First time using my own CDM. Need help

[thetivoguy]

Hi everybody. I've been using getwvkeys.cc for over a year. But I've been struggling with it for some websites. And finally decided to use dumper.

I've set up everything, visited bitmovin demo and got the two files. However, as you know some websites won't easily give up the PSSH or license URL. (Especially some paid ones, which I'm not going to name as it's against the rules to discuss them)

So I thought visiting them on the phone was supposed to dump the keys. This is the message I got on dump_keys after I visited bitmovin demo.

[Attachment 77291 - Click to enlarge]

And the video key I already have from getwvkeys.

[Attachment 77292 - Click to enlarge]

So the message includes the KID but not the rest of the key? Did I get the whole idea wrong? Dumper doesn't print out the key? Is it only for getting those two files to use them on scripts like WKS-KEYS? Which I did and worked fine. And then you're done with dumper? But for me, using WKS-KEYS isn't much different than using getwvkeys.

Hope I didn't post something duplicate. I did my best to search it on the forum but couldn't get an answer. Looking forward for your kind help.

[Karoolus]

Dumper is only meant to dump your Android CDM. It won't extract video decryption keys afaik.
You need a different script for that, check the stickies

[stabbedbybrick]

The files that you're dumping from your advice is what's commonly referred to as "CDM" (Content Decryption Module), which for L3 consist of a private RSA key and the device client identification. These are not decryption keys, but are responsible for the communication to the license server that results in decryption keys. Aside from a select few streaming services, you only need to dump it once and you're done. It can then be used for other services.

The major upside of using a local CDM with scripts as opposed to something like getwvkeys, is that you'll be able to handle data that the website cant. You'd also not be required to go through some stupid discord verification process in order to use it.

[thetivoguy]

Thank you guys.

[2nHxWW6GkN1l916N3ayz8HQoi]

The major upside of using a local CDM with scripts as opposed to something like getwvkeys, is that you'll be able to handle data that the website cant. You'd also not be required to go through some stupid discord verification process in order to use it.

Fun fact that I discovered. If someone is lazy and doesn't want to bother getting his own CDM, he can still use https://cdrm-project.com/ . Apparently, you can "force" it to run any custom script by simply "hijacking" their CDM challenge. Of course not anyone can do it since you need some basic programming knowledge.

But in theory, if you host your own "license server", you can get their cdm challenge, use it for your custom script, and return back the data for them to parse and show the keys (since the cdm session started on their server of course, so you can't parse the result yourself). So no local CDM is needed but you still need a custom script for cdrm-project to call. So you can skip the getting a CDM part and not even bother with their discord verification. I dunno if it was intended to be used this way but I think you can do some bad stuff with it.

I hosted my own license server and debugged the code. When I run the cdrm-project request, I actually got their challenge lol.

[white_snake]

The major upside of using a local CDM with scripts as opposed to something like getwvkeys, is that you'll be able to handle data that the website cant. You'd also not be required to go through some stupid discord verification process in order to use it.

Fun fact that I discovered. If someone is lazy and doesn't want to bother getting his own CDM, he can still use https://cdrm-project.com/ . Apparently, you can "force" it to run any custom script by simply "hijacking" their CDM challenge. Of course not anyone can do it since you need some basic programming knowledge.

But in theory, if you host your own "license server", you can get their cdm challenge, use it for your custom script, and return back the data for them to parse and show the keys (since the cdm session started on their server of course, so you can't parse the result yourself). So no local CDM is needed but you still need a custom script for cdrm-project to call. So you can skip the getting a CDM part and not even bother with their discord verification. I dunno if it was intended to be used this way but I think you can do some bad stuff with it.

I hosted my own license server and debugged the code. When I run the cdrm-project request, I actually got their challenge lol.

Anybody who can do that can most definitely dump their own CDM as well, but that is still quite interesting, never thought of it.

Btw with "stupid verification process" I think stabbed referred to getwvkeys.cc, not cdrm-project. The latter doesn't have any form of authentication AFAIK. Keysdb also logs you in through Discord, but it's immediate, you don't need to get verified or anything (that is unless they changed things recently, anybody feel free to correct me on that).

[2nHxWW6GkN1l916N3ayz8HQoi]

Anybody who can do that can most definitely dump their own CDM as well, but that is still quite interesting, never thought of it.

Btw with "stupid verification process" I think stabbed referred to getwvkeys.cc, not cdrm-project. The latter doesn't have any form of authentication AFAIK. Keysdb also logs you in through Discord, but it's immediate, you don't need to get verified or anything (that is unless they changed things recently, anybody feel free to correct me on that).

That's... actually good to know lol. I always thought that when people say discord verification, they meant the manual one that is kinda ridiculous (the one that got some people talking). I mean, don't get me wrong. I ain't telling them how to maintain their community. Hats off to them for what they accomplished. I'm just not willing to go through that.

It's good to know there are easier alternatives. Thanks for the info!

[Karoolus]

Anybody who can do that can most definitely dump their own CDM as well, but that is still quite interesting, never thought of it.

Btw with "stupid verification process" I think stabbed referred to getwvkeys.cc, not cdrm-project. The latter doesn't have any form of authentication AFAIK. Keysdb also logs you in through Discord, but it's immediate, you don't need to get verified or anything (that is unless they changed things recently, anybody feel free to correct me on that).

That's... actually good to know lol. I always thought that when people say discord verification, they meant the manual one that is kinda ridiculous (the one that got some people talking). I mean, don't get me wrong. I ain't telling them how to maintain their community. Hats off to them for what they accomplished. I'm just not willing to go through that.

It's good to know there are easier alternatives. Thanks for the info!

I just have my own instance of Getwvkeys running on a server at home. There is Discord verification but it doesn't check against any roles or verification inside a server