uuid and 403 Forbidden

[CrymanChen]

Hey guys,
just read about another post discussing Rakuten Spain.

Yesterday just finished investigating another site mytvsuper[.]com in Hong Kong. Honestly that's totally sick......
So I thought maybe try Rakuten TV...

I made some tests on the UK site (rakuten.tv/uk), but now am facing this 403 Forbidden problem.
URL:

https://www.rakuten.tv/uk/movies/killers--2

Type: Free movies (Free registration, Geo-restricted)

From what I have found,
After we have sent a POST request towards "https://gizmo.rakuten.tv/v3/avod/streamings",
uuid is in the response, and so does the mpd URL, License URL...
The format of the License URL is:

https://prod-kami.wuaki.tv/v1/licensing/wvm/{UUID}?uuid={UUID}

But that's the problem.
I used the uuid that the server gave me to conduct another POST request,
it gave me a 403 error.

{"errors":[{"code":"exception:[kami.exception.http_exception.HttpException]","message":"HttpException: Forbidden"}],"uuid":"670c7333-c000-428d-80fd-6f5519169601"}

I got no idea now.
Does Rakuten TV restricts emulator CDMs? I doubt that.
And indeed, open the Android Studio and stream the same video on your emulator and then use Fiddler to catch the uuid is also a solution, but... not the best solution right...?

I can provide the credentials although registration is quick and free. And also remote desktop sharing is workable.
Thanks.

Below is the screenshot of the cmd window. I wrote a custom script to try to catch all the necessary data.
I just pasted the account and password into the script beforhand, and then input the Video URL (with a question mark there "[?]"). All the other data were got from the responses so that means not generated manually.

[Attachment 77216 - Click to enlarge]

[2nHxWW6GkN1l916N3ayz8HQoi]

From what I've seen that uuid is generated using a POST to another request. And the json of that post request contains the element "device_uuid". There may be a conflict happening.

[stabbedbybrick]

You need to request the license URL from an Android device, either by debugging the traffic from an actual device or by writing a script that uses Android as identifier to access their API. There are no restrictions for the CDM.

6b9d1ea500e01f1be906496f410de19d:a69ee72bf462a73c548cb1e44f03aa95

[CrymanChen]

Thank you all @2nHxWW6GkN1l916N3ayz8HQoi and @stabbedbybrick.

Maybe just changing the User-Agent won't work. I'll try "fiddler"ing the data from my Pixel tomorrow.

[white_snake]

Maybe just changing the User-Agent won't work.

It shouldn't because site will not load the video at all, and will instead tell you to download the app for mobile.

[CrymanChen]

Ahh, that makes sense. I'll try downloading their mobile App.

(Since last time I saw a notice like "you can't watch this video from linux/... devices")

[CrymanChen]

Thank you guys, problem solved.
Indeed on Android is much different from that on Windows.

[cyberschlumpf]

I am currently looking to get 2 full series from rakuten.tv, https://www.rakuten.tv/de?content_type=tv_shows&tv_show_id=rick-stein-s-spain&content_...tein-s-spain-1 and https://www.rakuten.tv/de/search?q=rick%20stein&content_type=tv_shows&tv_show_id=rick-...ation-indien-1

From what I read, rakuten needs a special script that emulates an Android request.

I'm confident to be able to write one (have done before for joyn.de and itv.co.uk), but I am now very happy to just be able to use devine or freevine so I wonder if that hasn't this been solved before? No public download script yet which does just what you described above?

If I implement the full download process manually, will I be able to get full 720p and no inline advertisements? The first episode from a browser in a VM only offers 960x540 ( https://prod-kami.wuaki.tv/v1/delivery/dash/avod/e10c78f5-9581-499c-8893-722a2f5870ab.mpd) - but it also says it will only give me SD due to non HDCP playback.

[cyberschlumpf]

I just tried accessing rakuten.tv via Genymotion, but need to install the app and get the answer that encrypted playback is not available on the device. Is Genymotion blacklisted for rakuten.tv?

[azuranit]

Hi there,

this d4mD Rakuten is giving me a real hard Time!

As i was reading here and other Posts there is a way to get the keys with an Android Device...

1st attempt with Virtual Studio Pixel 6, the App and httptoolkit to spoof, I was able to get an <cencssh>, along with the LIC containing an UUID.
As the key request failed I suspected trusty 'downey' or the unknown imported keys to be faulty - pycryptodome gave me a hardtime too, as setup via pip fails since Release Update 3 weeks ago.

After all theses Issues sorted out and setting up a new VS_Pixel 6 - with new extracted/generated wvd and pywidivine running, I ended up with that using a_n_g_e_l_a 's l3.py script:

~/python/l3 $ python3 l3.py
PSSH? AAAAcHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAAFAIARIQCaDQtZifT4Ce5QOiwM6YAhoFd3Vha2kiLTA5YTBkMGI1OTg5ZjRmODA5ZWU1MDNhMmMwY2U5ODAyLW1jLTAtMTQ4LTAtMEjj3JWbBg==
License URL? https://prod-kami.wuaki.tv/v1/licensing/wvm/8201eb1b-c3e8-4f88-9222-2a70cf8bf667?uuid=8201eb1b-c3e8-4f88-9222-2a70cf8bf667
Traceback (most recent call last):
  File "/data/data/com.termux/files/home/python/l3/l3.py", line 33, in <module>
    licence.raise_for_status()
  File "/data/data/com.termux/files/usr/lib/python3.11/site-packages/requests/models.py", line 1024, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 403 Client Error: FORBIDDEN for url: https://prod-kami.wuaki.tv/v1/licensing/wvm/8201eb1b-c3e8-4f88-9222-2a70cf8bf667?uuid=8201eb1b-c3e8-4f88-9222-2a70cf8bf667

pywidevine test with the wvd is positive.

Any Help is very highly appreceated.

Thanks in advance
azu

[CrymanChen]

Hi there,

this d4mD Rakuten is giving me a real hard Time!

As i was reading here and other Posts there is a way to get the keys with an Android Device...

1st attempt with Virtual Studio Pixel 6, the App and httptoolkit to spoof, I was able to get an <cencssh>, along with the LIC containing an UUID.
As the key request failed I suspected trusty 'downey' or the unknown imported keys to be faulty - pycryptodome gave me a hardtime too, as setup via pip fails since Release Update 3 weeks ago.

After all theses Issues sorted out and setting up a new VS_Pixel 6 - with new extracted/generated wvd and pywidivine running, I ended up with that using a_n_g_e_l_a 's l3.py script:

~/python/l3 $ python3 l3.py
PSSH? AAAAcHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAAFAIARIQCaDQtZifT4Ce5QOiwM6YAhoFd3Vha2kiLTA5YTBkMGI1OTg5ZjRmODA5ZWU1MDNhMmMwY2U5ODAyLW1jLTAtMTQ4LTAtMEjj3JWbBg==
License URL? https://prod-kami.wuaki.tv/v1/licensing/wvm/8201eb1b-c3e8-4f88-9222-2a70cf8bf667?uuid=8201eb1b-c3e8-4f88-9222-2a70cf8bf667
Traceback (most recent call last):
  File "/data/data/com.termux/files/home/python/l3/l3.py", line 33, in <module>
    licence.raise_for_status()
  File "/data/data/com.termux/files/usr/lib/python3.11/site-packages/requests/models.py", line 1024, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 403 Client Error: FORBIDDEN for url: https://prod-kami.wuaki.tv/v1/licensing/wvm/8201eb1b-c3e8-4f88-9222-2a70cf8bf667?uuid=8201eb1b-c3e8-4f88-9222-2a70cf8bf667

pywidevine test with the wvd is positive.

Any Help is very highly appreceated.

Thanks in advance
azu

I can't quite remember it, but my situation is that I used my real Pixel instead of those emulators on Android Studio.

[azuranit]

...here we go again!

CrymenChen Thank You for your fast reply.

Ported my CDM to an Samsung S7edge that is (ab-)used as cryptominer...

Rakuten is playing fine - CDM comes up with 403 again:

~/python/l3 $ python3 l3.py
PSSH? AAAAcHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAAFAIARIQCaDQtZifT4Ce5QOiwM6YAhoFd3Vha2kiLTA5YTBkMGI1OTg5ZjRmODA5ZWU1MDNhMmMwY2U5ODAyLW1jLTAtMTQ4LTAtMEjj3JWbBg==
License URL? https://prod-kami.wuaki.tv/v1/licensing/wvm/50ccea0c-714a-4f45-9372-521f0b553b92?uuid=50ccea0c-714a-4f45-9372-521f0b553b92
Traceback (most recent call last):
  File "/data/data/com.termux/files/home/python/l3/l3.py", line 33, in <module>
    licence.raise_for_status()
  File "/data/data/com.termux/files/usr/lib/python3.11/site-packages/requests/models.py", line 1024, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 403 Client Error: FORBIDDEN for url: https://prod-kami.wuaki.tv/v1/licensing/wvm/50ccea0c-714a-4f45-9372-521f0b553b92?uuid=50ccea0c-714a-4f45-9372-521f0b553b92

any futher suggestions?

Thanks
azu


(update) just to show CDM working:

~/python/l3 $ pywidevine test ./WVD/4464_l3.wvd
INFO:root:pywidevine version 1.8.0 Copyright (c) 2022-2024 rlaphoenix
INFO:root:https://github.com/devine-dl/pywidevine
INFO:license:[+] Loaded Device (4464 L3)
INFO:license:[+] Loaded CDM
INFO:license:[+] Opened CDM Session: 0f3e198227754024511387d01577b09a
INFO:license:[+] Created License Request Message (Challenge)
INFO:license:[+] Got License Message
INFO:license:[+] License Parsed Successfully
INFO:license:[SIGNING] 00000000000000000000000000000000:fe1716fe2d4f8f5a4485c74fa2605f969a953a328c8ebc20e0108fea6dacfaa53d48bfbf1348cdcf2af4de68d120685bbd4646f5d27d2c0db3821941872c5ef6
INFO:license:[CONTENT] ccbf5fb4c2965be7aa130ffb3ba9fd73:9cc0c92044cb1d69433f5f5839a159df
INFO:license:[CONTENT] 9bf0e9cf0d7b55aeb4b289a63bab8610:90f52fd8ca48717b21d0c2fed7a12ae1
INFO:license:[CONTENT] eb676abbcb345e96bbcf616630f1a3da:100b6c20940f779a4589152b57d2dacb
INFO:license:[CONTENT] 0294b9599d755de2bbf0fdca3fa5eab7:3bda2f40344c7def614227b9c0f03e26
INFO:license:[CONTENT] 639da80cf23b55f3b8cab3f64cfa5df6:229f5f29b643e203004b30c4eaf348f4