Need Help Extracting Keys from Service with Custom Payload

[josephsamual]

Hi,

I'm attempting to extract keys from a service, but it has a custom body payload in its license URL. I've tried using both cdrm-project.com and getwvkeys.cc, but due to the custom body payloads and headers, I haven't had any success. Is there a way to extract these keys using any API that can accept custom json body and headers for its license? I'm working on creating a custom script with my own CDM, but this is my first time doing this, and I could use some advice if you can provide it. The service I'm working with is similar to Noor Play.

Below I have attached the license key payloads and its response.


[Attachment 79392 - Click to enlarge]

[Attachment 79393 - Click to enlarge]

[Attachment 79394 - Click to enlarge]

[Attachment 79395 - Click to enlarge]

[Attachment 79396 - Click to enlarge]

[Attachment 79397 - Click to enlarge]

[Attachment 79398 - Click to enlarge]

[aqzs]

You have to use something like this :

licence = requests.post(url=lic_url, headers=headers, json={'licenseRequest': f'{base64.b64encode(challenge).decode(),
‘Blabla’ : ‘blabla’}'})

Send a private message with more informations I can make the custom python

[white_snake]

Probably something like this:

import json
from pywidevine.cdm import Cdm
from pywidevine.device import Device
from pywidevine.pssh import PSSH
import base64
import requests

WVD = r"path_to.wvd"
LICENSE_URL = 'https://vdrm.mobiotics.com/prod/proxy/v1/license/widevine'

json_payload = r'{"payload": "CAQ=", "contentid": "...."}'
pssh = PSSH('AAA....')
headers = {}

device = Device.load(WVD)
cdm = Cdm.from_device(device)
session_id = cdm.open()
challenge = cdm.get_license_challenge(session_id, pssh)

custom_payload = json.loads(json_payload)
custom_payload["payload"] = base64.b64encode(challenge).decode('utf-8')
custom_payload = json.dumps(custom_payload)
response = requests.post(LICENSE_URL, data=custom_payload, headers=headers)
response.raise_for_status()
response_json = json.loads(response.content)
license = response_json["body"]
cdm.parse_license(session_id, license)

for key in cdm.get_keys(session_id):
    if key.type == 'CONTENT':
        print(f'--key {key.kid.hex}:{key.key.hex()}', end=' ')
cdm.close(session_id)

Not sure about headers, probably not needed though.

[aqzs]

Probably something like this:

import json
from pywidevine.cdm import Cdm
from pywidevine.device import Device
from pywidevine.pssh import PSSH
import base64
import requests

WVD = r"path_to.wvd"
LICENSE_URL = 'https://vdrm.mobiotics.com/prod/proxy/v1/license/widevine'

json_payload = r'{"payload": "CAQ=", "contentid": "...."}'
pssh = PSSH('AAA....')
headers = {}

device = Device.load(WVD)
cdm = Cdm.from_device(device)
session_id = cdm.open()
challenge = cdm.get_license_challenge(session_id, pssh)

custom_payload = json.loads(json_payload)
custom_payload["payload"] = base64.b64encode(challenge).decode('utf-8')
custom_payload = json.dumps(custom_payload)
response = requests.post(LICENSE_URL, data=custom_payload, headers=headers)
response.raise_for_status()
response_json = json.loads(response.content)
license = response_json["body"]
cdm.parse_license(session_id, license)

for key in cdm.get_keys(session_id):
    if key.type == 'CONTENT':
        print(f'--key {key.kid.hex}:{key.key.hex()}', end=' ')
cdm.close(session_id)

Not sure about headers, probably not needed though.

I recommand using :

data = {}
request.get(…. json=data)

Or :

data = {}
jsondata = json.loads(data)
request.get(…. data=jsondata)

Instead of sending the payload as str. (Sorry Im at school rn editing on phone is hard)

[white_snake]

I recommand using :

data = {}
request.get(…. json=data)

I believe deserialization still happens inside the requests library, so it's functionally the same, although more concise.

Or :

data = {}
jsondata = json.loads(data)
request.get(…. data=jsondata)

Instead of sending the payload as str. (Sorry Im at school rn editing on phone is hard)

json.loads() returns a dict type, so it's probably best to send this with:

json=jsondata

Also

data = {}
jsondata = json.loads(data)

would give you a TypeError.

[shellcmd]

had tested a free content, (make a free account), only got 576p resolution, does premium account provide 1080p? @josephsamual

[aqzs]

data = {}
jsondata = json.loads(data)

would give you a TypeError.

Sorry, I wanted to say json.dumps() instead of json.loads()

[white_snake]

data = {}
jsondata = json.loads(data)

would give you a TypeError.

Sorry, I wanted to say json.dumps() instead of json.loads()

Well, then it's basically what I did.

custom_payload = json.dumps(custom_payload)
response = requests.post(LICENSE_URL, data=custom_payload, headers=headers)

[josephsamual]

You have to use something like this :

licence = requests.post(url=lic_url, headers=headers, json={'licenseRequest': f'{base64.b64encode(challenge).decode(),
‘Blabla’ : ‘blabla’}'})

Send a private message with more informations I can make the custom python

Thank you. I sent you a PM

[aqzs]

Basic script to get the keys for others interested:

from pywidevine.cdm import Cdm
from pywidevine.device import Device
from pywidevine.pssh import PSSH
import requests
import base64

headers = {'x-session': TRUNCATED,}
data = {
    'contentid': 'UMaHUPObcAX',
    'packageid': '123km10RCF8WttMg',
    'drmscheme': 'WIDEVINE',
    'availabilityid': 'EZ5WAHC7',
    'seclevel': 'SW'
    }
TOKEN = requests.post('https://vcms.mobiotics.com/prodv3/subscriber/v1/content/drmtoken', headers=headers, data=data).json()['success']

headers = {'content-type': 'application/json',
    'x-session': TRUNCATED,}
pssh = input('pssh: ')
pssh = PSSH(pssh)
lic_url = 'https://vdrm.mobiotics.com/prod/proxy/v1/license/widevine'

device = Device.load("device.wvd")
cdm = Cdm.from_device(device)
session_id = cdm.open()
challenge = cdm.get_license_challenge(session_id, pssh)
json_data = {
    'payload': base64.b64encode(challenge).decode(),
    'contentid': 'UMaHUPObcAX',
    'providerid': 'sainapl',
    'timestamp': 1716826686,
    'drmscheme': 'WIDEVINE',
    'customdata': {
        'packageid': '123km10RCF8WttMg',
        'drmtoken': TOKEN,
    },
}
licence = requests.post(url=lic_url, headers=headers, json=json_data)
cdm.parse_license(session_id, licence.json()['body'])
returned_keys = []
for key in cdm.get_keys(session_id):
    if key.type != "SIGNING":
        returned_keys.append(f"{key.kid.hex}:{key.key.hex()}")
        print(f"\n--key {key.kid.hex}:{key.key.hex()}")
cdm.close(session_id)