Dumping Your own L3 CDM with Android Studio

[codehound]

After copying the command from you, I get this error

pip remove frida
ERROR: unknown command "remove"

Type

pip help

see if it (remove) exists

You may need to use:

pip uninstall frida

[staszek1503]

After copying the command from you, I get this error

pip remove frida
ERROR: unknown command "remove"

Type

pip help

see if it (remove) exists

You may need to use:

pip uninstall frida

This is how it looks now

pip uninstall frida
Found existing installation: frida 15.2.2
Uninstalling frida-15.2.2:
Would remove:
c:\users\stanisław\appdata\local\programs\python\p ython310\lib\site-packages\_frida.cp310-win_amd64.pyd
c:\users\stanisław\appdata\local\programs\python\p ython310\lib\site-packages\frida-15.2.2-py3.10.egg-info
c:\users\stanisław\appdata\local\programs\python\p ython310\lib\site-packages\frida\*
Proceed (Y/n)? Y
Successfully uninstalled frida-15.2.2

pip uninstall frida-tool
WARNING: Skipping frida-tool as it is not installed.

pip install frida-tool
ERROR: Could not find a version that satisfies the requirement frida-tool (from versions: none)
ERROR: No matching distribution found for frida-tool
WARNING: You are using pip version 21.2.4; however, version 22.3.1 is available.
You should consider upgrading via the 'C:\Users\Stanisław\AppData\Local\Programs\Python\ Python310\python.exe -m pip install --upgrade pip' command.

pip upgrade frida-tool
ERROR: unknown command "upgrade"

[A_n_g_e_l_a]

..snip... pip remove ...snip
ERROR: unknown command "remove"

You are. I have no doubt, a grown-up person of at least average intelligence, for you to even be here. But you appear unable to use Google and needed to wait to be given an answer to an easily surmountable problem..

Explain why, if you would be so kind. I just don't understand the process that reduces thinking adults to incompetance. I'm not getting at you in particular, I'm just trying to understand why it is happening so much in this forum.


[Attachment 68659 - Click to enlarge].


And now you are asking about upgrade - no thought of self-help. Really sad.

[Attachment 68660 - Click to enlarge]

And

[Attachment 68661 - Click to enlarge] from the OP.

[staszek1503]

pip install frida
Requirement already satisfied: frida in c:\users\s\appdata\local\programs\python\python310 \lib\site-packages (15.2.2)
Requirement already satisfied: setuptools in c:\users\s\appdata\local\programs\python\python310 \lib\site-packages (from frida) (58.1.0)

pip install frida-tools
Requirement already satisfied: frida-tools in c:\users\s\appdata\local\programs\python\python310 \lib\site-packages (11.0.0)
Requirement already satisfied: colorama<1.0.0,>=0.2.7 in c:\users\s\appdata\local\programs\python\python310 \lib\site-packages (from frida-tools) (0.4.6)
Requirement already satisfied: frida<16.0.0,>=15.2.0 in c:\users\s\appdata\local\programs\python\python310 \lib\site-packages (from frida-tools) (15.2.2)
Requirement already satisfied: prompt-toolkit<4.0.0,>=2.0.0 in c:\users\s\appdata\local\programs\python\python310 \lib\site-packages (from frida-tools) (3.0.36)
Requirement already satisfied: pygments<3.0.0,>=2.0.2 in c:\users\s\appdata\local\programs\python\python310 \lib\site-packages (from frida-tools) (2.14.0)
Requirement already satisfied: setuptools in c:\users\stanisław\appdata\local\programs\python\p ython310\lib\site-packages (from frida<16.0.0,>=15.2.0->frida-tools) (58.1.0)
Requirement already satisfied: wcwidth in c:\users\s\appdata\local\programs\python\python310 \lib\site-packages (from prompt-toolkit<4.0.0,>=2.0.0->frida-tools) (0.2.5)

python dump_keys.py
2023-01-12 11:35:36 PM - root - 16 - INFO - Connected to Android Emulator 5554
2023-01-12 11:35:36 PM - root - 17 - INFO - scanning all processes for the following libraries
2023-01-12 11:35:38 PM - root - 19 - DEBUG - Process(pid=1, name="init", parameters={})
2023-01-12 11:35:38 PM - root - 19 - DEBUG - Process(pid=1198, name="init", parameters={})
2023-01-12 11:35:38 PM - root - 19 - DEBUG - Process(pid=1199, name="init", parameters={})
2023-01-12 11:35:38 PM - root - 19 - DEBUG - Process(pid=1200, name="ueventd", parameters={})
2023-01-12 11:35:38 PM - root - 19 - DEBUG - Process(pid=1569, name="logd", parameters={})
2023-01-12 11:35:38 PM - root - 19 - DEBUG - Process(pid=1570, name="servicemanager", parameters={})
2023-01-12 11:35:38 PM - root - 19 - DEBUG - Process(pid=1571, name="hwservicemanager", parameters={})
2023-01-12 11:35:38 PM - root - 19 - DEBUG - Process(pid=1572, name="vndbinder", parameters={})
2023-01-12 11:35:38 PM - root - 19 - DEBUG - Process(pid=1574, name="android.hardware.keymaster@3.0-service", parameters={})
2023-01-12 11:35:38 PM - root - 19 - DEBUG - Process(pid=1579, name="vold", parameters={})
2023-01-12 11:35:38 PM - root - 19 - DEBUG - Process(pid=1623, name="android.hidl.allocator@1.0-service", parameters={})

2023-01-12 11:35:38 PM - root - 19 - DEBUG - Process(pid=1624, name="healthd", parameters={})
2023-01-12 11:35:38 PM - root - 19 - DEBUG - Process(pid=1625, name="vr_hwc", parameters={})
2023-01-12 11:35:38 PM - root - 19 - DEBUG - Process(pid=1626, name="android.hardware.audio@2.0-service", parameters={})

2023-01-12 11:35:38 PM - root - 19 - DEBUG - Process(pid=1627, name="android.hardware.broadcastradio@1.1-service", parameters={})
2023-01-12 11:35:38 PM - root - 19 - DEBUG - Process(pid=1628, name="android.hardware.camera.provider@2.4-service", parameters={})
2023-01-12 11:35:38 PM - root - 19 - DEBUG - Process(pid=1629, name="android.hardware.cas@1.0-service", parameters={})
2023-01-12 11:35:38 PM - root - 19 - DEBUG - Process(pid=1630, name="android.hardware.configstore@1.1-service", parameters={})
2023-01-12 11:35:38 PM - root - 19 - DEBUG - Process(pid=1631, name="android.hardware.drm@1.0-service", parameters={})
Traceback (most recent call last):
File "C:\Users\S\Desktop\L3\dump_keys.py", line 21, in <module>
libraries = scanner.find_widevine_process(device, process.name)
File "C:\Users\S\Desktop\L3\Helpers\Scanner.py", line 149, in find_widevine_process
process = dev.attach(process_name)
File "C:\Users\S\AppData\Local\Programs\Python\Python31 0\lib\site-packages\frida\core.py", line 34, in wrapper

return f(*args, **kwargs)
File "C:\Users\S\AppData\Local\Programs\Python\Python31 0\lib\site-packages\frida\core.py", line 173, in attach

return Session(self._impl.attach(self._pid_of(target), *args, **kwargs))
frida.ServerNotRunningError: unable to connect to remote frida-server: closed

I have no idea what to do next

[A_n_g_e_l_a]

[Attachment 68662 - Click to enlarge]

Does that give you a clue? FridaServerNotRunningError? I wonder what that could mean? If you have no idea go here

[cedric8528]

So you don't have read the tutorial....

You have upload Frida-server 16.0.8 in your virtual device and, as I can see, you have Frida 15.2.2 on your computer.

I have tell you that you must have THE SAME VERSION on your device and your computer...

And Moreover, you don't have Frida-tools on your computer.

"pip install frida-tool" doesn't work....mmmhhh why?... because it's "pip install frida-tools" and don't try to upgrade something that is not installed!!

So I tell you like I ask for my son :

Learn carefully your lesson and after you could do your exercise...

[Loryanam2]

So you don't have read the tutorial....

You have upload Frida-server 16.0.8 in your virtual device and, as I can see, you have Frida 15.2.2 on your computer.

I have tell you that you must have THE SAME VERSION on your device and your computer...

And Moreover, you don't have Frida-tools on your computer.

"pip install frida-tool" doesn't work....mmmhhh why?... because it's "pip install frida-tools" and don't try to upgrade something that is not installed!!

So I tell you like I ask for my son :

Learn carefully your lesson and after you could do your exercise...

Thank you so much i have 2 questions
1-if i install the android studio on my main gaming pc to get the CDM and this cdm get blocked by google in future
will this also block my PC from viwing widevine content ?
2-is the extracted CDM permanent or it will expire after days or a week ?

[counterfactual]

Let's have a look in dumper-main directory.

You will find a directory (private-keys) containing the 2 files


[Attachment 68358 - Click to enlarge]


you just have to rename the 2 files respectively in :
device_client_id_blob
device_private_key

Cedric, thanks for this great post. I have followed all the instructions, and amended them slightly for use on a Mac.
One thing to note is that it can be difficult to get the adb shell to run as root. However, this can be overcome by selecting an emulated device which does not have the Play Store, and then using the command

adb -s emulator-5554 root

Obviously replacing emulator-5554 with the one for your actual device.

After installing frida and starting the server locally, I start the dump-keys.py application. It starts well, and appears to recognize when I go to a DRM encrypted site, but then it does not produce any output (like those two files you mention). It does display one error

2023-01-19 07:50:06 AM - Helpers.Scanner - 85 - ERROR - unable to process the message
2023-01-19 07:50:06 AM - Helpers.Scanner - 86 - ERROR - {'type': 'error', 'description': 'Error: access violation accessing 0x3', 'stack': 'Error: access violation accessing 0x3\n    at <anonymous> (frida/runtime/core.js:141)\n    at readStdString (/script1.js:316)\n    at onLeave (/script1.js:361)', 'fileName': 'frida/runtime/core.js', 'lineNumber': 141, 'columnNumber': 1}
2023-01-19 07:50:06 AM - Helpers.Scanner - 87 - ERROR - None

But I do not see where it is going wrong. Did you select a device that has Google Play Store? I can't think why this would be necessary, but I am running out of ideas.

Here's the full output from terminal:

dumper git:(main) ✗ python3 dump_keys.py
2023-01-19 07:48:00 AM - root - 16 - INFO - Connected to Android Emulator 5554
2023-01-19 07:48:00 AM - root - 17 - INFO - scanning all processes for the following libraries
2023-01-19 07:48:09 AM - root - 19 - DEBUG - Process(pid=1, name="init", parameters={})
2023-01-19 07:48:09 AM - root - 19 - DEBUG - Process(pid=170, name="init", parameters={})
2023-01-19 07:48:09 AM - root - 19 - DEBUG - Process(pid=172, name="ueventd", parameters={})
2023-01-19 07:48:09 AM - root - 19 - DEBUG - Process(pid=192, name="logd", parameters={})
2023-01-19 07:48:09 AM - root - 19 - DEBUG - Process(pid=193, name="lmkd", parameters={})
2023-01-19 07:48:09 AM - root - 19 - DEBUG - Process(pid=194, name="servicemanager", parameters={})
2023-01-19 07:48:09 AM - root - 19 - DEBUG - Process(pid=195, name="hwservicemanager", parameters={})
2023-01-19 07:48:09 AM - root - 19 - DEBUG - Process(pid=196, name="sh", parameters={})
2023-01-19 07:48:09 AM - root - 19 - DEBUG - Process(pid=201, name="qemu-props", parameters={})
2023-01-19 07:48:09 AM - root - 19 - DEBUG - Process(pid=204, name="vold", parameters={})
2023-01-19 07:48:09 AM - root - 19 - DEBUG - Process(pid=210, name="android.system.suspend@1.0-service", parameters={})
2023-01-19 07:48:09 AM - root - 19 - DEBUG - Process(pid=211, name="keystore2", parameters={})
2023-01-19 07:48:09 AM - root - 19 - DEBUG - Process(pid=212, name="android.hardware.atrace@1.0-service", parameters={})
2023-01-19 07:48:09 AM - root - 19 - DEBUG - Process(pid=213, name="android.hardware.keymaster@4.1-service", parameters={})
2023-01-19 07:48:09 AM - root - 19 - DEBUG - Process(pid=256, name="tombstoned", parameters={})
2023-01-19 07:48:09 AM - root - 19 - DEBUG - Process(pid=338, name="dhcpclient", parameters={})
2023-01-19 07:48:10 AM - root - 19 - DEBUG - Process(pid=345, name="statsd", parameters={})
2023-01-19 07:48:10 AM - root - 19 - DEBUG - Process(pid=346, name="netd", parameters={})
2023-01-19 07:48:10 AM - root - 19 - DEBUG - Process(pid=347, name="zygote64", parameters={})
2023-01-19 07:48:10 AM - root - 19 - DEBUG - Process(pid=351, name="android.hidl.allocator@1.0-service", parameters={})
2023-01-19 07:48:10 AM - root - 19 - DEBUG - Process(pid=352, name="android.hardware.audio.service", parameters={})
2023-01-19 07:48:10 AM - root - 19 - DEBUG - Process(pid=353, name="android.hardware.authsecret@1.0-service", parameters={})
2023-01-19 07:48:10 AM - root - 19 - DEBUG - Process(pid=354, name="android.hardware.bluetooth@1.1-service.btlinux", parameters={})
2023-01-19 07:48:10 AM - root - 19 - DEBUG - Process(pid=355, name="android.hardware.camera.provider@2.4-service_64", parameters={})
2023-01-19 07:48:10 AM - root - 19 - DEBUG - Process(pid=356, name="android.hardware.camera.provider@2.7-service-google", parameters={})
2023-01-19 07:48:10 AM - root - 19 - DEBUG - Process(pid=357, name="android.hardware.cas@1.2-service", parameters={})
2023-01-19 07:48:10 AM - root - 19 - DEBUG - Process(pid=358, name="android.hardware.contexthub@1.1-service.mock", parameters={})
2023-01-19 07:48:10 AM - root - 19 - DEBUG - Process(pid=359, name="android.hardware.drm@1.0-service", parameters={})
2023-01-19 07:48:12 AM - Helpers.Scanner - 82 - INFO - Running libwvdrmengine.so at 0x7cfcc447f000
Error: Error: unable to intercept function at 0x7cfcc46248e0; please file a bug at F: _lcc46
Error: Error: unable to intercept function at 0x7cfcc4610380; please file a bug at F: _lcc00
2023-01-19 07:48:12 AM - root - 19 - DEBUG - Process(pid=360, name="android.hardware.drm@1.4-service.clearkey", parameters={})
2023-01-19 07:48:13 AM - root - 19 - DEBUG - Process(pid=361, name="android.hardware.drm@1.4-service.widevine", parameters={})
2023-01-19 07:48:14 AM - Helpers.Scanner - 82 - INFO - Running libwvhidl.so at 0x7c6e504d3000
Error: Error: unable to intercept function at 0x7c6e506afea0; please file a bug at F: _lcc00
Error: Error: unable to intercept function at 0x7c6e506c4400; please file a bug at F: _lcc46
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=362, name="android.hardware.gatekeeper@1.0-service.software", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=363, name="android.hardware.graphics.allocator@3.0-service", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=364, name="android.hardware.graphics.composer@2.3-service", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=365, name="android.hardware.health@2.1-service", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=366, name="android.hardware.media.c2@1.0-service-goldfish", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=367, name="android.hardware.neuralnetworks@1.3-service-sample-all", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=368, name="android.hardware.neuralnetworks@1.3-service-sample-float-fast", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=369, name="android.hardware.neuralnetworks@1.3-service-sample-float-slow", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=370, name="android.hardware.neuralnetworks@1.3-service-sample-minimal", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=371, name="android.hardware.neuralnetworks@1.3-service-sample-quant", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=372, name="android.hardware.power.stats@1.0-service.mock", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=373, name="android.hardware.sensors@2.1-service.multihal", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=374, name="android.hardware.thermal@2.0-service.mock", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=375, name="android.hardware.usb@1.0-service", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=376, name="android.hardware.wifi@1.0-service", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=377, name="android.hardware.identity-service.example", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=378, name="iptables-restore", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=379, name="android.hardware.lights-service.example", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=380, name="ip6tables-restore", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=381, name="android.hardware.power-service.example", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=384, name="android.hardware.rebootescrow-service.default", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=386, name="android.hardware.vibrator-service.example", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=388, name="audioserver", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=389, name="credstore", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=390, name="gpuservice", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=391, name="surfaceflinger", parameters={})
2023-01-19 07:48:15 AM - root - 19 - DEBUG - Process(pid=442, name="drmserver", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=445, name="traced_probes", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=447, name="traced", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=457, name="logcat", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=463, name="bt_vhci_forwarder", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=464, name="cameraserver", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=466, name="incidentd", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=467, name="installd", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=468, name="media.extractor", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=469, name="media.metrics", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=470, name="mediaserver", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=472, name="storaged", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=473, name="wificond", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=474, name="libgoldfish-rild", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=475, name="media.swcodec", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=483, name="mdnsd", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=484, name="gatekeeperd", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=486, name="android.hardware.biometrics.face@1.0-service.example", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=487, name="android.hardware.biometrics.fingerprint@2.1-service", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=489, name="llkd", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=561, name="system_server", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=739, name="android.hardware.input.classifier@1.0-service.default", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=919, name="wpa_supplicant", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=928, name="com.android.bluetooth", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=941, name="com.android.systemui", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=1033, name="adbd", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=1102, name="android.hardware.gnss@2.0-service.ranchu", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=1111, name="webview_zygote", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=1127, name="com.android.networkstack.process", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=1161, name="com.android.se", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=1182, name="SIM Toolkit", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=1241, name="com.google.android.apps.nexuslauncher", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=1326, name="com.google.android.gms.persistent", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=1452, name="com.google.android.gms", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=1569, name="com.google.android.inputmethod.latin", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=1596, name="com.google.android.ext.services", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=1717, name="com.google.process.gservices", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=1746, name="com.google.android.providers.media.module", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=1873, name="com.android.emulator.multidisplay", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=2387, name="com.google.android.googlequicksearchbox:search", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=2611, name="Google", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=2971, name="com.google.android.gms.unstable", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=6110, name="Messages", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=7166, name="Chrome", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=7236, name="com.android.chrome_zygote", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=7293, name="com.android.chrome:privileged_process0", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=9794, name="Photos", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=10664, name="com.android.chrome:sandboxed_process0:org.chromium.content.app.SandboxedProce", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=11894, name="com.google.android.partnersetup", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=12558, name="com.google.android.apps.wellbeing", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=12983, name="com.google.android.apps.messaging", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=13031, name="YouTube Music", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=13123, name="Calendar", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=13222, name="Clock", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=13255, name="Gmail", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=13344, name="YouTube", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=13518, name="com.android.providers.calendar", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=13679, name="com.android.chrome:sandboxed_process0:org.chromium.content.app.SandboxedProce", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=13730, name="com.google.process.gapps", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=13812, name="frida-server-16.0.8-android-x86_64", parameters={})
2023-01-19 07:48:16 AM - root - 19 - DEBUG - Process(pid=13815, name="logcat", parameters={})
2023-01-19 07:48:16 AM - root - 25 - INFO - Hooks completed
2023-01-19 07:49:34 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCrypto_GetProvisioningMethod",
    "payload": {
        "Method": "OEMCrypto_OEMCertificate"
    }
}
2023-01-19 07:49:34 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCryptoVersion",
    "payload": {
        "Version": 16
    }
}
2023-01-19 07:49:43 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCrypto_Terminate_Status: OEMCrypto_SUCCESS"
}
2023-01-19 07:49:43 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCrypto_Terminate_Status: OEMCrypto_SUCCESS"
}
2023-01-19 07:50:04 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCrypto_Initialize"
}
2023-01-19 07:50:04 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCryptoVersion",
    "payload": {
        "Version": 16
    }
}
2023-01-19 07:50:04 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCrypto_BuildInformation: OEMCrypto Level3 Code 22596 May 28 2021 16:59:00"
}
2023-01-19 07:50:04 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCrypto_Initialize"
}
2023-01-19 07:50:04 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCryptoVersion",
    "payload": {
        "Version": 16
    }
}
2023-01-19 07:50:04 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCryptoVersion",
    "payload": {
        "Version": 16
    }
}
2023-01-19 07:50:04 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCrypto_GetNumberOfOpenSessions: 0"
}
2023-01-19 07:50:04 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCrypto_GetProvisioningMethod",
    "payload": {
        "Method": "OEMCrypto_OEMCertificate"
    }
}
2023-01-19 07:50:04 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCryptoVersion",
    "payload": {
        "Version": 16
    }
}
2023-01-19 07:50:04 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCrypto_GetDeviceID",
    "payload": {
        "Status": "OEMCrypto_SUCCESS",
        "Length": 32,
        "DeviceId": "6d63776361616161716a674469526370744a4b4b54616a4e4e47754b58695a00"
    }
}
2023-01-19 07:50:04 AM - Helpers.Scanner - 60 - DEBUG - processing device id
2023-01-19 07:50:04 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCrypto_GetDeviceID",
    "payload": {
        "Status": "OEMCrypto_ERROR_SHORT_BUFFER",
        "Length": 32,
        "DeviceId": ""
    }
}
2023-01-19 07:50:04 AM - Helpers.Scanner - 60 - DEBUG - processing device id
2023-01-19 07:50:04 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCrypto_GetProvisioningMethod",
    "payload": {
        "Method": "OEMCrypto_OEMCertificate"
    }
}
2023-01-19 07:50:04 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCryptoVersion",
    "payload": {
        "Version": 16
    }
}
2023-01-19 07:50:04 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCrypto_BuildInformation: OEMCrypto Level3 Code 22596 May 28 2021 16:59:00"
}
2023-01-19 07:50:04 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "Replacing PrivacyMode"
}
2023-01-19 07:50:06 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCrypto_GetProvisioningMethod",
    "payload": {
        "Method": "OEMCrypto_OEMCertificate"
    }
}
2023-01-19 07:50:06 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCryptoVersion",
    "payload": {
        "Version": 16
    }
}
2023-01-19 07:50:06 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCrypto_BuildInformation: OEMCrypto Level3 Code 22596 May 28 2021 16:59:00"
}
2023-01-19 07:50:06 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "Replacing PrivacyMode"
}
2023-01-19 07:50:06 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCryptoVersion",
    "payload": {
        "Version": 16
    }
}
2023-01-19 07:50:06 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCrypto_BuildInformation: OEMCrypto Level3 Code 22596 May 28 2021 16:59:00"
}
2023-01-19 07:50:06 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMCryptoVersion",
    "payload": {
        "Version": 16
    }
}
2023-01-19 07:50:06 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "OEMSupportedCertificates: OEMCrypto_Supports_RSA_2048bit"
}
2023-01-19 07:50:06 AM - Helpers.Scanner - 78 - DEBUG - {
    "from": "android.hardware.drm@1.4-service.widevine",
    "message": "Replacing PrivacyMode"
}
2023-01-19 07:50:06 AM - Helpers.Scanner - 85 - ERROR - unable to process the message
2023-01-19 07:50:06 AM - Helpers.Scanner - 86 - ERROR - {'type': 'error', 'description': 'Error: access violation accessing 0x3', 'stack': 'Error: access violation accessing 0x3\n    at <anonymous> (frida/runtime/core.js:141)\n    at readStdString (/script1.js:316)\n    at onLeave (/script1.js:361)', 'fileName': 'frida/runtime/core.js', 'lineNumber': 141, 'columnNumber': 1}
2023-01-19 07:50:06 AM - Helpers.Scanner - 87 - ERROR - None

[libero08]

you ruin your life:
why to choose a device with google play if you have one who dont need to root?
google play need to root device after making , or use frida gadget instead, but this is complicated solution for major part of user.
Make your life better, use simple things!

[[ss]vegeta]

you ruin your life

I wouldn't go that far

[hencha]

My WKS show like this now, yesterday i use no problem

  File "C:\Users\WKS\l3.py", line 8, in <module>
    import base64, requests, sys, xmltodict, google
ModuleNotFoundError: No module named 'xmltodict'

i use python Python 3.11.1

is it mean my cdm not working again or my python version must downgrade ?

[cedric8528]

pip install xmltodict

[hencha]

pip install xmltodict

and show like this

ModuleNotFoundError: No module named 'google'

i already run " pip install google " and still like that

[ampersand]

https://www.google.com/search?q=ModuleNotFoundError%3A+No+module+named+%27google%27&rl...hrome&ie=UTF-8

[ploxer]

Hey Cedric8528,
Many thanks for the guide. But seem to be running into problems with the dumper step. I think I have verified my version of Frida server is the same as the one I downloaded via pip install. Any idea how to solve this?

Thanks

C:\kidtopssh\dumper-main>Python dump_keys.py
Traceback (most recent call last):
  File "C:\kidtopssh\dumper-main\dump_keys.py", line 6, in <module>
    from Helpers.Scanner import Scan
  File "C:\kidtopssh\dumper-main\Helpers\Scanner.py", line 3, in <module>
    from Crypto.PublicKey import RSA
ModuleNotFoundError: No module named 'Crypto'

this is because naming, you need to rename all packages in Lib\site-packages
you have crypto and script requires Crypto, kinda dumb I know
and all modules in folder Crypto need to be renamed too

[libero08]

edit, malformed question:
Any solution for , android tv AVD to get CDM?
wich AVD need to be defined 1080 or 4k?
wich keydump need to be used?

[Silv3r]

is it possible to dump L1 keys/CDM from android device ?

[ploxer]

is it possible to dump L1 keys/CDM from android device ?

yes, but its a hidden knowledge

[thej911]

Hi all , i got the files successfully thanks to cedric8528 , renamed the files ,but do we have to take the .json and .bin files from key_boxes folder and rename them to config.json and token.bin or it is not necessary ?

Regards

[cedric8528]

No You don't need this 2 files

[ramonarrington]

No You don't need this 2 files

after i follow the steps i only get 2 json and bin files


[Attachment 69252 - Click to enlarge]

[cedric8528]

So you don't dump anything....

Check that your version of Frida on your virtual phone and on your computer are the same.

Try again

[Loryanam2]

So you don't dump anything....

Check that your version of Frida on your virtual phone and on your computer are the same.

Try again

is the CDM permanent or it will expire after some weeks because it s extracted from a virtual device ?

[cedric8528]

The CDM you dump are valid until they are ban

There is no differences between a virtual device or a physical device...

[libero08]

I need to congratulate Diazole for his work and without his idea i will newer dump a 16.1.0
i perform only to 15.0.0 on my poco phone model 2021.

[tramuzat]

so I get as far as the last step, but no files are added to my Mac folder. I see as last:

2023-02-21 05:07:55 PM - Helpers.Scanner - 75 - DEBUG - {
"from": "android.hardware.drm@1.2-service.widevine",
"message": "OEMCrypto_LoadKeys",
"payload": {
"Status": "OEMCrypto_SUCCESS",
"Message": "0a540a2042353435303538383746433341453943304530303 03030303030303030303030122042353435303538383746433 341453943304530303030303030303030303030301a0020012 8003800400048dad8d39f06120208011a661210c2a79f60d49 fc3479b0c993000ffae1d1a50ef1d586233d46604f3ebf1d0c 964b7da57c2cf06576ccbf3620548a02f697945cb287fd5e3e 393168d020b556b7f5f6ef00ed1d85d0430603022d04099285 b0511bb0a8796e41bd1caec47b2dd70235720011a86010a10c cbf5fb4c2965be7aa130ffb3ba9fd731210b92cd003befc186 abc041e9660281e061a208f3b5c3e6381c5590f8bb753be7d5 f867f48e6d48f69f2de58235e06a71fd9222002280142340a2 094a4f28f4567e926e7dddd620462858a040ff1d9e5e30b990 c0042af34ab0a2d1210af75269522c0e18bfe3950a26cdf313 96204554844321a86010a109bf0e9cf0d7b55aeb4b289a63ba b86101210551d6bd0af16d95708112f19b3381b521a200f6bf 5ec142b6f49cb3da885cdb42d6b130b2c1a7932f8c473efdfa fd64addce2002280142340a20ee632c5d0162727306b7e53b9 95fc063a12ea3dc079402194f32d6e60b0088521210858747c e7c34ba2ca49c8cfeb170071c6204554844311a84010a10eb6 76abbcb345e96bbcf616630f1a3da1210cf064795f4e712ac9 67644d7862626181a20a5bb22d1c2789cf56d9485cac926c38 b329c3233dddf44ee8b89441272f2d95c2002280142340a208 f5f9246433651236d01bb197224976ef9c35b4b856364ba2c9 a825fb4017f02121017a226ecafdcdc344331d488b3f9b7426 20248441a84010a100294b9599d755de2bbf0fdca3fa5eab71 2107f179630878f9558301fc41f55ce60d31a2029537800c26 36bc0e611fffb888870662231422d131d1de7135f707e6b61c 8e82002280142340a20f3ee647bd94d0b47a16b23224ed6834 70740a2b09947629079ce4b6ddde4f6a21210ed2e789053deb 868b8b131c798ffe4d8620253441a87010a10639da80cf23b5 5f3b8cab3f64cfa5df61210c178abdaeecb612daf995327ea3 68c361a20b08a087c2f16c8ee4ffed12847892c998b9f164fd 630e753a8f21ae31b990e812002280142340a20b60c12710c7 2e823b9b2ae80e6a5b6977d9b54a15785b8a7d6f84fb02013f 74d12108dad16da8859595f7b8ab584370d0d7d62054155444 94f20dad8d39f063800",
"Signature": "eb24b152285d674fc7ac9596d5ccf394834ed2c1d8a0a7393 63049b9d1405fb2"
}
}

i do get the license_request.bin tho

[Dust3]

So I'm sure this works, but here's my hiccups.

2023-02-22 03:22:39 PM - main - 17 - INFO - Connected to Android Emulator 5554
2023-02-22 03:22:39 PM - main - 18 - INFO - Scanning all processes
Traceback (most recent call last):
  File "c:\Users\USER\Documents\Widevine\dumperv2\dump_keys.py", line 29, in <module>
    main()
  File "c:\Users\USER\Documents\Widevine\dumperv2\dump_keys.py", line 20, in main
    for process in device.usb_device.enumerate_processes():
  File "C:\Custom\Programs\Python\Python37\lib\site-packages\frida\core.py", line 26, in wrapper
    return f(*args, **kwargs)
  File "C:\Custom\Programs\Python\Python37\lib\site-packages\frida\core.py", line 110, in enumerate_processes
    return self._impl.enumerate_processes(*args, **kwargs)
frida.NotSupportedError: unable to inject library into process without libc

A quick google around shows a few github issues revolving around both versions and emulators not being supported.
I've tried:
This twitter thread - https://twitter.com/mame82/status/1335987735388188672
Going back to server versions: 16.0.10, 15.1.17, 12.7.4
Android versions: Pixel 5 API 28, Pixel 6 API 28, Pixel 5 API 30

Using the server version 12.7.4 gives a bit more errors, but still the same one at the end:

2023-02-22 03:34:57 PM - main - 17 - INFO - Connected to Android Emulator 5554
2023-02-22 03:34:57 PM - main - 18 - INFO - Scanning all processes
Process(pid=1, name="init")
Process(pid=147, name="init")
Process(pid=149, name="ueventd")
Process(pid=172, name="logd")
Process(pid=173, name="lmkd")
Process(pid=174, name="servicemanager")
Process(pid=177, name="hwservicemanager")
Process(pid=181, name="sh")
Process(pid=182, name="qemu-props")
Process(pid=185, name="vold")
Process(pid=193, name="android.hardware.keymaster@4.1-service")
Process(pid=209, name="android.system.suspend@1.0-service")
Process(pid=210, name="android.hardware.atrace@1.0-service")
Process(pid=275, name="createns")
Process(pid=280, name="tombstoned")
Process(pid=285, name="statsd")
Process(pid=286, name="netd")
Process(pid=287, name="zygote")
Process(pid=291, name="android.hidl.allocator@1.0-service")
Process(pid=292, name="android.hardware.audio.service.ranchu")
Process(pid=293, name="android.hardware.authsecret@1.0-service")
Process(pid=294, name="android.hardware.bluetooth@1.1-service.sim")
Process(pid=295, name="android.hardware.camera.provider@2.4-service")
Process(pid=296, name="android.hardware.camera.provider@2.6-service-google")
Process(pid=297, name="android.hardware.cas@1.2-service")
Process(pid=298, name="android.hardware.contexthub@1.1-service.mock")
Process(pid=299, name="android.hardware.drm@1.0-service")
Traceback (most recent call last):
  File "c:\Users\USER\Documents\Widevine\dumperv2\dump_keys.py", line 29, in <module>
    main()
  File "c:\Users\USER\Documents\Widevine\dumperv2\dump_keys.py", line 23, in main
    for library in device.find_widevine_process(process.name):
  File "c:\Users\USER\Documents\Widevine\dumperv2\Helpers\Device.py", line 71, in find_widevine_process
    process = self.usb_device.attach(process_name)
  File "C:\Custom\Programs\Python\Python37\lib\site-packages\frida\core.py", line 26, in wrapper
    return f(*args, **kwargs)
  File "C:\Custom\Programs\Python\Python37\lib\site-packages\frida\core.py", line 156, in attach
    return Session(self._impl.attach(self._pid_of(target)))
frida.NotSupportedError: unable to inject library into process without libc

The cheap phone I bought to root freezes up on bootloader (doesn't even enter it, it just freezes up on the fastboot screen), and the Truewell T95 S1 I had gotten just crashes whenever I try to load up chrome, so I'm at a bit of a loss.

[nickomaru]

delete

[hencha]

Hello All,
anybody have tutorial how to get CDM for L1 ?

[Hola]

Cool, really clear and understable explanation.
Finally got my own CDM.
Thanks again.

[Attachment 68398 - Click to enlarge]

Does it still works?