howto-deal-with-HLS-128-bit-aes-encrypted-the-hard-one-2.0-version

[slayer36]

getting apkid is okay... i am in issue now... i visit a page which uses spayee as content provider. i downloaded 2 videos with above given informations and it worked well. now for 3rd video, its not working. can you help me finding where the decryptor function is located?

https://www.futurly.com/s/preview/courses/blender-architecture#6337f80fe4b05a534f0e3d5a

take this as reference and please tell me where is the decryptor function?

2aac616013f1877619af8ac01abff0a6

[AlexXda]

Does anyone know to find all the request link of videos without clicking the specific video🤔

https://www.futurly.com/s/preview/courses/blender-architecture#6337f80fe4b05a534f0e3d5a

[AlexXda]

getting apkid is okay... i am in issue now... i visit a page which uses spayee as content provider. i downloaded 2 videos with above given informations and it worked well. now for 3rd video, its not working. can you help me finding where the decryptor function is located?

https://www.futurly.com/s/preview/courses/blender-architecture#6337f80fe4b05a534f0e3d5a

take this as reference and please tell me where is the decryptor function?

2aac616013f1877619af8ac01abff0a6

Buddy do you have any idea to find all request links in one go

[n0mansk1]

Did everyone gave up on this thread isn't there any way

Sorry for the tag. Needed to get some information out.

I have created a 12-page guide document to perform this exploit on Graphy's courses (hosted on Spayee). As of December 15th, 2024, the exploit works perfectly and as intended. Please do not message me for access to the document as I will not risk leaking it to the developer team. My version is unpatchable for the foreseeable future regardless of changes within the encrypt/decrypt functions. An LLM will change the code automatically. If you need any guidance otherwise, feel free to DM me. It is completely based upon the work done in this thread, I have not invented a new system or anything, I just made it very refined, targeted, and dynamic. If nothing else, I can always give you confirmation if it is still possible or not.

Special Thanks to:
f1shy-dev
jora
aadrl
NBA456017
aqzs
white_snake
slayer36

I love you guys, helped me out immensely.

Best Regards,
A Lurker.

[slayer36]

Did everyone gave up on this thread isn't there any way

Sorry for the tag. Needed to get some information out.

I have created a 12-page guide document to perform this exploit on Graphy's courses (hosted on Spayee). As of December 15th, 2024, the exploit works perfectly and as intended. Please do not message me for access to the document as I will not risk leaking it to the developer team. My version is unpatchable for the foreseeable future regardless of changes within the encrypt/decrypt functions. An LLM will change the code automatically. If you need any guidance otherwise, feel free to DM me. It is completely based upon the work done in this thread, I have not invented a new system or anything, I just made it very refined, targeted, and dynamic. If nothing else, I can always give you confirmation if it is still possible or not.

Special Thanks to:
f1shy-dev
jora
aadrl
NBA456017
aqzs
white_snake
slayer36

I love you guys, helped me out immensely.

Best Regards,
A Lurker.

have you just able to download videos, or PDF also?

[n0mansk1]

I have not explicitly tested the script on pdf files only videos but, if you have any such file that I can take a look at, I'll try to determine its usability for pdfs too.

Once again, tysm for all the help.

[slayer36]

I have not explicitly tested the script on pdf files only videos but, if you have any such file that I can take a look at, I'll try to determine its usability for pdfs too.

Once again, tysm for all the help.

it's easy btw

[n0mansk1]

I have not explicitly tested the script on pdf files only videos but, if you have any such file that I can take a look at, I'll try to determine its usability for pdfs too.

Once again, tysm for all the help.

it's easy btw

Maybe for you bro Y'all are smart asf. For me, the whole process felt like shitting rocks. Seeing everyone say its not possible anymore, they've given up hope made me feel like I'm wasting my time. But, yeah. Now I'm at peace

[slayer36]

I have not explicitly tested the script on pdf files only videos but, if you have any such file that I can take a look at, I'll try to determine its usability for pdfs too.

Once again, tysm for all the help.

it's easy btw

Maybe for you bro Y'all are smart asf. For me, the whole process felt like shitting rocks. Seeing everyone say its not possible anymore, they've given up hope made me feel like I'm wasting my time. But, yeah. Now I'm at peace

everyone have different methods to achieve same result, so don't stop learning.

[AlexXda]

I have not explicitly tested the script on pdf files only videos but, if you have any such file that I can take a look at, I'll try to determine its usability for pdfs too.

Once again, tysm for all the help.

it's easy btw

Maybe for you bro Y'all are smart asf. For me, the whole process felt like shitting rocks. Seeing everyone say its not possible anymore, they've given up hope made me feel like I'm wasting my time. But, yeah. Now I'm at peace

Btween can you find the request links in one go

[n0mansk1]

I have not explicitly tested the script on pdf files only videos but, if you have any such file that I can take a look at, I'll try to determine its usability for pdfs too.

Once again, tysm for all the help.

it's easy btw

Maybe for you bro Y'all are smart asf. For me, the whole process felt like shitting rocks. Seeing everyone say its not possible anymore, they've given up hope made me feel like I'm wasting my time. But, yeah. Now I'm at peace

Btween can you find the request links in one go

Without clicking the video? afaik no. You'll have to do it. At least programmatically. All the video IDs you can get easily, no problem. But, if you need the stream URL, you'll have to do the click because that content is not loaded in unless you're on that page.

But, that's what I think. Maybe someone else has a better idea.

EDIT: I was wrong. It is in fact possible, I have tried it out just now. Just parse the course website's course list accordion navbar using bs4 or similar, through their data-id attributes you will get video IDs of all the videos.

Then repeatedly make requests to: https://<course>.graphy.com/s/courses/<course_id>/videos/<video_id>/get for each video, and you will get all the stream IDs for that course.

[Prashantt]

My code is giving me errors so can you please share your working code at telegram id - @MagnetOOOOO

[Prashantt]

Did everyone gave up on this thread isn't there any way

Sorry for the tag. Needed to get some information out.

I have created a 12-page guide document to perform this exploit on Graphy's courses (hosted on Spayee). As of December 15th, 2024, the exploit works perfectly and as intended. Please do not message me for access to the document as I will not risk leaking it to the developer team. My version is unpatchable for the foreseeable future regardless of changes within the encrypt/decrypt functions. An LLM will change the code automatically. If you need any guidance otherwise, feel free to DM me. It is completely based upon the work done in this thread, I have not invented a new system or anything, I just made it very refined, targeted, and dynamic. If nothing else, I can always give you confirmation if it is still possible or not.

Special Thanks to:
f1shy-dev
jora
aadrl
NBA456017
aqzs
white_snake
slayer36

I love you guys, helped me out immensely.

Best Regards,
A Lurker.

Bro can you please share the document to me at telegram id- @MagnetOOOOO
My previous code is not working anymore.

[Prashantt]

Did everyone gave up on this thread isn't there any way

Sorry for the tag. Needed to get some information out.

I have created a 12-page guide document to perform this exploit on Graphy's courses (hosted on Spayee). As of December 15th, 2024, the exploit works perfectly and as intended. Please do not message me for access to the document as I will not risk leaking it to the developer team. My version is unpatchable for the foreseeable future regardless of changes within the encrypt/decrypt functions. An LLM will change the code automatically. If you need any guidance otherwise, feel free to DM me. It is completely based upon the work done in this thread, I have not invented a new system or anything, I just made it very refined, targeted, and dynamic. If nothing else, I can always give you confirmation if it is still possible or not.

Special Thanks to:
f1shy-dev
jora
aadrl
NBA456017
aqzs
white_snake
slayer36

I love you guys, helped me out immensely.

Best Regards,
A Lurker.

I'm getting wrong keys as a result the lecture is downloading but not playing. Please share the code to get the correct keys.

[LittleSoldier]

Redacted

[Sagnik]

Redacted

Can you please give the latest script to download the videos ? ( Thanks to the informations of this site, I have made it from myself).

[para8ox]

Now again the decrypt function is changed,

It looks like this,

(e.loadsuccess = function (t, e, r) {
var i = r.frag,
n = window.cjs,
a = n.AES.decrypt,
o = window.convertArrayToBase64,
u = n.mode.ECB,
d = n.enc,
h = d.Hex.parse,
c = n.pad.NoPadding;
if (i.decryptdata) {
var f = new Uint8Array(t.data),
pp = t.url.split('/timestamp/')[1] ?? '',
g = f.subarray(0, 16),
v = f.subarray(32, 48);
if (pp === 'aav') {
g = f.subarray(16, 32);
v = f.subarray(48, 64);
} else if (pp === 'scw') {
g = f.subarray(0, 16);
v = f.subarray(32, 48);
} else if (pp === 'scs') {
v = f.subarray(0, 16);
g = f.subarray(48, 64);
} else if (pp === 'sdq') {
v = f.subarray(8, 24);
g = f.subarray(32, 48);
} else if (pp === 'sxc') {
v = f.subarray(16, 32);
g = f.subarray(48, 64);
} else if (pp === 'q1wq') {
v = f.subarray(0, 16);
g = f.subarray(32, 48);
} else if (pp === 'w1q') {
g = f.subarray(0, 16);
v = f.subarray(48, 64);
}
(f = a(o(g), h(window.apkId.substring(32)), {
mode: u,
padding: c,
}))


So, can someone tell what to use now, because I tried with the first g and v ranges but the key I got was incorrect, so does anyone has any idea of this

[Sagnik]

Now again the decrypt function is changed,
So, can someone tell what to use now, because I tried with the first g and v ranges but the key I got was incorrect, so does anyone has any idea of this

Try this

import re
import base64
import requests
from Crypto.Cipher import AES
import binascii
import os


def _decrypt_key(data, url):
    # Extract pp value from URL (after '/timestamp/')
    pp_match = re.search(r'/timestamp/([^/]+)', url)
    pp = pp_match.group(1) if pp_match else ''

    # Convert data to bytearray for subarray slicing
    f = bytearray(data)

    # Default subarray ranges
    v_start, v_end = 0, 16
    g_start, g_end = 32, 48

    # Adjust subarray ranges based on pp value
    if pp == 'aav':
        v_start, v_end = 0, 16
        g_start, g_end = 48, 64
    elif pp == 'scw':
        v_start, v_end = 0, 16
        g_start, g_end = 32, 48
    elif pp == 'scs':
        v_start, v_end = 16, 32
        g_start, g_end = 48, 64
    elif pp == 'sdq':
        v_start, v_end = 8, 24
        g_start, g_end = 32, 48
    elif pp == 'sxc':
        g_start, g_end = 0, 16
        v_start, v_end = 48, 64
    elif pp == 'q1wq':
        g_start, g_end = 16, 32
        v_start, v_end = 48, 64
    elif pp == 'w1q':
        g_start, g_end = 0, 16
        v_start, v_end = 32, 48

    # Extract v and g subarrays
    v = f[v_start:v_end]
    g = f[g_start:g_end]

    # Prepare apkId for decryption
    apk_id_key = apkId[:16] + apkId[48:]

    # Perform AES decryption
    dec1 = AES.new(bytes.fromhex(apk_id_key), AES.MODE_ECB)
    tmp = dec1.decrypt(bytes(g))
    dec2 = AES.new(tmp, AES.MODE_ECB)
    return dec2.decrypt(bytes(v))


def download():
    # Extract base URL
    match = re.search(r"(https?://.*\/)", url_base)
    url_stream = match.group(1).strip()

    # Get m3u8 playlist
    r = requests.get(url_base)
    matchs = re.findall(r"(h.*m3u8)", r.text)
    video = url_stream + matchs[-1]

    # Get key URI from m3u8
    r = requests.get(video)
    matchs = re.search(r'AES-128,URI="(.*)"', r.text)
    uri_url = url_stream + matchs.group(1).strip()

    # Fetch and decrypt key
    res = requests.get(uri_url)
    key_data = _decrypt_key(res.content, uri_url)

    # Encode key to hex
    hex_key = binascii.hexlify(key_data).decode('utf-8')
    print(f"Decrypted key (hex): {hex_key}")

    # Run hlsdl command
    os.system(f'hlsdl -K {hex_key} -o output.mp4 -b "{url_base}"')


if __name__ == '__main__':
    apkId = input("Enter the apkId: ")
    url_base = input("Enter Index.m3u8 URL: ")
    download()

[para8ox]

Great man, it's working, did some tweaks in this and worked like a charm!

[pyc0de]

How about this one?

if (i.decryptdata) {
var f = new Uint8Array(t.data),
pp = t.url.split('/timestamp/')[1] ?? '',
g = f.subarray(0, 16),
v = f.subarray(32, 48);
if (pp === 'aav') {
g = f.subarray(16, 32);
v = f.subarray(48, 64);
} else if (pp === 'scw') {
g = f.subarray(0, 16);
v = f.subarray(32, 48);
} else if (pp === 'scs') {
v = f.subarray(0, 16);
g = f.subarray(48, 64);
} else if (pp === 'sdq') {
v = f.subarray(8, 24);
g = f.subarray(32, 48);
} else if (pp === 'sxc') {
v = f.subarray(16, 32);
g = f.subarray(48, 64);
} else if (pp === 'q1wq') {
v = f.subarray(0, 16);
g = f.subarray(32, 48);
} else if (pp === 'w1q') {
g = f.subarray(0, 16);
v = f.subarray(48, 64);
}
(f = a(o(g), h(window.apkId.substring(32)), {
mode: u,
padding: c,
})),

[Sagnik]

How about this one?

I think it is same as the previous.

[pyc0de]

[QUOTE=Sagnik;2775904]

Now again the decrypt function is changed,
So, can someone tell what to use now, because I tried with the first g and v ranges but the key I got was incorrect, so does anyone has any idea of this

Works fine!!! Thank you so much

Had to do some tweaks, adjusting the g/v function

In the script mentioned above, you have to inspect the page and adjust the key size to match the decrypt function ()


Here is the Python above

# Adjust subarray ranges based on pp value
if pp == 'aav':
v_start, v_end = 0, 16
g_start, g_end = 48, 64


From my site

if pp == 'aav':
g_start, g_end = 16, 32
v_start, v_end = 48, 64

So modify it to match from this

# Adjust subarray ranges based on pp value
if pp == 'aav':
v_start, v_end = 0, 16
g_start, g_end = 48, 64

to this

# Adjust subarray ranges based on pp value
if pp == 'aav':
v_start, v_end = 48, 64
g_start, g_end = 16, 32


Stay tunned that some site the v_start and g_start are in a different order

[whs912km]

sorry but script above on post 198 is for which site ?
and Enter the apkId and Enter Index.m3u8 URL is for ? is specific for some site or just a reply to para8ox from post 197 ?

[para8ox]

It can be used for graphy, and it's a general script, you need to modify it according to your own use, and things like apkId and Index.m3u8 URL are coming from the website that uses graphy for drm.

[whs912km]

ok understand. and you don't want share link to your video right ?

[para8ox]

Yes that video is not open, it needs credentials, so ofcourse it doesn't matter even I share it here.

[slayer36]

Yes that video is not open, it needs credentials, so ofcourse it doesn't matter even I share it here.

which website??