Decryption: The Dungeon of Despair

[[ss]vegeta]

just some guidance or useful sites to get the information from would be superb.

Analyze the extractors of yt-dlp

[deccavox]

I can't quite see how that's given information with regard to my actual question of 2 posts above.

[[ss]vegeta]

Me neither. I guess we are blind.

[ampersand]

bro, the thing is you're asking a question that is answered in the very first post of this thread - use http toolkit
it will show you all the requests and then you can start thinking up a solution
using it i recently cooked up a python script based on the old parnexcodes script (because i'm bad at python so doing it from scratch would be a pain) for downloading from tv5mondeplus where all i need to input is the id of the video (so not the url, but the id is in the url) and an output name and the script gets the keys, downloads the video, subtitles, decrypts and muxes it all together

[codehound]

bro, the thing is you're asking a question that is answered in the very first post of this thread - use http toolkit
it will show you all the requests and then you can start thinking up a solution
using it i recently cooked up a python script based on the old parnexcodes script (because i'm bad at python so doing it from scratch would be a pain) for downloading from tv5mondeplus where all i need to input is the id of the video (so not the url, but the id is in the url) and an output name and the script gets the keys, downloads the video, subtitles, decrypts and muxes it all together

Post of the week. Good research and innovation. Well done.

[Gene]

Hello
I still know almost nothing about py and networks
I would like to adapt your script to Auvio and Rtlplay
I would also like to automate the procedure as much as possible
I have read a lot and searched on the forums but I am far from understanding everything and the time it is the case, I am not ready to get there and then I do not seek to become an expert ...
Could you help me please?
Thanks a lot!

[A_n_g_e_l_a]

Hello
I still know almost nothing about py and networks
I would like to adapt your script to Auvio and Rtlplay
I would also like to automate the procedure as much as possible
Could you help me please?

I was in the same position as you this time last year. I read the forum for a month or more trying to make sense of how people were getting keys and decrypting videos.
My advice is read the forum as much as possible and keep doing so until you start to make sense of it. If you have no knowledge of python, no matter. Do you know of any other computer language? Because the concepts are the same. If not, as well as reading this forum, check out learning python at https://www.w3schools.com/python/default.asp

You say you want to adapt a script - that's not a bad place to start, but do it all by hand first so you know what the processes are.

No one can directly answer your questions because they are too broad and you, yourself, don't really know how to frame them because you haven't read the forum enough. It is hard work.

[Gene]

Thank you
Indeed it's not easy and I really did a lot of tests and widevine-dl seems to work well for the channels I talked about, but I still have to find the keys and for that I need to understand elements like what is a key and an api-key and a token
I have read your tutorial and I have learned some things but the fact that I don't know py and I don't understand other points yet, don't allow me to understand the scripts and the requests.
It's going to take me a long time to understand all this, but it's already difficult for those who know it...

[A_n_g_e_l_a]

I need to understand elements like what is a key and an api-key and a token

an API is an Application Programming Interface - it allows your computer to send and receive specific types of messages to and from remote computers. They are written in a computer language and only allow a very specific and small set of interactions. https://en.wikipedia.org/wiki/API

An API-key is a short string of, usually, letters and numbers - alphanumerics - that is given to you by the owner of the API. When you send a message to use the API, the key proves you have the right to access the remote computer. Getwvkeys.cc, the decryption key service on-line, uses an API; when you become accredited you will get a key allowing you to use the API. The key is sent to the back to API along with your html request message.

A token is again a proof that you have some right to the media you are trying to download. A token may also be a coded message ( take care if you post any on-line) - the one below is base64 encoded. A token is mainly given freely by a website but unless you send the token back, in your request to the remote website, they will refuse you.
Here is an example of a token carried in the mpd url (scroll to see it) -

https://ssaimanifest.prod.boltdns.net/eu-west-1/playback/once/v1/hls/v4/clear/1486976045/c64b3f6c-d36a-44ce-92ea-e7a9a68d436d/99b1033e-a10d-40d1-82b4-92bb7a3d92dd/cd6a78aa-34fa-4587-ad1d-a80fe3693848/content.m3u8?bc_token=NjNkNzhlNDhfMWY2NjI1ODUyMTZhMjQ0ODdmZGE1YmMwOTliMDM5ZmQyYWIwYWIyZmFiODMyYTQ4YmFiZjBjMmIxZmE5M2I3MQ%3D%3D

but it's already difficult for those who know it...

May I change that to " It's already difficult to those who are leaning it"? I don't think anyone will ever really know it all - it is a changing game of cat and mouse.
[edit]
Finally, on getwvkeys Discord there are some scripts for some of Belgium's media and possibly being nice to their author might bring reward - who knows. I

I see you have already asked these questions on Discord getwvkeys and people are helping you there. It is very impolite to waste everyone's time here!
I'm out.

[deccavox]

Thank you
Indeed it's not easy and I really did a lot of tests and widevine-dl seems to work well for the channels I talked about, but I still have to find the keys and for that I need to understand elements like what is a key and an api-key and a token
I have read your tutorial and I have learned some things but the fact that I don't know py and I don't understand other points yet, don't allow me to understand the scripts and the requests.
It's going to take me a long time to understand all this, but it's already difficult for those who know it...

This goes out to anybody just starting. I was in exactly the same boat as you Gene. A year ago or so I knew nothing about programming in Python and really nothing about how a browser and server interact with each other. Apart from the few ready made solutions on here and Github, I really struggled. But, I did as Angela did. I took it upon myself to learn Python (and I'm over 70 years old with no modern programming knowledge, so if I can do it, anybody can). There's a miriad of good tutorials on YouTube I used just to get the feel of it. Start with the basic stuff. But then I decided I needed a structured course, so I used https://blog.teclado.com/30-days-of-python/
Angela's course suggestion is also excellent. Both let you have hands on experience (they have exercises) which is essential to learn.
Believe you me, I constantly forget topics I have learned if I haven't used them for a while, so if I want refreshers on topics I search on YT. I have also created a database of the topics that I can use a reference.
I also have "studied" the relevant posts on here and the scripts. Many are still "foreign" to me and are hard to understand. But with time, I'll get there. There's been many a time when something's suddenly clicked and I've thought, ah, now I understand. I still struggle with interpretation of requests vs responses and how to extract certain information from them. But, I'll get there.

It's all practice practice practice (unless you're a genius).

So, I'm afraid, you'll have to get your hands dirty Gene. There's no quick fix I'm afraid.

[Sorenb]

To add to the list of recommended courses for free
https://futurecoder.io/

and https://www.sololearn.com/


Additional tip, get into debugging. Waaaay to many people stumble over themselves and fail to spot their own errors. It happens to us all, but getting good at debugging is probably the most important thing to grasp.
get comfortable around a good but not too powerful or resource heavy IDE (although I'm still partial to using Kate on Plasma with ide plugins) but Pycharm or if it's still around Atom. Vscode or even https://vscodium.com/ too.

And most importantly, do not panic, and do not think you know it all. Python is a deeep language, and it's only the tip of the sinking wreck, there's php which is a better tool for this sort of stuff, but it's not as intuitive.

[deccavox]

Yes, good tip with regard to debugging. Let it tell you where you've f***ked up instead of guessing.

I personally use VS Code as an IDE.

[A_n_g_e_l_a]

Yes, good tip with regard to debugging. Let it tell you where you've f***ked up instead of guessing.

I personally use VS Code as an IDE.

Another vote here for VScode. It lets you run your program, in a debug mode, interactively by setting breakpoints. At some breakpoint you can then view the value of variables and see if they are what you think they should be. VScode has found errors for me that were very deeply buried.

[A_n_g_e_l_a]

not poo powerful

Nice typo!

[Sorenb]

not poo powerful

Nice typo!

Yeah, I noticed that earlier and came back to fix it and add a link for vscodium, what's the point of using an OS free of Microsoft bloat and rely upon a bloated IDE when an open-source version exists. that doesn't have Microsofts telemetry installed.

[A_n_g_e_l_a]

Microsofts telemetry installed.

I have two Pihole DNS servers on my network; MS don't get telemetry from me!

[Gene]

I need to understand elements like what is a key and an api-key and a token

an API is an Application Programming Interface ...

but it's already difficult for those who know it...

May I change that to " It's already difficult to those who are leaning it"? ... I'm out.

Thanks a lot for your explanations!
But if I come here to ask for help, it's because I read your tuto and I thought that having your explanation would be a plus and that it would help me to find my way with more information...
I'm sorry if you took it the wrong way but I did it because I learned again thanks to you!
Sorry again and no I didn't get the same answers on discord as here, it's complementary

[Gene]

Thank you
Indeed it's not easy and I really did a lot of tests and widevine-dl ... those who know it...

This goes out to anybody just starting. I was in exactly the same boat as you Gene ... I'm afraid.

Thank you for your advice!
Indeed you are right, I've been learning other languages for years but sometimes I lose my patience, especially here where I'm only trying to access two strings and then, I'll still be interested in python for sure but I've got other things to do and so I'm trying to get as much help as possible in this case...
Believe me, I'm not a genius but in general I'm very persevering !

[Gene]

To add to the list of recommended courses for free
https://futurecoder.io/

and https://www.sololearn.com/


Additional tip, get into debugging. Waaaay to many people ... it's not as intuitive.

Thank you very much for your advice!
I'm going to check it all out

Yes, good tip with regard to debugging. Let it tell you where you've f***ked up instead of guessing.

I personally use VS Code as an IDE.

Another vote here for VScode. It lets you run your program, in a debug mode, interactively by setting breakpoints. At some breakpoint you can then view the value of variables and see if they are what you think they should be. VScode has found errors for me that were very deeply buried.

Thank you also

Yeah, I noticed that earlier and came back to fix it ... installed.

And here I have to learn to understand better lol

I have two Pihole DNS servers on my network; MS don't get telemetry from me!

Ad here also lol


I would like to know if when we get the key and once we have the mp4, do we have to decrypt right away or can we do it later?
In other words, is the decryption done online or on the pc?
Is the mp4 with a fixed mdp url always the same each time we download it or does its encryption change?

[Sorenb]

To add to the list of recommended courses for free
https://futurecoder.io/

and https://www.sololearn.com/


Additional tip, get into debugging. Waaaay to many people ... it's not as intuitive.

Thank you very much for your advice!
I'm going to check it all out

Yes, good tip with regard to debugging. Let it tell you where you've f***ked up instead of guessing.

I personally use VS Code as an IDE.

Another vote here for VScode. It lets you run your program, in a debug mode, interactively by setting breakpoints. At some breakpoint you can then view the value of variables and see if they are what you think they should be. VScode has found errors for me that were very deeply buried.

Thank you also

Yeah, I noticed that earlier and came back to fix it ... installed.

And here I have to learn to understand better lol

I have two Pihole DNS servers on my network; MS don't get telemetry from me!

Ad here also lol


I would like to know if when we get the key and once we have the mp4, do we have to decrypt right away or can we do it later?
In other words, is the decryption done online or on the pc?
Is the mp4 with a fixed mdp url always the same each time we download it or does its encryption change?

Well, put it this way, you have the encypted file, and the key.
Do you reckon the cipher key can change on a static file on your own machine?

The key generated at the time of download (keeping it simple here nitpickers) will work on that particular video no matter the distance from download to decryption.

[[ss]vegeta]

Keys can go stale, I heard.

[Sorenb]

Keys can go stale, I heard.

Wrap them in clingfilm, and keep them in the fridge. They'll be good for a while yet.

If in doubt, zip lock bag, freezer, in with the frozen peas. They'll be alright till Christmas.

[Gene]

Well, put it this way, you have the encypted file, and the key.
Do you reckon the cipher key can change on a static file on your own machine?

The key generated at the time of download (keeping it simple here nitpickers) will work on that particular video no matter the distance from download to decryption.

Ok, so it means that the file is encrypted differently at each download even though the url is the same?
But if at the time of the download we have both, can we put it in the freezer?

...And yes on some channels the keys expire but once you're in it's ok I guess

[Sorenb]

Ok, so it means that the file is encrypted differently at each download even though the url is the same?

Eh, no. You're overcomplicating your thinking here.
the encryption key may change depending on the server setup that is utilised by the streaming service. The encryption is applied by the streamers chosen licence server
Most streaming services keep the kid:key pair for the individual videos unchanged. While others have a short lived token that will will change at every play.

But, this only applies to the online playback of the video and obtaining the kid:key pair.

Once you download the video file, the kid:key pair at the time of download will always work on that downloaded video.

[Gene]

Thanks for the explanations!
Now I will try to understand how to get it for the strings I was talking about, because for the moment my tests did not give any result. And I continue

[deccavox]

Sorry, post not relevant. Cancelled

[A_n_g_e_l_a]

error

[A_n_g_e_l_a]

double error

[Gene]

In fact, this is my fear:
I wonder how we can achieve a result, assuming that
- you have to understand how/what to find the necessary information on the website of the channel...
- to find the right py script(s) or others...
- and in combination with which other py or other exe...
So if we combine the three tracks, it gives a tested script without knowing if it is it that does not work or if it is the information of the requests that are not good and this without knowing either with which other py to use... and of course if they work...
And finally, you have to understand the py because it's new for me
When do you think?
Am I wrong ?
How long do you think it will take ?

[Sorenb]

You are again over complicating your thinking.
Focus on one site. ONE.
And take your time.

BTW, I'll be honest after this

So if we combine the three tracks, it gives a tested script without knowing if it is it that does not work or if it is the information of the requests that are not good and this without knowing either with which other py to use... and of course if they work...

I have no idea what you are trying to say, the words are english, and yet I have no comprehension of what you are trying to convey.