Decryption and the Temple of Doom

[A_n_g_e_l_a]

The model in the thread, T95 S1 2Gb/16Gb, is no more available on amazon in my country and on other sites it costs much more than 30 USD or any other currency you use.

Can anybody recommend me a model that is compatile with the method explained i this thread?

Thanks in advance

That's a pain. Amazon UK have it https://www.amazon.co.uk/Android-Amlogic-Digital-Display-Ethernet/dp/B07F9K51DV Or from China https://fr.aliexpress.com/item/32895112328.html?algo_pvid=89622d80-b4d1-4bfc-af2f-2d65...d=KuOXhlcHPCiA

[MrMaffin]

It appears T95 S1 is available in every European Country on their respective Amazon website.
(I checked .co.uk, .es, .de, .fr and .it).

I really appreciated your thread, this is a wonderfully well-written guide that I look further to using.
Is there a reason for which it should only work on devices up to Android 9?
I'm waiting for my own T95 S1 to be delivered at home, but I wanted to try it out with an Amazon Fire Stick with Root Access, but I'm afraid it won't work since it's using a higher major release of Android.

Again, I want to show you my greatest appreciation for your effort in writing such a guide.

[A_n_g_e_l_a]

...
Is there a reason for which it should only work on devices up to Android 9?

Simply, Google got better at tightening Android security. And thanks for your kind comment.

[BeLive]

...

If you have older non-usable Android devices you can try extracting from them after getting root access. One of my devices wasn't working so I borrowed a friend's phone which he wasn't using, it doesn't have to be exactly a Android TV box.
+1 for guide by Angela as wouldn't have done it without that.

[MrMaffin]

...
and open https://bitmovin.com/demos/drm; let the page load and then close Chrome.

I was going to say that the bitmovin URL wasn't working anymore, but I found out while replying to this issue that the URL inside the post contains an illegal semi-colon, just saying.

P.S. I canceled the order for the TV Box, given that I've taken an old phone with Android 6.0.1!

I'll write soon if it works for me!

[A_n_g_e_l_a]

...
and open https://bitmovin.com/demos/drm; let the page load and then close Chrome.

I was going to say that the bitmovin URL wasn't working anymore, but I found out while replying to this issue that the URL inside the post contains an illegal semi-colon, just saying.

Great! Thanks for pointing it out. Now corrected.

[missdgsn]

Dear all,
i dont know it is been dump, it said
2022-08-13 01:05:31 AM - Helpers.Scanner - 82 - INFO - Running libdrmwvmplugin.so at 0xb63e5000
2022-08-13 01:05:31 AM - root - 19 - DEBUG - Process(pid=11823, name="sh", parameters={})
2022-08-13 01:05:31 AM - root - 19 - DEBUG - Process(pid=11834, name="su", parameters={})
2022-08-13 01:05:31 AM - root - 19 - DEBUG - Process(pid=11837, name="daemonsu:0:11834", parameters={})
2022-08-13 01:05:31 AM - root - 19 - DEBUG - Process(pid=11849, name="tmp-mksh", parameters={})
2022-08-13 01:05:31 AM - root - 19 - DEBUG - Process(pid=11851, name="app_process", parameters={})
2022-08-13 01:05:31 AM - root - 19 - DEBUG - Process(pid=11952, name="frida-server-15.2.2-android-arm", parameters={})
2022-08-13 01:05:31 AM - root - 19 - DEBUG - Process(pid=11962, name="daemonsu:0:11952", parameters={})
2022-08-13 01:05:31 AM - root - 19 - DEBUG - Process(pid=11963, name="logcat", parameters={})
2022-08-13 01:05:31 AM - root - 25 - INFO - Hooks completed

so where are they being stored?

[BadJoker]

In the folder on your PC

[T33V33]

2022-08-13 01:05:31 AM - root - 25 - INFO - Hooks completed

At this point they haven't been dumped.... its telling you its hooked onto the processes waiting for you to play some WV protected content on the device... Either play the Bitmovin demo page or a VOD app (Netflix etc) and it should then throw out a load more on the script before dumping the files to your PC

[missdgsn]

2022-08-13 01:05:31 AM - root - 25 - INFO - Hooks completed

At this point they haven't been dumped.... its telling you its hooked onto the processes waiting for you to play some WV protected content on the device... Either play the Bitmovin demo page or a VOD app (Netflix etc) and it should then throw out a load more on the script before dumping the files to your PC

thank you for reply.
so it means i need to play longer on website or HLS app

[T33V33]

2022-08-13 01:05:31 AM - root - 25 - INFO - Hooks completed

At this point they haven't been dumped.... its telling you its hooked onto the processes waiting for you to play some WV protected content on the device... Either play the Bitmovin demo page or a VOD app (Netflix etc) and it should then throw out a load more on the script before dumping the files to your PC

thank you for reply.
so it means i need to play longer on website or HLS app

If you are playing content already and the scripy is stuck at the 'hooks complete' message.... it means the script has attached to the wrong processes for your device. Not every device is the same so in some cases the script needs updating with the correct processes for your device. There is information on this forum somewhere explaining what to do when stuck at hooks complete.

...
Is there a reason for which it should only work on devices up to Android 9?

Simply, Google got better at tightening Android security. And thanks for your kind comment.

The script will in theory work beyond Android 9. I have been able to dump from ASE with both Android 10 and 11 running (not tried any actual devices though - no need to). Its pretty much all about finding and attaching to the correct processes for each Android version.

[libero08]

It work also for v12, i didnt try yet v13 but on same version android, different models can be difference of functions!

[A_n_g_e_l_a]

I have been able to dump from ASE with both Android 10 and 11 running (not tried any actual devices though - no need to). Its pretty much all about finding and attaching to the correct processes for each Android version.

I assume you are talking about Android Scripting Environment (ASE) and this https://github.com/damonkohler/sl4a ? Care to document running a dump script directly on the Android device? Or point to where you found it?

[basedcel]

I have been able to dump from ASE with both Android 10 and 11 running (not tried any actual devices though - no need to). Its pretty much all about finding and attaching to the correct processes for each Android version.

I assume you are talking about Android Scripting Environment (ASE) and this https://github.com/damonkohler/sl4a ? Care to document running a dump script directly on the Android device? Or point to where you found it?

Android Studio Emulator

[A_n_g_e_l_a]

Android Studio Emulator

Ah! Thanks. I'm old enough to just know it as Android Emulator. It used to be just Eclipse for Android app development back in 2010.

I tried using an emulated device running both Android 10 and 11 with no luck - despite adding extra process names.
I rooted the emulated device with Magisk and that appears to be a little hamstrung these days since its developer topjohnwu joined Google's team. I think root is partial these days with the official Magisk..

I suspect those claiming success used one of the earlier Magisk versions - now disappeared. But I really haven't rooted a phone properly for years so may be barking up the wrong tree?

I do wonder though since Dumper is written in python whether Android Scripting Environment would allow it to run on the phone directly. Would still need root though.

[missdgsn]

2022-08-13 01:05:31 AM - root - 25 - INFO - Hooks completed

At this point they haven't been dumped.... its telling you its hooked onto the processes waiting for you to play some WV protected content on the device... Either play the Bitmovin demo page or a VOD app (Netflix etc) and it should then throw out a load more on the script before dumping the files to your PC

thank you for reply.
so it means i need to play longer on website or HLS app

If you are playing content already and the scripy is stuck at the 'hooks complete' message.... it means the script has attached to the wrong processes for your device. Not every device is the same so in some cases the script needs updating with the correct processes for your device. There is information on this forum somewhere explaining what to do when stuck at hooks complete.+

...
Is there a reason for which it should only work on devices up to Android 9?

Simply, Google got better at tightening Android security. And thanks for your kind comment.

The script will in theory work beyond Android 9. I have been able to dump from ASE with both Android 10 and 11 running (not tried any actual devices though - no need to). Its pretty much all about finding and attaching to the correct processes for each Android version.

thank you.
finally i got my private CDM now.
the client_id BIN and private_key PEM
i want to replace the CDM of script from http://getwvkeys.cc/
so what should i do next.

[A_n_g_e_l_a]

i want to replace the CDM of script from http://getwvkeys.cc/
so what should i do next.

Either use your CDM locally; see towards the end my first post about using WKS-KEYS for details; or upload your CDM to gewvkeys.cc. I understand the site gives instruction when you begin the process. (That OR could be an AND!)

You will now face a conspiracy of silence Many people have written scripts to automatically download stuff but you'll be left to develop your own. Almost no-one will post code as script authors are frightened the scripts would become useless when website admins notice too much of their media being purloined and change their processes.

If you go the getwvkeys route join their Discord channel for help and scripts to get keys https://discord.gg/UEt4R3nPJN

[davidbdn1994]

Can it work on a tablet android 7.2??

[cedric8528]

It may work...the first CDM I had got comes from an Galaxy Tab S2 with Android 7

[houjiangen]

There is a problem with dumper. Please help me


D:\python3\python.exe E:/WKS-KEYS/l3.py
Traceback (most recent call last):
File "E:\WKS-KEYS\l3.py", line 7, in <module>
import base64, requests, sys, xmltodict
ModuleNotFoundError: No module named 'requests'

[[ss]vegeta]

There is a problem with dumper. Please help me


D:\python3\python.exe E:/WKS-KEYS/l3.py
Traceback (most recent call last):
File "E:\WKS-KEYS\l3.py", line 7, in <module>
import base64, requests, sys, xmltodict
ModuleNotFoundError: No module named 'requests'

Yeah, that's definitely a "dumper" problem and also googling the error will not find the easy fix of this.

[davidbdn1994]

im trying all day, but i still having this error executing dump-keys.py:

Traceback (most recent call last):
File "C:\Users\David\Downloads\dumper-main\dump_keys.py", line 14, in <module>
device = frida.get_usb_device()
File "C:\Users\David\AppData\Roaming\Python\Python310\s ite-packages\frida\__init__.py", line 91, in get_usb_device
return get_device_matching(lambda d: d.type == 'usb', timeout, **kwargs)
File "C:\Users\David\AppData\Roaming\Python\Python310\s ite-packages\frida\__init__.py", line 99, in get_device_matching
return get_device_manager().get_device_matching(predicate , timeout, **kwargs)
File "C:\Users\David\AppData\Roaming\Python\Python310\s ite-packages\frida\core.py", line 34, in wrapper
return f(*args, **kwargs)
File "C:\Users\David\AppData\Roaming\Python\Python310\s ite-packages\frida\core.py", line 66, in get_device_matching
return Device(self._impl.get_device_matching(lambda d: predicate(Device(d)), raw_timeout))
frida.InvalidArgumentError: device not found

Any help please?

[T33V33]

im trying all day, but i still having this error executing dump-keys.py:

Traceback (most recent call last):
File "C:\Users\David\Downloads\dumper-main\dump_keys.py", line 14, in <module>
device = frida.get_usb_device()
File "C:\Users\David\AppData\Roaming\Python\Python310\s ite-packages\frida\__init__.py", line 91, in get_usb_device
return get_device_matching(lambda d: d.type == 'usb', timeout, **kwargs)
File "C:\Users\David\AppData\Roaming\Python\Python310\s ite-packages\frida\__init__.py", line 99, in get_device_matching
return get_device_manager().get_device_matching(predicate , timeout, **kwargs)
File "C:\Users\David\AppData\Roaming\Python\Python310\s ite-packages\frida\core.py", line 34, in wrapper
return f(*args, **kwargs)
File "C:\Users\David\AppData\Roaming\Python\Python310\s ite-packages\frida\core.py", line 66, in get_device_matching
return Device(self._impl.get_device_matching(lambda d: predicate(Device(d)), raw_timeout))
frida.InvalidArgumentError: device not found

Any help please?

It's telling you the error... "device not found"

For whatever reason Frida is not seeing your device

[missdgsn]

There is a problem with dumper. Please help me


D:\python3\python.exe E:/WKS-KEYS/l3.py
Traceback (most recent call last):
File "E:\WKS-KEYS\l3.py", line 7, in <module>
import base64, requests, sys, xmltodict
ModuleNotFoundError: No module named 'requests'

install requests in python

pip install requests

[missdgsn]

im trying all day, but i still having this error executing dump-keys.py:

Traceback (most recent call last):
File "C:\Users\David\Downloads\dumper-main\dump_keys.py", line 14, in <module>
device = frida.get_usb_device()
File "C:\Users\David\AppData\Roaming\Python\Python310\s ite-packages\frida\__init__.py", line 91, in get_usb_device
return get_device_matching(lambda d: d.type == 'usb', timeout, **kwargs)
File "C:\Users\David\AppData\Roaming\Python\Python310\s ite-packages\frida\__init__.py", line 99, in get_device_matching
return get_device_manager().get_device_matching(predicate , timeout, **kwargs)
File "C:\Users\David\AppData\Roaming\Python\Python310\s ite-packages\frida\core.py", line 34, in wrapper
return f(*args, **kwargs)
File "C:\Users\David\AppData\Roaming\Python\Python310\s ite-packages\frida\core.py", line 66, in get_device_matching
return Device(self._impl.get_device_matching(lambda d: predicate(Device(d)), raw_timeout))
frida.InvalidArgumentError: device not found

Any help please?

you need to start frida server on your android device first.
once your android device not restart and stable it.
try the dumper script.
if your android restart after you input ./frida-server on CMD.
everything has to repeat again.

[A_n_g_e_l_a]

In my earlier posts I mentioned using narrowvine-reborn as an easy downloader. Since I have had a couple of PMs asking for pointers to using Narrowvine reborn I am adding it here.

Narrowvine-reborn.py takes two inputs - the mpd url and the url of the license file. Narrowvine-reborn works best if additional headers are not required but I believe it will take a simple input from headers.py in the same folder.

I downloaded narrowvine-reborn from here https://github.com/alienmaster9/narrowvine-reborn It is a clone of the original which was deleted.

I took only narrowvine-reborn.py from the download zip and placed it in the WKS-KEYS folder intending for it to use WKS-KEYS' ancillary files. (The CDM and pointers to its location)

As downloaded, narrowvine-reborn.py needs changes.

diff narrowvine_reborn.py narrowvine_reborn.py.orig
3c3
< from pywidevine.L3.decrypt.wvdecrypt import WvDecrypt
---
> from pywidevine.decrypt.wvdecrypt import WvDecrypt
78c78
<     os.system(f'yt-dlp -o "{cachePath}/encrypted_video.%(ext)s" --no-warnings --external-downloader aria2c --allow-unplayable-formats --no-check-certificate -f {VIDEO_ID} "{mpd_url}" --convert-subs srt --write-subs  -o "{cachePath}/encrypted_video.%(ext)s"')
---
>     os.system(f'yt-dlp -o "{cachePath}/encrypted_video.%(ext)s" --no-warnings --external-downloader aria2c --allow-unplayable-formats --no-check-certificate -f {VIDEO_ID} "{mpd_url}" -o "{cachePath}/encrypted_video.%(ext)s"')
90,109c90,97
<     try:
<         ff = FFmpeg(
<             global_options=['-loglevel','error'],
<             outputs={f'{outputPath}/{FILENAME}': ['-c:v','copy','-c:a','copy','-c:s', 'mov_text']},
<             inputs={
<                 f'{cachePath}/decrypted_video.mp4':None,
<                 f'{cachePath}/decrypted_audio.m4a':None,
<                 f'{cachePath}/encrypted_video.en.srt':None}
<         )		
<         ff.run()
<     except:
<         ff = FFmpeg(
<             global_options=['-loglevel','error'],
<             outputs={f'{outputPath}/{FILENAME}': ['-c:v','copy','-c:a','copy']},
<             inputs={
<                 f'{cachePath}/decrypted_video.mp4':None,
<                 f'{cachePath}/decrypted_audio.m4a':None}
<         )		
<         ff.run()
<         
---
>     ff = FFmpeg(
>         global_options=['-loglevel','error'],
>         outputs={f'{outputPath}/{FILENAME}': ['-c:v','copy','-c:a','copy']},
>         inputs={
>             f'{cachePath}/decrypted_video.mp4':None,
>             f'{cachePath}/decrypted_audio.m4a':None}
>     )		
>     ff.run()
209c197
< empty_folder(cachePath)
---
> #empty_folder(cachePath)
264,276c252,256
< 
< '''
< uncomment lines below to restore 'delete cache option'
< '''
< #delete_choice = input("Delete cache files? (y/n)\ny) Yes (default)\nn) No\ny/n> ")
< #if delete_choice == "n":
< #    pass
< #else:
< #    empty_folder(cachePath)
< '''
< comment out this line if restoring 'delete cache option'
< '''
< empty_folder(cachePath)
---
> delete_choice = input("Delete cache files? (y/n)\ny) Yes (default)\nn) No\ny/n> ")
> if delete_choice == "n":
>     pass
> else:
>     empty_folder(cachePath)

In the above 'diff' output:-
< means new
> means original but now replaced
Numbers are line numbers

Note: ' from pywidevine.L3.decrypt.wvdecrypt import WvDecrypt' above is my location for my CDM etc; check yours is the same especially if you are not using WKS-KEYS

I added the facility to download subtitles and for ffmpeg not to break if none were found.
I removed the annoyances to the program flow; stopping to ask questions about cache delete.

The fact that only the mpd url and license url are needed makes sites that provide the licence url within the mpd response particularly easy to download as it is possible to automate the whole download given the mpd.

For example a linux script to spit out the license url from UKTVPlay.co.uk:-

#!/bin/bash
# Ask the user for mpd link
echo Enter the mpd url: 
read  mpdurl
curl $mpdurl | awk '{print($4)}' |  awk '/https/{print $0}'| sed s/bc:licenseAcquisitionUrl=// | awk '{if (NR==2) print($0)}'

Finally I am only an occasional Narrowvine-reborn user. I am not its developer nor am I an expert. The above is all I know! So ask your questions here, in this thread, please.

[bassamh]

congratulations, you achieved nothing

Well, next time will be better.
It was the first shot for me
maybe it is here the issue? OEM crypto API ver 13 ?
Relax bro, i will extract from another terminal. So stay in touch ready to give me a hand




update,

at last i found those bastards...


[Attachment 65072 - Click to enlarge]


could someone to give me a hand, gently i ask , privately?
i dont want to disturb or break the forum rules here around.
thank you.

What did you do to get those files from device? I'm still getting .json .bin files

[darkw4v3]

I'm going to print the majority of this thread and frame it.

It has it all, an excellent tutorial/run through (refreshing), an epic sparring match between a dimwit and the community. Plus, I mean, "Temple of Doom" is in the title. You can't beat it.

[kingdo9]

For those having the problem where only two files are found one being the .json

I had this issue. You have to get your own references from libwvhidl
Although it still didn't work for me adding them onto script.js , only one of the below strings prevented it from working so I had to remove one by one until i found the problematic one.

random examples ( you need your own). I had to remove one of these to make it work.
'cwrgeplc', 'dnvyjyze', 'kgaiertd', 'podffucp', '

It worked on Android 9 , version 14 here.

[A_n_g_e_l_a]

For those having the problem where only two files are found one being the .json ...snip

Excellent post; thank you and congratulations getting over the final hurdle.

For people getting a json dumped and needing another file, [ss]Vegeta has the full low-down here of where to fine libwvhidl on your phone at: https://forum.videohelp.com/threads/404219-How-To-Dump-L3-CDM-From-Android-Device-s-(O...e6#post2646150 and how to find the required strings mentioned by kingdo9

Only don't send libwvhidl.so to him! No need! You can open in an editor and search for the required strings and copy them to the first line of 'script.js' located in dumper/helpers folder on your PC.

At some point I'll edit the first post to include this information for people using devices that dump a json.