Beyond WKS-KEYS

[A_n_g_e_l_a]

WKS-KEYS was a fine means of learning to get keys but its time has come. More developers are producing scripts that use a WideVine Descriptor file (wvd) to locate your CDM key and blob.

What follows is a method of getting and running a wvd file. Many will know and already use the method described below.

Running python scripts in a special Python environment.

Python has a problem. After lots of script downloads and installing all the necessary module or extra libraries to make the script run you can arrive at a situation where one script needs a 'pip install mybigmodule==10.2.21' but you have another script on your system that must use mybigmodule<=9.5.0. So if you follow the direction for one script it stops the other from working.

The solution is to create a named python enviroment in which to run the first script and another named enviroment to run second.


It is done like this and credit to Sorenb for the write-up:
create a venv (a virtual environment) on Linux/Macos

python3 -m venv env

- here the virtual environment is simply called 'env'
For Windows

py -m venv env

The the 'env' needs to be activated
linux/Macos

source env/bin/activate

Windows

.\env\Scripts\activate

Now your terminal or command window will show 'env' to remind you that you are using a Python Environment.
When you close the command window you close the environment. It is still there but next time you need to re-activate with activate command above.

'venv creates a folder env there it stores all the 'extra' modules you download to run a script. If you no longer want the environment - just delete the 'env' folder.

Now following the above method you can create as many environments as needed to keep each library of scripts safely apart from each other on your system.

Just remember to start the necessary environment before running your script.

WKS-KEYS is slowly being replaced in popularity by the use of a pip module 'pywidevine'
Pywidevine works much the same as with WKS-KEYS except you can run your scripts from anywhere. The python commands to get the pywidevine module to cough-up keys is different but all that is transparent to most users who just want to run scripts.

Instead of having to run your python scripts in the WKS-KEYS folder and use the path to pywidevine's decryption facilities within, you can now set up a means of using pywidevine from anywhere on your system.

You do this by first creating a WideVine Descriptor file (wvd) which contains the details of where the device_private_key and the device_client_blob may be found.

But first activate your python env or create a new one for pywidevine related scripts,

Install pywidevine. Pywidevine omits to install yaml, a needed library, so we do that at the same time

 pip install pywidevine pyaml

Then, with your chosen env on the command prompt line, navigate to the folder where your key and blob are located.

First make a folder where the descriptor file can be created

 mkdir WVD

then:-

pywidevine create-device -k device_private_key  -c device_client_id_blob -t ANDROID -l3 -o WVD

for me it responded

/home/angela/Programming/WKS-KEYS/pywidevine/L3/cdm/devices/emulator_1/WVD/google_aosp_on_ia_emulator_14.0.0_d6xxxxx4_l3.wvd

[Attachment 74182 - Click to enlarge]
It works the same on linux and Windows

Now when you wish to run a script that does not use WKS-KEYS you activate the environment pywidevine is installed in and install any scripts plus its required modules. They are functionally separate from anything outside the env(ironment).
Most scripts that use a wvd file to access your key and blob will need to know its location.

Mine now looks like this for an emulator key/blob /home/angela/Programming/WKS-KEYS/pywidevine/L3/cdm/devices/emulator_1/WVD/google_aosp_on_ia_emulator_14.0.0_d6ixxxxxx64_l3.w vd

Now you need an l3.py to use for simple keys

from pywidevine.cdm import Cdm
from pywidevine.device import Device
from pywidevine.pssh import PSSH
import requests
#
# enter special header values here  in the form  'token':  ' value',   each on one line -  remember the quotes and the comma!
headers = {
    'Accept': '*/*',
}

# prepare pssh
#pssh = PSSH("AAAAVnBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAADYIARIQSOe5B5JcTV2gbw07SycC7xoNd2lkZXZpbmVfdGVzdCIIMTIzNDU2NzgyB2RlZmF1bHQ=")
pssh = input("PSSH? ")
pssh = PSSH(pssh)
lic_url = input("License URL? ")

# load device
# for example
#device = Device.load(r"/home/angela/Programming/WKS-KEYS/pywidevine/L3/cdm/devices/emulator_1/WVD/google_aosp_on_ia_emulator_14.0.0_xxxxxc_4464_l3.wvd")
device = Device.load(r"<enter your path to the wvd file you have created, here>")

# load cdm
cdm = Cdm.from_device(device)

# open cdm session
session_id = cdm.open()

# get license challenge
challenge = cdm.get_license_challenge(session_id, pssh)

# send license challenge (assuming a generic license server SDK with no API front)
licence = requests.post(lic_url, headers = headers, data=challenge)
licence.raise_for_status()

# parse license challenge
cdm.parse_license(session_id, licence.content)

# print keys
for key in cdm.get_keys(session_id):

    if key.type=='CONTENT':
        print(f"\n--key {key.kid.hex}:{key.key.hex()}")

# close session, disposes of session data
cdm.close(session_id) 

[edit] I forgot to mention that you can now rename the wvd file created to something easier to type and you can copy it to anywhere in the system. The file contains data about your key and blob's location so be sure to never move your key and blob unless you want to do this process all over again. [/edit]

I plan moving away from WKS-KEYS in future script releases.

[Obo]

Thank you, Angela. Incidentally I was going to write up something very similar.

Further advantage of pywidevine is that you can actually test your cdm/wvd:

$ pywidevine test ~/cdm/xiaomi_redmi_l3.wvd 
INFO:root:pywidevine version 1.5.3 Copyright (c) 2022-2023 rlaphoenix
INFO:root:https://github.com/rlaphoenix/pywidevine
INFO:license:[+] Loaded Device (4445 L3)
INFO:license:[+] Loaded CDM
INFO:license:[+] Opened CDM Session: 0c6f231696c3e066a9cbc63c9ca0c701
INFO:license:[+] Created License Request Message (Challenge)
INFO:license:[+] Got License Message
INFO:license:[+] License Parsed Successfully
INFO:license:[SIGNING] 00000000000000000000000000000000:5093...4b08
INFO:license:[CONTENT] ccbf5fb4c2965be7aa130ffb3ba9fd73:9cc0c92044cb1d69433f5f5839a159df
INFO:license:[CONTENT] 9bf0e9cf0d7b55aeb4b289a63bab8610:90f52fd8ca48717b21d0c2fed7a12ae1
INFO:license:[CONTENT] eb676abbcb345e96bbcf616630f1a3da:100b6c20940f779a4589152b57d2dacb
INFO:license:[CONTENT] 0294b9599d755de2bbf0fdca3fa5eab7:3bda2f40344c7def614227b9c0f03e26
INFO:license:[CONTENT] 639da80cf23b55f3b8cab3f64cfa5df6:229f5f29b643e203004b30c4eaf348f4

It doesn't spit out the keys if your cdm has been revoked, but instead answers with a "permission denied" error (the medv widevine github repo contains a set of revoked keys).

Migration from the WKS-Keys code was easy enough.

[phantom84]

Sorry to be a pain but getting stuck here... any guidance please?

(env) C:\Users\Name>pywidevine create-device -k device_private_key  -c device_client_id_blob -t ANDROID -l3 -o WVD
INFO:root:pywidevine version 1.5.3 Copyright (c) 2022-2023 rlaphoenix
INFO:root:https://github.com/rlaphoenix/pywidevine
Usage: pywidevine create-device [OPTIONS]
Try 'pywidevine create-device --help' for help.

Error: key: Not a path to a file, or it doesn't exist.

[phantom84]

Sorry to be a pain but getting stuck here... any guidance please?

(env) C:\Users\Name>pywidevine create-device -k device_private_key  -c device_client_id_blob -t ANDROID -l3 -o WVD
INFO:root:pywidevine version 1.5.3 Copyright (c) 2022-2023 rlaphoenix
INFO:root:https://github.com/rlaphoenix/pywidevine
Usage: pywidevine create-device [OPTIONS]
Try 'pywidevine create-device --help' for help.

Error: key: Not a path to a file, or it doesn't exist.

Looks like I need to go off and find out how to do this

You do this by first creating a WideVine Descriptor file (wvd) which contains the details of where the device_private_key and the device_client_blob may be found.

[CrymanChen]

The first time to get a front row (yeah)
---
As always, really grateful for Angela who has taught me a lot. Every post of yours is a treasure.
Plus, upload a screenshot to prove Angela's right-ness.

[Attachment 74185 - Click to enlarge]

[A_n_g_e_l_a]

Sorry to be a pain but getting stuck here... any guidance please?

(env) C:\Users\Name>pywidevine create-device -k device_private_key  -c device_client_id_blob -t ANDROID -l3 -o WVD
INFO:root:pywidevine version 1.5.3 Copyright (c) 2022-2023 rlaphoenix
INFO:root:https://github.com/rlaphoenix/pywidevine
Usage: pywidevine create-device [OPTIONS]
Try 'pywidevine create-device --help' for help.

Error: key: Not a path to a file, or it doesn't exist.

Looks like I need to go off and find out how to do this

You do this by first creating a WideVine Descriptor file (wvd) which contains the details of where the device_private_key and the device_client_blob may be found.

You need to already have a device_private_key and a device_client_blob. We assume you already have read the stickies and got your own. Then just move to the folder where the key and blob are and run the pywidevine create-device line.

[A_n_g_e_l_a]

Every post of yours is a treasure.

Thank you. If only that were so!

[neofita]

Thank you for sharing. Very much appreciated. Kudos to you!

[phantom84]

Hi sorry to be a pain attempting to build file running

pywidevine create-device -k device_private_key  -c device_client_id_blob -t ANDROID -l3 -o WVD

but now getting

(env) c:\Users\name\WVD>pywidevine create-device -k device_private_key  -c device_client_id_blob -t ANDROID -l3 -o WVD
INFO:root:pywidevine version 1.5.3 Copyright (c) 2022-2023 rlaphoenix
INFO:root:https://github.com/rlaphoenix/pywidevine
Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "C:\Users\name\env\Scripts\pywidevine.exe\__main__.py", line 7, in <module>
  File "C:\Users\name\env\Lib\site-packages\click\core.py", line 1157, in __call__
    return self.main(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\name\env\Lib\site-packages\click\core.py", line 1078, in main
    rv = self.invoke(ctx)
         ^^^^^^^^^^^^^^^^
  File "C:\Users\name\env\Lib\site-packages\click\core.py", line 1688, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\name\env\Lib\site-packages\click\core.py", line 1434, in invoke
    return ctx.invoke(self.callback, **ctx.params)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\name\env\Lib\site-packages\click\core.py", line 783, in invoke
    return __callback(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\name\env\Lib\site-packages\click\decorators.py", line 33, in new_func
    return f(get_current_context(), *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\name\env\Lib\site-packages\pywidevine\main.py", line 234, in create_device
    out_path.write_bytes(wvd_bin)
  File "C:\Users\name\AppData\Local\Programs\Python\Python311\Lib\pathlib.py", line 1067, in write_bytes
    with self.open(mode='wb') as f:
         ^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\name\AppData\Local\Programs\Python\Python311\Lib\pathlib.py", line 1044, in open
    return io.open(self, mode, buffering, encoding, errors, newline)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: 'WVD\\google_aosp_on_ia_emulator_14.0.0_381026f8_4464_l3.wvd'

(env) c:\Users\name\WVD>

[iamghost]

did you create WVD folder with device_private_key and device_client_id_blob local

[Attachment 74235 - Click to enlarge]

[A_n_g_e_l_a]

FileNotFoundError: [Errno 2] No such file or directory: 'WVD\\google_aosp_on_ia_emulator_14.0.0_381026f8_4464_l3.wvd'

(env) c:\Users\name\WVD>

Have you noticed you are in a directory WVD and you are asking pywidevine to create a wvd file in another directory called WVD?
Follow the instructions as if they were a pilot's check-list.

Edit. And there is no trailing slash on WVD in this line

pywidevine create-device -k device_private_key -c device_client_id_blob -t ANDROID -l3 -o WVD

[Obo]

Did you create the directory "WVD" where the .wvd file should be written to? Seems not...

Try "-o ." instead (I hope that Windows treats "." as current directory like Linux and MacOS do?)

[phantom84]

Did you create the directory "WVD" where the .wvd file should be written to? Seems not...

Try "-o ." instead (I hope that Windows treats "." as current directory like Linux and MacOS do?)

WVD folder was created correctly as far as I can tell...

Sorry didnt see all the replies... Going to start again...Think I know what I have done wrong

[A_n_g_e_l_a]

WVD folder was created correctly as far as I can tell...

You MOVE INTO the folder with the key and the blob AND FROM THERE create a folder called WVD.
DO NOT MOVE from where you are, with the key and the blob , then you run the line.

[phantom84]

WVD folder was created correctly as far as I can tell...

You MOVE INTO the folder with the key and the blob AND FROM THERE create a folder called WVD.
DO NOT MOVE from where you are, with the key and the blob , then you run the line.

SUCCESS!

(env) C:\Users\name>pywidevine create-device -k device_private_key -c device_client_id_blob -t ANDROID -l3 -o WVD
INFO:root:pywidevine version 1.5.3 Copyright (c) 2022-2023 rlaphoenix
INFO:root:https://github.com/rlaphoenix/pywidevine
INFO:create-device:Created Widevine Device (.wvd) file, google_aosp_on_ia_emulator_14.0.0_381026f8_4464_l3.wvd
INFO:create-device: + Type: ANDROID
INFO:create-device: + System ID: 4464
INFO:create-device: + Security Level: 3
INFO:create-device: + Flags: None
INFO:create-device: + Private Key: True (2048 bit)
INFO:create-device: + Client ID: True (1780 bytes)
INFO:create-device: + VMP: False
INFO:create-device: + Saved to: C:\Users\name\WVD\google_aosp_on_ia_emulator_14.0.0_381026f8_4464_l3.wvd

(env) C:\Users\name>

[stevepen1974]

Hi,

New to running scripts and hoping for advice on what I am doing wrong. I install uk-fta on Windows as per:

1. Create py -m venv env
2. .\env\Scripts\activate
3. pip install pywidevine pyaml in C:\Users\steve\test\Scripts
4. Add all files within uk-fta to C:\Users\steve\test\Scripts
5. Add working .wvd to config.py
6. pip install -r requirements.txt to C:\Users\steve\test\Scripts
7. Add ffprobe.exe ,N_m3u8DL-RE.exe,mp4decrypt.exe,mkvmerge.exe,ffmpeg.exe,ffplay.exe to C:\Users\steve\test\Scripts

Menu.py will not run in C:\Users\steve\test\Scripts.

If I move menu.py to C:\Users\steve\test\Lib\site-packages the script works and downloads and decrypts correctly.

This only runs once and I have to do a new install to run again.

So much easier than manual batch download/decrypts.

Any advice appreciated on correct installation and many thanks to Angela for sharing/developing this script.

Cheers

Steve

[A_n_g_e_l_a]

@ stevepen1974
Hard to know what you are doing. Just make sure that you activate your env(ironment) each time you use it. With the environment set and (env) showing in your command window all should be well. You should be able to pip install requirements in any folder you like, and run from there. The fact that menu.py won't run suggests you haven't done pip install -r requirements with env activated.

[stevepen1974]

@ stevepen1974
Hard to know what you are doing. Just make sure that you activate your env(ironment) each time you use it. With the environment set and (env) showing in your command window all should be well. You should be able to pip install requirements in any folder you like, and run from there. The fact that menu.py won't run suggests you haven't done pip install -r requirements with env activated.

Thanks for replying, Angela.

Yes, all pip installed are in the active environment. I have now got this to work by adding all the Lib site -packages to the ukfta folder with menu.py.

I added a desktop shortcut for menu.py and can run direct from this shortcut? Bit confused by this as I thought you had to activate and run .\env\Scripts\activate from command window to allow the script to work.

Cheers

Steve

[A_n_g_e_l_a]

Bit confused by this as I thought you had to activate and run .\env\Scripts\activate from command window to allow the script to work.

You're confused? So am I! With a correctly setup env by using venv as in post #1 the standard Python library is included.

I would start again! You've probably made a mistake in setup. Delete the env folder you have created and any others that are may have been made by error. Then follow the method at post #1 step by step and watch you don't assume anything.

Remember you do not have to work in the env folder and UK-FTA can be anywhere on your system. So long as you run the .\env\Srcipts\activate in your command window and do not close it, the environment is active. Change directory to UK-FTA - using your command window. Put your binaries in there if they are not in your Path by all means (Some people put them in system32 so windows finds them).

[stevepen1974]

Bit confused by this as I thought you had to activate and run .\env\Scripts\activate from command window to allow the script to work.

You're confused? So am I! With a correctly setup env by using venv as in post #1 the standard Python library is included.

I would start again! You've probably made a mistake in setup. Delete the env folder you have created and any others that are may have been made by error. Then follow the method at post #1 step by step and watch you don't assume anything.

Remember you do not have to work in the env folder and UK-FTA can be anywhere on your system. So long as you run the .\env\Srcipts\activate in your command window and do not close it, the environment is active. Change directory to UK-FTA - using your command window. Put your binaries in there if they are not in your Path by all means (Some people put them in system32 so windows finds them).

Thanks, I will take another look as the way I have it working is not correct.

[mkjustuk]

Sorry, was a question about the device key, but I think I have it sussed.

[billybanana]

Now you need an l3.py to use for simple keys

Thank you Angela for another useful thread and the code which I am now using. I've moved over from WKS-KEYS now pretty easily.

Further advantage of pywidevine is that you can actually test your cdm/wvd

That's a useful tip too. I've added that to my arsenal of tidbits to remember

[white_snake]

In thanking A_n_g_e_l_a for another super useful thread, I wanted to add that, on Windows, you may create a batch file to directly open a terminal with the python environment activated, like this:

@echo off
start /B cmd.exe /K "cd /D C:\Users\path_you_want_to_start_in & C:\Users\path_to_env\Scripts\activate"

path_you_want_to_start_in might be your downloads folder, the folder you have your scripts in or whatever you like (works also if the path contains spaces).

Example:

@echo off
start /B cmd.exe /K "cd /D D:\My Downloads & %USERPROFILE%\wvenv\Scripts\activate"

[PSXman_uk]

PS C:\Scripts\env\Scripts> python l3.py
PSSH? AAAAWHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAADgIARIQ86Ys7iUsS2edueV7RzCVFyIgQjVhTjlVUGlsYmhBMGFSdE1JbThrV29GNWxVWTdHNTI4AQ==
License URL? https://cbsi.live.ott.irdeto.com/widevine/getlicense?CrmId=cbsi&AccountId=cbsi&SubCont...c0d7fa%22%2Csu
Traceback (most recent call last):
  File "C:\Scripts\env\Scripts\l3.py", line 33, in <module>
    licence.raise_for_status()
  File "C:\Users\psxma\AppData\Local\Programs\Python\Python312\Lib\site-packages\requests\models.py", line 1021, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: https://cbsi.live.ott.irdeto.com/widevine/getlicense?CrmId=cbsi&AccountId=cbsi&SubCont...c0d7fa%22%2Csu
PS C:\Scripts\env\Scripts>

Get an error anybody know whats causing this please

[iamghost]

what is URL?

[PSXman_uk]

https://cbsi.live.ott.irdeto.com/widevine/getlicense?CrmId=cbsi&AccountId=cbsi&SubCont...c0d7fa%22%2Csu



PSSH:AAAAWHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAADgIA RIQ86Ys7iUsS2edueV7RzCVFyIgQjVhTjlVUGlsYmhBMGFSdE1 JbThrV29GNWxVWTdHNTI4AQ==


https://www.cbs.com/shows/video/B5aN9UPilbhA0aRtMIm8kWoF5lUY7G52/

[iamghost]

--key f3a62cee252c4b679db9e57b47309517:884e62a9cabbb29873afbbfe85dc9295

[PSXman_uk]

mine doesn't generate a key just an error message as above any ideas or way to test it out

[imr_saleh]

mine doesn't generate a key just an error message as above any ideas or way to test it out

for me i got 403 if not using US ip

<Response [403]>
license request failed:
b'{"code":130301,"message":"Content is not available in this location."}'

[PSXman_uk]

have us vpn and watching the video I'll try another vpn weird thanks.

HTTPError: 403 Client Error: Forbidden for url: