Dumping Your own L3 CDM with Android Studio

[streetf22]

Sorry for my grammar, hopefully it will be undersoodable.
If you’re using a Mac and you’ve managed to follow all the steps but only the key_boxes directory is created (without the private_keys directory), you should do the following:
1. Pull the libwvhidl.so file from your device:

adb pull /vendor/lib64/libwvhidl.so

2. Use nm to inspect exported symbols:

nm -gD libwvhidl.so

You will get output like this:

000000000017de28 T tfayzalk
                 U time@LIBC
000000000017f6f0 T umsygtib
                 U unlink@LIBC
000000000017f23c T vauxqowp
000000000017dbe8 T vlezovbp
000000000017daac T vngfjbek
                 U vsnprintf@LIBC
00000000001802a0 T vyxlkkyb
000000000017e504 T ydihlccg

3. Add these symbol names to the KNOWN_DYNAMIC_FUNC array in dumper/Helpers/script.js. The updated first line should look like this:

const KNOWN_DYNAMIC_FUNC = ['ulns', 'cwkfcplc', 'dnvffnze', 'kgaitijd', 'polorucp', 'vauxqowp', 'vlezovbp', 'vngfjbek', 'vyxlkkyb', 'ydihlccg'];

4. Run the process again. This time, the private_key directory will be generated with the correct files.

credit to This GitHub comment

[leophir]

Thank you very much for this tutorial it worked using a different DRM website and a Pixel 3 XL running Android API 28.

Can you tell me how you proceeded ? Like in some other cases the dump_keys Python Skript did not work. How did you do it?

I've really followed the instructions with the help of ChatGPT because I'm not comfortable with python. The only changes I've made are the ones listed above.

[JBR2001]

Someone could tell me where the problem may be, he's been trying to load the bitmovin page all the time and he always restarts.

[leophir]

Someone could tell me where the problem may be, he's been trying to load the bitmovin page all the time and he always restarts.

Bitmovin was an impossible issue for me because of CloudFlare not liking a virtual device legitimately. I had to use another streaming page using widevine in my country to trigger the DRM and the tool.

[JBR2001]

which one did you use?

[leophir]

which one did you use?

A rapid Google search pointed to this page: https://reference.dashif.org/dash.js/latest/samples/drm/widevine.html
The website I've used requires a French IP and a paid account.

[streetf22]

Someone could tell me where the problem may be, he's been trying to load the bitmovin page all the time and he always restarts.

I had the same issue. What worked for me was this:
1. On the virtual device, open Google and search for “bitmovin”.
2. Go to the main bitmovin.com site — if the first result doesn’t work, scroll down and look for another bitmovin.com link.
3. Once you’re on the main page, manually add /demos/drm to the URL.
4. If it still doesn’t work, try closing everything, on the virtual device, and repeating the steps — it should eventually work.

[v4mp3t4]

Hi Guys,
from long time i read and try to understand but i lost the way

i succesfull got client_id and key.pem over frida and dumper py

succesfull create device.wvd

succesfull pssh

succesfull download mp4 contents

i follow many thrends around about decrypt over ffmpeg but i not understand ;-( someone can help?

[InvalidUser]

Sorry for my grammar, hopefully it will be undersoodable.
If you’re using a Mac and you’ve managed to follow all the steps but only the key_boxes directory is created (without the private_keys directory), you 4. Run the process again. This time, the private_key directory will be generated with the correct files.
...
credit to This GitHub comment

Thank you so much for posting this! I was completely stuck.

And thank you, OP, for the updated post!

[DoomDash]

I'm sure I'm making a dumb mistake, but on the step in the updated 2025 instructions "On the next window popping up, go to the second tab called x86 Images, then scroll down until you find Android Pie, API28, x86_64, Android Pie (Google APIs), and click the down arrow to download it:", I'm not getting the same screen in the screenshot, instead get this:

[Attachment 87100 - Click to enlarge]

What am I missing here - thanks for any help or suggestions!

[InvalidUser]

What am I missing here - thanks for any help or suggestions!

I couldn't get this to work with anything higher than a Pixel 3 XL. And that gave me fits (using API 28) until I switched to API 29. That said, I'm working on a mac, so maybe there are subtle differences between this and the PC version.

Regardless, the mistake you're making (in the picture you attached, which I marked up below) is that you are going with the default system image, which for your device, is API 36 or something like that. Click on the dropdown box (where it gives you the choice of API, see red arrow) and select something earlier. If you're still finding nothing, then try clicking the "show unsupported" checkbox at the bottom (red arrow #2). If all else fails, then change your device to something that actually supported that API -- eg, the pixel 3 XL.



[Attachment 87101 - Click to enlarge]



One final note, I had trouble getting chrome to work with that image, so I just loaded the web page using a shell command. This seemed to work great, and since many of the images I tested didn't even come with chrome installed, I thought it might be a useful thing to add to the discussion (not necessarily for you, but for anyone else who runs into this issue). The command I used was:

adb shell am start -a android.intent.action.VIEW -d "https://bitmovin.com/demos/drm"

(Or, if you have trouble with bitmovin, a good alternative site was "https://shaka-player-demo.appspot.com/demo/")

[Navii3]

Wow, what a process and tutorial! Everything was going well until Python dump_keys.py. I received some unusual error that mentioned crypto? I then downloaded the Dumper dependencies thinking that would help and here was the result:


[Attachment 87105 - Click to enlarge]

[Navii3]

I use an anti-detect browser with a fake UA. Can i set up this tool using the spoofed UA data or does it need to be my real?

[m7king]

I followed all steps carefully and it all went well until running the python script. The script connects to my emulated device but in the end I get this error:

frida.ServerNotRunningError: unable to connect to remote frida-server: closed

I have not closed my frida terminal and it's still running in the background. If anyone know any fix, please let me know. I would be really thankful for any help.

[InvalidUser]

frida.ServerNotRunningError: unable to connect to remote frida-server: closed

Any chance the version of Frida running on the emulated phone is different from the one that you downloaded to your machine? That seems like the most likely culprit.

Alternatively, if you didn't see the previous comment (quoted below) there's a specific version of frida that seems to work best with this (or at least it did for me):

Change your version of frida.

pip install frida==16.5.2