pytho n39-32\lib\site-packages\frida\core.py", line 26, in wrapper
return f(*args, **kwargs)
File "C:\Users\USER\AppData\Local\Programs\Python\Pytho n39-32\lib\site-packages\frida\core.py", line 110, in enumerate_processes
return self._impl.enumerate_processes(*args, **kwargs)
frida.NotSupportedError: unable to handle 64-bit processes due to build configuration
PS C:\Users\USER\Desktop\L3\dumper-main\dumper-main>

I installed on 32 bit versions and still the same.

[T33V33]

I installed on 32 bit versions and still the same.

Using the correct version of Frida Server?

[amb3r]

I installed on 32 bit versions and still the same.

Using the correct version of Frida Server?

Use:
frida-server-15.1.14-android-arm.xz

[darkw4v3]

It's 64bit hardware, to hook you need 64bit frida

However, I don't think anyone has yet successfully dumped their PK and client ID from a Samsung device.

[amb3r]

It's 64bit hardware, to hook you need 64bit frida

However, I don't think anyone has yet successfully dumped their PK and client ID from a Samsung device.

hmmm a friend dumped from samsung galaxy s5

now i have another bug, i use frida on the phone

PS C:\Users\XXXX\Desktop\L3\L3-Dumper-main> py dump_keys.py
2022-01-10 09:41:30 PM - root - 16 - INFO - Connected to SM G930F
2022-01-10 09:41:30 PM - root - 17 - INFO - scanning all processes for the following libraries
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=1, name="init", parameters={})
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=2062, name="ueventd", parameters={})
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=3066, name="watchdogd", parameters={})
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=3088, name="servicemanager", parameters={})
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=3089, name="hwservicemanager", parameters={})
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=3090, name="vndbinder", parameters={})
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=3103, name="android.hardware.keymaster@3.0-service", parameters={})
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=3104, name="ffffffffd0000000000000000000001c.tlbin", parameters={})
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=3106, name="vold", parameters={})
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=3264, name="daemonsu:mount:master", parameters={})
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=3271, name="daemonsu:master", parameters={})
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=3362, name="system_server", parameters={})
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=3372, name="netd", parameters={})
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=3373, name="zygote64", parameters={})
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=3374, name="zygote", parameters={})
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=3375, name="iptables-restore", parameters={})
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=3376, name="ip6tables-restore", parameters={})
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=3403, name="android.hidl.allocator@1.0-service", parameters={})
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=3404, name="android.hardware.audio@2.0-service", parameters={})
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=3405, name="android.hardware.bluetooth@1.0-service", parameters={})
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=3406, name="android.hardware.configstore@1.0-service", parameters={})
2022-01-10 09:41:33 PM - root - 19 - DEBUG - Process(pid=3407, name="android.hardware.drm@1.0-service", parameters={})
Traceback (most recent call last):
File "C:\Users\xxxxxx\Desktop\L3\L3-Dumper-main\dump_keys.py", line 21, in <module>
libraries = scanner.find_widevine_process(device, process.name)
File "C:\Users\xxxxxx\Desktop\L3\L3-Dumper-main\Helpers\Scanner.py", line 149, in find_widevine_process
process = dev.attach(process_name)
File "C:\Users\xxxxxx\AppData\Local\Programs\Python\Pyt hon39-32\lib\site-packages\frida\core.py", line 26, in wrapper
return f(*args, **kwargs)
File "C:\Users\xxxxxxx\AppData\Local\Programs\Python\Py thon39-32\lib\site-packages\frida\core.py", line 165, in attach
return Session(self._impl.attach(self._pid_of(target), *args, **kwargs))
frida.ServerNotRunningError: unable to connect to remote frida-server: closed
PS C:\Users\xxxxxxx\Desktop\L3\L3-Dumper-main>

[darkw4v3]

It's 64bit hardware, to hook you need 64bit frida

However, I don't think anyone has yet successfully dumped their PK and client ID from a Samsung device.

hmmm a friend dumped from samsung galaxy s5

I should clarify - I'm sure it's been done, I just haven't heard of it being done - until now. Samsungs don't seem to like to give up their secrets.

[amb3r]

It's 64bit hardware, to hook you need 64bit frida

However, I don't think anyone has yet successfully dumped their PK and client ID from a Samsung device.

hmmm a friend dumped from samsung galaxy s5

I should clarify - I'm sure it's been done, I just haven't heard of it being done - until now. Samsungs don't seem to like to give up their secrets.

they were generally available on the web l3 from samsung, for example:
SM-N935F_l3.zip

[jdanielw]

Hi, just to let everyone know. I dumped my keys from a Samsung Galaxy Tab A. Took a total of 12 hours and I bricked it a few times. I had to flas TWRP via Oden. I did not take a backup, I suggest any Samsung owner should take a backup at this point in case you brick it. I luckily found a version of Android 7 to downgrade to. I then installed Super Su via TWRP and this rooted the tablet. DRM info showed L3. I ran frida and got caught up on hooks a bit, however I kept in opening and closing Netflix and it dumped the two files required. I can confirm they work great. Samsung devices do work, it just has to be the right one. On the other hand, I also tried an a20 phone and bricked that one. Threw it in the bin.

[darkw4v3]

Great to hear that there have been successes with Samsung devices. Sounds like they have definitely earned their reputation of being difficult (for these purposes) though.

[nickomaru]

I have another problem
I have a satellite receiver on android 7
I installed a root on it, installed Frida, but I can not connect with it!
Lan connect
adb writes - device offline and I can't do anything about it
i tried all methods ...

[Fred122]

Hi all This is going to sound dumb but I cannot get T95 S1 to connect to add via USB. I've tried everything solution I can find and Linux Win10 AND iMac but when I adb devices I get 'List of devices attached' but nothing else ie no device. I've got in developer mode with and usb debugging switched on but it will not connect. I'm currently tearing out what little hair I have and it's doing my head in. Any ideas greatly appreciated
I've also tested usb cable and the ports work with a keyboard/mouse

[nickomaru]

Fred122


How does the dispatcher determine your device?


did you install the adb drivers?

[Xfinger]

Can people write out what phones they have done that workt
And what dont work, so we dont buy wrong phones Thanks!

[EatThis]

Can people write out what phones they have done that workt
And what dont work, so we dont buy wrong phones Thanks!

Nice try, and aid Google to prepare their list of devices to ban?

Jokes aside, the answer is any device with Android 5-10 as long as you can root.

[Fred122]

Getting from": "Dynamic Function",
"message": "L3 RSA Key export function found: ulns"
Stuck at hooks completed

[EatThis]

Getting from": "Dynamic Function",
"message": "L3 RSA Key export function found: ulns"
Stuck at hooks completed

You need to playback any content, this function will not be magically called if there is not app or content that try to make use of it.

Does it say Private Key/Lincense Request Captured? If you're going to show any logs. Redact any of the shown values.

[Xfinger]

Is it possibly to extract a new different key from same phone? Ore more than one!

[Fred122]

Getting from": "Dynamic Function",
"message": "L3 RSA Key export function found: ulns"
Stuck at hooks completed

You need to playback any content, this function will not be magically called if there is not app or content that try to make use of it.

Does it say Private Key/Lincense Request Captured? If you're going to show any logs. Redact any of the shown values.

I've tried stopping and starting playing content and also from different sources with no joy. No doesn't get Private Key/Lincense Request Captured? just sits at hooks completed
Thanks

[EatThis]

I've tried stopping and starting playing content and also from different sources with no joy. No doesn't get Private Key/Lincense Request Captured? just sits at hooks completed
Thanks

Will send you an PM on something to try.

[EatThis]

Is it possibly to extract a new different key from same phone? Ore more than one!

Yes, however, if the CDM gets blocked/blacklisted all the different keys extracted will be useless as well.

[amb3r]

I've tried stopping and starting playing content and also from different sources with no joy. No doesn't get Private Key/Lincense Request Captured? just sits at hooks completed
Thanks

Will send you an PM on something to try.

I am asking for the same, I am standing in the same place. Thx

[Kaba]

I have same problem on my device. I will be happy, if somebody can help me also with this info... per PM

BR

[amb3r]

So it can be done on Samsung phones! 3 device

[EatThis]

^^ 3 more devices to Google revoke list.

[laynoto]

Today I've succeeded to dump L3 CDM from my old phone. I tried many times and couldn't succeeded last few days. Today uninstall all python versions and installed version 3.9 with these modifications:


[Attachment 62981 - Click to enlarge]


[Attachment 62982 - Click to enlarge]


[Attachment 62983 - Click to enlarge]

Installed to my phone Frida-Server from Play Store (https://play.google.com/store/apps/details?id=me.shingle.fridaserver&hl=tr&gl=US) and started.


PS: I wanted to share these experiences for noobs like me.

[tuskacz]

Today I've succeeded to dump L3 CDM from my old phone. I tried many times and couldn't succeeded last few days. Today uninstall all python versions and installed version 3.9 with these modifications:


[Attachment 62981 - Click to enlarge]


[Attachment 62982 - Click to enlarge]


[Attachment 62983 - Click to enlarge]

Installed to my phone Frida-Server from Play Store (https://play.google.com/store/apps/details?id=me.shingle.fridaserver&hl=tr&gl=US) and started.


PS: I wanted to share this experiences for noobs like me.

Who cares about L3, it's like boasting about breaking CSS keys for DVD. Childish.
Dump L1 then we'll talk. Otherwise you're not impressing me.

[Quint]

Of course, very interesting to read, that you are not impressed! But why then did you full-quote the whole thing? Would be most impressive to me and others if one wouldn't have to scroll about 20 miles down each page (as said a couple of times by different people).

[TonyChocolonely]

Who cares about L3, it's like boasting about breaking CSS keys for DVD. Childish.
Dump L1 then we'll talk. Otherwise you're not impressing me.

This thread literally is titled "How To Dump L3 CDM From Android Device's (ONLY Talk About Dumping L3 CDMS)". What might be easy for you might not have been for the OP and other users reading this. This whole thread and the others are about helping others, not about impressing others.