Dumping L3 from Android 10, 11 and 12

[Diazole]

I have forked the wvdumper/dumper script and updated it to support L3 extraction on Android 9, 10, 11 and 12 and have successfully extracted the key from these android versions, but have so far only tested CDM versions 14, 15, 16 and 16.1.

https://github.com/Diazole/dumper

p.s. once the functions have been hooked, you just need to load the Bitmovin player and click load to dump the keys - https://bitmovin.com/demos/drm

Update:

Thank you to dark125 for the suggestion of looping through the function names (even though you sent me a different file to the one you were dumping). The script no longer requires you to provide the function name yourself and instead hooks to every a-z function essentially brute-forcing.

I have also successfully dumped Android 9 CDM 14.

[[ss]vegeta]

Well done sir.

[k2000]

thank you it can be useful

[ampersand]

this is great, so now android 7-12 is covered by dumpers, good job

[A_n_g_e_l_a]

Great stuff. Well done!

[upinsm0ke]

Tested and working on Android 10 Thanks again for your contribution

[dark125]

Android 11 with oemcrypto 16 works fine. Thanks.

[Loryanam2]

What is That ?

[mostafasmh1996]

Thank you <3
Worked for me

[mostafasmh1996]

Does anyone know how to dump or extract Chrome CDM?

[marktwain]

Hi Thanks for your job!!"

[ridibunda]

Thank you. I will try it for Android 9 CDM 14.0 as soon as possible.

For a Nokia phone with a half-dead battery.

[DrNumands]

What might it mean if this updated script only displays rsakey in console, and does nothing after that?

only the output following 'Retrieved key' is displayed (rsakey) in console;
self.logger.debug(
'Retrieved key: \n\n%s\n',

android 12, oemcdm 16

[DrNumands]

Installed drminfo app, cdm version is 16.1.0, not 16. Tried the command line argument to set to 16.1.0.

The updated script has less debug reporting than the original script. Would it be possible to update the original script while keeping its original structure (including scanner.py), in order to support cdm 16.1.0? Using the minimum of edits to the original, what would it take?

[Diazole]

Yes, my fork has less debug reporting because I removed the irrelevant debug logs, you can add them back yourself if you think they will help you (I highly doubt they will).

Are you providing a function name/does the output state what your function name might be?

[DrNumands]

Thanks for the reply. Changing to a different version of chrome allowed your fork to work. The video was playing fine with the other version of chrome, but I guess the browser version is important for use with the script.

[Beluga]

I have forked the wvdumper/dumper script and updated it to support L3 extraction on Android 9, 10, 11 and 12 and have successfully extracted the key from these android versions, but have so far only tested CDM versions 14, 15, 16 and 16.1.

https://github.com/Diazole/dumper

p.s. once the functions have been hooked, you just need to load the Bitmovin player and click load to dump the keys - https://bitmovin.com/demos/drm

Update:

Thank you to dark125 for the suggestion of looping through the function names (even though you sent me a different file to the one you were dumping). The script no longer requires you to provide the function name yourself and instead hooks to every a-z function essentially brute-forcing.

I have also successfully dumped Android 9 CDM 14.

[Attachment 68317 - Click to enlarge]

Stuck here on android 10,11

[JerryDevis]

I have forked the wvdumper/dumper script and updated it to support L3 extraction on Android 9, 10, 11 and 12 and have successfully extracted the key from these android versions, but have so far only tested CDM versions 14, 15, 16 and 16.1.

https://github.com/Diazole/dumper

p.s. once the functions have been hooked, you just need to load the Bitmovin player and click load to dump the keys - https://bitmovin.com/demos/drm

Update:

Thank you to dark125 for the suggestion of looping through the function names (even though you sent me a different file to the one you were dumping). The script no longer requires you to provide the function name yourself and instead hooks to every a-z function essentially brute-forcing.

I have also successfully dumped Android 9 CDM 14.

Hey, do you have any script for dumping valid keyboxes?

It seems like, the keybox that wvdumper script dumps is not valid and can not be provisioned by google.

[Diazole]

[Attachment 68317 - Click to enlarge]
Stuck here on android 10,11

Send me your libwvhidl.so file, you can use this post to retrieve it - https://forum.videohelp.com/threads/404219-How-To-Dump-L3-CDM-From-Android-Device-s-(O...e6#post2646150

[JerryDevis]

Send me your libwvhidl.so file, you can use this post to retrieve it - https://forum.videohelp.com/threads/404219-How-To-Dump-L3-CDM-From-Android-Device-s-(O...e6#post2646150

Can I PM that file to you?

[Diazole]

Hey, do you have any script for dumping valid keyboxes?

It seems like, the keybox that wvdumper script dumps is not valid and can not be provisioned by google.

What do you mean?

[DrNumands]

does the output state what your function name might be?

Although the script works, the output does not state what the function name might be. I see others have posted logs where such output (of the likely function name) is shown.

How might I determine which is the working function name? If I provide a function name on the command line, does the script no longer attach to all of the functions and brute force them all? It only checks the one function name specified?

If so, I could go through all of the function names, specifying them one at a time on the command line, and the one that works is the actual function name?

[Diazole]

How might I determine which is the working function name? If I provide a function name on the command line, does the script no longer attach to all of the functions and brute force them all? It only checks the one function name specified?

Correct.

You can find your unique function name by reverse engineering the libwvhidl.so file.

If so, I could go through all of the function names, specifying them one at a time on the command line, and the one that works is the actual function name?

You can certainly do that but that would be rather time consuming or you can send me the file and i'll provide you with the function name. I thought you had already dumped your keys?

[hasmevask]

da820PmcEXBMWNDoveRRdcR9y0BB+3hwCAmii6eZpBmc2AUQVd wL4w==
-----END RSA PRIVATE KEY-----

2022-12-31 05:52:33 PM - Helpers.Device - 48 - DEBUG - Retrieved key:

-----BEGIN RSA PRIVATE KEY-----

YltEcnu3m4qMxHPoCrX0/96MSKcFcNE6rI9P1Fw4F0iZM7q0rJ0WEXOtolBNVayZ

on Android 12

dump_keys.py --cdm-version '16.0.0' shows above keys and stuck...

dump_keys.py --cdm-version '16.0.1' just shows functions and stuck .... main - 24 - INFO - Functions Hooked, load the DRM stream test on Bitmovin!

[Diazole]

dump_keys.py --cdm-version '16.0.0' shows above keys and stuck...

dump_keys.py --cdm-version '16.0.1' just shows functions and stuck .... main - 24 - INFO - Functions Hooked, load the DRM stream test on Bitmovin!

PM me your libwvhidl.so

[hasmevask]

dump_keys.py --cdm-version '16.0.0' shows above keys and stuck...

dump_keys.py --cdm-version '16.0.1' just shows functions and stuck .... main - 24 - INFO - Functions Hooked, load the DRM stream test on Bitmovin!

PM me your libwvhidl.so

sent check pm

[yesm4n]

Does not work for me. I have a rooted Pixel 3 with Android 12.

I am running frida-server-16.0.8-android-arm64 as root.

This is all I see when running your script:

> python dump_keys.py --cdm-version 16.1.0

2022-12-31 01:49:29 PM - main - 25 - INFO - Connected to Pixel 3
2022-12-31 01:49:29 PM - main - 26 - INFO - Scanning all processes
android.hardware.drm@1.0-service
android.hardware.drm@1.3-service.widevine
android.hardware.drm@1.4-service.clearkey
drmserver
2022-12-31 01:49:31 PM - main - 34 - INFO - Functions Hooked, load the DRM stream test on Bitmovin!

Opening https://bitmovin.com/demos/drm in Chrome, then loading and playing the video does not provoke additional output. The EME section on the demo page confirms widevine is supported on my device.

[Diazole]

sent check pm

Your function name is 'crhqcdet'.

dump_keys.py --function-name 'crhqcdet'

Let me know how you get on

[hasmevask]

sent check pm

Your function name is 'crhqcdet'.

dump_keys.py --function-name 'crhqcdet'

Let me know how you get on

function name is correct. thanks it stuck there also

Helpers.Device - 56 - INFO - Hooked crhqcdet at 0xf6a42a09
main - 24 - INFO - Functions Hooked, load the DRM stream test on Bitmovin

but job done by your dumper only

thanks again for your hard work and valuable work and time share

[Diazole]

Force quit chrome and restart your device, then try again