Need help with a T95 S1 Android TV Box

[Reed_Righthead]

Greetings all, I've been using the forum and read as many excellent guides as I could find, including those from a_n_g_e_l_a. Now instead of lurking, I joined and am seeking help.

Following her guide, I bought from Amazon Canada a T95 S1. I appeared to be shipped a previously used unit as it had someone else's gmail account settings in it and all, and initially it was very unstable. Reset it back to factory, then updated chrome, and I've been trying to use various versions of dumper to no avail. Despite the router and the T95 being in the same room and no obstructions, I was entirely unable to make wifi work, so it is connected via ethernet, as are my computers.

Here is what I know for certain: Python 3.10, frida-server-15.1.17-android-arm.xz, T95 S1 Android 10 build MBOX_10.2.0_20201017, Google widevine 15.0.0 L3, Chrome 106.0.5249.126, adb 1.0.41 Version 33.0.3-8952118, frida 15.1.17 installed on pc through python.

I visited the bitmovin demo page, and I've tried 3 different versions of the dumper script. The one that seems to go the furthest (which is to say it goes further than saying the functions are hooked) is the original one, However, none of them generate any files, and "dumperv2" and the newest one that is for up to android 12 seem to go no further than functions hooked.

I even tried it on a different PC, just in case, but the result was the same.

Tried all the recommendations, playing the video, pressing load whilst its playing, etc. and the result is the same.

As well, I tried changing the pulldown on bitmovin that has DASH, HLS, and Smooth. DASH and HLS are the parkour video while Smooth is a shorter racing video.

I also checked to make certain that it says using widevine, and it is.

I don't have a dedicated keyboard or mouse hooked up to the T95 S1, so no shift refresh, so tried clearing the chrome cache instead...no joy there either.

My ultimate goal once I have a working CDM is to obtain content from ctv.ca, specifically one program (4 seasons)

(edited to add this
The original version of dumper actually does create one file called license_request.bin, but that is all

[johns0]

I changed your thread title so more people would help,next time you post a new thread use a title that describes the issue.

[AbortRetryFail]

I visited the bitmovin demo page, and I've tried 3 different versions of the dumper script. The one that seems to go the furthest (which is to say it goes further than saying the functions are hooked) is the original one, However, none of them generate any files, and "dumperv2" and the newest one that is for up to android 12 seem to go no further than functions hooked.

There's plenty of posts here, made before Diazole released their updated dumper, from people purporting to have dumped keys from Android 10 devices with OEMCrypto v15. I cannot attest to any of that, because I've only ever dumped keys from stock Android 9 devices and older phones upgraded to it through unofficial ROMs. If you can't get Diazole's version to work, which I understand dynamically hooks what needs to be hooked, one thing that might work is using the dumper from the wvdumper GitHub account and making these changes.

[A_n_g_e_l_a]

Greetings all, I've been using the forum and read as many excellent guides as I could find, including those from a_n_g_e_l_a. Now instead of lurking, I joined and am seeking help.
Despite the router and the T95 being in the same room and no obstructions, I was entirely unable to make wifi work, so it is connected via ethernet, as are my computers.

You really need adb working properly and I've never 'ethernet connected' adb devices - do they do that? You can either use a USB cable; yes they do work but you either need an OTG adapter in the cable link (the data wires need to cross over d+ to D- for it to work) or you can make a wireless connection.

To wireless connect you probably need to set developer options.

To become a 'developer' you will need a keyboard! Go to system settings, choose system - about and tap the T95 model number 7 times. After three taps a pop message will count down to developer status. Once you have developer settings find them in system and scroll down to enable wireless usb debugging. After that is turned on you should be able to connect with adb after giving permission to a pop up on the t95. If i''ve go the exact sequence wrong, search 'enable android developer settings' - there are tons of guides.

[Reed_Righthead]

Greetings all, I've been using the forum and read as many excellent guides as I could find, including those from a_n_g_e_l_a. Now instead of lurking, I joined and am seeking help.
Despite the router and the T95 being in the same room and no obstructions, I was entirely unable to make wifi work, so it is connected via ethernet, as are my computers.

You really need adb working properly and I've never 'ethernet connected' adb devices - do they do that? You can either use a USB cable; yes they do work but you either need an OTG adapter in the cable link (the data wires need to cross over d+ to D- for it to work) or you can make a wireless connection.

To wireless connect you probably need to set developer options.

To become a 'developer' you will need a keyboard! Go to system settings, choose system - about and tap the T95 model number 7 times. After three taps a pop message will count down to developer status. Once you have developer settings find them in system and scroll down to enable wireless usb debugging. After that is turned on you should be able to connect with adb after giving permission to a pop up on the t95. If i''ve go the exact sequence wrong, search 'enable android developer settings' - there are tons of guides.

Hello, A_n_g_e_l_a. In your guide you had said that USB connection did not work on your T95 so I never even tried it on mine. I'm certain that the T95 I got sent was previously sold/used as it had someone else's google account information and such in it. I contacted the seller on amazon.ca but received no reply. Initially it was so unstable that even selecting apps on the remote would randomly reboot the box. That seemed to be alleviated after resetting it to "factory". Although the T95 and the router were mere feet away in the same room, with no obstructions, I could not get it to connect under WiFi at all. Then I simply removed the ethernet cable from my printer and plugged it into the ethernet port on the T95. Developer options are indeed turned on in the T95 and though USB has not thus far been used, USB debugging is enabled.

I can and do connect to the T95 through ADB, and was able to push, and execute frida-server-15.1.17-android-arm as directed.

Two things differ from your guide to my experience thus far: There is no "popup" permission request (as it presumably would with Wifi) when I connect to the IP (192.168.1.79 in my case), and the su command to switch to superuser borks when the hypen is added (su -). I tried two different versions of ADB, and the result was the same with su, so I omitted the hypen. The ADB version I am currently using is the one that is currently provided officially.

The scripts (dumper) do execute, but the only one I have ever had go further than the 'hooks completed' is the original one. With that one, as soon as I press load on bitmovin, it immediately brings up a *lot* of information (all told, 675 lines in Notepad++) but the only file it creates is network_request.bin, no other files created.

The more modern scripts that work on android >9 (my T95 S1 came with android 10) go no further than 'hooks completed...' regardless of what I do.

tried to download firmware for the T95 on my PC but wherever it is coming from (on mega) the archives are consistently corrupt, even the videos. Don't have that problem with any other downloads thus far.

(site https://www.turewell.com/pages/tvbox-document is where the links came from.)

[Diazole]

Are you running frida as root? what does whoami return?

PM me your "libwvhidl.so" using the steps found here - https://forum.videohelp.com/threads/404219-How-To-Dump-L3-CDM-From-Android-Device-s-(O...e6#post2646150

[Reed_Righthead]

Are you running frida as root? what does whoami return?

PM me your "libwvhidl.so" using the steps found here - https://forum.videohelp.com/threads/404219-How-To-Dump-L3-CDM-From-Android-Device-s-(O...e6#post2646150

Yes, I'm certain. Here is a session:
(NOTE THE FOLLOWING IS ADB SESSION #1):

D:\muse\platform-tools>adb version
Android Debug Bridge version 1.0.41
Version 33.0.3-8952118
Installed as D:\muse\platform-tools\adb.exe

D:\muse\platform-tools>adb connect 192.168.1.79
connected to 192.168.1.79:5555

D:\muse\platform-tools>adb shell
dolphin-p1:/ $ whoami
shell
dolphin-p1:/ $ su -
su: invalid uid/gid '-'
1|dolphin-p1:/ $ su-
/system/bin/sh: su-: inaccessible or not found
127|dolphin-p1:/ $ su
dolphin-p1:/ # whoami
root
dolphin-p1:/ # ls -l /data/local/tmp/
total 19463
-rw------- 1 shell shell 2 2022-10-26 23:42 apks_installed_tcnt
-rwxrwx--x 1 root root 19903288 2022-10-27 00:25 frida-server-15.1.17-android-arm
-rw------- 1 shell shell 0 2022-10-26 23:39 kodi_install
drwxr-xr-x 2 root root 3488 2022-10-28 03:06 re.frida.server
-rw------- 1 shell shell 0 2022-10-26 23:42 symbol_thirdpart_apks_installed
dolphin-p1:/ # /data/local/tmp/frida-server-15.1.17-android-arm

(NOTE: UNTIL I TERMINATE frida-server, this ADB Session is at a standstill, which brings us to...)

(NOTE THE FOLLOWING IS IN ADB SESSION #2):

D:\muse\platform-tools>adb shell
dolphin-p1:/ $ whoami
shell
dolphin-p1:/ $ su
dolphin-p1:/ # whoami
root
dolphin-p1:/ # ps | grep frida
root 16888 13715 33228 20876 poll_schedule_timeout 0 S frida-server-15.1.17-android-arm
dolphin-p1:/ # cd /data/local/tmp/
dolphin-p1:/data/local/tmp # rm re.frida.server
rm: re.frida.server: Is a directory
1|dolphin-p1:/data/local/tmp # rm -r re.frida.server
dolphin-p1:/data/local/tmp # ls -l
total 19460
-rw------- 1 shell shell 2 2022-10-26 23:42 apks_installed_tcnt
-rwxrwx--x 1 root root 19903288 2022-10-27 00:25 frida-server-15.1.17-android-arm
-rw------- 1 shell shell 0 2022-10-26 23:39 kodi_install
-rw------- 1 shell shell 0 2022-10-26 23:42 symbol_thirdpart_apks_installed
dolphin-p1:/data/local/tmp #

(NOTE: the re.frida.server above appears to have been created because I tried [unsuccessfuly I thought] to redirect output to a file on my PC via "py dump_keys.py >output.txt".
which was unneccesary because I can just scroll back in the command window and capture what I need anyhow...so as you can see, I just turfed it)

(NOTE: obtaining libwvhidl.so...)

dolphin-p1:/ # whoami
root
dolphin-p1:/ # cp vendor/lib64/libwvhidl.so /data/local/tmp
cp: bad 'vendor/lib64/libwvhidl.so': No such file or directory
1|dolphin-p1:/ # cp vendor/lib/libwvhidl.so /data/local/tmp
dolphin-p1:/data/local/tmp # cd /