Decryption and the Temple of Doom

[T33V33]

Thanks. I follow this guide and got my L3 keys!

According to DRM-Info app, the phone from where I took L3 keys has L1 aswell, I wonder from which site / app I can get L1 Keys?

Thanks, really appreciate this guide!

Dumper script will only ever dump L3.... To dump L1 is a completely different process... You need to exploit your device so that you can access it's secure zone and read/write data from where it is designed not to. In short it's very difficult and every device model is likely to be different so there cannot be a single script for all.

[ampersand]

Finally managed to dump the keys from an H96 Max box. I don't know if they'll work or not but at least this first step is done. EDIT: Download and decryption from TV5MondePlus successful.
Big thanks to Angela and Vegeta.

A couple of tips about the problems I had while trying to extract the keys:
- if you can't connect the box to your PC via USB to open the 5555 port and consequently can't even connect to it through adb on wifi, follow what this guy did and open the 5555 port directly on your box: https://stackoverflow.com/a/3740005
- when looking for the OEMCrypto functions, first try the *.so file in the lib folder, the ones in lib64 didn't work for me (got a json instead of the real files)
- if you can't pull the *.so file from the data/local/tmp folder like in Vegeta's example in the other thread (invalid permissions), copy it to the sdcard folder and try to pull from there

[davidbdn1994]

Finally i got the pem key, but... it says: no client ID blob available for this device
Men... i dont know what to do now

[Attachment 66968 - Click to enlarge]

Is it for vdocipher, maybe?

[ampersand]

did you rename the "client_id.bin" file into "device_client_id_blob" (no extension) and put it into the cdm folder of WKS-KEYS along with the "device_private_key" file?

[davidbdn1994]

sorry!, my mistake, but now i got this: unable to parse license - check protobufs

[ampersand]

from what I have read here on videohelp that can mean anything from posting the wrong headers to your CDM being revoked
I think you'll have to search for any previous posts about the video service you're trying to download from (try googling - "SERVICE_NAME site:forum.videohelp.com") especially about the headers, they're the biggest headache
and if you don't find anything, open a thread here, lay out your problem and what you have so far and someone might help

[davidbdn1994]

Ok i will do it

[elfoeda]

sorry!, my mistake, but now i got this: unable to parse license - check protobufs

Try downgrading protobuf

pip install protobuf==3.20.1

[ac427]

The model in the thread, T95 S1 2Gb/16Gb, is no more available on amazon in my country and on other sites it costs much more than 30 USD or any other currency you use.

Can anybody recommend me a model that is compatible with the method explained i this thread?

Thanks in advance

Is the 4K model ok or too new in terms of OS version?

You wont get a L1 from the 4K version if thats your train of thought. This model has been chosen for its ease of use, crypto version and because its pre-rooted, most beginners wont even get past rooting an android device, let alone making contact with it - or take them weeks.

Also bear in mind you could brick any device you attempt this on, so dont use your partner's work cell phone or anything expensive. This device is cheap.

Thank you. I have a T95 S1 with Android 7 on the way. Is L1 possible with that?

Well the device turned up today and of course says Android 10 on the box, rather than Android 7 that was on the advert.

Does Android 10 reduce the range of possibilities with the box?

Is it possible to downgrade flash it to Android 7?

[A_n_g_e_l_a]

Is it possible to downgrade flash it to Android 7?

Finding an image to flash might be a problem. But why are you asking any questions before you've checked your box out? Doesn't that just waste everyone's time? You might just have to treat it like phone and root it

Android 10 is do-able, by all accounts.

[ac427]

Is it possible to downgrade flash it to Android 7?

Finding an image to flash might be a problem. But why are you asking any questions before you've checked your box out? Doesn't that just waste everyone's time? You might just have to treat it like phone and root it

Android 10 is do-able, by all accounts.

Thanks Angela, I saw there had been success with Android 10. It says Android 10 on the cardboard box, so it probably is despite the advert banner.

I just wanted to make sure Android 10 was not a limiting factor compared to Android 7. Otherwise i could just send it back and try to find an Android 7 TV box.

And the answer may help others decide on which box to get.

Apologies for straying slightly off topic.

[T33V33]

It says Android 10 on the cardboard box, so it probably is despite the advert banner.

I just wanted to make sure Android 10 was not a limiting factor compared to Android 7. Otherwise i could just send it back and try to find an Android 7 TV box.

And the answer may help others decide on which box to get.

There are at least 2 versions of this box.... The older one with Android 7 and a newer one with 10. If the box says 10 then it will be the newer one (which is the one on sale when you search in most places). If you bought and it said Android 7 and they sent Android 10 then they haven't sent what you ordered so send it back.

Android 10 is a limiting factor compared to Android 7 but only so far as the script probably needs editing to get the correct functions and you may need to find the correct version of Frida to make it work.

[A_n_g_e_l_a]

[snip]......and you may need to find the correct version of Frida to make it work.

I saw all that when researching how to get my own cdm. It was then the received wisdom in this forum. I found it to be wrong and moreover time-wasting.

Add to that, people varying the versions of python they tried, all wrong, as far as I could tell.
Folks were just giving the set-up conditions of when their own cdm's dumped, and not definitively testing whether other set-ups worked - hardly scientific method. So, please, be wary of starting more folk-law again.

To be clear: eventually, after being given the run-around, I used the latest everything (February 2022) with success on an Android 7 TV Box. Developers work hard to make their stuff backwards compatible - and if they cannot, they say so.

[T33V33]

[snip]......and you may need to find the correct version of Frida to make it work.

I saw all that when researching how to get my own cdm. It was then the received wisdom in this forum. I found it to be wrong and moreover time-wasting.

Add to that, people varying the versions of python they tried, all wrong, as far as I could tell.
Folks were just giving the set-up conditions of when their own cdm's dumped, and not definitively testing whether other set-ups worked - hardly scientific method. So, please, be wary of starting more folk-law again.

To be clear: eventually, after being given the run-around, I used the latest everything (February 2022) with success on an Android 7 TV Box. Developers work hard to make their stuff backwards compatible - and if they cannot, they say so.

To be clear... the version of frida required depends on the archtecturte of the device in use... So its most certainly not time wasting. Try using the x86 frida on an Arm based device and see what happens

[A_n_g_e_l_a]

To be clear... the version of frida required depends on the archtecturte of the device in use... So its most certainly not time wasting. Try using the x86 frida on an Arm based device and see what happens

Thank you Captain Obvious. I thought better of you.

[T33V33]

To be clear... the version of frida required depends on the archtecturte of the device in use... So its most certainly not time wasting. Try using the x86 frida on an Arm based device and see what happens

Thank you Captain Obvious. I thought better of you.

I'm simply pointing out that it is not time wasting (where you seem to claim it is) making sure one is using the correct version of Frida if they chose a different box as it may be a different archtecture. May be obvious to you but not to someone else.

[A_n_g_e_l_a]

I'm simply pointing out that it is not time wasting (where you seem to claim it is) making sure one is using the correct version of Frida if they chose a different box as it may be a different archtecture. May be obvious to you but not to someone else.

No you're not. And stop being disingenuous.

You, among others, made some plain wrong statements about trying different Frida versions with some supposedly working and others not. In my experience it was all utter tosh. That fact has been supported by numerous people getting a dumped CDM by following the instructions to use the latest everything, (well at Feb 2022), in the first post of this thread; and I will not have the message watered down.

But, now, you pop up here trying to muddy the waters again. Stop. You were plain wrong before in a post and similarly now. Sorry to have to be so blunt with you but you appear not to take direction very well.
You said:-

Android 10 is a limiting factor compared to Android 7 but only so far as the script probably needs editing to get the correct functions and you may need to find the correct version of Frida to make it work.

You weren't talking about an architecture were you? It is plain both boxes mentioned were Androids. Now you're just digging a bigger hold to climb out from.

[gadumuc]

I used the lastest frida-server on PlayStore on my Android when dumping cdm, worked fine.

[darkw4v3]

Well, this is a spicy exchange.

[A_n_g_e_l_a]

Finally managed to dump the keys from an H96 Max box. I don't know if they'll work or not but at least this first step is done. EDIT: Download and decryption from TV5MondePlus successful.

Excellent; what Android version was on your H96 and did it come rooted? Just looked on Ali-express and they all seem to be Android 11???

[lomero]

@darkw4v3
very laugh your post

[ampersand]

Finally managed to dump the keys from an H96 Max box. I don't know if they'll work or not but at least this first step is done. EDIT: Download and decryption from TV5MondePlus successful.

Excellent; what Android version was on your H96 and did it come rooted? Just looked on Ali-express and they all seem to be Android 11???

Android 9. I bought a used one off a local ebay-like website for about $20 in local currency.
Yeah it was pre-rooted, thank God, I've tried rooting a phone or two and didn't get anywhere. Kingoroot or whatever it's called was useless for me.

[shock]

I saw a few people mentioning they were able to dump the keys from their S6 Edge. I just found my old device running Android 7 and root it, but I am unable to go past the Hooks screen. Did you do anything specific or is the problem on my end? I tried different Frida versions, still no luck. Thanks in advance !

[staszek1503]

Finally managed to dump the keys from an H96 Max box. I don't know if they'll work or not but at least this first step is done. EDIT: Download and decryption from TV5MondePlus successful.
Big thanks to Angela and Vegeta.

A couple of tips about the problems I had while trying to extract the keys:
- if you can't connect the box to your PC via USB to open the 5555 port and consequently can't even connect to it through adb on wifi, follow what this guy did and open the 5555 port directly on your box: https://stackoverflow.com/a/3740005
- when looking for the OEMCrypto functions, first try the *.so file in the lib folder, the ones in lib64 didn't work for me (got a json instead of the real files)
- if you can't pull the *.so file from the data/local/tmp folder like in Vegeta's example in the other thread (invalid permissions), copy it to the sdcard folder and try to pull from there

@ampersand
Is this the same box you write about?
https://allegro.pl/oferta/h96-max-4-64gb-android-smart-tv-box-kodi-netflix-9188581107?...ant=9188576941
Would this also work like this?
https://pl.aliexpress.com/item/1005001525086693.html?spm=a2g0o.productlist.0.0.f6a8ef4...d=ZRYltuuHQaew
Because it seems structurally similar to the T95

[ampersand]

I saw a few people mentioning they were able to dump the keys from their S6 Edge. I just found my old device running Android 7 and root it, but I am unable to go past the Hooks screen. Did you do anything specific or is the problem on my end? I tried different Frida versions, still no luck. Thanks in advance !

if it's me you're asking, I've no idea, sorry, but I saw someone else having the same problem on videohelp, so worse comes to worst try PMing this guy:
https://forum.videohelp.com/members/299742-myteryuser

@ampersand
Is this the same box you write about?
https://allegro.pl/oferta/h96-max-4-64gb-android-smart-tv-box-kodi-netflix-9188581107?...ant=9188576941
Would this also work like this?
https://pl.aliexpress.com/item/1005001525086693.html?spm=a2g0o.productlist.0.0.f6a8ef4...d=ZRYltuuHQaew
Because it seems structurally similar to the T95

yes, but it has to be android 9, angela has mentioned the ones they found on aliexpress are android 11

one more thing I forgot to mention, the frida server you push to the device has to be the arm64 version - the x86 one didn't work for me and the error said it was because the architecture was x64

[ampersand]

I saw a few people mentioning they were able to dump the keys from their S6 Edge. I just found my old device running Android 7 and root it, but I am unable to go past the Hooks screen. Did you do anything specific or is the problem on my end? I tried different Frida versions, still no luck. Thanks in advance !

maybe try this as well (last post, but read the rest as well, maybe there's a clue there - also don't use netflix app, use that bitmovin video angela recommends in the first post):
https://github.com/wvdumper/dumper/issues/21

[codehound]

One of the leaked dumper scripts autoplays wv content after hooks - so grab the correct one

Yes follow A_n_g_e_l_a's advice use bitmovin demo

In my experience (and now watch 10,000 people say different) the keys get dumped when you refresh the page..not just play the content (this is where a lot of people struggle)

But I have a lot of private L3s (for what they're worth nowadays) so what do I know ? - Hey things have moved on...

[shock]

I saw a few people mentioning they were able to dump the keys from their S6 Edge. I just found my old device running Android 7 and root it, but I am unable to go past the Hooks screen. Did you do anything specific or is the problem on my end? I tried different Frida versions, still no luck. Thanks in advance !

maybe try this as well (last post, but read the rest as well, maybe there's a clue there - also don't use netflix app, use that bitmovin video angela recommends in the first post):
https://github.com/wvdumper/dumper/issues/21

Thanks !

[A_n_g_e_l_a]

In my experience (and now watch 10,000 people say different) the keys get dumped when you refresh the page..not just play the content (this is where a lot of people struggle)

Good point. And I would go slightly further.... on your browser hold the 'shift' key down and click refresh so all the license information the browser once had is discarded and it is all loaded afresh.

[Romano2K]

Hi!

Thank you Angela for compiling this tutorial, and thank you Angela and vegeta for the support on this thread and others.

First of all, how do I check if a file is Widevine L1 or L3 encrypted?

Anyway I'd like to get my own CDM keys.

But the suggested T95 S1 is out of stock in my country, and anyway I wanted to know if other people have had success with other Android TV boxes. While I'm at it, I'd rather buy a branded and modern model that I'll keep using after extracting keys.

Do you know if any of the following is either factory rooted or easy to root, and then if Frida and wvdumper will work? I've read that one could modify wvdumper for devices not supported out of the box, but I haven't understood how.

- Google Chromecast with Google TV (2022-2022)
- Nokia Streaming Box 8000
- Nvidia Shield TV
- Strong Leap S1
- Thomson THA100
- Xiaomi Mi Box S