How To Dump L3 CDM From Android Device's (ONLY Talk About Dumping L3 CDMS)

[T33V33]

Hi,

My L3 is now dumped. I want to use it to get decryption keys from channel 4 (all4) and channel 5 (my5). How do I get keys from channel 4 and how do I get 1080p encrypted videos from channel 5? I can get channel 5 keys, but not the 1080p encrypted videos to decrypt. You can inbox or respond here, kindly.

Probably the wrong thread to be asking this

[santibg04]

Hi, can you help me? I only get the key_boxes.

Maybe.
The file I need so I can help you should be somewhere on your phone.
The usual name of the file is libwvhidl.so in rare cases, it could be something else. The size is almost always around 3.3 megabytes
Use a root file explorer app and try to find libwvhidl.so on your phone.
Or use this

adb shell
su
cp vendor/lib64/libwvhidl.so /data/local/tmp
adb pull /data/local/tmp/libwvhidl.so

or this

adb shell
su
cp vendor/lib/libwvhidl.so /data/local/tmp
adb pull /data/local/tmp/libwvhidl.so

and then find a way to send it to me.

Or, whatever, it's time for all of you to try doing it urself.
Basically, you open that file with Notepad and search for "oemcrypto_le".
The 2nd find of "oemcrypto_le" should come to this

[Attachment 63108 - Click to enlarge]
The "gibberish" above oemcrypto_le

aubxesnu bscwumyx covmuybg cuxpfige eraviosd euoobbxy gunfzzhu hzfgrcal lqsrlehr meopfgvt mtylmzom oucdfqff pldrclfq psyprwmh pyxylqvw qxkjmvcw sxmfafok udanauth vajorhmx ycrdjvyl

are the dynamic functions that should be replaced in the first line of script.js located in dumper/helpers folder.
And then you try again and that's it.

Hi,on a samsung what would the file be called? help please I have not been able to get the l3 from 2 samsung j5 and j2 devices

[[ss]vegeta]

Hi,on a samsung what would the file be called? help please I have not been able to get the l3 from 2 samsung j5 and j2 devices

There's enough information in that post, even more than you need.
Be thankful for that info, it's not public. Don't ask anymore questions and keep on searching.

[ridibunda]

It is said that Frida Server can also be used without rooting Android device.

Can Frida give us L3 CDMs from an unrooted phone? Has anyone tried it?

[DannGamerz]

It is said that Frida Server can also be used without rooting Android device.

Can Frida give us L3 CDMs from an unrooted phone? Has anyone tried it?

Even though to run the frida server doesnt need a rooted phone. But to dump the keys from the phone needed root because only the root can see the thing processing.

[Sorenb]

It is said that Frida Server can also be used without rooting Android device.

Can Frida give us L3 CDMs from an unrooted phone? Has anyone tried it?

Where is it said a non rooted device can run frida server? This I'm finding to be either a misunderstanding on your part or someone is lying. Frida requires magisk, which is super user privilege otherwise known as root.

[laynoto]

It is said that Frida Server can also be used without rooting Android device.

Can Frida give us L3 CDMs from an unrooted phone? Has anyone tried it?

Where is it said a non rooted device can run frida server? This I'm finding to be either a misunderstanding on your part or someone is lying. Frida requires magisk, which is super user privilege otherwise known as root.

Frida Server doesn't require root or magisk. You can install from play store: https://play.google.com/store/apps/details?id=me.shingle.fridaserver

[Sorenb]

And does it run as it should on a non rooted device? Considering the low level functions it is meant to capture it does seem unlikely. But, I'm willing to be corrected here.

[hech54]

ONLY-Talk-About-Dumping-L3-CDMS........
Is here a good place to discuss my love of turtles?



Sorry.....couldn't resist. It was like a challenge.

[ElCap]

ONLY-Talk-About-Dumping-L3-CDMS........
Is here a good place to discuss my love of turtles?

Sorry.....couldn't resist. It was like a challenge.

Well, seeing as the OP didn't even follow their own topic subject, I'll just leave this here
I like turtles

[EatThis]

People like to throw their theories as if they 'read' or 'heard' somewhere to see if they can get the answer they're looking for, why not just ask, does frida-server works without root?

The answer is, no. There are hundreds of apps on the Google Play store that require root and can be downloaded fine. it requires root to function.

[ridibunda]

Frida Server can be used without root.

Here is a guide to install:

https://koz.io/using-frida-on-android-without-root/

But... Look at the first-given answer above by DannGamerz... Without root, you cannot access the path where L3 CDMs are stored, because you don't have administrative privileges on your Android system. On "unrooted" devices, you are using a "guest" account, admin account belongs to Google

[basedcel]

Hi, can you help me? I only get the key_boxes.

Maybe.
The file I need so I can help you should be somewhere on your phone.
The usual name of the file is libwvhidl.so in rare cases, it could be something else. The size is almost always around 3.3 megabytes
Use a root file explorer app and try to find libwvhidl.so on your phone.
Or use this

adb shell
su
cp vendor/lib64/libwvhidl.so /data/local/tmp
adb pull /data/local/tmp/libwvhidl.so

or this

adb shell
su
cp vendor/lib/libwvhidl.so /data/local/tmp
adb pull /data/local/tmp/libwvhidl.so

and then find a way to send it to me.

Or, whatever, it's time for all of you to try doing it urself.
Basically, you open that file with Notepad and search for "oemcrypto_le".
The 2nd find of "oemcrypto_le" should come to this

[Attachment 63108 - Click to enlarge]
The "gibberish" above oemcrypto_le

aubxesnu bscwumyx covmuybg cuxpfige eraviosd euoobbxy gunfzzhu hzfgrcal lqsrlehr meopfgvt mtylmzom oucdfqff pldrclfq psyprwmh pyxylqvw qxkjmvcw sxmfafok udanauth vajorhmx ycrdjvyl

are the dynamic functions that should be replaced in the first line of script.js located in dumper/helpers folder.
And then you try again and that's it.

This is a ******* ugly hack but OK, kudos to making info public which has been passed down by someone to you.

[[ss]vegeta]

This is a ******* ugly hack but OK, kudos to making info public which has been passed down by someone to you.

Kudos to you for monitoring stuff like these instead of helping others.

[santibg04]

This is a ******* ugly hack but OK, kudos to making info public which has been passed down by someone to you.

Kudos to you for monitoring stuff like these instead of helping others.

Can you help me with the devices I have to get said file, I've searched and I still can't find the wall of the file, please

[EatThis]

Frida Server can be used without root.

Here is a guide to install:

https://koz.io/using-frida-on-android-without-root/

But... Look at the first-given answer above by DannGamerz... Without root, you cannot access the path where L3 CDMs are stored, because you don't have administrative privileges on your Android system. On "unrooted" devices, you are using a "guest" account, admin account belongs to Google

It's beyond me why someone would go this far to post this much of nonsense into a single single post.

The article linked is to include one of the Frida tools to your target .apk so you have access to it on the same process as the .apk. you cannot do this for anything beyond the target application. The processes which this dumper will hook to is outside of any aplicacions. frida-server, which is what you need, can be used on any running processes, including drm.widevine or mediaserver, which ultimately requires root privilegies.

Who cares what someone say, you will not be able to run this dumper without root and the rida-server daemon running. Period.

[basedcel]

This is a ******* ugly hack but OK, kudos to making info public which has been passed down by someone to you.

Kudos to you for monitoring stuff like these instead of helping others.

Not sure what helping means to you but to me it doesn't mean spoonfeeding people instead of trying to let them figure out some things on their own. If someone were to ask what those function(s) mean or are related to, I'm not sure you would be so confident in explaining that.

[basedcel]

This is a ******* ugly hack but OK, kudos to making info public which has been passed down by someone to you.

Kudos to you for monitoring stuff like these instead of helping others.

Can you help me with the devices I have to get said file, I've searched and I still can't find the wall of the file, please

stop begging and try to figure out stuff on your own.
official documentation is available on the internet, read it and figure shit out, you already have the code.

[[ss]vegeta]

I'm not sure you would be so confident in explaining that.

You are correct. But still, I don't see any proper point in your posts except "you know nothing".
I don't know anything.

Now, what will be the point of your presence here?

[k2000]

Hi

I'm trying to extract another Key L3 on a Samsung Galaxy S5 and it seems a lot more complicated than Samsung Galaxy S5 Neo had succeeded.

Magisk doesn't seem fully rooted it just installs on the Ram.

And this model the latest Android is version 6.1. So impossible to use Frida and Module to switch to L3 in magisk.

Do you have an idea for a workaround to have magisk as a super user?.

Thanks

[santibg04]

This is a ******* ugly hack but OK, kudos to making info public which has been passed down by someone to you.

Kudos to you for monitoring stuff like these instead of helping others.

Can you help me with the devices I have to get said file, I've searched and I still can't find the wall of the file, please

stop begging and try to figure out stuff on your own.
official documentation is available on the internet, read it and figure shit out, you already have the code.

I don't know how this file comes out in samsung, and I've searched the web and I can't find the solution, for something I'm asking for help

[T33V33]

This is a ******* ugly hack but OK, kudos to making info public which has been passed down by someone to you.

Kudos to you for monitoring stuff like these instead of helping others.

Can you help me with the devices I have to get said file, I've searched and I still can't find the wall of the file, please

stop begging and try to figure out stuff on your own.
official documentation is available on the internet, read it and figure shit out, you already have the code.

I don't know how this file comes out in samsung, and I've searched the web and I can't find the solution, for something I'm asking for help

A few posts up it literally tells you the location of the file...

Its either in vendor/lib/ or vendor/lib64/
And as also stated you will need to use a root file explorer app... ie. you will need root access

[santibg04]

This is a ******* ugly hack but OK, kudos to making info public which has been passed down by someone to you.

Kudos to you for monitoring stuff like these instead of helping others.

Can you help me with the devices I have to get said file, I've searched and I still can't find the wall of the file, please

stop begging and try to figure out stuff on your own.
official documentation is available on the internet, read it and figure shit out, you already have the code.

I don't know how this file comes out in samsung, and I've searched the web and I can't find the solution, for something I'm asking for help

A few posts up it literally tells you the location of the file...


If I am root and look in the indicated address and it is not there, that is why I ask for help, I have already done all the steps but the file is not there or at least with that name it is not there


If I am root and look in the indicated address and it is not there, that is why I ask for help, I have already done all the steps but the file is not there or at least with that name it is not there

Its either in vendor/lib/ or vendor/lib64/
And as also stated you will need to use a root file explorer app... ie. you will need root access

If I am root and look in the indicated address and it is not there, that is why I ask for help, I have already done all the steps but the file is not there or at least with that name it is not there

[gnodde]

can anyone help getting the 1080p keys for this all4 tv show plz?? and post them here quoting this post or pm thanks

main URL: https://www.channel4.com/programmes/guy-martins-lancaster-bomber/on-demand/72675-001

mpd: https://ak-jos-c4assets-com.akamaized.net/CH4_08_02_900_72675001001001_001/CH4_08_02_9..._template=time

license: https://c4.eme.lp.aws.redbeemedia.com/wvlicenceproxy-service/widevine/acquire

im im getting is:

license response status: <Response [403]>
server reports:
server did not issue license, make sure you have correctly pasted all the required headers in the headers.py. Also check json/raw params of POST request.

KID:KEY -> 00000000000000000000000004277739:07eee2c5ddd4b8299 a8a765ac342c67c

Anychange u are able to decrypt my5 1080p Videos if i send u the 1080p mpd links plz?

the 1080p MY5 Mpds are available to get via tv app by adding _1080p (after manifest) please DM ASAP Thanks

Hi! Long time lurker here, but decided to make an account, as this My5 _1080p "trick" has been bothering me for a while now and sorry if I bump this up while it probably should have it's own thread.

Does someone have an example link maybe as I can't get this to work?

I made some code that makes a request to get the playback info json from
https://cassie-auth.channel5.com/api/v2/media/XXXXXX/E1234.json (example request)

The resulting JSON (sample below) has the mpd url in it and the WV url etc.., but I can add whatever I want to it, it will not become HD.
So I am guessing that this _1080p trick happens somewhere else? I tried with the Android and AndroidTV and the website but the stream results are always similar, so I am guessing either I need to hit a different endpoint or this _1080p trick is not working anymore?

example response I get from cassie-auth:

<?xml version="1.0" encoding="UTF-8"?>
<content>
    <id>C53336305473</id>
    <asset>
        <renditions>
            <rendition>
                <renditionid>0</renditionid>
                <format>SD</format>
                <bitrates>
                    <bitrate>160</bitrate>
                    <bitrate>360</bitrate>
                    <bitrate>480</bitrate>
                    <bitrate>800</bitrate>
                    <bitrate>1200</bitrate>
                    <bitrate>1500</bitrate>
                </bitrates>
                <url>https://akadash0.akamaized.net/cenc/C53336301233/C53336301233A/20220117193655/C5333630123A-tt.mpd</url>
            </rendition>
        </renditions>
        <profile>dash1</profile>
        <drm>widevine</drm>
        <keyserver>https://cassie.channel5.com/api/v2/licences/widevine/171/C5333630123?expiry=1644594863&amp;tag=3063323730396536383464333334343163653837785566664663331626539395555677</keyserver>
        <version>A</version>
        <subtitled>true</subtitled>
        <subtitleurl>https://akasubs.akamaized.net/webvtt/C5333632503/C5333630403A.vtt</subtitleurl>
        <thumbnailsurl>https://akathumbnails.channel5.com/C5333630403A/thumbnails.vtt</thumbnailsurl>
        <audiodescribed>false</audiodescribed>
        <duration>2708</duration>
    </asset>
</content>

[T33V33]

Hi! Long time lurker here, but decided to make an account, as this My5 _1080p "trick" has been bothering me for a while now and sorry if I bump this up while it probably should have it's own thread.

Does someone have an example link maybe as I can't get this to work?

I made some code that makes a request to get the playback info json from
https://cassie-auth.channel5.com/api/v2/media/XXXXXX/E1234.json (example request)

The resulting JSON (sample below) has the mpd url in it and the WV url etc.., but I can add whatever I want to it, it will not become HD.
So I am guessing that this _1080p trick happens somewhere else? I tried with the Android and AndroidTV and the website but the stream results are always similar, so I am guessing either I need to hit a different endpoint or this _1080p trick is not working anymore?

example response I get from cassie-auth:

1080p it only available via the MY5 Smart TV app on Samsung TVs. Not on Android or any other device. I suspect (Haven't been able to verify myself) that you need to sniff the data from the TV and I think this maybe gives a different mpd that can then have the _1080p trick done?

[gnodde]

Thanks! I will give that a go in that case.. just need to find a Samsung TV next , or if someone is willing to share some samples of the endpoints (complete mpd link for example) of the 1080p that would help as well. In the end they all talk to that cassie server I am sure of that, it is just a matter of finding out what the right path in that API is.

[gnodde]

Did some experimenting last night and I think I sort of have the general idea now of how this works. What I would need is the platformId for Samsung TV's if someone would be willing to share that, that would be great

From my experiments, my LG Tv requests https://cassie.channel5.com/platform/my5lg/config.json for example, but Samsung is not as easy as my5samsung unfortunatly. Even then I am pretty sure I need the private key to make the requests to the auth server to get the JSON but having the right PlatformID would be a good start.

I got it all working for SD content at the moment but I want the HD stuff

[Dannyboi]

please check your PM thanks as im the one that discovered the _1080p trick (these expire quickly if it does ill post it again)

Normal MPD:
http://akasss.channel5.com/playready/C5318400001/C5318400001A/20200629142103/C53184000...A.ism/Manifest

1080p MPD:
http://akasss.channel5.com/playready/C5318400001/C5318400001A/20200629142103/C53184000...Manifest_1080p

[T33V33]

please check your PM thanks as im the one that discovered the _1080p trick (these expire quickly if it does ill post it again)

Normal MPD:
http://akasss.channel5.com/playready/C5318400001/C5318400001A/20200629142103/C53184000...A.ism/Manifest

1080p MPD:
http://akasss.channel5.com/playready/C5318400001/C5318400001A/20200629142103/C53184000...Manifest_1080p

Playready encrypted?

[Dannyboi]

please check your PM thanks as im the one that discovered the _1080p trick (these expire quickly if it does ill post it again)

Normal MPD:
http://akasss.channel5.com/playready/C5318400001/C5318400001A/20200629142103/C53184000...A.ism/Manifest

1080p MPD:
http://akasss.channel5.com/playready/C5318400001/C5318400001A/20200629142103/C53184000...Manifest_1080p

Playready encrypted?

yes that sucks but think they may also be encrypted using widevine for 1080p