Dumping Your own L3 CDM with Android Studio

[keep_it_breezy]

used this :
emu64xa:/ # su -c "sh /data/local/tmp/frida-server-16.2.5-android-x86

[Attachment 79474 - Click to enlarge]
Tested and work

This would need closed quotes:

su -c "sh /data/local/tmp/frida-server-16.2.5-android-x86"

[keep_it_breezy]

used this :
emu64xa:/ # su -c "sh /data/local/tmp/frida-server-16.2.5-android-x86

[Attachment 79474 - Click to enlarge]
Tested and work

That's literally not working

If your terminal drops you into a ">" it's implying it wants further user input. In this case, you needed to close the quotation marks.

[juan]

oh you're right . forgot the the close " .

used this :
emu64xa:/ # su -c "sh /data/local/tmp/frida-server-16.2.5-android-x86"

wkwkwk, i didn't notice it . i just quick ss my screen and didn't see the ">" .

[imvin]

help !
i delete the default one , and create a one .
adb.exe shell
su.
didnt work

[keep_it_breezy]

help !
i delete the default one , and create a one .
adb.exe shell
su.
didnt work

Sorry I don't understand what you're asking here - please provide screenshots and be more explicit.

[GiddyFish]

That got the server running now having issues with running the dump_keys.py BTW: I had to install an earlier version of pycryptodome

Successfully installed pycryptodome-3.14.1

D:\Python\dumper-main>python dump_keys.py
2024-05-30 09:35:27 PM - root - 16 - INFO - Connected to Android Emulator 5554
2024-05-30 09:35:27 PM - root - 17 - INFO - scanning all processes for the following libraries
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1, name="init", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1200, name="init", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1201, name="init", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1202, name="ueventd", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1583, name="logd", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1584, name="servicemanager", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1585, name="hwservicemanager", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1586, name="vndbinder", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1592, name="android.hardware.keymaster@3.0-service", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1593, name="vold", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1636, name="android.hidl.allocator@1.0-service", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1637, name="healthd", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1638, name="vr_hwc", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1639, name="android.hardware.audio@2.0-service", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1640, name="android.hardware.broadcastradio@1.1-service", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1641, name="android.hardware.camera.provider@2.4-service", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1642, name="android.hardware.cas@1.0-service", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1643, name="android.hardware.configstore@1.1-service", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1644, name="android.hardware.drm@1.0-service", parameters={})
Traceback (most recent call last):
  File "D:\Python\dumper-main\dump_keys.py", line 21, in <module>
    libraries = scanner.find_widevine_process(device, process.name)
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "D:\Python\dumper-main\Helpers\Scanner.py", line 149, in find_widevine_process
    process = dev.attach(process_name)
              ^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\XXX\AppData\Roaming\Python\Python311\site-packages\frida\core.py", line 86, in wrapper
    return f(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^
  File "C:\Users\XXXXX\AppData\Roaming\Python\Python311\site-packages\frida\core.py", line 994, in attach
    return Session(self._impl.attach(self._pid_of(target), **kwargs))  # type: ignore
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
frida.ServerNotRunningError: unable to connect to remote frida-server: closed

Both cmd windows and the Android sim are running


[Attachment 79479 - Click to enlarge]

[juan]

@imvin

so you created new AVD right ?

adb.exe shell
su...not working

Root Your Android Phone
- git clone https://gitlab.com/newbit/rootAVD.git
- cd rootAVD
- rootAVD.bat
- rootAVD.bat ListAllAVDs .. you will see something like this
- rootAVD.bat systems-images\amdroid-33\google_apis_playstore\x86_64\ramdisk.img
"android-33 = your AVD API"
"x86_64 or x86 or x64''
-retype or copy paste : rootAVD.bat systems-images\amdroid-32\google_apis_playstore\x86\ramdisk.img [ if your API 32 and system image is x86 ]

your avd now will close and just reopen it .

[juan]

That got the server running now having issues with running the dump_keys.py BTW: I had to install an earlier version of pycryptodome

Successfully installed pycryptodome-3.14.1

D:\Python\dumper-main>python dump_keys.py
2024-05-30 09:35:27 PM - root - 16 - INFO - Connected to Android Emulator 5554
2024-05-30 09:35:27 PM - root - 17 - INFO - scanning all processes for the following libraries
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1, name="init", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1200, name="init", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1201, name="init", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1202, name="ueventd", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1583, name="logd", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1584, name="servicemanager", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1585, name="hwservicemanager", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1586, name="vndbinder", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1592, name="android.hardware.keymaster@3.0-service", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1593, name="vold", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1636, name="android.hidl.allocator@1.0-service", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1637, name="healthd", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1638, name="vr_hwc", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1639, name="android.hardware.audio@2.0-service", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1640, name="android.hardware.broadcastradio@1.1-service", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1641, name="android.hardware.camera.provider@2.4-service", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1642, name="android.hardware.cas@1.0-service", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1643, name="android.hardware.configstore@1.1-service", parameters={})
2024-05-30 09:35:28 PM - root - 19 - DEBUG - Process(pid=1644, name="android.hardware.drm@1.0-service", parameters={})
Traceback (most recent call last):
  File "D:\Python\dumper-main\dump_keys.py", line 21, in <module>
    libraries = scanner.find_widevine_process(device, process.name)
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "D:\Python\dumper-main\Helpers\Scanner.py", line 149, in find_widevine_process
    process = dev.attach(process_name)
              ^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\XXX\AppData\Roaming\Python\Python311\site-packages\frida\core.py", line 86, in wrapper
    return f(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^
  File "C:\Users\XXXXX\AppData\Roaming\Python\Python311\site-packages\frida\core.py", line 994, in attach
    return Session(self._impl.attach(self._pid_of(target), **kwargs))  # type: ignore
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
frida.ServerNotRunningError: unable to connect to remote frida-server: closed

Both cmd windows and the Android sim are running


[Attachment 79479 - Click to enlarge]

oh you're right . forgot the the close " .

used this :
emu64xa:/ # su -c "sh /data/local/tmp/frida-server-16.2.5-android-x86"

wkwkwk, i didn't notice it . i just quick ss my screen and didn't see the ">" .

[white_snake]

Hi
I'm having a spot of bother trying to Execute frida-server!
No such file or directory

As can be seen from bellow the frida-server is in the tmp directory and has read write executable permisions

C:\Users\XXXXXX\AppData\Local\Android\Sdk\platform-tools>adb.exe shell
emu64xa:/ $ su
emu64xa:/ # mv /sdcard/frida-server-16.2.5-android-x86 /data/local/tmp/
emu64xa:/ # chmod +x /data/local/tmp/frida-server-16.2.5-android-x86
emu64xa:/ # /data/local/tmp/frida-server-16.2.5-android-x86
/system/bin/sh: /data/local/tmp/frida-server-16.2.5-android-x86: No such file or directory
126|emu64xa:/ # ls -l /data/local/tmp/
total 55208
-rwxrwx--x 1 u0_a172 media_rw 56528216 2024-05-30 16:46 frida-server-16.2.5-android-x86
emu64xa:/ #

Hoping someone advise

Does

cd /data/local/tmp/
./frida-server-16.2.5-android-x86

make a difference?

[imvin]

@imvin

so you created new AVD right ?

adb.exe shell
su...not working

Root Your Android Phone
- git clone https://gitlab.com/newbit/rootAVD.git
- cd rootAVD
- rootAVD.bat
- rootAVD.bat ListAllAVDs .. you will see something like this
- rootAVD.bat systems-images\amdroid-33\google_apis_playstore\x86_64\ramdisk.img
"android-33 = your AVD API"
"x86_64 or x86 or x64''
-retype or copy paste : rootAVD.bat systems-images\amdroid-32\google_apis_playstore\x86\ramdisk.img [ if your API 32 and system image is x86 ]

your avd now will close and just reopen it .

Thank you juan , it work now .

[GiddyFish]

oh you're right . forgot the the close " .

used this :
emu64xa:/ # su -c "sh /data/local/tmp/frida-server-16.2.5-android-x86"

wkwkwk, i didn't notice it . i just quick ss my screen and didn't see the ">" .

Thanx I got it working I really should remember not to do this kind of stuff late at night when concentration is low

If anyone is interested before running dump_keys.py had to "Set PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python"
Because:

D:\Python\dumper-main>python dump_keys.py
Traceback (most recent call last):
  File "D:\Python\dumper-main\dump_keys.py", line 6, in <module>
    from Helpers.Scanner import Scan
  File "D:\Python\dumper-main\Helpers\Scanner.py", line 7, in <module>
    from Helpers.wv_proto2_pb2 import SignedLicenseRequest
  File "D:\Python\dumper-main\Helpers\wv_proto2_pb2.py", line 33, in <module>
    _descriptor.EnumValueDescriptor(
  File "C:\Users\Kylie Minouge\AppData\Roaming\Python\Python311\site-packages\google\protobuf\descriptor.py", line 917, in __new__
    _message.Message._CheckCalledFromGeneratedFile()
TypeError: Descriptors cannot be created directly.
If this call came from a _pb2.py file, your generated code is out of date and must be regenerated with protoc >= 3.19.0.
If you cannot immediately regenerate your protos, some other possible workarounds are:
 1. Downgrade the protobuf package to 3.20.x or lower.
 2. Set PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python (but this will use pure-Python parsing and will be much slower).

More information: https://developers.google.com/protocol-buffers/docs/news/2022-05-06#python-updates

D:\Python\dumper-main>Set PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python

D:\Python\dumper-main>python dump_keys.py

Like I said it's now working
Thanx

[GiddyFish]

Do these keys expire?
If they do what causes it?

[keep_it_breezy]

Do these keys expire?
If they do what causes it?

Typically not on a time basis, though of course that could change in the future (Widevine providers can revoke keys etc.)
Things that could potentially cause it are if you are seen to be making a ridiculous amount of key requests (less likely if you're using L3 to be honest).

[sesasa]

Good morning and thanks for the tutorial.

I follow the 1st page and everything is ok, but when I get to the video playback it doesn't create the (private-keys) folder, what am I missing?

Furthermore, for each video, it is necessary to create a new device?, can you delete it and use the same model?

Thank you, good day

[A_n_g_e_l_a]

answered in error

[sesasa]

answered in error

Thank you for your response, I will take your previous comment into account

[A_n_g_e_l_a]

answered in error

Thank you for your response, I will take your previous comment into account

No, sorry I thought I was in my Thread - Temple of Doom - which I'm currently editing. And indeed it may be helpful if you cannot dump keys easily from your virtual device in the manner Cedric describes.

[sesasa]

answered in error

Thank you for your response, I will take your previous comment into account

No, sorry I thought I was in my Thread - Temple of Doom - which I'm currently editing. And indeed it may be helpful if you cannot dump keys easily from your virtual device in the manner Cedric describes.

Ahh ok, good any help in welcome and I'm sure I'll get something valid, thank you

[sesasa]

Good morning everyone, I am stuck here, how can I continue, thank you


[Attachment 79752 - Click to enlarge]

[Maanvis]

Hey, I just joined to thank Cedric and others for creating this guide.
I emulated an android 3 device and was able to get a L3 CDM with it.
I've been using it to download NPO documentaries, for which we used pywks with a handy little script that some nice people on the Pywks discord made to download NPO content. It can also be modified to get other NPO brands content, like 2doc, vpro, zapp etc.

If you want to get an NPO key yourself and have gotten the L3 CDM I can send you the script.

[polkzhyzia]

sorry i am noob a spoon feeder. a small knowledge person but willing to learn. i am just doing in what on the post says. already created a device in Android Studio and when you said go to command prompt, now i am stuck in, command prompt says,
C:\Windows\System32>pip install frida
'pip' is not recognized as an internal or external command,
operable program or batch file.

[peterb999]

Have you installed Python? it sounds like you haven't.

Download it from here - https://www.python.org/downloads/

When you install it check the box that says add it to the path and run as administrator. After it installs you'll be able to run PIP.

[Karn]

sorry i am noob a spoon feeder. a small knowledge person but willing to learn. i am just doing in what on the post says. already created a device in Android Studio and when you said go to command prompt, now i am stuck in, command prompt says,
C:\Windows\System32>pip install frida
'pip' is not recognized as an internal or external command,
operable program or batch file.

When you install python, it downloads and installs all the necessary components required to go along with it. Pip being one of them.


[Attachment 79786 - Click to enlarge]

[polkzhyzia]

sorry i am noob a spoon feeder. a small knowledge person but willing to learn. i am just doing in what on the post says. already created a device in Android Studio and when you said go to command prompt, now i am stuck in, command prompt says,
C:\Windows\System32>pip install frida
'pip' is not recognized as an internal or external command,
operable program or batch file.

When you install python, it downloads and installs all the necessary components required to go along with it. Pip being one of them.


[Attachment 79786 - Click to enlarge]

in python it says ivalid syntax , which frida assets will i download

[polkzhyzia]

i downloaded the latest frida server and put it to platform-tools folder and run a command it says like this an error, "AppData\Local\Android\Sdk\platform-tools>adb.exe push frida-server-16.3.3-android-arm64 /sdcard
adb: error: cannot stat 'frida-server-16.3.3-android-arm64': No such file or directory"


Update!
ok i fixed it, now is for the "su" command says "/system/bin/sh: su: inaccessible or not found"

[polkzhyzia]

Hey, I just joined to thank Cedric and others for creating this guide.
I emulated an android 3 device and was able to get a L3 CDM with it.
I've been using it to download NPO documentaries, for which we used pywks with a handy little script that some nice people on the Pywks discord made to download NPO content. It can also be modified to get other NPO brands content, like 2doc, vpro, zapp etc.

If you want to get an NPO key yourself and have gotten the L3 CDM I can send you the script.

if you do please, much appreciate it ,

[polkzhyzia]

i need help , i got this error and stuck with this problem for too long , how do i fix it?


generic_x86_arm:/ # ls /data/local/tmp
frida-server-16.3.3-android-x86_64.xz
generic_x86_arm:/ # /data/local/tmp/frida-server16.3.3-android-x86_64
/system/bin/sh: /data/local/tmp/frida-server16.3.3-android-x86_64: inaccessible or not found

[white_snake]

i need help , i got this error and stuck with this problem for too long , how do i fix it?


generic_x86_arm:/ # ls /data/local/tmp
frida-server-16.3.3-android-x86_64.xz
generic_x86_arm:/ # /data/local/tmp/frida-server16.3.3-android-x86_64
/system/bin/sh: /data/local/tmp/frida-server16.3.3-android-x86_64: inaccessible or not found

You have not extracted the frida binary, you just pushed the .xz archive to your phone.

[polkzhyzia]

i need help , i got this error and stuck with this problem for too long , how do i fix it?


generic_x86_arm:/ # ls /data/local/tmp
frida-server-16.3.3-android-x86_64.xz
generic_x86_arm:/ # /data/local/tmp/frida-server16.3.3-android-x86_64
/system/bin/sh: /data/local/tmp/frida-server16.3.3-android-x86_64: inaccessible or not found

You have not extracted the frida binary, you just pushed the .xz archive to your phone.

how do i extract the file , please elaborate. or you mean literally , manually extract the file.? and then the su command

[white_snake]

how do i extract the file , please elaborate. or you mean literally , manually extract the file.? and then the su command

Ever heard of WinRAR or 7-zip? Either one of those two should do the job. The file that's inside the .xz archive is the actual executable you need to run.

P.S.: you obviously can do the extraction on your computer, don't have to do it inside your Android device.