NPO widevine decryption no longer working

[StukBetonijzer]

I'm trying to get the keys for example this stream: https://www.npostart.nl/het-jaar-van-fortuyn/25-03-2022/AT_2156884

I have WKS-KEYS with Android CDM in place. In the headers.py I put the "'x-custom-data': " with the value that was given, which should be sufficient.

This method was working before, but now I'm getting this error:

python l3.py output:

PSSH: AAAAXHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAADwIARIQ43SFoLGVUEZ10kDXjsJl2RoIdXNwLWNlbmMiGDQzU0ZvTEdWVUVaMTBrRFhqc0psMlE9PSoAMgA=
License URL: https://npo-drm-gateway.samgcloud.nepworldwide.nl/authentication
D:\xxx\pywidevine\L3\cdm\cdm.py:260: RuntimeWarning: Unexpected end-group tag: Not all data was converted
  license.ParseFromString(base64.b64decode(license_b64))
Traceback (most recent call last):
  File "D:\xxx\l3.py", line 25, in <module>
    correct, keys = WV_Function(pssh, lic_url)
  File "D:\xxx\l3.py", line 21, in WV_Function
    wvdecrypt.update_license(license_b64)
  File "D:\xxx\pywidevine\L3\decrypt\wvdecryptcustom.py", line 58, in update_license
    self.cdm.provide_license(self.session, license_b64)
  File "D:\xxx\pywidevine\L3\cdm\cdm.py", line 275, in provide_license
    session.session_key = oaep_cipher.decrypt(license.SessionKey)
  File "C:\Users\xxx\AppData\Local\Programs\Python\Python39\lib\site-packages\Cryptodome\Cipher\PKCS1_OAEP.py", line 167, in decrypt
    raise ValueError("Ciphertext with incorrect length.")
ValueError: Ciphertext with incorrect length.

What am I doing wrong? How to fix this error? Thanks in advance

[[ss]vegeta]

CDM =
[Attachment 64011 - Click to enlarge]

Might be...

[StukBetonijzer]

CDM =
[Attachment 64011 - Click to enlarge]

Might be...

Any way to confirm?

I also tried this stream with the same method: https://bitmovin.com/demos/drm

And it would give me the keys

[[ss]vegeta]

Any way to confirm?

Someone with more experience and still a spark for this will probably show up and tell you soon.

When was the last time you were able to get keys from npo?
If I'm not mistaken it needed modification some time ago.
So if you were able to get keys in the last few days, CDM probably toasted.
If you were able to get keys a somewhat long time ago, might just need some modification.

[StukBetonijzer]

Any way to confirm?

Someone with more experience and still a spark for this will probably show up and tell you soon.

When was the last time you were able to get keys from npo?
If I'm not mistaken it needed modification some time ago.
So if you were able to get keys in the last few days, CDM probably toasted.
If you were able to get keys a somewhat long time ago, might just need some modification.

Last time I tried was 2 months ago, in late january.

Hopefully someone knows what's going on. TIA

[lomero]

e37485a0b195504675d240d78ec265d9:42b76d72cb073f505aff26a31c96775d

[StukBetonijzer]

e37485a0b195504675d240d78ec265d9:42b76d72cb073f505aff26a31c96775d

Thanks but I'm hoping I could get a working method again so I can get the keys myself.

The CDM that I'm using seems to be working still. When I get the keys from this stream: https://bitmovin.com/demos/drm with a revoked key, it gives me "unable to parse license - check protobufs" error, but with my own L3 CDM, it's working, so there must be an issue with my WKS-KEYS.

edit: This stream for example is giving me the same error: https://www.rtlnieuws.nl/video/uitzendingen/video/5297771/rtl-nieuws-1930-uur

PSSH: AAAAMnBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAABISEPxKFH8UT0EipRFvdLZbtB8=
License URL: https://keydelivery.rtl.nl/widevine/?kid=fc4a147f-144f-4122-a511-6f74b65bb41f
D:\xxx\pywidevine\L3\cdm\cdm.py:260: RuntimeWarning: Unexpected end-group tag: Not all data was converted
  license.ParseFromString(base64.b64decode(license_b64))
Traceback (most recent call last):
  File "D:\xxx\l3.py", line 25, in <module>
    correct, keys = WV_Function(pssh, lic_url)
  File "D:\xxx\l3.py", line 21, in WV_Function
    wvdecrypt.update_license(license_b64)
  File "D:\xxx\pywidevine\L3\decrypt\wvdecryptcustom.py", line 58, in update_license
    self.cdm.provide_license(self.session, license_b64)
  File "D:\xxx\pywidevine\L3\cdm\cdm.py", line 275, in provide_license
    session.session_key = oaep_cipher.decrypt(license.SessionKey)
  File "C:\Users\xxx\AppData\Local\Programs\Python\Python39\lib\site-packages\Cryptodome\Cipher\PKCS1_OAEP.py", line 167, in decrypt
    raise ValueError("Ciphertext with incorrect length.")
ValueError: Ciphertext with incorrect length.

[lomero]

obviously you have some problems ...

https://www.rtlnieuws.nl/video/uitzendingen/video/5297771/rtl-nieuws-1930-uur

fc4a147f144f4122a5116f74b65bb41f:78e99545dcc09e6d1d5544c3970cce54

[GEOLINK]

Getting the same error as OP using WKS-Keys but I'm able to get the KID:KEY on the getwv site... I wonder what am I doing wrong on WKS-Keys?

[StukBetonijzer]

Getting the same error as OP using WKS-Keys but I'm able to get the KID:KEY on the getwv site... I wonder what am I doing wrong on WKS-Keys?

For which of the links?

Apparently for NPO, the problem is in the l3.py and how the x-custom-data is used. It was working fine late january but they must have changed something now. So far nobody wants to reveal the solution. There are more ppl that are having this problem.

[A_n_g_e_l_a]

I updated all my pip packages recently. Errrors I had been getting, (unrelated to this admittedly), disappeared. Worth a try?

[StukBetonijzer]

I updated all my pip packages recently. Errrors I had been getting, (unrelated to this admittedly), disappeared. Worth a try?

Which command could we use for that? TIA

[lomero]

yes for NPO need a proper py
instead rtlnieuws.nl work with l3

[A_n_g_e_l_a]

I updated all my pip packages recently. Errrors I had been getting, (unrelated to this admittedly), disappeared. Worth a try?

Which command could we use for that? TIA

pip3 list --outdated --format=freeze | grep -v '^\-e' | cut -d = -f 1 | xargs -n1 pip3 install -U

But I just tried to get the keys for rtl and failed with 'check protobufs'

[StukBetonijzer]

I updated all my pip packages recently. Errrors I had been getting, (unrelated to this admittedly), disappeared. Worth a try?

Which command could we use for that? TIA

pip3 list --outdated --format=freeze | grep -v '^\-e' | cut -d = -f 1 | xargs -n1 pip3 install -U

But I just tried to get the keys for rtl and failed with 'check protobufs'

That error usually indicates a revoked CDM.

And I'm on windows, so that command won't do me much good :P

[A_n_g_e_l_a]

And I'm on windows, so that command won't do me much good :P

I am sorry to everyone using Windows.
It must be truly awful for them!


Seriously, will that not work from a command window? I thought lots of bash syntax copied over. If not google search - as I did.

[A_n_g_e_l_a]

That error usually indicates a revoked CDM.

That is the prevailing wisdom. However, I have found it to be quite false.

[lomero]

That error usually indicates a revoked CDM

not true
this happens when l3 fails to interpret the license request correctly

[A_n_g_e_l_a]

I found, eventually, that narrowvine-reborn collects this too.
I had errors of all kinds but the headers were wrong.
This narrowvine call worked for me:

python narrowvine_reborn.py -mpd "https://cdn-rtlvod-d5.akamaized.net/27a97a1d-457b-4707-b55e-8f8c4104ee62/528773b2-bbaf-423f-9437-cd4ef31a4dd5.ism/manifest(format=mpd-time-csf,encryption=cenc,Filter=Quality).mpd" -lic "https://api.rtl.nl/watch/license/widevine/?kid=fc4a147f-144f-4122-a511-6f74b65bb41f" -k "{'Origin': 'https://www.rtlnieuws.nl', 'x-cluster': 'prdw', 'Authorization' : 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1dWlkIjoiNTI4NzczYjItYmJhZi00MjNmLTk0MzctY2Q0ZWYzMWE0ZGQ1IiwidGVuYW50IjoiWGwiLCJtZXRhLVVzZXJBZ2VudCI6Ik1vemlsbGEvNS4wIChYMTE7IEZlZG9yYTsgTGludXggeDg2XzY0OyBydjo5OC4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94Lzk4LjAiLCJtZXRhLVJlZmVyZXIiOiJodHRwczovL3d3dy5ydGxuaWV1d3MubmwvdmlkZW8vdWl0emVuZGluZ2VuL3ZpZGVvLzUyOTc3NzEvcnRsLW5pZXV3cy0xOTMwLXV1ciIsIm1ldGEtQ291bnRyeUNvZGUiOiJnZW9yZWdpb249Mixjb3VudHJ5X2NvZGU9R0IscmVnaW9uX2NvZGU9RU4sY2l0eT1TRUFGT1JELGxhdD01MC43Nyxsb25nPTAuMTAsdGltZXpvbmU9R01ULGNvbnRpbmVudD1FVSx0aHJvdWdocHV0PWxvdyxidz0xLG5ldHdvcms9YnQsYXNudW09Mjg1Nixsb2NhdGlvbl9pZD0wIiwibWV0YS1SZXF1ZXN0VGltZVV0YyI6IjIwMjItMDMtMjcgMTE6MjM6NTIuNTc1IiwibWV0YS1UZW5hbnQiOiJYbCIsIm1ldGEtRGV2aWNlIjoid2ViIiwibWV0YS1Ecm0iOiJXaWRldmluZSIsIm1ldGEtRm9ybWF0IjoiZGFzaCIsIm1ldGEtSXNEb3dubG9hZCI6IkZhbHNlIiwibmJmIjoxNjQ4MzgwMjMyLCJleHAiOjE2NDgzODM4MzIsImlhdCI6MTY0ODM4MDIzMiwiaXNzIjoiaHR0cHM6Ly9lbnRpdGxlbWVudC5ydGwubmwiLCJhdWQiOiJSVEwifQ.41IzDnaj1pHxlJw-AoL_du26GDC-wv4B7B7HdsrV6ZQ'}"

And, still exploring... WKS-KEYS needed this header

headers = {
    'User-Agent': 'Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0',
    'Accept': '*/*',
    'Accept-Language': 'en-GB,en;q=0.5',
    'Accept-Encoding': 'gzip, deflate, br',
    'Referer': 'https://www.rtlnieuws.nl/video/uitzendingen/video/5297771/rtl-nieuws-1930-uur',
    'Authorization': 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1dWlkIjoiNTI4NzczYjItYmJhZi00MjNmLTk0MzctY2Q0ZWYzMWE0ZGQ1IiwidGVuYW50IjoiWGwiLCJtZXRhLVVzZXJBZ2VudCI6Ik1vemlsbGEvNS4wIChYMTE7IEZlZG9yYTsgTGludXggeDg2XzY0OyBydjo5OC4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94Lzk4LjAiLCJtZXRhLVJlZmVyZXIiOiJodHRwczovL3d3dy5ydGxuaWV1d3MubmwvdmlkZW8vdWl0emVuZGluZ2VuL3ZpZGVvLzUyOTc3NzEvcnRsLW5pZXV3cy0xOTMwLXV1ciIsIm1ldGEtQ291bnRyeUNvZGUiOiJnZW9yZWdpb249Mixjb3VudHJ5X2NvZGU9R0IscmVnaW9uX2NvZGU9RU4sY2l0eT1TRUFGT1JELGxhdD01MC43Nyxsb25nPTAuMTAsdGltZXpvbmU9R01ULGNvbnRpbmVudD1FVSx0aHJvdWdocHV0PWxvdyxidz0xLG5ldHdvcms9YnQsYXNudW09Mjg1Nixsb2NhdGlvbl9pZD0wIiwibWV0YS1SZXF1ZXN0VGltZVV0YyI6IjIwMjItMDMtMjcgMTE6MjM6NTIuNTc1IiwibWV0YS1UZW5hbnQiOiJYbCIsIm1ldGEtRGV2aWNlIjoid2ViIiwibWV0YS1Ecm0iOiJXaWRldmluZSIsIm1ldGEtRm9ybWF0IjoiZGFzaCIsIm1ldGEtSXNEb3dubG9hZCI6IkZhbHNlIiwibmJmIjoxNjQ4MzgwMjMyLCJleHAiOjE2NDgzODM4MzIsImlhdCI6MTY0ODM4MDIzMiwiaXNzIjoiaHR0cHM6Ly9lbnRpdGxlbWVudC5ydGwubmwiLCJhdWQiOiJSVEwifQ.41IzDnaj1pHxlJw-AoL_du26GDC-wv4B7B7HdsrV6ZQ',
    'content-type': 'application/octet-stream',
    'Origin': 'https://www.rtlnieuws.nl',
    'DNT': '1',
    'Connection': 'keep-alive',
    'Sec-Fetch-Dest': 'empty',
    'Sec-Fetch-Mode': 'cors',
    'Sec-Fetch-Site': 'cross-site',
    'kid': 'fc4a147f-144f-4122-a511-6f74b65bb41f',
    # Requests doesn't support trailers
    # 'TE': 'trailers',
}

[headers]

e37485a0b195504675d240d78ec265d9:42b76d72cb073f505aff26a31c96775d

Apperantly you can get the key. Im curious how you do it. I can't get it even with setting the request headers.

[pkp]

'x-custom-data' in the header is JWT which is one time and should be generated from within the code itself

[ridibunda]

'x-custom-data' in the header is JWT which is one time and should be generated from within the code itself

How? Just explain it.

[naim2007]

'x-custom-data' in the header is JWT which is one time and should be generated from within the code itself

Done. thanks king

[ridibunda]

'x-custom-data' in the header is JWT which is one time and should be generated from within the code itself

Done. thanks king

Why do your "kings" do not share any info on this forum?

I updated all my pip packages recently. Errrors I had been getting, (unrelated to this admittedly), disappeared. Worth a try?

I updated my pip packages too. WKS does not even start now.


I hope Vegeta or ElCap will give us a explaination about this issue.

[ElCap]

if we're talking about rtlnieuws.nl, the x-custom-data token lasts for about 1 hour and its not one-time. it doesnt seem to be geo-restricted either.

if we're talking about npostart.nl, the 'x-custom-data' token is much shorter (maybe 1min) but its not one-time.
its enough time to copy it from the browser into a wks or getwvkeys.py script.
the token is restricted to your ip address too.

[ridibunda]

if we're talking about rtlnieuws.nl, the x-custom-data token lasts for about 1 hour and its not one-time. it doesnt seem to be geo-restricted either.

if we're talking about npostart.nl, the 'x-custom-data' token is much shorter (maybe 1min) but its not one-time.
its enough time to copy it from the browser into a wks or getwvkeys.py script.
the token is restricted to your ip address too.

In my case, it is not "x-custom-data".

There is a "dt-custom-data" under Request Headers. It is the same value on every stream and it doesn't change day to day, too.

Request URL is https://lic.drmtoday.com/license-proxy-widevine/cenc/

That modified lic server link does not work:

https://lic.drmtoday.com/license-proxy-widevine/cenc/?specConform=true

I convert cURL(bash) to Python, then it gives "not all data was converted" error.

How did it work on that Pakistani Discord Guy's website? I am unable to use it now.

[ElCap]

not sure what youre talking about....
neither of rtlnieuws.nl or npostart.nl use drmtoday as a license server

what site?
sample link?

[[ss]vegeta]

He is doing something wrong (or maybe updating python and/or modules messed up something).
He sent me PSSH and lic url and custom data, WKS works just fine.

[ridibunda]

Yes, thanks Vegeta.

No problem with Python or modules. It was just about "headers.py" file.

"headers.py" must only include "dt-custom-data" lines in headers part. Other lines above must be deleted.

Otherwise, WKS is unable to send the correct request to that lic server.

Like that:

headers = {
'dt-custom-data':,
}

data = ....

response = ...

[codehound]

Yes, thanks Vegeta.

No problem with Python or modules. It was just about "headers.py" file.

As you said, "headers.py" must only include "user-agent" and "dt-custom-data" lines in headers part. Other lines above must be deleted.

Otherwise, WKS is unable to send the correct request to that lic server.

Like that:

headers = {
'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36',
}

data = ....

response = ...

And everyone can see your user ID in the dt-custom-data string......