unable to parse license - check protobufs

[jammesvx]

i have uses WKS KEY but it cannot get key

l3.py

PSSH: AAAAMnBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAABISEJ00j0 0R8M9/KZgs0Gbz2KA=
License URL: https://license.kktv.com.tw/
Token: token_type=playback&token_value=07bbac65366147af99 e5763ff4c428a6f0a899e58e144000af89dd1ab96848b0&dev ice_id=35480cd4-e396-4376-86bf-13c9096cfdf6&client_platform=Web
device_id: 35480cd4-e396-4376-86bf-13c9096cfdf6
b'NTAwMQ=='
unable to parse license - check protobufs

[lomero]

read PM ...
and simple l3.py not work on kktv

your key

f20980ed619b7ee93e44e4bc5c79fe38:f1e494eed00ff8b55a76857ad99cdc30

[ari]

read PM ...
and simple l3.py not work on kktv

your key

f20980ed619b7ee93e44e4bc5c79fe38:f1e494eed00ff8b55a76857ad99cdc30

i have the same problem. can you help?

[Sebast94]

read PM ...
and simple l3.py not work on kktv

your key

f20980ed619b7ee93e44e4bc5c79fe38:f1e494eed00ff8b55a76857ad99cdc30

i have the same problem. can you help?

Hello, I just tried it and it works perfectly with l3.py, it specifies what you want to download, this error can have multiple reasons (wrong pssh, wrong url license, revoked cdm, or problems in your headers).

[ari]

i figured it out... headers problem!
the trick lays in the customdata header that the license request needs to send and is very specific in the backend for devices connected i believe
i did setup burp suite with android emulator and bypassed ssl pinning from the app with objection, and got the right customdata header that the app sends with parameters that are specific for android and my loggedin device it seems.... and thats was the problem i was doing with headers from browser/windows

the service i was dumping keys is TV(dot)SFR(dot)FR. cheers

[DigitalArchive]

For this one getting the same error message when attempting l3 py, I'm not sure if it's passing the payload POST body, wouldn't be surprised if I'm doing something wrong, I copied all request headers, license uses POST with payload and following the same format as headers, I put the payload as params into headers.py, is that the correct method? So far I have only done cwtv so this one is a bit different, if anyone has used the globaltv site before (Canada) I would appreciate any pointers! Not just looking for the key, would like to learn what I'm doing incorrectly.

I didn't find the PSSH in the mpd but N_m3u8DL-RE found it when I gave it the mpd.

https://globaltvvideo.corusdigitaldev.com/globaltv/content/vod/vms/GlobalTV/GLOB0056764250000000/1695864663_drm_866f8362-5f16-469f-a1fd-16b5652ff412.ism/.mpd
https://global.corusappservices.com/authorization/widevine/getresourcekey
PSSH: IhRHTE9CMDA1Njc2NDI1MDAwMDAwMEjj3JWbBg==
KID: c9c555aafd6082085f156ab5e5951900

There are several POST requests which is a bit strange, there is the token but also an additional value.

{"authorization_token":"eyJhbGciOiJIUzI1NiIsInR5cC I6IkpXVCJ9.eyJzdWlkIjoiMWY2MjFmODQtYTY5ZS00YWU4LWF hZTUtODUxYmViYzg2NjIyIiwiZHVpZCI6IjUzNWVjNDQyLTJjZ DgtNDRlMS04ZWZjLWM3ZDZjM2MyM2I5MSIsInB1aWQiOm51bGw sInJlc291cmNlX2lkIjoiR0xPQjAwNTY3NjQyNTAwMDAwMDAiL CJleHAiOjE2OTY0NzgyMTZ9.RKJXGZmnIDfvXN1kJUeJFN5wU3 P9_oGyOWB9x9YEdyQ","license_request_data":[8,4]}

And also the same as above, but with really long license_request_data

[8,1,18,201,31,18,52,10,50,10,28,34 ........

[Karoolus]

For this one getting the same error message when attempting l3 py, I'm not sure if it's passing the payload POST body, wouldn't be surprised if I'm doing something wrong, I copied all request headers, license uses POST with payload and following the same format as headers, I put the payload as params into headers.py, is that the correct method? So far I have only done cwtv so this one is a bit different, if anyone has used the globaltv site before (Canada) I would appreciate any pointers! Not just looking for the key, would like to learn what I'm doing incorrectly.

I didn't find the PSSH in the mpd but N_m3u8DL-RE found it when I gave it the mpd.

https://globaltvvideo.corusdigitaldev.com/globaltv/content/vod/vms/GlobalTV/GLOB005676...ff412.ism/.mpd
https://global.corusappservices.com/authorization/widevine/getresourcekey
PSSH: IhRHTE9CMDA1Njc2NDI1MDAwMDAwMEjj3JWbBg==
KID: c9c555aafd6082085f156ab5e5951900

There are several POST requests which is a bit strange, there is the token but also an additional value.

{"authorization_token":"eyJhbGciOiJIUzI1NiIsInR5cC I6IkpXVCJ9.eyJzdWlkIjoiMWY2MjFmODQtYTY5ZS00YWU4LWF hZTUtODUxYmViYzg2NjIyIiwiZHVpZCI6IjUzNWVjNDQyLTJjZ DgtNDRlMS04ZWZjLWM3ZDZjM2MyM2I5MSIsInB1aWQiOm51bGw sInJlc291cmNlX2lkIjoiR0xPQjAwNTY3NjQyNTAwMDAwMDAiL CJleHAiOjE2OTY0NzgyMTZ9.RKJXGZmnIDfvXN1kJUeJFN5wU3 P9_oGyOWB9x9YEdyQ","license_request_data":[8,4]}

And also the same as above, but with really long license_request_data

[8,1,18,201,31,18,52,10,50,10,28,34 ........

I'm actually getting a different PSSH from that MPD:

AAAAPHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAABwiFEdMT0IwMDU2NzY0MjUwMDAwMDAwSOPclZsG

[DigitalArchive]

Interesting, thank you for checking, that looks better and clearly that's part of my problem. I'll keep digging into it.

[NBA456017]

    challengeb64 = str(base64.b64encode(wvdecrypt.get_challenge()), "utf-8")

    json_data = {
        'authorization_token': '##########',
        'license_request_data':challengeb64
    }

    widevine_license = requests.post(url=lic_url, headers=headers, json=json_data)

[DigitalArchive]

Thank you NBA456017, I will try this.

[ffilfernandes]

Hi everyone, I have the same problem, can anyone help me? tanck


[Attachment 74555 - Click to enlarge]

[lomero]

wrong header

share here pssh only

[ffilfernandes]

Thank you in advance for your help
I think it must also be the headers

AAAAO3Bzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAABsIARIQOt rw1PhZQAGdBYzH4sZ+sCIFRVBHQzU=

[Obo]

The "check protobufs" error message is somewhat misleading. The reason for the error message is, that the license query did not return a result, that was parsable as valid license result (unable to parse into the protobuf structure for what is expected as result).

The usual reason is missing or wrong headers or wrong arguments for the license request.

[lomero]

3adaf0d4f85940019d058cc7e2c67eb0:31419c6445bcccb9053df6358b7d554b

[ffilfernandes]

Thank you for the key but I want to learn how to get it if you could help me I would be very grateful

[ffilfernandes]

I have this on my haider, is it ok?

headers = {
'sec-ch-ua': '"Chromium";v="118", "Google Chrome";v="118", "Not=A?Brand";v="99"',
'content-type': 'application/json',
'Referer': 'https://nostv.pt/',
'nv-authorizations': 'eyJraWQiOiI5MTk4NjAiLCJ0eXAiOiJKV1QiLCJhbGciOiJIU zI1NiJ9.eyJyZXF1ZXN0VG9rZW5TaWduYXR1cmUiOiJiWFZzb1 NrTmxkYnlCdndMS1NqMTJKZlM2QWIwQ2c4eXp1TXRoYXIydXMw IiwiYWNjb3VudElkIjoibm9zaTFDNEUyMzcyMjcwOUFFQTFENE ZEMEU4MkQyRUE3NzcyNkFGNDZGQzI3RTMzODBFOEFCQzA3Q0ZC QTVBOUM5ODMiLCJ2ZXIiOiIyLjAiLCJoZWFydGJlYXQiOjMwMC wic2hvcnRWYWxpZGl0eUR1cmF0aW9uIjo0MjAsInRlbmFudElk IjoiTk9TNzFaVjEiLCJ0eXAiOiJTZXNzaW9uIiwic2Vzc2lvbk lkIjoiYWJmMjIyNDYtMmZhMC00OGYyLTgzZjEtY2M0YWNkMDVk YzJhIiwiZXhwIjoxNjk4MzQ5Njk3fQ.QiH1Zgkg9ugds9ye4jP OqkfwoLLNgAcZGq_BPr2uS_A',
'sec-ch-ua-mobile': '?0',
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36',
'sec-ch-ua-platform': '"Windows"',
}

json_data = {
'challenge': 'EkkSPRo7CjQKEFLeKYtz5B3ZXx/ohZe1eGQSEFLeKYtz5B3ZXx/ohZe1eGQaACABKAQ4AEAASK746qkGENoLGAAYAiCKhOupBjAVG iD3/CJAz8GSiqP5SYkmeuD7felzDDM+ejwMFOnFJ3kgDg==',
}

[lomero]

in headers use only 'nv-authorizations' value

but you have also json_data and so need custom script for your site

[Baldrick]

Please don't discuss paid subscription services. nostv.pt doesn't seem to be any free service.

Okey. It's free in Portugal.

[ffilfernandes]

tanck you Here the channels presented are free in Portugal

[DigitalArchive]

I'm actually getting a different PSSH from that MPD

Hi Karoolus, circling back on this since I haven't had the chance to work on this more yet, if you don't mind would you be willing to mention where you found the PSSH? I was looking through Developer Tools / Network / etc and wasn't finding it, but I am also aware in some cases it's more complicated and I think I saw at least one tool discussed before that automated the process, I am still interested in finding it manually if that's possible.

[shellcmd]

edited.

[Karoolus]

I'm actually getting a different PSSH from that MPD

Hi Karoolus, circling back on this since I haven't had the chance to work on this more yet, if you don't mind would you be willing to mention where you found the PSSH? I was looking through Developer Tools / Network / etc and wasn't finding it, but I am also aware in some cases it's more complicated and I think I saw at least one tool discussed before that automated the process, I am still interested in finding it manually if that's possible.

I get the PSSH from the init file, so I never look for it manually. All I need is the MPD URL

[sunshine18]

Hi everyone, I have the same problem

Resolvef

[Jacky01]

Dear Friends,
so far I've successfully let WKS-KEYS handle both "standard" licence requests, and "less standard/JSON" licence requests adopting NBA456017's script mod, though here I have a special case that stucks me and I really wish to hear your ideas about:
It's a free to view tennis event streamed by raiplay.it

MPD:

https://streamcdnr15-b70cb04c54ab478189e9d8ee45637b13.msvdn.net/ostr1/podcastcdn/drm_r...1939cfa5885451

PSSH:

AAAAbnBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAAE4IARIQPRm+wJ0DNNy+aAYrSXfd+xoFTmFncmEiMWRybV9yb290L0RSTV9OaXR0b19BVFBfRmluYWxzLzIxNTMzMzczXywxODAwLDI0MDA=

License URL:

https://rai6nb5f.anycast.nagra.com/RAI6NB5F/wvls/contentlicenseservice/v1/licenses

Request Headers:

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: */*
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://www.raiplay.it/
nv-authorizations: eyJhbGciOiJIUzI1NiIsImtpZCI6IjE5MDEwIiwidHlwIjoiSldUIn0.eyJ2ZXIiOiIxLjAiLCJ0eXAiOiJDb250ZW50QXV0aFoiLCJleHAiOjE3MDAyMTcwNDIsImNvbnRlbnRSaWdodHMiOlt7ImNvbnRlbnRJZCI6ImRybV9yb290L0RSTV9OaXR0b19BVFBfRmluYWxzLzIxNTMzMzczXywxODAwLDI0MDAiLCJzdG9yYWJsZSI6ZmFsc2V9XX0.yxiwTrY8Lp6otoUkqjOU6Jof-OPcpyuzUU6kXtwfN6g
Content-Length: 5462
Origin: https://www.raiplay.it
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

[Attachment 74915 - Click to enlarge]
Request POST payload (5462 bytes) here attached does NOT look JSON data, I can just recognize some text as "Nagra"1drm_root/DRM_Nitto_ATP_Finals/21533373_,1800,2400" and "license.widevine.com" so I'm stucked here (unable to parse license - check protobufs).
Is anyone able to collect keys for this content? Thank you for any possible hint you may reply.

[Karoolus]

Dear Friends,
so far I've successfully let WKS-KEYS handle both "standard" licence requests, and "less standard/JSON" licence requests adopting NBA456017's script mod, though here I have a special case that stucks me and I really wish to hear your ideas about:
It's a free to view tennis event streamed by raiplay.it

MPD:

https://streamcdnr15-b70cb04c54ab478189e9d8ee45637b13.msvdn.net/ostr1/podcastcdn/drm_r...1939cfa5885451

PSSH:

AAAAbnBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAAE4IARIQPRm+wJ0DNNy+aAYrSXfd+xoFTmFncmEiMWRybV9yb290L0RSTV9OaXR0b19BVFBfRmluYWxzLzIxNTMzMzczXywxODAwLDI0MDA=

License URL:

https://rai6nb5f.anycast.nagra.com/RAI6NB5F/wvls/contentlicenseservice/v1/licenses

Request Headers:

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: */*
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://www.raiplay.it/
nv-authorizations: eyJhbGciOiJIUzI1NiIsImtpZCI6IjE5MDEwIiwidHlwIjoiSldUIn0.eyJ2ZXIiOiIxLjAiLCJ0eXAiOiJDb250ZW50QXV0aFoiLCJleHAiOjE3MDAyMTcwNDIsImNvbnRlbnRSaWdodHMiOlt7ImNvbnRlbnRJZCI6ImRybV9yb290L0RSTV9OaXR0b19BVFBfRmluYWxzLzIxNTMzMzczXywxODAwLDI0MDAiLCJzdG9yYWJsZSI6ZmFsc2V9XX0.yxiwTrY8Lp6otoUkqjOU6Jof-OPcpyuzUU6kXtwfN6g
Content-Length: 5462
Origin: https://www.raiplay.it
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

[Attachment 74915 - Click to enlarge]
Request POST payload (5462 bytes) here attached does NOT look JSON data, I can just recognize some text as "Nagra"1drm_root/DRM_Nitto_ATP_Finals/21533373_,1800,2400" and "license.widevine.com" so I'm stucked here (unable to parse license - check protobufs).
Is anyone able to collect keys for this content? Thank you for any possible hint you may reply.

The token has expired. Can you provide a new one (or the video link) ?

[Jacky01]

Sure!

nv-authorizations:

eyJhbGciOiJIUzI1NiIsImtpZCI6IjE5MDEwIiwidHlwIjoiSldUIn0.eyJ2ZXIiOiIxLjAiLCJ0eXAiOiJDb250ZW50QXV0aFoiLCJleHAiOjE3MDAyNDQ3OTMsImNvbnRlbnRSaWdodHMiOlt7ImNvbnRlbnRJZCI6ImRybV9yb290L0RSTV9OaXR0b19BVFBfRmluYWxzLzIxNTMzMzczXywxODAwLDI0MDAiLCJzdG9yYWJsZSI6ZmFsc2V9XX0.JtroRefLwEMmRGiin8RnqkmbCyf23WVH4498BcCl3iM

MPD:

https://b70cb04c54ab478189e9d8ee45637b13.msvdn.net/ostr1/podcastcdn/drm_root/DRM_Nitto...d765b0d15f0247

and here's the link to the video's webpage:

https://www.raiplay.it/video/2023/11/Tennis---Nitto-ATP-Finals-2023-Gruppo-Verde-2a-gi...73c88df7e.html

(please note if any login is requested on raiplay.it you can make your own account 100% for free)

[iamghost]

--key 3d19bec09d0334dcbe68062b4977ddfb:6be588c07a8a967c269f4ebdaf6b099b

[Jacky01]

--key 3d19bec09d0334dcbe68062b4977ddfb:6be588c07a8a967c269f4ebdaf6b099b

First of all a BIG thanks to iamghost: you and your talent (here and elsewhere) go on amazing me!
Secondly, I am really very glad that even such "special case/s" can be successully handled, somehow! (that is never obvious)
Thirdly, I would really like asking you just a hint of the working procedure, more precisely what data (nv-authorizations or other tokens I unnoticed? b64encoded? JSON formatted?) should I attach (POST) to the request to get a working widevine_license, whether I should use a particular/modded Python script or WKS-KEYS is still the right one
Thank you again: every little trace from you will be precious to all of us!

[Jacky01]

*** SOLVED ***
for those interested in my same issue, it turned out that WKS-KEYS standard script in this "special case" failed for 2 crucial reasons:

1) 'nv-authorizations' token must be provided to the license server by the request headers WITHOUT double quotes! (incredibly it will be discarded if quoted)
2) as most tokens, 'nv-authorizations' is (very!) time limited and single use, therefore it should be provided about real-time just after it is received

adapting WKS-KEYS standard script to 1) and 2) it WORKS PERFECTLY even by a local L3 (V)CDM!
Greetings to this amazing community and special thanks to iamghost