KeyDive: Beyond Android SDK 33

[A_n_g_e_l_a]

Keydive will script the whole process of dumping a CDM and thanks to hyugogirubato the process has never been easier.

However, devices using Android SDK 34 i.e. Android 14 need a decompiler and extraction of information from android.hardware.drm-service.widevine, a binary library on the device.

It needs Ghidra to do that and involves a bit of phaffing about. It is easy enough but why re-invent the wheel?

So I propose library of function.xml files that have been extracted by Ghidra and worked extracting a CDM from an Android 14 and above device.

I'll start off posting mine:-
Google Pixel 6a function xml and line 143 of keydive.js needed the integer changed from 6 to 5, in my case, for successful extraction.

Pixel 6 Pro https://forum.videohelp.com/attachments/79618-1717466654/func.xml Thanks Mon4t
Pixel 7 https://forum.videohelp.com/attachments/79621-1717508986/func.xml Thanks Blacksiren
Pixel 4a Emulator https://forum.videohelp.com/attachments/79983-1718722746/functions.xml Thanks White_Snake

[PSXman_uk]

I have been using this for ages and working with hyugogirubato finding the hooks it couldn't find I just supplied the devices with the errors, and he / she rewrote the script if you use -a -w after keydrvie.py it automatically launches chrome on the device and dumps the wvd which I now have a lot of I've given to the community I've only ever had to use Ghidra once ill see if I can find the xml for some reason Samsungs on android 14 dump ok but the cdm version is 16 or so not 18 like on the newer ones.

I also use it on emulated, so it makes it easier.

@whitesnake has also been using this for a while

For example, these are from devices on Android 14 real wvds and client_id.bin and private_key.pem


https://files.videohelp.com/u/33133/1870464879.zip
https://files.videohelp.com/u/33133/2133788905.zip
https://files.videohelp.com/u/33133/2418410377.zip
https://files.videohelp.com/u/33133/2924950228.zip

[m0n4t]

Hi,... it works..

Pixel 6 pro. I put in line 143: 6 int

regards

[A_n_g_e_l_a]

Hi,... it works..

Magic! And as forecast by the Ancients ' You shall inherit the World' (of media).

Thanks for posting func.xml: it will help others.

[Blacksiren]

Hello, here is the functions.xml for Pixel 7 (API 34 | CDM 18)

CDM dumped via KeyDive and then tested the resulting WVD by using "pywidevine test"


[Attachment 79620 - Click to enlarge]

[A_n_g_e_l_a]

Hello, here is the functions.xml for Pixel 7 (API 34 | CDM 18)

Thanks very much. I'm collecting each funcs.xml and linking in post #1.

[A_n_g_e_l_a]

Is there no-one else looking at Android 14 and who created a functions.xml? Come on everyone!

[white_snake]

Is there no-one else looking at Android 14 and who created a functions.xml? Come on everyone!

I wanted to post it, but forgot about it. This is for an emulated Pixel 4a API 34.

[A_n_g_e_l_a]

I wanted to post it, but forgot about it. This is for an emulated Pixel 4a API 34.

Magic! Thanks; added to post 1.

[white_snake]

[Attachment 80063 - Click to enlarge]
While extracting CDM from my Android I am getting this error with KeyDive script, How can I resolve this?

You only downloaded the keydive.py script without the rest (like the files in the "extractor" folder).

[A_n_g_e_l_a]

You only downloaded the keydive.py script without the rest (like the files in the "extractor" folder).

There is no quote from stacyy in this thread. Have you posted incorrectly? Shall we try to keep this thread just to functions.xml as the topic?

[LittleSoldier]

You only downloaded the keydive.py script without the rest (like the files in the "extractor" folder).

There is no quote from stacyy in this thread. Have you posted incorrectly? Shall we try to keep this thread just to functions.xml as the topic?

His comment must have been deleted by mods
He was spamming other threads too with the same question which were already answered by TPD94

[A_n_g_e_l_a]

His comment must have been deleted by mods

Gosh! Do they do that? Must be a 'first'!
There are so many threads that need a clean-up or, preferably, policing in the first place.

So while this in top of the forum - has anyone else got a functions.xml to share that they successfully used to key keys dumped with an Android 14 device??

[LittleSoldier]

His comment must have been deleted by mods

Gosh! Do they do that? Must be a 'first'!
There are so many threads that need a clean-up or, preferably, policing in the first place.

Yes, they do, All thanks to Baldrick You can report a post or comment that is against the forum rules underneath that comment

Ex:

[A_n_g_e_l_a]

Yes, they do, All thanks to Baldrick You can report a post or comment that is against the forum rules underneath that comment

Oh I see! You are acting as Mr Plod. I've never seen a mod do a tidy-up.

[LittleSoldier]

Oh I see! You are acting as Mr Plod. I've never seen a mod do a tidy-up.

Even if I don't want to, there are instances where I have to do this because this place now feels like home to me

[FoxRefire]

@A_n_g_e_l_a

Sharing functions.xml so that people with the same device do not have to retrieve it again is a good idea in itself.

But it is more elegant to share the function names defined in the OEM_CRYPTO_API constant, and firmware version and proper model name also shuold be written.

Different editions or different FW version of the same model may use different CDM binary and have different functions that should be hooked.


PS.
I made a change to make the your starterpack's code more concise by implementing the curl parsing process using the convert-to-requests library instead of regex.
https://editor.mergely.com/exxIvPlI

and it can also make the following change to accommodate multi-line curl strings retrieved from chromium-based browsers, but it will not work properly unless you change it to input instead of getpass.
https://editor.mergely.com/n0S3CugQ

[A_n_g_e_l_a]

There was a reason for going the regex route, although I confess I wasn't aware of that particular curl parser. The reason is this:-

[Attachment 80092 - Click to enlarge]
Screen with sites that return encoded bytes.

The data bytes in some widevine messages still plays havoc with the screen as the image shows with your amendments. In fact that data is useless information being the browser's widevine message - for which we substitute ours..

Because I choose to use regex, garbled and unnecessary data messing up the screen is not returned. It is no less 'elegant' a solution - it is just that you see the code rather than relying on yet another import and all the parsing happening out of sight. And your method would surely frighten the punters and result in deluge of 'support queries'. I work to the KISS principal.

[FoxRefire]

The data bytes in some widevine messages still plays havoc with the screen as the image shows with your amendments.

While there may be some who do, there are others on the forum who feel that it is not pasted because they don't see anything as well.
Shouldn't it also support curl strings copied from Chromium-based browsers that contain line breaks like this?

curl 'https://drm-widevine-licensing.axtest.net/AcquireLicense' \
  -H 'accept: */*' \
  -H 'accept-language: ja;q=0.6' \
  -H 'origin: https://reference.dashif.org' \
  -H 'priority: u=1, i' \
  -H 'referer: https://reference.dashif.org/' \
  -H 'sec-ch-ua: "Not/A)Brand";v="8", "Chromium";v="126", "Brave";v="126"' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'sec-ch-ua-platform: "Linux"' \
  -H 'sec-fetch-dest: empty' \
  -H 'sec-fetch-mode: cors' \
  -H 'sec-fetch-site: cross-site' \
  -H 'sec-gpc: 1' \
  -H 'user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36' \
  -H 'x-axdrm-message: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ2ZXJzaW9uIjoxLCJjb21fa2V5X2lkIjoiYjMzNjRlYjUtNTFmNi00YWUzLThjOTgtMzNjZWQ1ZTMxYzc4IiwibWVzc2FnZSI6eyJ0eXBlIjoiZW50aXRsZW1lbnRfbWVzc2FnZSIsImtleXMiOlt7ImlkIjoiOWViNDA1MGQtZTQ0Yi00ODAyLTkzMmUtMjdkNzUwODNlMjY2IiwiZW5jcnlwdGVkX2tleSI6ImxLM09qSExZVzI0Y3Iya3RSNzRmbnc9PSJ9XX19.4lWwW46k-oWcah8oN18LPj5OLS5ZU-_AQv7fe0JhNjA' \
  --data-raw $'<REDACTED>'

Also, what do you think about the main topic in #17?

Different FW versions and terminal regions may use different CDM binaries, and the same functions.xml cannot be used if it is different.

Also, if you simply share the function name, @hyugogirubato can add it to the constant and hook the correct function without having to specify xml.

[A_n_g_e_l_a]

While there may be some who do, there are others on the forum who feel that it is not pasted because they don't see anything as well.
Shouldn't it also support curl strings copied from Chromium-based browsers that contain line breaks like this?

Ideally yes. But not at the cost your ''improvement" makes. My code: my release; piss off. And stop will-waving!

Also, what do you think about the main topic in #17?

To be perfectly honest I gave it no thought whatsoever. I'd seen you ranting about 'stupid' users earlier. You'd been categorized.

[PSXman_uk]

While there may be some who do, there are others on the forum who feel that it is not pasted because they don't see anything as well.
Shouldn't it also support curl strings copied from Chromium-based browsers that contain line breaks like this?

Ideally yes. But not at the cost your ''improvement" makes. My code: my release; piss off. And stop will-waving!

Also, what do you think about the main topic in #17?

To be perfectly honest I gave it no thought whatsoever. I'd seen you ranting about 'stupid' users earlier. You'd been categorized.

Well said