[Release] Widevine L3 Guesser Extension-Works in 2024 Firefox/Chrome All OS

[kingkong0]

@FoxRefire

congratulations I haven't seen such a beautiful and important work in quite some time.

I wanted to ask you are there any other services the non standard ones that use json sending is it possible to do something?

[Usernamnet]

Got it to work with your http://0.tcp.ap.ngrok.io:12365 api but not with http://127.0.0.1:18888
(have note tested if the keys was alright yet)

Edit: some sites just gives me "undefined"

[Karoolus]

@FoxRefire

congratulations I haven't seen such a beautiful and important work in quite some time.

I wanted to ask you are there any other services the non standard ones that use json sending is it possible to do something?

You'll have to edit the WVServer code and compile it again

[gustawa21]

Great, it works on cda.pl, player.pl but it doesn't work on canal+

[thej911]

First of all thanks for the great work , loaded the server with the extension and this works like a charm !
Just one last thing , for the pssh and the lic url do i have to select them manually every time or am i doing something wrong ?

Regards

[kingkong0]

@FoxRefire

congratulations I haven't seen such a beautiful and important work in quite some time.

I wanted to ask you are there any other services the non standard ones that use json sending is it possible to do something?

You'll have to edit the WVServer code and compile it again

thank you for the answer have you tried it yet and does it work?

[Karoolus]

@FoxRefire

congratulations I haven't seen such a beautiful and important work in quite some time.

I wanted to ask you are there any other services the non standard ones that use json sending is it possible to do something?

You'll have to edit the WVServer code and compile it again

thank you for the answer have you tried it yet and does it work?

I changed the code in popup.js to work with license servers like DRMToday, which uses json.
I sent OP a code snippet, it's up to him whether or not to add it to his code.

[kingkong0]

@FoxRefire

congratulations I haven't seen such a beautiful and important work in quite some time.

I wanted to ask you are there any other services the non standard ones that use json sending is it possible to do something?

You'll have to edit the WVServer code and compile it again

thank you for the answer have you tried it yet and does it work?

I changed the code in popup.js to work with license servers like DRMToday, which uses json.
I sent OP a code snippet, it's up to him whether or not to add it to his code.

yes I wanted to see if it worked by making some changes and solving so when from undefined , yes I know it needs to be modified popup.js if it's not too much trouble you can say you put in popup.js

[Karoolus]

yes I wanted to see if it worked by making some changes and solving so when from undefined , yes I know it needs to be modified popup.js if it's not too much trouble you can say you put in popup.js

let psshs = chrome.extension.getBackgroundPage().getPsshs();
let requests = chrome.extension.getBackgroundPage().getRequests();
let userInputs = {};

function drawList(arr, _searchBox, _list, _userInputs) {
  const elements = arr;
  const searchBox = document.getElementById(_searchBox);
  const list = document.getElementById(_list);

  elements.forEach((element, index) => {
    const li = document.createElement("li");
    li.textContent = element;
    li.addEventListener("click", () => {
      userInputs[_userInputs] = index;
      document.getElementById(_userInputs).value = element;
      document.getElementById(_userInputs + "Index").value = index;
      document.getElementById("selectPssh").style.display = "none";
      document.getElementById("selectRequest").style.display = "none";
      document.getElementById("home").style.display = "block";
    });
    list.appendChild(li);
  });

  searchBox.addEventListener("input", (event) => {
    const searchValue = event.target.value.toLowerCase();
    list.innerHTML = "";
    elements.forEach((element, index) => {
      if (element.toLowerCase().includes(searchValue)) {
        const li = document.createElement("li");
        li.textContent = element;
        li.addEventListener("click", () => {
          userInputs[_userInputs] = index;
          document.getElementById(_userInputs).value = element;
          document.getElementById(_userInputs + "Index").value = index;
          document.getElementById("selectPssh").style.display = "none";
          document.getElementById("selectRequest").style.display = "none";
          document.getElementById("home").style.display = "block";
        });
        list.appendChild(li);
      }
    });
  });
}

function selectPssh() {
  document.getElementById("home").style.display = "none";
  document.getElementById("selectPssh").style.display = "block";
}

function selectRequest() {
  document.getElementById("home").style.display = "none";
  document.getElementById("selectRequest").style.display = "block";
}

var CommonWV = async function (pssh, licUrl, _headers) {
  const serverAddr = "http://127.0.0.1:18888";
  console.group("fetch cert...");
  let certBuffer = await fetch(licUrl, {
    body: new Uint8Array([0x08, 0x04]),
    headers: _headers,
    method: "POST",
  }).then((resp) => resp.arrayBuffer());
  let certB64 = "";
  if (isValidJson(String.fromCharCode(...new Uint8Array(certBuffer)))) {
    let jsonData = JSON.parse(
      String.fromCharCode(...new Uint8Array(certBuffer))
    );
    if (jsonData.license) {
      certB64 = jsonData.license;
    } else {
      console.log("JSON does not contain 'license'");
    }
  } else {
    certB64 = btoa(String.fromCharCode(...new Uint8Array(certBuffer)));
  }
  console.log(certB64);
  console.groupEnd();

  console.group("fetch challenge...");
  let jsonC = await fetch(serverAddr + "/getchallenge", {
    body: JSON.stringify({
      PSSH: pssh,
      CertBase64: certB64,
    }),
    headers: {
      "Content-Type": "application/json",
    },
    method: "POST",
  }).then((resp) => resp.json());
  let challengeBase64 = jsonC.challengeBase64;
  console.log(challengeBase64);
  console.groupEnd();

  console.group("fetch license...");
  let licBuffer = await fetch(licUrl, {
    body: Uint8Array.from(atob(challengeBase64), (c) => c.charCodeAt(0)),
    headers: _headers,
    method: "POST",
  }).then((resp) => resp.arrayBuffer());
  let licB64 = "";
  if (isValidJson(String.fromCharCode(...new Uint8Array(licBuffer)))) {
    let jsonData = JSON.parse(
      String.fromCharCode(...new Uint8Array(licBuffer))
    );
    if (jsonData.license) {
      licB64 = jsonData.license;
    } else {
      console.log("JSON does not contain 'license'");
    }
  } else {
    licB64 = btoa(String.fromCharCode(...new Uint8Array(licBuffer)));
  }
  console.log(licB64);
  console.groupEnd();

  console.group("get keys...");
  let jsonK = await fetch(serverAddr + "/getkeys", {
    body: JSON.stringify({
      PSSH: pssh,
      ChallengeBase64: challengeBase64,
      LicenseBase64: licB64,
    }),
    headers: {
      "Content-Type": "application/json",
    },
    method: "POST",
  }).then((resp) => resp.json());
  let keys = jsonK.keys;
  console.log(keys);
  console.groupEnd();
  return keys;
};

function isValidJson(str) {
  try {
    JSON.parse(str);
    return true;
  } catch (e) {
    return false;
  }
}

async function guess() {
  endpoint = document.getElementById("guessr").value;
  const result = await CommonWV(
    psshs[userInputs["pssh"]],
    requests[userInputs["license"]]["url"],
    requests[userInputs["license"]]["headers"]
  );
  document.getElementById("result").value = result;
}

if (psshs.length != 0) {
  document.addEventListener("DOMContentLoaded", function () {
    document.getElementById("noEME").style.display = "none";
    document.getElementById("home").style.display = "block";
    document.getElementById("psshButton").addEventListener("click", selectPssh);
    document
      .getElementById("licenseButton")
      .addEventListener("click", selectRequest);
    document.getElementById("guess").addEventListener("click", guess);
    drawList(psshs, "psshSearch", "psshList", "pssh");
    drawList(
      requests.map((r) => r["url"]),
      "requestSearch",
      "requestList",
      "license"
    );
  });
}

I might have edited other parts of this js as well, I'm not sure. I'm rewriting it to suit my own needs.

[kingkong0]

yes I wanted to see if it worked by making some changes and solving so when from undefined , yes I know it needs to be modified popup.js if it's not too much trouble you can say you put in popup.js

let psshs = chrome.extension.getBackgroundPage().getPsshs();
let requests = chrome.extension.getBackgroundPage().getRequests();
let userInputs = {};

function drawList(arr, _searchBox, _list, _userInputs) {
  const elements = arr;
  const searchBox = document.getElementById(_searchBox);
  const list = document.getElementById(_list);

  elements.forEach((element, index) => {
    const li = document.createElement("li");
    li.textContent = element;
    li.addEventListener("click", () => {
      userInputs[_userInputs] = index;
      document.getElementById(_userInputs).value = element;
      document.getElementById(_userInputs + "Index").value = index;
      document.getElementById("selectPssh").style.display = "none";
      document.getElementById("selectRequest").style.display = "none";
      document.getElementById("home").style.display = "block";
    });
    list.appendChild(li);
  });

  searchBox.addEventListener("input", (event) => {
    const searchValue = event.target.value.toLowerCase();
    list.innerHTML = "";
    elements.forEach((element, index) => {
      if (element.toLowerCase().includes(searchValue)) {
        const li = document.createElement("li");
        li.textContent = element;
        li.addEventListener("click", () => {
          userInputs[_userInputs] = index;
          document.getElementById(_userInputs).value = element;
          document.getElementById(_userInputs + "Index").value = index;
          document.getElementById("selectPssh").style.display = "none";
          document.getElementById("selectRequest").style.display = "none";
          document.getElementById("home").style.display = "block";
        });
        list.appendChild(li);
      }
    });
  });
}

function selectPssh() {
  document.getElementById("home").style.display = "none";
  document.getElementById("selectPssh").style.display = "block";
}

function selectRequest() {
  document.getElementById("home").style.display = "none";
  document.getElementById("selectRequest").style.display = "block";
}

var CommonWV = async function (pssh, licUrl, _headers) {
  const serverAddr = "http://127.0.0.1:18888";
  console.group("fetch cert...");
  let certBuffer = await fetch(licUrl, {
    body: new Uint8Array([0x08, 0x04]),
    headers: _headers,
    method: "POST",
  }).then((resp) => resp.arrayBuffer());
  let certB64 = "";
  if (isValidJson(String.fromCharCode(...new Uint8Array(certBuffer)))) {
    let jsonData = JSON.parse(
      String.fromCharCode(...new Uint8Array(certBuffer))
    );
    if (jsonData.license) {
      certB64 = jsonData.license;
    } else {
      console.log("JSON does not contain 'license'");
    }
  } else {
    certB64 = btoa(String.fromCharCode(...new Uint8Array(certBuffer)));
  }
  console.log(certB64);
  console.groupEnd();

  console.group("fetch challenge...");
  let jsonC = await fetch(serverAddr + "/getchallenge", {
    body: JSON.stringify({
      PSSH: pssh,
      CertBase64: certB64,
    }),
    headers: {
      "Content-Type": "application/json",
    },
    method: "POST",
  }).then((resp) => resp.json());
  let challengeBase64 = jsonC.challengeBase64;
  console.log(challengeBase64);
  console.groupEnd();

  console.group("fetch license...");
  let licBuffer = await fetch(licUrl, {
    body: Uint8Array.from(atob(challengeBase64), (c) => c.charCodeAt(0)),
    headers: _headers,
    method: "POST",
  }).then((resp) => resp.arrayBuffer());
  let licB64 = "";
  if (isValidJson(String.fromCharCode(...new Uint8Array(licBuffer)))) {
    let jsonData = JSON.parse(
      String.fromCharCode(...new Uint8Array(licBuffer))
    );
    if (jsonData.license) {
      licB64 = jsonData.license;
    } else {
      console.log("JSON does not contain 'license'");
    }
  } else {
    licB64 = btoa(String.fromCharCode(...new Uint8Array(licBuffer)));
  }
  console.log(licB64);
  console.groupEnd();

  console.group("get keys...");
  let jsonK = await fetch(serverAddr + "/getkeys", {
    body: JSON.stringify({
      PSSH: pssh,
      ChallengeBase64: challengeBase64,
      LicenseBase64: licB64,
    }),
    headers: {
      "Content-Type": "application/json",
    },
    method: "POST",
  }).then((resp) => resp.json());
  let keys = jsonK.keys;
  console.log(keys);
  console.groupEnd();
  return keys;
};

function isValidJson(str) {
  try {
    JSON.parse(str);
    return true;
  } catch (e) {
    return false;
  }
}

async function guess() {
  endpoint = document.getElementById("guessr").value;
  const result = await CommonWV(
    psshs[userInputs["pssh"]],
    requests[userInputs["license"]]["url"],
    requests[userInputs["license"]]["headers"]
  );
  document.getElementById("result").value = result;
}

if (psshs.length != 0) {
  document.addEventListener("DOMContentLoaded", function () {
    document.getElementById("noEME").style.display = "none";
    document.getElementById("home").style.display = "block";
    document.getElementById("psshButton").addEventListener("click", selectPssh);
    document
      .getElementById("licenseButton")
      .addEventListener("click", selectRequest);
    document.getElementById("guess").addEventListener("click", guess);
    drawList(psshs, "psshSearch", "psshList", "pssh");
    drawList(
      requests.map((r) => r["url"]),
      "requestSearch",
      "requestList",
      "license"
    );
  });
}

I might have edited other parts of this js as well, I'm not sure. I'm rewriting it to suit my own needs.

thanks for sharing, a service like Canal+ using json from undefined, if it's not too much can I ask you which service you are testing on?

[Karoolus]

thanks for sharing, a service like Canal+ using json from undefined, if it's not too much can I ask you which service you are testing on?

I'm testing on platforms that use DRMToday. It might have a different json layout on your end. Check the output in the extension debug console and change the code accordingly.

[skipmack46]

@Karoolus, can you get it to pull keys that has M3u8 links as well instead of just MPD? thanks

[Karoolus]

@Karoolus, can you get it to pull keys that has M3u8 links as well instead of just MPD? thanks

I have no idea, what service is that on?

[skipmack46]

multiple services has m3u8 with keys, I was just wandering is all. I like the app so far.

[Karoolus]

multiple services has m3u8 with keys, I was just wandering is all. I like the app so far.

Well none of the services I use, have m3u8 so that's why I asked. I can have a look if you tell me where to look

[skipmack46]

no worries, I sent you a PM

[FoxRefire]

Ngrok public API shutdowned.
Instead, I published permanent public API, use this instead.
https://proposed-marketa-foxrefire.koyeb.app

[FoxRefire]

[Announcement]
Released new version.please update extension

New version includes:
* Custom scheme support
* Separate some codes to make code looks clear
* Public API integration
* Auto selects PSSH when there is one detected PSSH

[skipmack46]

where we download the new extension?

[FoxRefire]

Github

[skipmack46]

can you send me the URL again, as I looked on both links I had, but it says nothing been updated today. thanks

[FoxRefire]

https://github.com/FoxRefire/wvg

[skipmack46]

thanks, going to try it out now.

[skipmack46]

works good.

[skipmack46]

@FoxRefire can you add to pull keys from m3u8 links that have keys as well? thanks

[senkron24]

waww working perfeckt thank you great work.,..

[orenn16]

https://github.com/FoxRefire/wvg

Public API:
https://proposed-marketa-foxrefire.koyeb.app

This tool is researchment and pentest tool of Widevine, Do not decrypt content with keys obtained using this tool if yo do not own rights of content!

The tool works great!
Truly one of the most special things I've seen lately.

Very smart development.

I would recommend adding the following actions to :RESULT

Direct link to the MPD file
+
auto Code ready for download using N_m3u8dl-re or webdl.\
+
Option to export the (cURL Header).

[pteque]

This would be easier to use without the external WVCore server. Compile pywidevine to WASM using pyodide and it could all run in the extension...

[whs912km]

@FoxRefire

first thanks for your rel
anyway with latest version, i can run WVCore.Server.exe and win cmd open and close instantly
before guesser does not work still for me, but WVCore.Server.exe cmd popup show some data correctly ...

[papa01]

An interesting tool, but I still haven't moved forward with AM Prime.