Dumping Your own L3 CDM with Android Studio

[streetf22]

Sorry for my grammar, hopefully it will be undersoodable.
If you’re using a Mac and you’ve managed to follow all the steps but only the key_boxes directory is created (without the private_keys directory), you should do the following:
1. Pull the libwvhidl.so file from your device:

adb pull /vendor/lib64/libwvhidl.so

2. Use nm to inspect exported symbols:

nm -gD libwvhidl.so

You will get output like this:

000000000017de28 T tfayzalk
                 U time@LIBC
000000000017f6f0 T umsygtib
                 U unlink@LIBC
000000000017f23c T vauxqowp
000000000017dbe8 T vlezovbp
000000000017daac T vngfjbek
                 U vsnprintf@LIBC
00000000001802a0 T vyxlkkyb
000000000017e504 T ydihlccg

3. Add these symbol names to the KNOWN_DYNAMIC_FUNC array in dumper/Helpers/script.js. The updated first line should look like this:

const KNOWN_DYNAMIC_FUNC = ['ulns', 'cwkfcplc', 'dnvffnze', 'kgaitijd', 'polorucp', 'vauxqowp', 'vlezovbp', 'vngfjbek', 'vyxlkkyb', 'ydihlccg'];

4. Run the process again. This time, the private_key directory will be generated with the correct files.

credit to This GitHub comment

[leophir]

Thank you very much for this tutorial it worked using a different DRM website and a Pixel 3 XL running Android API 28.

Can you tell me how you proceeded ? Like in some other cases the dump_keys Python Skript did not work. How did you do it?

I've really followed the instructions with the help of ChatGPT because I'm not comfortable with python. The only changes I've made are the ones listed above.

[JBR2001]

Someone could tell me where the problem may be, he's been trying to load the bitmovin page all the time and he always restarts.

[leophir]

Someone could tell me where the problem may be, he's been trying to load the bitmovin page all the time and he always restarts.

Bitmovin was an impossible issue for me because of CloudFlare not liking a virtual device legitimately. I had to use another streaming page using widevine in my country to trigger the DRM and the tool.

[JBR2001]

which one did you use?

[leophir]

which one did you use?

A rapid Google search pointed to this page: https://reference.dashif.org/dash.js/latest/samples/drm/widevine.html
The website I've used requires a French IP and a paid account.

[streetf22]

Someone could tell me where the problem may be, he's been trying to load the bitmovin page all the time and he always restarts.

I had the same issue. What worked for me was this:
1. On the virtual device, open Google and search for “bitmovin”.
2. Go to the main bitmovin.com site — if the first result doesn’t work, scroll down and look for another bitmovin.com link.
3. Once you’re on the main page, manually add /demos/drm to the URL.
4. If it still doesn’t work, try closing everything, on the virtual device, and repeating the steps — it should eventually work.

[v4mp3t4]

Hi Guys,
from long time i read and try to understand but i lost the way

i succesfull got client_id and key.pem over frida and dumper py

succesfull create device.wvd

succesfull pssh

succesfull download mp4 contents

i follow many thrends around about decrypt over ffmpeg but i not understand ;-( someone can help?

[InvalidUser]

Sorry for my grammar, hopefully it will be undersoodable.
If you’re using a Mac and you’ve managed to follow all the steps but only the key_boxes directory is created (without the private_keys directory), you 4. Run the process again. This time, the private_key directory will be generated with the correct files.
...
credit to This GitHub comment

Thank you so much for posting this! I was completely stuck.

And thank you, OP, for the updated post!

[DoomDash]

I'm sure I'm making a dumb mistake, but on the step in the updated 2025 instructions "On the next window popping up, go to the second tab called x86 Images, then scroll down until you find Android Pie, API28, x86_64, Android Pie (Google APIs), and click the down arrow to download it:", I'm not getting the same screen in the screenshot, instead get this:

[Attachment 87100 - Click to enlarge]

What am I missing here - thanks for any help or suggestions!

[InvalidUser]

What am I missing here - thanks for any help or suggestions!

I couldn't get this to work with anything higher than a Pixel 3 XL. And that gave me fits (using API 28) until I switched to API 29. That said, I'm working on a mac, so maybe there are subtle differences between this and the PC version.

Regardless, the mistake you're making (in the picture you attached, which I marked up below) is that you are going with the default system image, which for your device, is API 36 or something like that. Click on the dropdown box (where it gives you the choice of API, see red arrow) and select something earlier. If you're still finding nothing, then try clicking the "show unsupported" checkbox at the bottom (red arrow #2). If all else fails, then change your device to something that actually supported that API -- eg, the pixel 3 XL.



[Attachment 87101 - Click to enlarge]



One final note, I had trouble getting chrome to work with that image, so I just loaded the web page using a shell command. This seemed to work great, and since many of the images I tested didn't even come with chrome installed, I thought it might be a useful thing to add to the discussion (not necessarily for you, but for anyone else who runs into this issue). The command I used was:

adb shell am start -a android.intent.action.VIEW -d "https://bitmovin.com/demos/drm"

(Or, if you have trouble with bitmovin, a good alternative site was "https://shaka-player-demo.appspot.com/demo/")

[Navii3]

Wow, what a process and tutorial!

[Navii3]

I use an anti-detect browser with a fake UA. Can i set up this tool using the spoofed UA data or does it need to be my real?

[m7king]

I followed all steps carefully and it all went well until running the python script. The script connects to my emulated device but in the end I get this error:

frida.ServerNotRunningError: unable to connect to remote frida-server: closed

I have not closed my frida terminal and it's still running in the background. If anyone know any fix, please let me know. I would be really thankful for any help.

[InvalidUser]

frida.ServerNotRunningError: unable to connect to remote frida-server: closed

Any chance the version of Frida running on the emulated phone is different from the one that you downloaded to your machine? That seems like the most likely culprit.

Alternatively, if you didn't see the previous comment (quoted below) there's a specific version of frida that seems to work best with this (or at least it did for me):

Change your version of frida.

pip install frida==16.5.2

[utilitysnail]

If anyone ever gets this error


[Attachment 87163 - Click to enlarge]

when trying to dump the keys, you have to add

rpc.exports = {
inject: inject
};

to the bottom of "script.js" in the "Helpers" folder

[mrbloodstone]

FYI i had major issues using dumper due to multiple function error's. I have spent 4 hours working on it and I finally got the dumps. I will say if you are using Windows and have basic to intermediate IT knowledge use Google Gemini not chatgpt when troubleshooting any errors. It was miles better. Helped me understand and troubleshoot dumper, frida, javascript and android errors than chatgpt. The hooker function was giving an error when running the key dump for example. Gemini helped me re-write the entire function. I will say it took some time as it did spin other error's but Gemini literally helped me get to each step until I finally got the key dumps. It even helped me find the exact answer to an error that was not specific by making a debug js file and loading that under dumper which allowed it to pinpoint one of the problems and solve it. To be honest Gemini helping me rewrite functions that were generating errors may have helped but that may have not been the problem from the beginning. It could have been the latest version of Frida I was using (apologies if this has been mentioned. I didn't think about Frida being the problem until I started thinking about until the end).

Virtual Phone Model: Pixel3xl
OS: Android 9 (x86_x64)
Frida Version: Frida 16.1.4 and Frida 16.1.4 android x86_x64


Hope this helps anyone in the future

[m7king]

frida.ServerNotRunningError: unable to connect to remote frida-server: closed

Any chance the version of Frida running on the emulated phone is different from the one that you downloaded to your machine? That seems like the most likely culprit.

Alternatively, if you didn't see the previous comment (quoted below) there's a specific version of frida that seems to work best with this (or at least it did for me):

Change your version of frida.

pip install frida==16.5.2

I have checked if the frida version and frida server version is the same or not for more than 5 times now. I still have the same error.

[kevinsheeks]

Hello folks,

This post will revisite the famous Dumping Your own L3 CDM with Android Studio, but updated for 2025.

This will be written from the perspective of a Linux user, but you can translate it easily for Windows.

Prerequisites

This assumes you have a PC with a x86_64 processor (AMD or Intel), either with Linux or Windows. It is possible to do it under ARM64 but I don't have such machine available.

Step 1: softwares needed

• Install adb-studio from https://developer.android.com/studio

It is available for Windows and Linux and will allow us to create a virtual android.

On Linux, you can use Flatpak:

flatpak install com.google.AndroidStudio

or Snap

sudo snap install android-tools

It is in the AUR for Arch users:

sudo pacman -S android-studio

• Install Android platform-tools

On linux, it's eitheir:

sudo dnf install android-tools

sudo apt install android-tools-adb

sudo pacman -S android-sdk-platform-tools

On Windows, grab it from https://developer.android.com/tools/releases/platform-tools and extract the zip to an easily accessible directory.

• Install python3

If you're on Linux, it is most likely already installed, if not I assume you know how to install it. On Windows, you can get it from https://www.python.org/downloads/windows/ or from a package manager like Chocolatey.

• Install frida

In a command line, type:

pip install frida frida-tools

Please note the version number of frida (currently it is 16.6.6).
On Windows, after installing Python, I think you can go to the Start menu, then Python, and launch a command line there to type that command.

• Download the frida-server corrresponding to your Frida version at https://github.com/frida/frida/releases
  • Click either "Show all assets" or "Assets" under the release corresponding to the version of Frida you have (usually the last one if you just installed Frida)
  • Search for frida-server-XX.X.X-android-x86_64.xz and download it. Please make sur to use the Android, x86_64 version.
  • Extract the file with your favorite archive extractor. On Windows, you can use 7zip.
  • Rename the extracted file to frida-server
• Download the utility to dump the keys

On linux, if you have git, you can git clone https://github.com/wvdumper/dumper in a directory easiy accessible.
On Windows or Linux, you can also just download the archive from https://github.com/wvdumper/dumper/archive/refs/heads/main.zip. In that case, just extract the zip afterward.

• Install Protobuf 3.20.0

In a command line, type:

pip install --force-reinstall -v "protobuf==3.20.0"

We use this specific version to use the dump keys utility.
On Windows, after installing Python, I think you can go to the Start menu, then Python, and launch a command line there to type that command.

Step 2: creating a virtual Android device

• Launch Android Studio
  
  On Linux, go to the extracted android-studio/bin/ and launch ./studio.sh
  
  If you have installed any other way, there is probably a shorcut somewhere to start it.
• We will then create the virtual device. First follow the first startup wizard:
  
  
  
  
  
  
• After everything is downloaded, just create a new project and select No activity:
  
  
  
• Select API28 ("Pie"; Android 9.0):
  
  
  
• After the project is created, click on the Device Manager icon on the right toolbar:
  
  
  
• Then click on the "+" button and Create Virtual Device:
  
  
  
• Select an Android device like Pixel 9 Pro XL for example:
  
  
  
• On the next window popping up, go to the second tab called x86 Images, then scroll down until you find Android Pie, API28, x86_64, Android Pie (Google APIs), and click the down arrow to download it:
  
  
  
  In any case, do not select any images more recent than Android Pie/API28 or we won't be able to root it.
  Select x86_64 if you have an AMD or Intel processor. If you are on ARM64, go to the 3rd tab to download the same image for ARM64.
  Do not download images where it says Google Play in the Target column.
• Wait for the image to download:
  
  
  
• After the download is finished, scroll down again to select Android Pie, API28, x86_64, Android Pie (Google APIs) that you've just downloaded and click Next:
  
  
  
• Click Finish on the following window:
  
  
  
• Then click the Start arrow to load the virtual Android device we've just created:
  
  
  
• Wait a bit, you should have soon a Android device ready like this:
  
  

Step 3: copy frida-server and start it

On Linux, type the following command in a terminal, in the directory where you have extracted frida-server:

adb root
adb push frida-server /data/local/tmp/
adb shell
chmod 755 /data/local/tmp/frida-server
/data/local/tmp/frida-server &

On Windows, open a command line (cmd) then go to the directory where you extracted adb.exe from the platform-tools, and do the same:

adb.exe root
adb.exe push /path/to/extracted/frida-server /data/local/tmp/
adb.exe shell
chmod 755 /data/local/tmp/frida-server
/data/local/tmp/frida-server &

Note, on both Windows and Linux, you can change directory with cd path/to/the/directory and go to the parent directory with cd ..

In any case, do not close that terminal window.

Step 4: start dump_keys.py

On Linux, open a new terminal, go to the directory where you extracted or cloned dumper, and launch

python dump_keys.py

On Windows, after installing Python, I think you can go to the Start menu, then Python, and launch a command line there. Then use the command cd path/to/the/dumper/directory to go to the correct directory, than launch

python dump_keys.py

The program is starting, when it is ready, you should see something like

2025-02-09 06:09:31 AM - root - 25 - INFO - Hooks completed

Step 5: load a webpage with DRM on the virtual device

Launch Chrome on the virtual phone (do not sign in). Then go to the following URL: https://bitmovin.com/demos/drm

Click Allow when prompted to play protected content:



Then click Load and play the video:



Step 6: copy the keys

In the background, dump_keys should have been doing its work:



In the directory where you have cloned or extracted dumper, you should have the following directories: key_dumps/Android Emulator XXXX/private_keys/XXXX/

In this directory, you can have one or more folder with a number, and inside them you will find two files:
- client_id.bin
- private_key.pem

(do not share them)

Copy or backup them to a safe place.

You can now stop the virtual device, quit Android studio, stop dump_keys.py (Ctrl+C) and close adb too.

Step 7: Profit!

thank you so much

[Jarsky]

Has anyone had trouble getting this to work now? I've used it before just fine.
I just set it all up again; but im not able to get past the CF page for any sites behind CF (including bitmovin); and i've tried about 10 different dash mpd players with no luck. the videos that have played; im not sure if they have DRM as I dont see any change on dumper-main and no Android Emulator directory created.

Think its to do with the outdate version of Pi (API28); but if I try and use Pixel 9 in the above post its using API35+.
If I try and use that again I don't see any movement on dumper-main


[Attachment 87291 - Click to enlarge]

[rogerwaters]

Has anyone had trouble getting this to work now? I've used it before just fine.
I just set it all up again; but im not able to get past the CF page for any sites behind CF (including bitmovin); and i've tried about 10 different dash mpd players with no luck. the videos that have played; im not sure if they have DRM as I dont see any change on dumper-main and no Android Emulator directory created.

Think its to do with the outdate version of Pi (API28); but if I try and use Pixel 9 in the above post its using API35+.
If I try and use that again I don't see any movement on dumper-main


[Attachment 87291 - Click to enlarge]

I am in the same boat, able to do all the steps except dumper doesn't seem to do anything. :/

[fuoadco]

plz some help .. what i missssssssing here
[Attachment 87389 - Click to enlarge]