Live Stream - content decryption issue

[Erevo]

Hi guys,

Can you please help me how to properly decrypt a live stream (in general) from the following website?

Live stream channel (geoprotection applied to CZ):
https://sport.ceskatelevize.cz/#live

PSSH: found via EME logger (--> MediaKeySession::generateRequest)
When combined with licence, I can obtain 12 keys in total.

Live stream (2 mins sample) downloaded using N_m3u8DL-RE (latest build)
Note: Only timeshift playlist works for me, e.g.:
https://ivys-cdn.o2tv.cz/cdn/uri/get/?contentType=timeshift&drmOnly=true&expiry=166879...encryption=wv"

N_m3u8DL-RE.exe "URL" --auto-select --key-text-file keys.txt --live-keep-segments false --live-real-time-merge --live-record-limit 00:02:00

The issue, no matter when using mp4decrypt or shaka packager, content is still encrypted.
I have also tried to download encrypted, and decrypt later after merging... no change at all, both audio and video files are still encrypted and unplayable.

Any help or advice would be really appreaciated.
Thank you.

[Jawz22]

I haven't had much experience with live streams but used this the one time I needed to download a live stream:

ffmpeg -cenc_decryption_key "key" -i "mpd" -map 0:4 -map 0:5 -vcodec copy -acodec copy decryptedaeg.mp4

and from what I can remember the key is only the key without the KID before it. This is not my work just something I found on this forum. Hope it helps

[ElCap]

Hi guys,

Can you please help me how to properly decrypt a live stream (in general) from the following website?

Live stream channel (geoprotection applied to CZ):
https://sport.ceskatelevize.cz/#live

PSSH: found via EME logger (--> MediaKeySession::generateRequest)
When combined with licence, I can obtain 12 keys in total.

Live stream (2 mins sample) downloaded using N_m3u8DL-RE (latest build)
Note: Only timeshift playlist works for me, e.g.:
https://ivys-cdn.o2tv.cz/cdn/uri/get/?contentType=timeshift&drmOnly=true&expiry=166879...encryption=wv"

N_m3u8DL-RE.exe "URL" --auto-select --key-text-file keys.txt --live-keep-segments false --live-real-time-merge --live-record-limit 00:02:00

The issue, no matter when using mp4decrypt or shaka packager, content is still encrypted.
I have also tried to download encrypted, and decrypt later after merging... no change at all, both audio and video files are still encrypted and unplayable.

Any help or advice would be really appreaciated.
Thank you.

Looks like to be one of the few live streams (that ive seen) that change the kid and key regularly (about every 10mins).
these are some of the psshs ive seen

AAAANHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAABQiBjQyMi10djjshAZI49yVmwZQAA==
AAAANHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAABQiBjQyMi10djjthAZI49yVmwZQAA==
AAAANHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAABQiBjQyMi10djjuhAZI49yVmwZQAA==

when you decode the pssh the only thing that changes is the Crypto Period Index, which gets increased by one for each new pssh.
Each different pssh returns a new set of 12 kids and keys (not even the kids are the same)

the other difficult thing is that the init file doesnt contain the kid, its just zeroed out (as the kid changes).
so you cant match the key to the kid, you have to try all the keys with the following format "1:key" until one works (and that only works on the segments encrypted with that key)




BUT!
you can get an unencrypted stream if you modify the post request that the browser does.
eg. find the POST request for https://playlist.ceska televize.cz/ - copy it

the post data should look similar to this

{"contentType":"live","items":[{"id":422,"key":"removed","assetId":"CT4DRM","playerType":"dash","date":"2022-11-19 01:18:24","requestSource":"front-sport","drm":1,"quality":"web"}]}

change assetId from 'CT4DRM' to 'CT4'
change drm from '1' to '0'

send that post request and the response should be similar to

{
   "CODE":"OK",
   "RESULT":{
      "playlist":[
         {
            "id":422,
            "streamUrls":{
               "main":"https://ivys-cdn.o2tv.cz/cdn/uri/get/?contentType=live&drmOnly=false&expiry=1668820704&id=422&playerType=dash&quality=web&region=4&skipIpAddressCheck=false&userId=removed&token=removed&encryption=wv",
               "timeshift":"https://ivys-cdn.o2tv.cz/cdn/uri/get/?contentType=timeshift&drmOnly=false&expiry=1668820704&id=422&playerType=dash&quality=web&region=4&skipIpAddressCheck=false&userId=removed&token=removed&encryption=wv"
            }
         }
      ]
   }
}

copy the timeshift url and use it with n_m3u8dl-re (or other dash downloader)

N_m3u8DL-RE.exe "url" -mt --live-record-limit 00:00:30 -M format=mp4 --live-real-time-merge --auto-select

n_m3u8dl-re had some issues with trying to download the complete recording not just the live part - thats some other issue

[[ss]vegeta]

Looks like to be one of the few live streams (that ive seen) that change the kid and key regularly (about every 10mins).
these are some of the psshs ive seen

AAAANHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAABQiBjQyMi10djjshAZI49yVmwZQAA==
AAAANHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAABQiBjQyMi10djjthAZI49yVmwZQAA==
AAAANHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAABQiBjQyMi10djjuhAZI49yVmwZQAA==

when you decode the pssh the only thing that changes is the Crypto Period Index, which gets increased by one for each new pssh.
Each different pssh returns a new set of 12 kids and keys (not even the kids are the same)

the other difficult thing is that the init file doesnt contain the kid, its just zeroed out (as the kid changes).
so you cant match the key to the kid, you have to try all the keys with the following format "1:key" until one works (and that only works on the segments encrypted with that key)




BUT!
you can get an unencrypted stream if you modify the post request that the browser does.
eg. find the POST request for https://playlist.ceska televize.cz/ - copy it

the post data should look similar to this

{"contentType":"live","items":[{"id":422,"key":"removed","assetId":"CT4DRM","playerType":"dash","date":"2022-11-19 01:18:24","requestSource":"front-sport","drm":1,"quality":"web"}]}

change assetId from 'CT4DRM' to 'CT4'
change drm from '1' to '0'

send that post request and the response should be similar to

{
   "CODE":"OK",
   "RESULT":{
      "playlist":[
         {
            "id":422,
            "streamUrls":{
               "main":"https://ivys-cdn.o2tv.cz/cdn/uri/get/?contentType=live&drmOnly=false&expiry=1668820704&id=422&playerType=dash&quality=web&region=4&skipIpAddressCheck=false&userId=removed&token=removed&encryption=wv",
               "timeshift":"https://ivys-cdn.o2tv.cz/cdn/uri/get/?contentType=timeshift&drmOnly=false&expiry=1668820704&id=422&playerType=dash&quality=web&region=4&skipIpAddressCheck=false&userId=removed&token=removed&encryption=wv"
            }
         }
      ]
   }
}

copy the timeshift url and use it with n_m3u8dl-re (or other dash downloader)

N_m3u8DL-RE.exe "url" -mt --live-record-limit 00:00:30 -M format=mp4 --live-real-time-merge --auto-select

n_m3u8dl-re had some issues with trying to download the complete recording not just the live part - thats some other issue

Marvelous!
Well done ElCap.

[Erevo]

First of all, thank you for the feedback... Jawz22, ElCap.

@ElCap
Wow, what a fabulous workaround! I confirm to be able to successfully obtain unprotected live stream
You made my day. Thank you also for other inside information about crypto period index and pssh regeneration.

[jonatasants]

Could someone get the key for this live stream?
https://i-live-cache.akamaized.net/hdntl=exp=1668956762~acl=*%2fTN7%2f*~id=5185d944-14...%3E30000%29%29
License
https://licensev2.dstv.com/widevine/getLicense?CrmId=afl&AccountId=afl&ContentId=TN7&l...tBAWbk_DxY8qmA