[Release] Widevine L3 Guesser Extension-Works in 2024 Firefox/Chrome All OS

[FoxRefire]

Documentation<= Read here first!

https://github.com/FoxRefire/wvg/tree/next


Legacy version still available here:
https://github.com/FoxRefire/wvg/tree/legacy
Deprecated,don't ask questions about normal user usage of older versions. but you can ask questions about the specifications and code for this.

This tool is researchment and pentest tool of Widevine, Do not decrypt content with keys obtained using this tool if you do not own rights of content!

Rules:
1.Bug report without any logs will ignored(Right click-->Inspect-->Console from both Video & Pop-up page)
2.You must Read instruction properly, Use your brain and Do web search before asking for help
3.Don't discuss or ask about decryption after key gathered by this extension here I do not want to take any legal risks by doing this. Please go to the other thread.
4. Do not discuss paid services such as A****n, U***y, IPTVs in this forum. !!!This goes for other threads as well!!!
5.Contribute to OSS. I am not free customer support for you.


Demo sites where you can try out this extension:
https://gist.github.com/FoxRefire/98bf4d339731679e394fa2ed5a9f5561

[whs912km]

bah, thanks for the tip
anyway does not work at my test here https://mediasetinfinity.mediaset.it/movie/thenextthreedays/the-next-three-days_F303277101000102

found pssh, and mpd, but tick on "Guess" and nothing appears ...
and this site it's very easy to do. work with wks and simply l3.py only. don't required specifies value to add

[FoxRefire]

Please check latest extension.
If it still not work,send me logs.
Right click on extension --> Inspect
then send me console/network logs.

[whs912km]

same as previous version. and inspect element is grey, i can't load
try yourself my link above, it's free to watch (the first few minutes)

[FoxRefire]

Could you provide me working italy socks?
I'm not living in italy.

Or try other browser for get logs from devtool

[naim2007]

trying all ptatforms streamings, not work at all bro

[whs912km]

I'm not living in italy
Or try other browser for get logs from devtool

not from Italy ? mee too ! use VPN ...
and i've tried 3 browser, brave, FF and another one (chromium based). all the same issue
can find pssh and mpd, but guesser can't load. and again, inspect element is grey

[FoxRefire]

@whs912km
>not from Italy ? mee too ! use VPN ...
VPN service which i'm using doesn't have italy server.

>inspect element is grey
Browser? try different browser.
works on my side.

>can find pssh and mpd
mpd is not license url

@naim2007
Please send me logs.
Also did it work here?

[skipmack46]

I had a issue at first, but I figured it out and it works great, however it will not do streams that has m3u8 with keys, only mpd with keys just a FYI. nice work though much appreciated

[whs912km]

@whs912km
>not from Italy ? mee too ! use VPN ...
VPN service which i'm using doesn't have italy server.

>inspect element is grey
Browser? try different browser.
works on my side.

>can find pssh and mpd
mpd is not license url

no IT VPN? ok no problem, i have. but guesser not work (for me)

>inspect element is grey
browser: brave and another chromium based (but both not latest version, maybe my issue is about that? both chromium based 109 only)

>mpd is not license url
yep, right. i wrote wrong. i meant lic url

[FoxRefire]

>no IT VPN? ok no problem, i have. but guesser not work (for me)
Ah, Singapore server worked.thanks.
Anyway, key fetching works on my side.

[Attachment 78271 - Click to enlarge]

>chromium based 109 only
Try latest version of chrome or firefox.
This extension use completely differrent way by old guessor extensions.
So you do not need downgrade browsers.
And follow the installation instructions on readme.
You need running WVCore.Server.
https://github.com/nilaoda/Blog/discussions/58#discussioncomment-9052557
Read here and follow instructions

[ga2p]

Hello, thanks for the extension.

It doesn't work for me, tested in Firefox and Chrome, with the urls: https://bitmovin.com/demos/drm and https://reference.dashif.org/dash.js/latest/samples/drm/widevine. html

I use the same CDM as with widevine_keys-main and WKS-KEYS.

It makes 2 calls, first to the certificate and then to "http://127.0.0.1:18888/getchallenge", passing the "CertBase64" and "pssh".
This is the response: {"type":"https://tools.ietf.org/html/rfc7231#section-6.6.1","title":"An error occurred while processing your request.","status" :500,"detail":"Error"}

This is the log:
2024-04-10 10:18:44.3251 [INFO] [WVCore.Server.RequestHandler] - /getchallenge ==> {"PSSH":"AAAAW3Bzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAA DsIARIQ62dqu8s0Xpa7z2FmMPGj2hoNd2lkZXZ pbmVfdGVzdCIQZmtqM2xqYVNkZmFsa3IzaioCSEQyAA==","Ce rtBase64":"CAUSxQUKvwIIAxIQKHA0VMAI9jYYredEPbbEyBi L5/mQBSKOAjCCAQoCggEBALUhErjQXQI/zF2V4sJRwcZJtBd82NK+ 7zVbsGdD3mYePSq8MYK3mUbVX9wI3+lUB4FemmJ0syKix/XgZ7tfCsB6idRa6pSyUW8HW2bvgR0NJuG5priU8rmFeWKqFxxP ZmMNPkxgJxiJf14e+baq9a1Nuip+FBdt8TSh0xhbWiGKwFp MQfCB7/+Ao6BAxQsJu8dA7tzY8U1nWpGYD5LKfdxkagatrVEB90oOSYzA HwBTK6wheFC9kF6QkjZWt9/v70JIZ2fzPvYoPU9CVKtyWJOQvuVYCPHWaAgNRdiTwryi901go MDQoJk87wFgRwMzTDY4E5S GvJ2vJP1noH+a2UMCAwEAAToSc3RhZ2luZy5nb29nbGUuY29tE oADmD4wNSZ19AunFfwkm9rl1KxySaJmZSHkNlVzlSlyH/iA4KrvxeJ7yYDa6tq/P8OG0ISgLIJTeEjMdT/0l7ARp9qXeIoA4q prhM19ccB6SOv2FgLMpaPzIDCnKVww2pFbkdwYubyVk7jei7UP De3BKTi46eA5zd4Y+oLoG7AyYw/pVdhaVmzhVDAL9tTBvRJpZjVrKH1lexjOY9Dv1F/FJp6X6rEctWPlVkOyb/SfEJwhAa/ K81uDLyiPDZ1Flg4lnoX7XSTb0s+Cdkxd2b9yfvvpyGH4aTIfa t4YkF9Nkvmm2mU224R1hx0WjocLsjA89wxul4TJPS3oRa2CYr5 +DU4uSgdZzvgtEJ0lksckKfjAF0K64rPeytvDPD5fS69eFu y3Tq26/LfGcF96njtvOUA4P5xRFtICogySKe6WnCUZcYMDtQ0BMMM1Lga wFNg4VA+KDCJ8ABHg9bOOTimO0sswHrRWSWX1XF15dXolCk65y Eqz5lOfa2/fVomeopkU"}

[FoxRefire]

Umm, I think looks like API problem, not extension.
Could you try my API?
http://0.tcp.ap.ngrok.io:12365
Please don't use this API on a regular basis.
I will shutdown this public API after 24hrs

[ga2p]

Hello, I just tested with your server and it works perfectly.

I have the server on Windows.
I put the two CDM files in the same folder as the .exe
When I start it it comes out:
2024-04-10 11:15:49.2103 [INFO] - The app started!
2024-04-10 11:15:49.2103 [INFO] - Listening: http://0.0.0.0:18888

But I don't know why that error keeps coming up.

Thanks for everything

[FoxRefire]

>Hello, I just tested with your server and it works perfectly.
Great! Thanks for responding.
I'm running server on Fedora 40 beta linux.
And I haven't tested on Windows.

I apologize that can't give you perfect advice as the API server was not created by me, but you can try the following:
* Check if firewall/AV programs blocks server's behavior
* Run server on Linux VM or WSL

Anyway, I am considering either re-implementing the API server myself in pywidewine or forking WVCore.Server to provide full support.
If someone interested about contributing this, please contact me on my Github.

@whs912km @naim2007
Could you guys also test it with my public API and report the results?
http://0.tcp.ap.ngrok.io:12365

[ga2p]

I just made my own Windows build and it works perfect for me.

Some improvements for the extension:
Sometimes the certificate and the license are different URLS, for example: Vodafone,.
- You would have to put a field for the certificate and another for the url.
- The api URL field, which if modified, attacks that url to obtain the API.

Greetings, thank you.

[skipmack46]

I also noticed it does not display the proper key sometimes, as I have a valid key for a channel, and I test that channel with guesser and it comes up with wrong key.

[CyrusVeber]

No success, even on bitmovin demo.

Tried developer's hosted API with Firefox - the extension just ignores URL and tries to pass request via local PC instead

https://licensing.bitmovin.com/licensing

[whs912km]

@FoxRefire

about https://github.com/nilaoda/Blog/discussions/58#discussioncomment-9052557
ok tested with latest brave version on win11
added device_client_id_blob and device_private_key, run WVCore.Server.exe but again click on Guess nothing appears ...
with default API and also with your new temp API. the same

[FoxRefire]

Could try this build?
https://github.com/FoxRefire/WVCore.Server/releases

Also, I'm looking for testers on Android(Termux+Kiwi browser).
For more information:
https://github.com/FoxRefire/wvg/issues/1

[Funx]

Got the same error on http://127.0.0.1:18888/getchallenge (404), with your remote api "http://0.tcp.ap.ngrok.io:12365"

So license post req ok 200
api request 404 (payload exists)

[FoxRefire]

Try this server
https://github.com/FoxRefire/WVCore.Server/releases

[Funx]

and btw windows defender flagged your extension zip file as (false positive?) virus.

[Karoolus]

Very nice! This is something I never knew I needed, thanks!

[FoxRefire]

@Funx
Yes,False positive.
Build is [automated](https://github.com/FoxRefire/WVCore.Server/blob/main/.github/workflows/release.yml) and workflow is opensourced.
Therefore I cannot secretly embed malicious code.

[FoxRefire]

Remote API fixed in 48c7bcf and worked with my phone!(Kiwi browser)

[FoxRefire]

I am extending the term of my public API.
You can use this API until 04/11/2024 20:00 UTC.
http://0.tcp.ap.ngrok.io:12365

From then on, please set up WVCore.Server on your own.

[naim2007]

works just fine with all standard license streaming service only
payload license give me error. Thanks for this great ext

[whs912km]

@FoxRefire

from your link https://github.com/FoxRefire/WVCore.Server/releases
i've download WVCore.Server-win-x64.zip (for my nbook with win_x64) but on zip file i can see a lot of files (about 300). and then?
previous (for my test on post#19) i've found and tested one file only WVCore.Server.exe (16MB) and run this file, your guesser does not work
so explain better how to compile WVCore.Server from github link above

[FoxRefire]

Install
https://dotnet.microsoft.com/download

git clone https://github.com/nilaoda/WVCore
git clone https://github.com/nilaoda/WVCore.Server
cd WVCore.Server
dotnet publish -r win-x64 -c Release

that's it. it will create bin folder and use these