Dumping Your own L3 CDM with Android Studio

[colebri]

ok thanks

as I mentionned before, the file requested by keydive is libwvaidl.so

but when making a request in the avd there is no result, does it mean that there is no such file in the device. So how is it possible to continue?

[Blacksiren]

it literally tells you the path you are supposed to look for, try searching for it again.

[colebri]

it literally tells you the path you are supposed to look for, try searching for it again.

yes you're right:


[Attachment 80909 - Click to enlarge]

but I can't find the com.google.android.widevine folder, it seems that it doesn't exist in the apex/ folder

[Blacksiren]

Which AVD are you using?

[colebri]

I'm using a pixel3A with android 14 upsidedowncake API 34

in fact I did a mistake, I havefound the path on the avd (/apex/com.google.android.widevine/bin/hw/) in which there is the android.hardware.drm-service.widevine file, but no .so file, what shall I do with this file?

[Blacksiren]

Run it through Ghidra and analyze it.

[colebri]

wonderfull, it seems to be ok this time!! thank you so much!!

last step now, try to recover the keys with wks-keys!

[Karn]

r.

[colebri]

Hello

I just come back from holidays, so I wasn't able to do some tests.

With the OG starting last week, I wan't to download some videos from the Max digital platform for which I suscribe for one month

I'm able to load the videos from the platform with N_m3u8DL-CLI_v2.9.9, of course they are unreadable on VLC (video doesn't start), I also managed to download them with downloadhelper, the video are "readable" on VLC but encrypted (the image is green).

so I tried with the CDM exported from my AVD and was able to grab 6 keys (the 3 last seeming to be null) with WKS-KEYS:

--key 0100eb1254cda8411ed8eb452d61717b:b55b873137a9260f6 1d120dcfa4bf457
--key 01010b21b445f06c5b7df852099de4e5:d74846911dd67839e fd1c2745512f8ac
--key 0102a4112501a5fd6b968a9a59bc8bbc:9caba2dca5726d2bf 53ff519cc2d59c5
--key 0103eb76d31907b76961288aa099afa4:00000000000000000 000000000000000
--key 01044cad235f26cb119ee4223544274f:00000000000000000 000000000000000
--key 0105123319b7acf07240163bd646cce2:00000000000000000 000000000000000

It seems also that Headers.py's file isn't relevant when downloading on this site, I tried with 2 or 3 different versions and always obtained the same values for the keys.

but when I try to decrypt with Bento's mp4decrypt using these 6 keys, I'm not able to do it, the resulting video remain crypted (either "unreadable" or "readable but encrypted" with vlc

so do you have any idea on what I did wrong? I have some questions:

1.- is it possible to grab wrong keys for a file? I mean, if WKS-KEYS returns values, it would mean that all the provided informations (pssh, license url, cmd) should be ok and that only a set of keys exists for the file?
2.- is it possible that the CDM I collected from my AVD lead to wrong keys for a file? I thought that if my CDM are not correct, WKS-KEY wouldn't retrun any key and just an error message?
3.- what the purpose of the headers file? I red somewhere on a topic that the only relevant part of it was concerning the token or authentification, is it possible that some platforms don't use token so that headers.py is useless?

thanks for your answers!

[Karn]

so do you have any idea on what I did wrong? I have some questions:

Start a new thread where more people can take a look and possibly assist.

[colebri]

ok I will do it, thanks for answer!

[cult]

Hi, I'm having trouble getting the l3 cdm with android studio. The procedure I'm doing, the one in the first post, doesn't give me any
error but it doesn't create the two files client_id.bin and private_key.pem.
When I launch the Python dump_keys.py command the procedure starts, then it pauses, prompting me to open the link https://bitmovin/demos/drm on the
virtual cell phone. I start the video on bitmovin but it doesn't create the Kyes_dump folder
nor the two files I mentioned above. To give you an idea, this is the image of the cmd. Thanks.

[PSXman_uk]

Hi, I'm having trouble getting the l3 cdm with android studio. The procedure I'm doing, the one in the first post, doesn't give me any
error but it doesn't create the two files client_id.bin and private_key.pem.
When I launch the Python dump_keys.py command the procedure starts, then it pauses, prompting me to open the link https://bitmovin/demos/drm on the
virtual cell phone. I start the video on bitmovin but it doesn't create the Kyes_dump folder
nor the two files I mentioned above. To give you an idea, this is the image of the cmd. Thanks.

You are much better off using keydive to get the correct files you require if you use -a and -w it will autoload bitmovin on your virtual device and created both files plus the wvd file as well.

[cult]

Ok, now I'll try. Thanks. Too bad, I managed to get android studio working now I have to start studying again.

[Chancho]

hey fellas, i really appreciate the guides on the site so far, even though i am incapable of successfully following any of them to a working well.....anything i guess.
I am embarrassed to ask this since i am at a standstill very early on in the TuT but here goes.

on this step

adb.exe devices

i get an error

adb.exe: command not found

i have tried

adb devices

with the same result.

i receive

Command 'adb' not found, but can be installed with:
sudo apt install adb # version 1:33.0.3-2, or
sudo apt install google-android-platform-tools-installer # version 34.0.4+16950

back in terminal

i am using Ubuntu and i'm guessing it's cause .exe is a windows executable file? but i can't seem to find a solution. I've navigated to the folder where adb is located
running on (venv) ~/Android/Sdk/platform-tools

any guidance is really appreciated. Unfortunately i am very new to linux also having switched from Windows a few months ago but this is really the first project i am trying to learn on a new OS. I've read a bunch of the guides and have learned a lot but clearly not enough to troubleshoot my own mistakes.

Thanks!

Installing Win10 VM to see how it goes.

[Karn]

on this step

adb.exe devices

i get an error

adb.exe: command not found

i have tried

adb devices

with the same result.

i receive

Command 'adb' not found, but can be installed with:
sudo apt install adb # version 1:33.0.3-2, or
sudo apt install google-android-platform-tools-installer # version 34.0.4+16950

back in terminal

Better not run platform tools on venv. Venv is used for specific python modules that would otherwise conflict with each other.

Try installing adb independently and create a PATH on environment variable and see if its working.

Then run

abd --help

or

adb --version

If that pulls up info


[Attachment 81363 - Click to enlarge]

[Chancho]

on this step

adb.exe devices

i get an error

adb.exe: command not found

i have tried

adb devices

with the same result.

i receive

Command 'adb' not found, but can be installed with:
sudo apt install adb # version 1:33.0.3-2, or
sudo apt install google-android-platform-tools-installer # version 34.0.4+16950

back in terminal

Better not run platform tools on venv. Venv is used for specific python modules that would otherwise conflict with each other.

Try installing adb independently and create a PATH on environment variable and see if its working.

Then run

abd --help

or

adb --version

If that pulls up info


[Attachment 81363 - Click to enlarge]

Thanks! After installing the adb independently the device is now showing and i can view the help and version info. I will try to continue with the process. Hopefully i don't have to start from the beginning but it might be better to do so since i was running in Venv.

[Karn]

Thanks! After installing the adb independently the device is now showing and i can view the help and version info. I will try to continue with the process.

Noob to noob advice.

I would avoid venv for the time being as it can get confusing initially, and run the script on the main system instead.

[Dominic192000]

I don't know what I'm doing wrong, please help.

I can get pass the chmod command, I get this:

Microsoft Windows [Version 10.0.19042.868]
(c) 2020 Microsoft Corporation. All rights reserved.

C:\Users\user\AppData\Local\Android\Sdk\platform-tools>adb.exe devices
List of devices attached
emulator-5554 device


C:\Users\user\AppData\Local\Android\Sdk\platform-tools>adb.exe push frida-server-16.4.7-android-x86 /sdcard
frida-server-16.4.7-android-x86: 1 file pushed, 0 skipped. 102.0 MB/s (56540592 bytes in 0.529s)

C:\Users\user\AppData\Local\Android\Sdk\platform-tools>adb.exe shell
emu64xa16k:/ $ su
emu64xa16k:/ # mv /sdcard/frida-server-16.4.7-android-x86 /data/local/tmp
emu64xa16k:/ # chmod +x /data/local/tmp/frida-server-16.4.7-android-x8
chmod: /data/local/tmp/frida-server-16.4.7-android-x8: No such file or directory

I'm executing CMD on: C:\Users\user\AppData\Local\Android\Sdk\platform-tools
My server file is: frida-server-16.4.7-android-x86
I'm using android studio koala and emulating a Pixel 6 API Vanilla Ice Cream
The server file is on: C:\Users\user\AppData\Local\Android\Sdk\platform-tools

[cedric8528]

Look


[Attachment 81416 - Click to enlarge]

[imr_saleh]

tried to Dumping CDM from a real device "android 8.1"
but all versions bellow has the same issue after command "chmod +x /data/local/tmp/frida-server-16.0.10-android-arm64" result "Bad mode"

frida-server-16.0.10-android-arm
frida-server-16.0.10-android-arm64
frida-server-16.0.10-android-x86_64
frida-server-16.4.8-android-arm
frida-server-16.4.8-android-arm64
frida-server-16.4.8-android-x86

[Attachment 81430 - Click to enlarge]

[MasterZanix]

Hey i got keys but when I tried play bitmovin demo its screen black and says no drm is somthing wrong?i followed every strp carefully?

[Dominic192000]

Look


[Attachment 81416 - Click to enlarge]

That worked but now I have another problem, now with the last command.

Microsoft Windows [Version 10.0.19042.868]
(c) 2020 Microsoft Corporation. All rights reserved.

C:\Users\user\AppData\Local\Android\Sdk\platform-tools>adb.exe devices
List of devices attached
emulator-5554 device


C:\Users\user\AppData\Local\Android\Sdk\platform-tools>adb.exe push frida-server-16.4.7-android-x86 /sdcard
frida-server-16.4.7-android-x86: 1 file pushed, 0 skipped. 69.7 MB/s (56540592 bytes in 0.773s)

C:\Users\user\AppData\Local\Android\Sdk\platform-tools>adb.exe shell
emu64xa16k:/ $ su
emu64xa16k:/ # mv /sdcard/frida-server-16.4.7-android-x86 /data/local/tmp
emu64xa16k:/ # chmod +x /data/local/tmp/frida-server-16.4.7-android-x86
emu64xa16k:/ # /data/local/tmp/frida-server-16.4.7-android-x86
/system/bin/sh: /data/local/tmp/frida-server-16.4.7-android-x86: No such file or directory
126|emu64xa16k:/ #

I have no experience on programing so I'm using chat gpt to have an idea of what I'm doing, according to the IA:

The output shows that the file /data/local/tmp/frida-server-16.4.7-android-x86 exists and has the correct permissions (-rwxrwx--x), which should allow it to be executed. However, the fact that you're still receiving the "No such file or directory" error when trying to execute it might be due to a few other potential issues.

Your emulator is running on the x86_64 architecture, which means it's a 64-bit version of the x86 architecture.

However, the binary you're trying to execute, frida-server-16.4.7-android-x86, is likely compiled for the 32-bit x86 architecture, not x86_64. This mismatch can cause the "No such file or directory" error, even though the file exists and has the correct permissions.
Solution

You should download and use the version of the Frida server that is compiled for x86_64 architecture. Look for a file named something like frida-server-16.4.7-android-x86_64 and then try running it again:

Is the chat gpt right? And if so, can someone tell me which version of the server should I use? There are like 10 files with "x86_64" in the name. I tried some but they give me different errors.

[Karn]

Is the chat gpt right? And if so, can someone tell me which version of the server should I use? There are like 10 files with "x86_64" in the name. I tried some but they give me different errors.

In Cedrics tutorial note he has created an x86 pie avd, and he pushed x86 frida.

Check your emu, if you have created x86_64 avd, then you need to download and push only

frida-server-16.x.x-android-x86_64.xz

You can find the latest frida here

[PSXman_uk]

tried to Dumping CDM from a real device "android 8.1"
but all versions bellow has the same issue after command "chmod +x /data/local/tmp/frida-server-16.0.10-android-arm64" result "Bad mode"

frida-server-16.0.10-android-arm
frida-server-16.0.10-android-arm64
frida-server-16.0.10-android-x86_64
frida-server-16.4.8-android-arm
frida-server-16.4.8-android-arm64
frida-server-16.4.8-android-x86

[Attachment 81430 - Click to enlarge]

what device is it ? is it rooted correctly have you used root checker ? is it definitely 64bit

[imr_saleh]

tried to Dumping CDM from a real device "android 8.1"
but all versions bellow has the same issue after command "chmod +x /data/local/tmp/frida-server-16.0.10-android-arm64" result "Bad mode"

frida-server-16.0.10-android-arm
frida-server-16.0.10-android-arm64
frida-server-16.0.10-android-x86_64
frida-server-16.4.8-android-arm
frida-server-16.4.8-android-arm64
frida-server-16.4.8-android-x86

[Attachment 81430 - Click to enlarge]

what device is it ? is it rooted correctly have you used root checker ? is it definitely 64bit

its rooted as you can see '#' in the command,
i have tried both versions x86_64 also arm64_arm

[Karn]

its rooted as you can see '#' in the command,
i have tried both versions x86_64 also arm64_arm

Try with keydive. The process is much simpler.

[PSXman_uk]

tried to Dumping CDM from a real device "android 8.1"
but all versions bellow has the same issue after command "chmod +x /data/local/tmp/frida-server-16.0.10-android-arm64" result "Bad mode"

frida-server-16.0.10-android-arm
frida-server-16.0.10-android-arm64
frida-server-16.0.10-android-x86_64
frida-server-16.4.8-android-arm
frida-server-16.4.8-android-arm64
frida-server-16.4.8-android-x86

[Attachment 81430 - Click to enlarge]

what device is it ? is it rooted correctly have you used root checker ? is it definitely 64bit

its rooted as you can see '#' in the command,
i have tried both versions x86_64 also arm64_arm

Bad mode means the permissions on the file are not set correctly , set permission to 777 using chmod and run Frida using `-D` arg for running as deamon. If any issues try to disable SELinux using `setenforce 0` (and use `getenforce` for check)

[imr_saleh]

Try with keydive. The process is much simpler.

Bad mode means the permissions on the file are not set correctly , set permission to 777 using chmod and run Frida using `-D` arg for running as deamon. If any issues try to disable SELinux using `setenforce 0` (and use `getenforce` for check)

Finally I was able to extract the CDM via keydive.
Thanks for assistance.

[Attachment 81749 - Click to enlarge]

[PSXman_uk]

Try with keydive. The process is much simpler.

Bad mode means the permissions on the file are not set correctly , set permission to 777 using chmod and run Frida using `-D` arg for running as deamon. If any issues try to disable SELinux using `setenforce 0` (and use `getenforce` for check)

Finally I was able to extract the CDM via keydive.
Thanks for assistance.

[Attachment 81749 - Click to enlarge]

Excellent well done