Dumping Your own L3 CDM with Android Studio

[A_n_g_e_l_a]

Would you recommend downgrading my python like mrmyst suggested?

The error message says it is missing crypto

pip install crypto

may do it. But it is missing on my system which runs fine without it.

We upgrade systems to improve them; so it follows we downgrade and make them worse. There is a lot of silly folklore around python because version 2 was incompatible with version 3. Just run the latest pyton you can find.

[cedric8528]

yes A_n_g_e_l_a.... but "crypto" is "pycryptodome"....and i think that you have pycryptodome installed on your computer

[A_n_g_e_l_a]

yes A_n_g_e_l_a.... but "crypto" is "pycryptodome"....and i think that you have pycryptodome installed on your computer

Well there s a package 'crypto' and thats what the error message was asking for. And the import in scanner.py is for "from Crypto.PublicKey import RSA" No mention of cryptodome?

I see in the requirements it just lists protobuf. Now that package does casue problems and recently a major version change from 3 to 4 occured. I wonder if it is related to that

pip install protobuf==3.20.3 if version 4 is installed

and i have these installed that have crypto in their title

cryptography==37.0.2
pycrypto==2.6.1 ## missing this one?
pycryptodome==3.16.0
pycryptodomex==3.15.0

[mrmyst]

There is a lot of silly folklore around python because version 2 was incompatible with version 3

I'm using Python 3.10.7

[cedric8528]

Thank you for your help Angela.

Maybe

pip install pycrypto

[Jawz22]

Thanks Cederic8528, mrmyst and A_n_g_e_l_a for all your help.

I started from scratch, uninstalled python and deleted the packages folder—restarted, and installed the latest python and these:

pip install protobuf==3.20.3
pip install cryptography==37.0.2
pip install pycryptodome==3.16.0
pip install pycryptodomex==3.15.0

When running

pip install pycrypto

it threw up a long error and didn't install but it worked now. Not really sure where the problem was but starting from scratch seemed to work so now have my own CDM.

Thanks again for your excellent guide and your extra help

[cedric8528]

I'm glad it worked

[A_n_g_e_l_a]

Adjusted 'The Temple of Doom' intro to point to this thread. Thanks, Cedric, for doing this.

[cedric8528]

Thanks you A_n_g_e_l_a

[cenkoman]

I got private_key.pem and client_id.bin but i'm not sure how to use them. Can you please explain? (sorry for the dumb question, I just try to learn from scratch)

[ampersand]

Now you download WKS-Keys ( https://cdm-project.com/CDM-Tools ), copy those files into the "WKS-KEYS\pywidevine\L3\cdm\devices\android_generic" folder, rename the files:
client_id.bin -> device_client_id_blob
private_key.pem -> device_private_key
and there you go

[cenkoman]

Now you download WKS-Keys ( https://cdm-project.com/CDM-Tools ), copy those files into the "WKS-KEYS\pywidevine\L3\cdm\devices\android_generic" folder, rename the files:
client_id.bin -> device_client_id_blob
private_key.pem -> device_private_key
and there you go

i've done what you said above but when i run l3.py it asks for the pssh and the lic url. i enter them correctly but i got the error

unable to parse license - check protobufs
anything i'm doing wrong?

Thank you for your answer..

[CrymanChen]

I got private_key.pem and client_id.bin but i'm not sure how to use them. Can you please explain? (sorry for the dumb question, I just try to learn from scratch)

You should rename them separately.
change private_key.pem to device_private_key
change client_id.bin to device_client_id_blob

[ElCap]

i've done what you said above but when i run l3.py it asks for the pssh and the lic url. i enter them correctly but i got the error

unable to parse license - check protobufs
anything i'm doing wrong?

Thank you for your answer..

search the forum for the streaming site as its probably come up before, or if you cant find it, start a new thread and include a link to what you are trying to get (the browser main url not the mpd url)

[black_tooth]

Just wanted to make a post in case anyone else runs into the same issue that Jawz22 was encountering when trying to run

Python dump_keys.py

They were getting the error: No module named 'Crypto'

I believe that when you install the latest version of the pip package pycryptodome, it creates a folder named 'crypto' in:

C:\Users\<YourName>\AppData\Local\Programs\Python\Python311\Lib\site-packages

You need to rename that folder with a capital 'C' to 'Crypto'

I was encountering the same issue that Jawz22 was getting and even after reinstalling Python and all of these pip packages and rebooting, I still kept getting that same error, but renaming that folder finally worked for me. Good luck.

--------

I have a different issue however. Now I have gotten to the final step of the process and I have gone to view a test DRM video and I see that dumper-main is working and everything, however, in the first post, cedric8528 says: "Let's have a look in dumper-main directory.

You will find a directory (private-keys) containing the 2 files"

That directory is not there for me, nor are there 2 files anywhere. The only new file that I see in dumper-main is some file named license_request.bin (https://imgur.com/dMVsXUB). I have searched my entire C drive for client_id.bin and it cannot be found.

[cedric8528]

When you download "dumper-main" , the folder "private keys" doesn't exist.

It will be create when you will dump the two files...and I think you have dump....nothing

I think you have missed something in the procedure.

Maybe try with another site (with drm)

[DrFishopolisPHD]

put yourself in the right directory and type

adb.exe devices

We can see that our virtual device is recongnized.


[Attachment 68351 - Click to enlarge]

Put the Frida-server file we have downloaded In our virtual phone

adb.exe push frida-server-16.0.2-android-x86 /sdcard

[Attachment 68352 - Click to enlarge]

So let's communicate with our Virtual device
Put the Frida server in the good directory of our device
Give permission to execute the file
Execute frida-server!

adb.exe shell
su
mv /sdcard/frida-server_yourversion /data/local/tmp
chmod  +x /data/local/tmp/frida-server-yourversion
/data/local/tmp/frida-server-16.0.2-android-x86

[Attachment 68356 - Click to enlarge]

Is there an alternate way of accomplishing what these adb.exe commands are doing? I'm on a Mac and everything seems to work but that ("platform-tools" directory is /Users/yourname/Library/Android/sdk/platform-tools on Mac). Do you think this can be tweaked for Mac?

[A_n_g_e_l_a]

Is there an alternate way of accomplishing what these adb.exe commands are doing? I'm on a Mac .... Do you think this can be tweaked for Mac?

One might imagine that any Dr Fishopolis with a Ph.d might just be bright enough to work it out for himself; but a poser, just puffing himself, might not. Where do you stand?

[ampersand]

Is there an alternate way of accomplishing what these adb.exe commands are doing? I'm on a Mac and everything seems to work but that ("platform-tools" directory is /Users/yourname/Library/Android/sdk/platform-tools on Mac). Do you think this can be tweaked for Mac?

what's the problem exactly? adb doesn't work at all (as in, doesn't get recognized as a command) or it doesn't show any devices? have you tried googling "adb mac" to figure out how to set up adb on mac?

[gareth41]

I cant event get the Android to boot.

Get a popup saying Waiting for debugger, attach a debugger or ESC to cancel.

Must be something simple i'm missing. Which version of Android Studio is the OP using I have downloaded the latest version from the website - perhaps an older version is needed?

[cedric8528]

@gareth41

You can close this popup and your phone will boot normally...

If after few minutes, you don't have your phone on the screen, Try to install "Intel X86 Emulator Accelerator (if you have an Intel Proc)


[Attachment 68603 - Click to enlarge]

[raylink]

I am trying to get the keys for a moto g3, I changed the rom to android 7.1, but when I put the last commands from the following list the phone stops responding.
adb.exe shell
his
mv /sdcard/frida-server_yourversion /data/local/tmp
chmod +x /data/local/tmp/frida-server-yourversion
/data/local/tmp/frida-server-16.0.2-android-x86
So I run dump keys and get this:

[gareth41]

@gareth41

You can close this popup and your phone will boot normally...

If after few minutes, you don't have your phone on the screen, Try to install "Intel X86 Emulator Accelerator (if you have an Intel Proc)


[Attachment 68603 - Click to enlarge]

Thanks, I ended up using another PC as the one I was on had issues. Clean install of Win10 and then Android Studio it worked perfectly and I was able to extract a client id and private key.

I wonder how long this method will work before Google put an end to it. Obviously the unique client id and key (CDM) need to be valid and known to Google (registered in their database) or the widevine license request would fail. I haven't checked this but I would say its likely Android Studio is requesting a new CDM each time from Google - and if that is the case it probably wont be long before they patch newer version's of Android Studio (to prevent extraction) and block older versions from requesting new CDM's. Will be interesting to see where this goes...

[raylink]

Since I was having trouble running dump keys in an android 7.1 room, I did the steps in this tutorial and got the files, thanks.

[staszek1503]

anyone help ?

λ adb devices
List of devices attached
emulator-5554 device



λ adb.exe shell
su
mv /sdcard/frida-server-16.0.8-android-x86 /datgeneric_x86_arm:/ $ su
a/local/tmp
chgeneric_x86_arm:/ # mv /sdcard/frida-server-16.0.8-android-x86 /data/local/tmp
mod +x /data/local/tmp/frida-server-16.0.8-android-x86
/data/local/tmp/frida-server-16.0.8-android-x86 &generic_x86_arm:/ # chmod +x /data/local/tmp/frida-server-16.0.8-android-x86
generic_x86_arm:/ # /data/local/tmp/frida-server-16.0.8-android-x86 &
[1] 4047
generic_x86_arm:/ # ps | grep frida
root 4047 4043 64468 50316 poll_schedule_timeout f1556b39 S frida-server-16.0.8-android-x86
generic_x86_arm:/ # ps | grep frida
root 4047 4043 64468 50316 poll_schedule_timeout f1556b39 S frida-server-16.0.8-android-x86
generic_x86_arm:/ # ps | grep frida
root 4047 4043 64428 50352 poll_schedule_timeout f1556b39 S frida-server-16.0.8-android-x86
generic_x86_arm:/ # ps | grep frida
root 4047 4043 64428 50352 poll_schedule_timeout f1556b39 S frida-server-16.0.8-android-x86
generic_x86_arm:/ #


λ python dump_keys.py
2023-01-10 08:33:23 PM - root - 16 - INFO - Connected to Android Emulator 5554
2023-01-10 08:33:23 PM - root - 17 - INFO - scanning all processes for the following libraries
Traceback (most recent call last):
File "C:\Users\S\Desktop\L3\dump_keys.py", line 18, in <module>
for process in device.enumerate_processes():
File "C:\Users\S\AppData\Local\Programs\Python\Python31 0\lib\site-packages\frida\core.py", line 34, in wrapper

return f(*args, **kwargs)
File "C:\Users\S\AppData\Local\Programs\Python\Python31 0\lib\site-packages\frida\core.py", line 118, in enumerate_processes
return self._impl.enumerate_processes(*args, **kwargs)
frida.ProtocolError: unable to communicate with remote frida-server; please ensure that major versions match and that the remote Frida has the feature you are trying to use

[cedric8528]

As you can see on the error message, your version of frida-server must be the same on local and on your virtual device.

You can also try another version of Frida.

[staszek1503]

As you can see on the error message, your version of frida-server must be the same on local and on your virtual device.

You can also try another version of Frida.

At 100 are the same
All installed two days ago
I also tried different versions of Phyton 9.2 10.0 currently I have 10.2
version
frida-server-16.0.8-android-x86
as installed on the computer
I also tried other commands

adb push frida-server-16.0.8-android-x86 /data/local/tmp/
adb shell chmod 755 /data/local/tmp/frida-server-16.0.8-android-x86
adb shell /data/ local/tmp/frida-server-16.0.8-android-x86 &

instead of

mv /sdcard/frida-server-16.0.8-android-x86 /data/local/tmp
chmod +x /data/local/tmp/frida-server-16.0.8-android-x86
/data/local/tmp/frida-server-16.0.8-android-x86

[cedric8528]

pip remove frida

pip remove frida-tools

Reinstall Frida and frida-tools.

[staszek1503]

pip remove frida

pip remove frida-tools

Reinstall Frida and frida-tools.

After copying the command from you, I get this error

pip remove frida
ERROR: unknown command "remove"

[iamghost]

pip uninstall frida, pip uninstall frida-tool. it should work