Dumping Your own L3 CDM with Android Studio

[ErikDB]

[Attachment 84781 - Click to enlarge]

I'm wondering if anyone can help me with this. Getting this error early in the steps.

Try putting a smash ("/") at the end of that "mv" command?

[eloxole]

[Attachment 84784 - Click to enlarge]

Still the same issue

[romanrsr]

Hi Guys.
I'm running frida-server on, Pixel 7 Pro with API Level 28 and Target Android 9. But when I try to open udemxx in the browser, I get the following message:
Application error: a client-side exception has occurred (see the browser console for more information).

What is the problem?

Thanks!

[copyrightr]

hi all, newbie to the forum here. I have followed all steps and get to the point of playing the video on the device, but i receive no info in the dump screen

[muiacir]

hello
thnx for this tutorial

[rvlnnb]

Hello folks,

This post will revisite the famous Dumping Your own L3 CDM with Android Studio, but updated for 2025.

This will be written from the perspective of a Linux user, but you can translate it easily for Windows.

Prerequisites

This assumes you have a PC with a x86_64 processor (AMD or Intel), either with Linux or Windows. It is possible to do it under ARM64 but I don't have such machine available.

Step 1: softwares needed

• Install adb-studio from https://developer.android.com/studio

It is available for Windows and Linux and will allow us to create a virtual android.

On Linux, you can use Flatpak:

flatpak install com.google.AndroidStudio

or Snap

sudo snap install android-tools

It is in the AUR for Arch users:

sudo pacman -S android-studio

• Install Android platform-tools

On linux, it's eitheir:

sudo dnf install android-tools

sudo apt install android-tools-adb

sudo pacman -S android-sdk-platform-tools

On Windows, grab it from https://developer.android.com/tools/releases/platform-tools and extract the zip to an easily accessible directory.

• Install python3

If you're on Linux, it is most likely already installed, if not I assume you know how to install it. On Windows, you can get it from https://www.python.org/downloads/windows/ or from a package manager like Chocolatey.

• Install frida

In a command line, type:

pip install frida frida-tools

Please note the version number of frida (currently it is 16.6.6).
On Windows, after installing Python, I think you can go to the Start menu, then Python, and launch a command line there to type that command.

• Download the frida-server corrresponding to your Frida version at https://github.com/frida/frida/releases
  • Click either "Show all assets" or "Assets" under the release corresponding to the version of Frida you have (usually the last one if you just installed Frida)
  • Search for frida-server-XX.X.X-android-x86_64.xz and download it. Please make sur to use the Android, x86_64 version.
  • Extract the file with your favorite archive extractor. On Windows, you can use 7zip.
  • Rename the extracted file to frida-server
• Download the utility to dump the keys

On linux, if you have git, you can git clone https://github.com/wvdumper/dumper in a directory easiy accessible.
On Windows or Linux, you can also just download the archive from https://github.com/wvdumper/dumper/archive/refs/heads/main.zip. In that case, just extract the zip afterward.

• Install Protobuf 3.20.0

In a command line, type:

pip install --force-reinstall -v "protobuf==3.20.0"

We use this specific version to use the dump keys utility.
On Windows, after installing Python, I think you can go to the Start menu, then Python, and launch a command line there to type that command.

Step 2: creating a virtual Android device

• Launch Android Studio
  
  On Linux, go to the extracted android-studio/bin/ and launch ./studio.sh
  
  If you have installed any other way, there is probably a shorcut somewhere to start it.
• We will then create the virtual device. First follow the first startup wizard:
  
  
  
  
  
  
• After everything is downloaded, just create a new project and select No activity:
  
  
  
• Select API28 ("Pie"; Android 9.0):
  
  
  
• After the project is created, click on the Device Manager icon on the right toolbar:
  
  
  
• Then click on the "+" button and Create Virtual Device:
  
  
  
• Select an Android device like Pixel 9 Pro XL for example:
  
  
  
• On the next window popping up, go to the second tab called x86 Images, then scroll down until you find Android Pie, API28, x86_64, Android Pie (Google APIs), and click the down arrow to download it:
  
  
  
  In any case, do not select any images more recent than Android Pie/API28 or we won't be able to root it.
  Select x86_64 if you have an AMD or Intel processor. If you are on ARM64, go to the 3rd tab to download the same image for ARM64.
  Do not download images where it says Google Play in the Target column.
• Wait for the image to download:
  
  
  
• After the download is finished, scroll down again to select Android Pie, API28, x86_64, Android Pie (Google APIs) that you've just downloaded and click Next:
  
  
  
• Click Finish on the following window:
  
  
  
• Then click the Start arrow to load the virtual Android device we've just created:
  
  
  
• Wait a bit, you should have soon a Android device ready like this:
  
  

Step 3: copy frida-server and start it

On Linux, type the following command in a terminal, in the directory where you have extracted frida-server:

adb root
adb push frida-server /data/local/tmp/
adb shell
chmod 755 /data/local/tmp/frida-server
/data/local/tmp/frida-server &

On Windows, open a command line (cmd) then go to the directory where you extracted adb.exe from the platform-tools, and do the same:

adb.exe root
adb.exe push /path/to/extracted/frida-server /data/local/tmp/
adb.exe shell
chmod 755 /data/local/tmp/frida-server
/data/local/tmp/frida-server &

Note, on both Windows and Linux, you can change directory with cd path/to/the/directory and go to the parent directory with cd ..

In any case, do not close that terminal window.

Step 4: start dump_keys.py

On Linux, open a new terminal, go to the directory where you extracted or cloned dumper, and launch

python dump_keys.py

On Windows, after installing Python, I think you can go to the Start menu, then Python, and launch a command line there. Then use the command cd path/to/the/dumper/directory to go to the correct directory, than launch

python dump_keys.py

The program is starting, when it is ready, you should see something like

2025-02-09 06:09:31 AM - root - 25 - INFO - Hooks completed

Step 5: load a webpage with DRM on the virtual device

Launch Chrome on the virtual phone (do not sign in). Then go to the following URL: https://bitmovin.com/demos/drm

Click Allow when prompted to play protected content:



Then click Load and play the video:



Step 6: copy the keys

In the background, dump_keys should have been doing its work:



In the directory where you have cloned or extracted dumper, you should have the following directories: key_dumps/Android Emulator XXXX/private_keys/XXXX/

In this directory, you can have one or more folder with a number, and inside them you will find two files:
- client_id.bin
- private_key.pem

(do not share them)

Copy or backup them to a safe place.

You can now stop the virtual device, quit Android studio, stop dump_keys.py (Ctrl+C) and close adb too.

Step 7: Profit!

[peterb999]

Thanks a lot for that, much appreciated.

[Pepnek]

@rvlnnb

thanks a lot for your work!

unfortunately i get this error whenever i try to start dump_keys.py:

[Attachment 85501 - Click to enlarge]

can someone help me? thanks


Edit: i figured it out. it downloaded the wrong android system image (i should have downloaded the x86_64 version instead of the x86 version)

[hopsplatter]

I'm currently stuck on @rvlnnb's instructions on step 4 - running the dumper returns: frida.TransportError: failed to open USB device: Input/Output Error
Does anyone have any ideas to fix this?

[Attachment 85518 - Click to enlarge]

[cedric8528]

Change your version of frida.

pip install frida==16.5.2

[iamanastronaut_]

This is still working!! Thanks a lot

[hopsplatter]

Change your version of frida.

pip install frida==16.5.2

This worked perfectly! Thank you!

[Bingseer]

Hi everyone! I think I got a problem. When dumping it said unable to save keybox. I scrolled the entire page and didn't find the same situation. Can someone help me? Thanks!
[Attachment 85744 - Click to enlarge]
And the Chinese 拒绝访问 means access denied, I believe. I live in China so the system here is Chinese.

[KanyeMan98]

Im following the new guide for 2025 rvlnnb posted but first off i can't use Android Pie on pixel 9 pro, i have to go all the way to a pixel 3, and then the rest of the steps work, but when i try to dump keys I get "frida.TransportError: the connection is closed" error. what can i possibly do to fix this, do i have to use an older version of android studio, cause now im just stuck.

I'm on Windows btw

[Midoo]

does this method still work?

[rickitron]

Could someone please help me with this error?


[Attachment 86243 - Click to enlarge]

[Ganteng]

Im following the new guide for 2025 rvlnnb posted but first off i can't use Android Pie on pixel 9 pro, i have to go all the way to a pixel 3, and then the rest of the steps work, but when i try to dump keys I get "frida.TransportError: the connection is closed" error. what can i possibly do to fix this, do i have to use an older version of android studio, cause now im just stuck.

I'm on Windows btw

same problem here

[Sviests]

Im following the new guide for 2025 rvlnnb posted but first off i can't use Android Pie on pixel 9 pro, i have to go all the way to a pixel 3, and then the rest of the steps work, but when i try to dump keys I get "frida.TransportError: the connection is closed" error. what can i possibly do to fix this, do i have to use an older version of android studio, cause now im just stuck.

I'm on Windows btw

That's what i had to do and it's working for me, using this older android studio version:
Android Studio Ladybug | 2024.2.1 Patch 2 October 31, 2024
https://redirector.gvt1.com/edgedl/android/studio/install/2024.2.1.11/android-studio-2...11-windows.exe

I had to also downgrade pycryptodome to 3.14.1 and protobuf to 3.19,otherwise frida would return a lot of errors.

[titotrinidad]

Does my virtual phone need to be rooted?


Edit.... Worked just had to downgrade my phone

[Anonymous543394]

I am running Pixel 6 API 30 to get videos from Crunchyroll. Everything seems to be functioning as normal. But client_id.bin and private_key.pem do not show up in the dumper folder.

[Attachment 86407 - Click to enlarge]
[Attachment 86408 - Click to enlarge]

[taro]

Hi, I have exactly the same problem ! Did you find any solution ?

Hey guys,this great thread and your help.

After installing Android Studio, Python, Frida, Frida tools (16.0.18) and Downloading frida Server (frida-server-16.0.18-android-x86), Pushing frida server to /sdcard, starting the server and running Python dump_keys.py, i get this message:

C:\Users\Helona\AppData\Local\Android\Sdk\platform-tools\dumper-main>python dump_keys.py
2023-04-26 09:34:55 PM - root - 16 - INFO - Connected to Android Emulator 5554
2023-04-26 09:34:55 PM - root - 17 - INFO - scanning all processes for the following libraries
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=1, name="init", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=171, name="init", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=173, name="ueventd", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=215, name="logd", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=216, name="lmkd", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=217, name="servicemanager", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=218, name="hwservicemanager", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=223, name="sh", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=224, name="qemu-props", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=228, name="vold", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=237, name="android.system.suspend@1.0-service", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=238, name="keystore", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=239, name="android.hardware.atrace@1.0-service", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=240, name="android.hardware.security.keymint-service", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=277, name="tombstoned", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=360, name="dhcpclient", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=372, name="statsd", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=373, name="netd", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=374, name="zygote64", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=378, name="android.hidl.allocator@1.0-service", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=379, name="android.hardware.audio.service", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=380, name="android.hardware.authsecret@1.0-service", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=381, name="android.hardware.bluetooth@1.1-service.btlinux", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=382, name="android.hardware.camera.provider@2.4-service_64", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=383, name="android.hardware.camera.provider@2.7-service-google", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=384, name="android.hardware.cas@1.2-service", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=389, name="android.hardware.contexthub@1.1-service.mock", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=390, name="iptables-restore", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=391, name="ip6tables-restore", parameters={})
2023-04-26 09:34:56 PM - root - 19 - DEBUG - Process(pid=393, name="android.hardware.drm-service.clearkey", parameters={})
Traceback (most recent call last):
File "C:\Users\Helona\AppData\Local\Android\Sdk\platfor m-tools\dumper-main\dump_keys.py", line 21, in <module>
libraries = scanner.find_widevine_process(device, process.name)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^
File "C:\Users\Helona\AppData\Local\Android\Sdk\platfor m-tools\dumper-main\Helpers\Scanner.py", line 149, in find_widevine_process
process = dev.attach(process_name)
^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Helona\AppData\Local\Packages\PythonSoft wareFoundation.Python.3.11_qbz5n2kfra8p0\LocalCach e\local-packages\Python311\site-packages\frida\core.py", line 86, in wrapper
return f(*args, **kwargs)
^^^^^^^^^^^^^^^^^^
File "C:\Users\Helona\AppData\Local\Packages\PythonSoft wareFoundation.Python.3.11_qbz5n2kfra8p0\LocalCach e\local-packages\Python311\site-packages\frida\core.py", line 1010, in attach
return Session(self._impl.attach(self._pid_of(target), **kwargs)) # type: ignore
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
frida.ServerNotRunningError: unable to connect to remote frida-server: closed

the frida-server-16.0.18-android-x86 is located in C:\Users\Helona\AppData\Local\Android\Sdk\platform-tools,
inside this directory, i got another directory 'dumper-main' with the 'dump_keys.py' and other files..........


What am i doing wrong ? What should be the problem ?

thanks !!!!

[freeseasailor]

Android Studio doesn't allow me to chose the Android Pie x86 image anymore, what am I doing wrong?

[Danker1990]

Same issue. whatever you click with content reads the code but doesn't produce the 2 crucial files. the dumper code needs to be updated.

[neo_rld]

Android Studio doesn't allow me to chose the Android Pie x86 image anymore, what am I doing wrong?

Same issue. whatever you click with content reads the code but doesn't produce the 2 crucial files. the dumper code needs to be updated.

From "main menu" (icon with 4 lines) upper to left -> tools -> sdk manager -> tab "sdk platforms" remove old system image and add android 9 system image (these are hided below "Android 9.0 Pie")

[streetf22]

I'm on Mac ARM64, I've got those errors while running frida-server

[Attachment 86808 - Click to enlarge]

[TomArgent]

Any pointers on why this is happening? Noticed someone above having a similar issue, but I started out with the method listed at the beginning of the thread, had a permissions issue [couldn't get root to run frida, for some reason] so I switched to the Keydive method and am now having an issue where, even when I can clearly see the file using the list command, I can't access it because it "doesn't exist." I've used chmod +x and 777 and 755 just to make sure that wasn't the issue, but it still gives this same error every time [Both when calling it via "./frida-server" and via "/data/local/tmp/frida-server"]

Running Android 13 (as that's recommended in the KeyDive tutorial) on the Pixel 6, emulated exactly as it's detailed in this post. I have Frida 16.7.16 installed on my pc using pip and have 16.7.16 on the virtual phone.

[cedric8528]

Try System Image in x86....same things for Frida-Server...

[Hausi]

Thanks for this great tutorial. But I get stuck at the point where the python script should be started. I always get this output:

C:\dumper-main> python dump_keys.py
2025-05-11 01:16:04 PM - root - 16 - INFO - Connected to Android Emulator 5554
2025-05-11 01:16:04 PM - root - 17 - INFO - scanning all processes for the following libraries
Traceback (most recent call last):
  File "C:\dumper-main\dump_keys.py", line 18, in <module>
    for process in device.enumerate_processes():
  File "C:\Users\Hausi\AppData\Local\Programs\Python\Python310\lib\site-packages\frida\core.py", line 86, in wrapper
    return f(*args, **kwargs)
  File "C:\Users\Hausi\AppData\Local\Programs\Python\Python310\lib\site-packages\frida\core.py", line 948, in enumerate_processes
    return self._impl.enumerate_processes(**kwargs)  # type: ignore
frida.ProcessNotFoundError: unable to find process with name 'system_server'

Any ideas?

Please tell me if you need more info. Would be thankful for your advice.

Best regards

[leophir]

Thank you very much for this tutorial it worked using a different DRM website and a Pixel 3 XL running Android API 28.

[suwofis]

Thank you very much for this tutorial it worked using a different DRM website and a Pixel 3 XL running Android API 28.

Can you tell me how you proceeded ? Like in some other cases the dump_keys Python Skript did not work. How did you do it?