Decryption and the Temple of Doom

[yungtaco]

Yo, I have a probably dumbass question, but I'm too neurotic not to make sure. If I successfully remove and decrypt a drm protected video, is it okay to share it? Can it be traced back to the account I downloaded it from? Through something like exif data or metadata in the file or something?

Watermarking has recently become a thing. Whether any CDN currently watermarks their output - who knows. Probably not a good idea to break into someone's IP and publicly share it.

Okay, that's exactly the advice I needed to hear. Thank you for the quick reply!

[mosh1]

hello im back again. i hope you can help me...

i have some questions, that are unclear to me. i tried to search the forum, but every thread is not really answering the logic behind answers.

1.i want to download this series: https://plus.rtl.de/video-tv/serien/medical-detectives-geheimnisse-der-gerichtsmedizin...affel-1-241411
- in order to decrypt these Videofiles. Do i need the specific private key of this Site?
- or is it possible to decrypt the videos with a private key from your tutorial (widevine, frida, hook, wks bla)
- i did not understand why there are more than one key in output. The video i downloaded was just 1 file

2. i sucessfully got a pair of keys from bitmoovin. looks like:

--key ccbf5fb4c2965be7aa130ffb3ba9fd73:9cc0c92044cb1d69433f5f5839a159df
--key 9bf0e9cf0d7b55aeb4b289a63bab8610:90f52fd8ca48717b21d0c2fed7a12ae1
--key eb676abbcb345e96bbcf616630f1a3da:100b6c20940f779a4589152b57d2dacb
--key 0294b9599d755de2bbf0fdca3fa5eab7:3bda2f40344c7def614227b9c0f03e26
--key 639da80cf23b55f3b8cab3f64cfa5df6:229f5f29b643e203004b30c4eaf348f4

3. i have a windows pc and made this command over mp4decrypt

mp4decrypt --show-progress --key ccbf5fb4c2965be7aa130ffb3ba9fd73:9cc0c92044cb1d69433f5f5839a159df --key 9bf0e9cf0d7b55aeb4b289a63bab8610:90f52fd8ca48717b21d0c2fed7a12ae1 --key eb676abbcb345e96bbcf616630f1a3da:100b6c20940f779a4589152b57d2dacb --key 0294b9599d755de2bbf0fdca3fa5eab7:3bda2f40344c7def614227b9c0f03e26 --key 639da80cf23b55f3b8cab3f64cfa5df6:229f5f29b643e203004b30c4eaf348f4 (video i want to decrypt.mp4) (output.mp4)

the video (downloaded over dl-re) is in the same path as mp4decrypt
i also tried to use only one key and i tried to do every time --key 1:blbablabla

every time the video is not playable (green stuff, no sound)

i tried to get a fresh pair of keys with plus.rtl.de but i can not find the rigt license url. everything i got was "https://widevine.tvnow.de/index/license"
when i inserted the header and start l3.py i get this error "unable to parse license - check protobufs"

could you help me please?

[Obo]

You probably did miss some headers for the license request - copy the full request from your browsers development tools with "copy as curl request" and convert it at curlconverter.com to python code, which you can put into headers.py. The URL is correct, I got the following key:

--key f1f3e2bc015852018f313154b1f9c0eb:58ef0139c447e20a17c0463395a25402

[mosh1]

oh man. which header did you use? there are tons of files you can choose. was that the ".mpd" entry?

[Obo]

All of the headers of the license request (https://widevine.tvnow.de/index/license)

The .mpd entry describes the download, use that if you want to download the video with yt-dlp or any other tool. There's usually no need to copy any of the headers of that request.

[A_n_g_e_l_a]

oh man. which header did you use? there are tons of files you can choose. was that the ".mpd" entry?

If you are applying for a license do you think the licence url's header could be a good candidate? Keep your thinking head.

[mosh1]

omg, thank you both! after reading it, i feel a little bit stupid
in order to get a private key from the license Server, you should get it from the license server hahaha

im happy now, thank you Angela for the tutorial and Obo for the last piece

[Ahmed omar]

oh man. which header did you use? there are tons of files you can choose. was that the ".mpd" entry?

If you are applying for a license do you think the licence url's header could be a good candidate? Keep your thinking head.

hello
i want to get keys from vdocipher but l3.py need modify someone told me that. i tried to get keys but i couldn't


py l3.py

PSSH: AAAAUnBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAADIiKnZkb2 NpcGhlcjoxNWY4YWVlNzBlMzQ0NzZlODg0NGViYmNmMTVhOWMx Zkjj3JWbBg==
License URL: https://license.vdocipher.com/auth

[A_n_g_e_l_a]

hello
i want to get keys from vdocipher but l3.py need modify someone told me that. i tried to get keys but i couldn't

Tough. But discussing vdcipher here has nothing to do with this thread and will likely result in it being closed.

Think before you post! Go elsewhere. I suggest you ask your 'someone' who told you about modifying l3.py!!

[grootlearner]

Help needed,

I m using ""python 3.10.2""
and frida ""frida-16.1.4""

frida running like this
\dumper-main>frida-ls-devices
Id Type Name OS
-------- ------ --------------- ------------------
local local TASK-MASTER Windows 10.0.19045
barebone remote GDB Remote Stub
socket remote Local Socket

and protobuf-3.20.3
pywidevine 1.4.3

On my PC but when trying to dump cdm i m getting error

line 1193, in get_device_matching
return Device(self._impl.get_device_matching(lambda d: predicate(Device(d)), raw_timeout))
frida.InvalidArgumentError: device not found

more in attachment.

Kindly show me a way to dump l3.
Thanks.
[Attachment 73867 - Click to enlarge]

[A_n_g_e_l_a]

[Attachment 73883 - Click to enlarge]
There's your error: device not found.

adb devices?

[Spy]

I tried alot of frida server versions* all give me the same error when running the dumper






(My device is redmi note 11s , android 13 , rooted with magisk if this helps)

[A_n_g_e_l_a]

You need to find the function names for dumper to hook since you are using a later Android version. The link for finding function names from android 10 11 12 is somewhere in this thread. I'm sorry I do not have it to hand.
Kindly know you wasted your time trying different Frida versions. That wasn't advice you found here.
There are some people on the forum who seem to think the Frida version that worked for them MUST be the one for everyone else to use; as with python versions.

[Spy]

I tried editing the js in the script

with the text i got from "libwvhidl.so" i saw someone saying it should work after that
the text i edited:
"aucgueyc birbsmsd bmmodzuz bnomcggp dvynlnsn ezlwnpmd ffclmzgx frugjfxz fsnjtqti fxyuoecq kkjmrxxp lgfhnode ncmqbmbc nisionfx pafundwz plzfrxzg qtwoquvu uyeqpizj vzonshxu ypyubjuo"

But still

[Spy]

If you need them



(I have been reading here for like a month or two )

[A_n_g_e_l_a]

I think when you use the found function names you remove all existing names and only add one new one at a time. Then run dumper.
Mine was second on the list with Android 11.

[Spy]

I think when you use the found function names you remove all existing names and only add one new one at a time. Then run dumper.
Mine was second on the list with Android 11.

I already did replace all the functions names with mine but didnt work

[A_n_g_e_l_a]

I already did replace all the functions names with mine but didnt work

But did you try one function name ONLY at a time??

[Spy]

I already did replace all the functions names with mine but didnt work

But did you try one function name ONLY at a time??

I have tried

dump_keys.py --function-name 'ezlwnpmd'

with every one of them, and i also tried edting into the js file like this

[A_n_g_e_l_a]

I have tried

OK Just checkin'

Don't give up yet. Pop over to Cedrics thread, in the stickies, about getting a cdm from an emulator. Go through the techniques there. First try with a low version of Android where we know dumper works. Then when you understand the technique and get results... then try again with your Redmi.
I suspect the function names are wrong but the only way to be sure of that is to know that you can get keys from Android emulator with published function names

[Spy]

I have tried

OK Just checkin'

Don't give up yet. Pop over to Cedrics thread, in the stickies, about getting a cdm from an emulator. Go through the techniques there. First try with a low version of Android where we know dumper works. Then when you understand the technique and get results... then try again with your Redmi.
I suspect the function names are wrong but the only way to be sure of that is to know that you can get keys from Android emulator with published function names

can I use a Samsung Galaxy J5? (I have read on the cdrm project archive that a Samsung wont work )

[Sadomasochist]

I found an old android devicie I wanted to get cdm out of, it showed 64 bit in the device specification site but the 64 arm server wasnt working(yes I also checked ARM cortex) and i did this command abd shell shell getprop ro.product.cpu.abi and it gives out the architecture which is armeabi-v7a. So it is not a 64 bit one, so I got 'frida-server-16.1.3-android-arm' did all the steps! once it reached /data/local/tmp/frida-server-16.1.3-android-arm &

I found my phone restarting, and i couldnt run that command again, it says the server is already running, so i did a 'netstat -tulpn | grep :27042' andd it showed me

tcp 0 0 127.0.0.1:27042 0.0.0.0:* LISTEN 16080/frida-server-16.1.3-android-arm

I mean i tried killing 16080 and run again, it is the same process phone restarts and it this port is listening but dumper always gives the error

return self._impl.enumerate_processes(**kwargs) # type: ignore
frida.TransportError: timeout was reached

The phone that I am trying on is motorola e5 play! So any help is appreciated.

[when I tried running the arm64 one i get this error

james:/ # /data/local/tmp/frida-server-16.1.3-android-arm64 &
[1] 6404
james:/ # : /data/local/tmp/frida-server-16.1.3-android-arm64: not executable: 64-bit ELF file
]

[Sadomasochist]

I think I reduced the version to the one shown in example did crash my phone but then I had incompatible error in dump_keys so I reduced the version of frida-tools in my pc pip install frida-tools = 10.0.0 something close to the version of frida installed on my phone and it worked. I was able to dump it. Thanks!

[A_n_g_e_l_a]

I was able to dump it. Thanks!

Woohey!

[javidial]

In vomistar Spain, the license url in chrome doesn’t contain the token needed. The only way is to emulate or get an android tv, and check internet traffic from there with a PC.
Can anybody point me out to how to check the traffic of an android tv, similar to devtools in chrome?

Emulating the tv OS with android studio is easy, but u don’t know how to connect the terminal (windows) to the android tv and get the token, and perhaps the other staff like mpd, etc.
Thanks

[A_n_g_e_l_a]

In vomistar Spain, the license url in chrome doesn’t contain the token needed. The only way is to emulate or get an android tv, and check internet traffic from there with a PC.
Can anybody point me out to how to check the traffic of an android tv, similar to devtools in chrome?

Emulating the tv OS with android studio is easy, but u don’t know how to connect the terminal (windows) to the android tv and get the token, and perhaps the other staff like mpd, etc.
Thanks

Your question is off topic for this thread about getting a CDM; you'll get a beeter response asking in a new thread.

However, the license token will be there but it will likely be encrypted.

If you want to view traffic passing from your android TV it too will be encrypted. Wireshark allows all ip traffic to be intercepted and but it is not in the clear. Your best bet is either to find someone who has defeated Vomistar, and is willing to share a script, or use a rooted android device, and perhaps frida tools, to help capture what is going on. All that is far beyond my expertise and, I suspect, most of whom post here.

[Spy]

how can i get keys from inkryptvideos after getting a working cdm?

[A_n_g_e_l_a]

how can i get keys from inkryptvideos after getting a working cdm?

Begin by not asking off-topic question here. Start your own thread.

[Spy]

how can i get keys from inkryptvideos after getting a working cdm?

Begin by not asking off-topic question here. Start your own thread.

multiple threads have the same topic but with no answers so i thought here someone could help

[maydayhelp]

How did you get to that content ID?

From the PSSH. You can use this: https://tools.axinom.com/decoders/PsshBox

Hello, I entered my PSSH into that site, but I can't tell which entry is the "content ID".

My PSSH is:

AAAAOHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAABgSEAAAAAAcHi0zYzAgICAgICBI88aJmwY=