Need help to download HLS AES-128 encrypted video.

[2nHxWW6GkN1l916N3ayz8HQoi]

When I make a request to the link the php file is downloaded.

First key

okey

Edit: IV=0x97e05e5b1f3329130331f234af992a09

Second key. Why are these keys diferent? Is it the same stream? If I am not wrong, AES-128 has only one encryption key.

Edit: Yeah. I think this one alters the received key. @LZAA was right, it's related to timestamp so maybe that's why it's different. If the app is open source you could look into the code and understand their logic. Otherwise, reverse engineer their app using IDA or other stuff (will remain a dream).

[johnyl0]

When I make a request to the link the php file is downloaded.

First key

okey

Edit: IV=0x97e05e5b1f3329130331f234af992a09

Second key. Why are these keys diferent? Is it the same stream? If I am not wrong, AES-128 has only one encryption key.

Edit: Yeah. I think this one alters the received key. @LZAA was right, it's related to timestamp so maybe that's why it's different. If the app is open source you could look into the code and understand their logic. Otherwise, reverse engineer their app using IDA or other stuff (will remain a dream).

oh no, not the same stream.

[johnyl0]

When I make a request to the link the php file is downloaded.

First key

okey

Edit: IV=0x97e05e5b1f3329130331f234af992a09

Second key. Why are these keys diferent? Is it the same stream? If I am not wrong, AES-128 has only one encryption key.

Edit: Yeah. I think this one alters the received key. @LZAA was right, it's related to timestamp so maybe that's why it's different. If the app is open source you could look into the code and understand their logic. Otherwise, reverse engineer their app using IDA or other stuff (will remain a dream).

the network proceeds as follows

1. main m3u8 get request
2. 1080p quality m3u8 get request
3. track 1 get request
4. key.php get request
5. track 1 is played
6. track 2 get request
7. key.php get request
8. track 2 is played
.
.
.

the key.php requests are the same, I downloaded and examined all the key.php files in the requests. they are all the same, I compared the hex values.

what I don't understand is why he makes requests after each track, even though the requests are the same

[lomero]

use my code at post#23

if N_m3u8DL-RE can't download (forbidden) need to add header like that (only to example)
-H "User-Agent: Mozilla/5.0...."
--header "Cookie: CloudFront-Policy=eyJT ...."
-H "Authorization: ba9e-deca6 ....

[johnyl0]

use my code at post#23

if N_m3u8DL-RE can't download (forbidden) need to add header like that (only to example)
-H "User-Agent: Mozilla/5.0...."
--header "Cookie: CloudFront-Policy=eyJT ...."
-H "Authorization: ba9e-deca6 ....

Hi,

The contentDir value in the URI value is constantly changing.

For example, when I make a request to the same m3u8 link, the contentDir in the uri value changes.

https://xxx.com/vodsession/key.php?contentDir=163a09918524de012c339f6e643b2ce6

@LZAA was right, it's related to timestamp so maybe that's why it's different

Edit: It gives the key.php file with the same hex value even when the contentDir value has changed.

[LZAA]

Need full URL '0.ts'.

[johnyl0]

Need full URL '0.ts'.

please wait

[johnyl0]

Need full URL '0.ts'.

Edit: links expired

[LZAA]

0d5ba7503d466dc46c934a19621e14a7 -> Wrong key.

[johnyl0]

0d5ba7503d466dc46c934a19621e14a7 -> Wrong key.

is it available for download?

[johnyl0]

0d5ba7503d466dc46c934a19621e14a7 -> Wrong key.

Hi,

Can you help me download it? I can pay for it.