Help downloading an AES-128 encrypted video

[VinzOP]

Hi guys

I've recently payed for an HLS video, and I need to download it.
I've tried several codes using ffmpeg and N_m3u8DL-RE, but I figured that the problem is that the video is AES-128 encrypted, and I can't really find a master.m3u8 using dev tools.

What I have found are the next URLs:
1080.m3u8

https://hls2.videos.sproutvideo.com/c9a8ce796e95905e51bfb56668dec3de/c5336e6679d7b2316c858bd7089c6e55/video/1080.m3u8?Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9obHMyLnZpZGVvcy5zcHJvdXR2aWRlby5jb20vYzlhOGNlNzk2ZTk1OTA1ZTUxYmZiNTY2NjhkZWMzZGUvYzUzMzZlNjY3OWQ3YjIzMTZjODU4YmQ3MDg5YzZlNTUvKi5tM3U4P3Nlc3Npb25JRD0yZmU4YjQwYy1iY2ZjLTQ4NTAtYTQ0ZS0wNjI2NGE4YmEzMWEiLCJDb25kaXRpb24iOnsiRGF0ZUxlc3NUaGFuIjp7IkFXUzpFcG9jaFRpbWUiOjE3MTg4NzY5Nzh9fX1dfQ__&Signature=kV05VwnVSzxRkDVsKZ4c3bCe2QpN1QF8WjzIYHgdkAQDnDgHX48R8E7L8Bti7JM-bbZi7e5KsyaUTqMSSG7VNrDxHdccvbbMLlPtLTVb6qNkLC8RS-TFsY1crK6WbLcVu4Xizoa-TK7tB42Z8lGZcRFdvM0P7JaGaHT42ImXR0~3xe5iy~cxVGkJZy9xxRNQIPOWBakKzpjz0VbGS3ZzgH6VbfqZwzKiB7eSGoQUV2kTXPE5TjsmvO0d0QCA5oU1BWCjlGxLB0pLsfXw0kRbMMdsPUmSkq8PlWu9CxmsCuJu-Kd6UDalNQXwtd7tEeKoOw6Wk6-4khWyOBriAHgdEA__&Key-Pair-Id=APKAIB5DGCGAQJ4GGIUQ&sessionID=2fe8b40c-bcfc-4850-a44e-06264a8ba31a

1080.key

https://hls2.videos.sproutvideo.com/c9a8ce796e95905e51bfb56668dec3de/c5336e6679d7b2316c858bd7089c6e55/video/1080.key?Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9obHMyLnZpZGVvcy5zcHJvdXR2aWRlby5jb20vYzlhOGNlNzk2ZTk1OTA1ZTUxYmZiNTY2NjhkZWMzZGUvYzUzMzZlNjY3OWQ3YjIzMTZjODU4YmQ3MDg5YzZlNTUvKi5rZXk~c2Vzc2lvbklEPTJmZThiNDBjLWJjZmMtNDg1MC1hNDRlLTA2MjY0YThiYTMxYSIsIkNvbmRpdGlvbiI6eyJEYXRlTGVzc1RoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTcxODg3Njk3OH19fV19&Signature=c~PKO1oGb1qGGinI2mbVnEf8fc7q9mZZ48pf0JtraebF51XoB2m~q8QwbeK1cYP1Ko7Vv7fuKX-XL78yru12JlLdUS8K~pup0XRG~4aiOlqrS2NzyjOMKa5UuYmaSiFZ8r~SoQSjeqXByMu0WhrIqo69JjzOWEh-R0fp-5f6a6so0KQQd63vM6JaYtXjVi6NGDMnDAdolvcCJgJgcDxL-CgsEFfTNeljDcsn20pf7JWsvczmTZ6~Kg9oGkJXWeX5j2flp-BUBHtuQcyqQhrwK0fQcGprSmVDVCBVGQ1HQrSA4~miVZik59vqkG9AyZEBDB8QGUJcGQta5XaIRKoMOg__&Key-Pair-Id=APKAIB5DGCGAQJ4GGIUQ&sessionID=2fe8b40c-bcfc-4850-a44e-06264a8ba31a

If I download the 1080.m3u8 file I'm getting the next info

#EXTM3U
#EXT-X-VERSION:3
#EXT-X-TARGETDURATION:10
#EXT-X-MEDIA-SEQUENCE:0
#EXT-X-KEY:METHOD=AES-128,URI="1080.key",IV=0x58a229b8a0fca02624d079aee19de6ad
#EXTINF:10.000000,
1080_00000.ts
#EXTINF:10.000000,

Read many threads about this kind of encryption, but I can't find the right way to get things done.
I'm using a mac running OS Sonoma by the way.

Deep thanks!

[LittleSoldier]

Hi guys

Read many threads about this kind of encryption, but I can't find the right way to get things done.

Read Here: https://forum.videohelp.com/threads/413718-My-journey-with-AES-128-encrypted-HLS

Key

bdd9a63e75927325216397543e318564

Edit - Oops! It looks like I mistakenly pasted the wrong key. Thanks to @shellcmd for bringing this to my attention.

P.S. @VinzOP If you are still not able to decrypt it please post the actual video URL

[shellcmd]

Hi guys

Read many threads about this kind of encryption, but I can't find the right way to get things done.

Read Here : https://forum.videohelp.com/threads/413718-My-journey-with-AES-128-encrypted-HLS

Key

0a502b3daa741f7903b12d0547b64f8f

how to do this when we cant login the website(even dont know which the site it is) with firefox? i only have one idea is make a get request to the key link, and then encode the response to base64, convert to hex. but the value not same to yours, can you give some tips?

i got base64 and hex:

vdmmPnWScyUhY5dUPjGFZA==

bdd9a63e75927325216397543e318564

[LittleSoldier]

how to do this when we cant login the website(even dont know which the site it is) with firefox? i only have one idea is make a get request to the key link, and then encode the response to base64, convert to hex. but the value not same to yours, can you give some tips?

@shellcmd

My Bad.. I accidentally pasted the wrong conversion of base64 to hex by my oversight

I've used the same workaround in Firefox to get that key.

[shellcmd]

ok, thanks. now i know how to handle this in firefox.

[VinzOP]

Thanks for all the answers.

Read the thread posted by dronem, where he explains how to download AES-128 encrypted HLS with hlsdl (not available for mac).
As I'm still trying to figure out how to download this video, I will provide all the details I can.

This is the site from where I payed for the stream.
As it's a rental, to watch the stream I need to be logged in. If this would be as easy as it is in Vimeo for example... where I can be logged in and find the video's URL encrypted in HTLM code using dev tools, copy-pasting it to the browser and downloading it as easy as right clicking and saving.

When I get access to the full video, what I'm getting now in dev tools is the next:

- index.m3u8

https://hls2.videos.sproutvideo.com/c9a8ce796e95905e51bfb56668dec3de/c5336e6679d7b2316c858bd7089c6e55/video/index.m3u8?Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9obHMyLnZpZGVvcy5zcHJvdXR2aWRlby5jb20vYzlhOGNlNzk2ZTk1OTA1ZTUxYmZiNTY2NjhkZWMzZGUvYzUzMzZlNjY3OWQ3YjIzMTZjODU4YmQ3MDg5YzZlNTUvKi5tM3U4P3Nlc3Npb25JRD0yYzBiYTcxNy02Y2YxLTQxNWYtOWRkZC00Y2JiMzE5NjQzZDQiLCJDb25kaXRpb24iOnsiRGF0ZUxlc3NUaGFuIjp7IkFXUzpFcG9jaFRpbWUiOjE3MTg5MjE1MTF9fX1dfQ__&Signature=PWa-zxIH20OtSn3uAfpNgxEsC0ydqGxV5WgbsFTqTXFQ2K~Psi4wHa8ovt4~oiTFTIx5kBuoPUohWpVlgrVsWcWD3yPQbxc-06mqjSIg3Gbk8lllxRpkqVjQBxQJICGld~wvWipdPz-MhmesyuwVXmDrUDbakg7QYnQ9YsfklE3UQYVGKDn6Q-S30JXwh1kP0mI4btMupTcVWtVDMESLKpGHkFITPF01e0ai7G-FSiQK2sLLIB~OY5vhUXGim723iu9gDkGR6kgJQEFgWPIzvWk1kvIYW2SkyKfusCSO~MOsVYlQJDstt~y8~joAs-4ZtQFAuvpswazMKYmkm~Hzyw__&Key-Pair-Id=APKAIB5DGCGAQJ4GGIUQ&sessionID=2c0ba717-6cf1-415f-9ddd-4cbb319643d4

What I tried to do with it was to apply the next code found in other thread, and see what happens:

N_m3u8DL-RE "index URL" --custom-hls-method AES_128 --custom-hls-key KEY -M format=mkv -mt --save-name "NAME"

Terminal gives me this:

13:17:02.116 INFO : Content Matched: HTTP Live Streaming
13:17:02.116 INFO : Parsing streams...
13:17:02.116 WARN : Master List detected, try parse all streams
13:17:02.120 WARN : Writing meta json
13:17:02.120 INFO : Extracted, there are 5 streams, with 5 basic streams, 0 audio streams, 0 subtitle streams
13:17:02.121 INFO : Vid 1920x1080 | 3226 Kbps | avc1.42e00a,mp4a.40.2
13:17:02.121 INFO : Vid 1280x720 | 1785 Kbps | avc1.42e00a,mp4a.40.2
13:17:02.121 INFO : Vid 852x480 | 933 Kbps | avc1.42e00a,mp4a.40.2
13:17:02.121 INFO : Vid 640x360 | 808 Kbps | avc1.42e00a,mp4a.40.2
13:17:02.121 INFO : Vid 426x240 | 433 Kbps | avc1.42e00a,mp4a.40.2
13:17:12.776 INFO : Parsing streams...
13:17:12.904 WARN : Live stream found
13:17:12.905 INFO : Selected streams:
13:17:12.905 INFO : Vid 1920x1080 | 3226 Kbps | avc1.42e00a,mp4a.40.2 | | 
~00m00s
13:17:12.905 WARN : Writing meta json
13:17:12.906 INFO : Save Name: video
13:17:12.906 WARN : MuxAfterDone is detected, binary merging is automatically 
enabled
13:17:12.907 WARN : set refresh interval to 1 seconds
                                                              
Vid 1920x1080 | 3226 Kbps 00m00s/00m00s 0/0 Waiting     0% -

In this case, I can select the 1080 stream in the Index, and it creates the "NAME" folder but it doesn't download any real content, and stays processing at 0% until I quit terminal. Well, I also notice that it finds video streams without audio, but lets pass that for now.

- 1080.m3u8

https://hls2.videos.sproutvideo.com/c9a8ce796e95905e51bfb56668dec3de/c5336e6679d7b2316c858bd7089c6e55/video/1080.m3u8?Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9obHMyLnZpZGVvcy5zcHJvdXR2aWRlby5jb20vYzlhOGNlNzk2ZTk1OTA1ZTUxYmZiNTY2NjhkZWMzZGUvYzUzMzZlNjY3OWQ3YjIzMTZjODU4YmQ3MDg5YzZlNTUvKi5tM3U4P3Nlc3Npb25JRD0yYzBiYTcxNy02Y2YxLTQxNWYtOWRkZC00Y2JiMzE5NjQzZDQiLCJDb25kaXRpb24iOnsiRGF0ZUxlc3NUaGFuIjp7IkFXUzpFcG9jaFRpbWUiOjE3MTg5MjE1MTF9fX1dfQ__&Signature=PWa-zxIH20OtSn3uAfpNgxEsC0ydqGxV5WgbsFTqTXFQ2K~Psi4wHa8ovt4~oiTFTIx5kBuoPUohWpVlgrVsWcWD3yPQbxc-06mqjSIg3Gbk8lllxRpkqVjQBxQJICGld~wvWipdPz-MhmesyuwVXmDrUDbakg7QYnQ9YsfklE3UQYVGKDn6Q-S30JXwh1kP0mI4btMupTcVWtVDMESLKpGHkFITPF01e0ai7G-FSiQK2sLLIB~OY5vhUXGim723iu9gDkGR6kgJQEFgWPIzvWk1kvIYW2SkyKfusCSO~MOsVYlQJDstt~y8~joAs-4ZtQFAuvpswazMKYmkm~Hzyw__&Key-Pair-Id=APKAIB5DGCGAQJ4GGIUQ&sessionID=2c0ba717-6cf1-415f-9ddd-4cbb319643d4

If I use the same code that for index.m3u8, it gives me the next:

13:29:17.379 INFO : Content Matched: HTTP Live Streaming
13:29:17.379 INFO : Parsing streams...
13:29:17.380 WARN : METHOD changed from AES-128 to AES_128
13:29:17.385 WARN : Writing meta json
13:29:17.385 INFO : Extracted, there are 1 streams, with 1 basic streams, 0 audio streams, 0 subtitle streams
13:29:17.385 INFO : Vid *AES_128 Kbps | 488 Segments | ~01h21m11s
13:29:17.386 INFO : Selected streams:
13:29:17.386 INFO : Vid *AES_128 Kbps | 488 Segments | ~01h21m11s
13:29:17.386 WARN : Writing meta json
13:29:17.386 INFO : Save Name: video
13:29:17.386 WARN : MuxAfterDone is detected, binary merging is automatically 
enabled
13:29:17.387 INFO : Start downloading...Vid Kbps
13:29:20.490 WARN : Response status code does not indicate success: 403       
(Forbidden).━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━   0% - 0.00Bps(3) --:--:-- ⢿
13:29:20.494 ERROR: Download first segment failed!

- segment.ts

https://hls2.videos.sproutvideo.com/c9a8ce796e95905e51bfb56668dec3de/c5336e6679d7b2316c858bd7089c6e55/video/1080_00004.ts?Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9obHMyLnZpZGVvcy5zcHJvdXR2aWRlby5jb20vYzlhOGNlNzk2ZTk1OTA1ZTUxYmZiNTY2NjhkZWMzZGUvYzUzMzZlNjY3OWQ3YjIzMTZjODU4YmQ3MDg5YzZlNTUvKi50cz9zZXNzaW9uSUQ9MmMwYmE3MTctNmNmMS00MTVmLTlkZGQtNGNiYjMxOTY0M2Q0IiwiQ29uZGl0aW9uIjp7IkRhdGVMZXNzVGhhbiI6eyJBV1M6RXBvY2hUaW1lIjoxNzE4OTIxNTExfX19XX0_&Signature=U1rqJ8yT8Dh55kryIcyQx1kpv4zL~bBNQBZu1yik6PVaIXRSECBHaq8XJX6JjrJReSnTclW513f4bG426~ath2CxxdNBStcGy7eAcxlwqLL8yNOvwvflkP1VtwuGDw9AukTYvY0749eEi9MmehCeESH4101R1t7JycLf0F3-YV3ivJP--E2GWfm5Z7KgAyH4iYVhN16DwLu3ZtSvW2jHj0uTY6NFYIefMeBpeeAUq~jcHOGz7SageIqojMi31q3nEMU1OHiL5dpr8oLKHN4PPuKmn9XECMVJWgs3EYWQrhInV5q3~V27jYiQ8weAaKeJRbJycYjYaldS-FMobu0-hA__&Key-Pair-Id=APKAIB5DGCGAQJ4GGIUQ&sessionID=2c0ba717-6cf1-415f-9ddd-4cbb319643d4

If I try to download a single segment, and I apply the same code than for the last two operations, it actually download a 5Mb chunk. But the content is 00m00s, so I don't really understand.

13:33:11.945 INFO : Content Matched: HTTP Live MPEG2-TS
13:33:11.947 INFO : Parsing streams...
13:33:11.958 WARN : Writing meta json
13:33:11.958 INFO : Extracted, there are 1 streams, with 1 basic streams, 0 audio streams, 0 subtitle streams
13:33:11.959 INFO : Vid Kbps | <RE_LIVE_TS> | | ~00m00s
13:33:11.959 INFO : Selected streams:
13:33:11.959 INFO : Vid Kbps | <RE_LIVE_TS> | | ~00m00s
13:33:11.959 WARN : Writing meta json
13:33:11.960 INFO : Save Name: video
13:33:11.960 WARN : MuxAfterDone is detected, binary merging is automatically 
enabled
13:33:12.776 INFO : File Size: 5.04MB                    
13:33:12.780 INFO : Done

So, maybe I'm not using the right code, or the right tool to put all together as it should.
What is weird is that when I used both keys provided by LittleSoldier and shellcmd, the results were the same.
Related to that, and still don't really understand how to convert a the 1080.key file to hex the right way. When I open the file in text reader, I see:

"ΩŸ¶>uís%!cóT>1Öd"

so I used ChatGPT with the promt to convert it to hex, and after encoding with utf-8 it gave me the following

cea59fc2b63e75c3ades2121c3b3543e31c39664

Can that be right?

Hope this gives more context.

[shellcmd]

yes can't download first segment. I think there should be some authorization data in m3u8 link's headers. try to add them to command use -H "key: value", you can use this for many times. the key: value part maybe cookie, authorization, token, refere or user-agent

[VinzOP]

What I see in headers are:

Response Headers

Accept-Ranges: bytes
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, HEAD
Access-Control-Allow-Origin: https://videos.sproutvideo.com

Age: 76886
Cache-Control: max-age=31536000
Content-Length: 16271
Content-Type: application/x-mpegURL
Date: Thu, 20 Jun 2024 01:06:59 GMT
Etag: "340f6367458d4d4ad3508a62c99df920"
Last-Modified: Sat, 02 Apr 2022 00:54:21 GMT
Server: AmazonS3
Vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
Via: 1.1 ce446dd85fdbce4015c9b8e158295374.cloudfront.net (CloudFront)
X-Amz-Cf-Id: mNRqd5204Q3y_XvPjWqt8nYsUHGG36W2HvlSAS6M8Bs3vOB48bxPow==
X-Amz-Cf-Pop: SCL51-P3
X-Cache: Hit from cloudfront

Request Headers

:authority: hls2.videos.sproutvideo.com
:method: GET
:path: /c9a8ce796e95905e51bfb56668dec3de/c5336e6679d7b2316c858bd7089c6e55/video/1080.m3u8?Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9obHMyLnZpZGVvcy5zcHJvdXR2aWRlby5jb20vYzlhOGNlNzk2ZTk1OTA1ZTUxYmZiNTY2NjhkZWMzZGUvYzUzMzZlNjY3OWQ3YjIzMTZjODU4YmQ3MDg5YzZlNTUvKi5tM3U4P3Nlc3Npb25JRD0yYjU4MTM4Ny05ZjkzLTQ1ODEtOWIwZi0yYjVmZjcwZDdhMGQiLCJDb25kaXRpb24iOnsiRGF0ZUxlc3NUaGFuIjp7IkFXUzpFcG9jaFRpbWUiOjE3MTg5NDQxMDR9fX1dfQ__&Signature=X66C~LSyVXbnGhlBCW2LvpEh0MfG1SQb2-18Gmlh1~MtujrQ21Qm2rMsZSf1iM5cOJYpHFs9wX-ef734~ZgW~6Ujw9O64PTsUYEYRrpa-L-GA1yZY~cHl6EN-m1z5MzPJy8bUcY~BtB3Lj6KZcYfL2Un1maar~Y5UBvQlrrllLk7bCDQ75rT0VmNrGoWLv2t76sfMROxQhpS4mJY2xcp74X5R49kTAGU6rV1B2waW0k7~ypuEsostE49t2RronPE~9WNTCRTr91Kbzjr9jRSQ-pcr~Dy6cCsSGpQVpW2C1EAchcXWZso0l8fHpo5W~2-f9FThk2BvVPQ6o7RM7gpkg__&Key-Pair-Id=APKAIB5DGCGAQJ4GGIUQ&sessionID=2b581387-9f93-4581-9b0f-2b5ff70d7a0d
:scheme: https
Accept: */*
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: fr,es;q=0.9,en-US;q=0.8,en;q=0.7
Dnt: 1
Origin: https://videos.sproutvideo.com
Priority: u=1, i
Referer: https://videos.sproutvideo.com/embed/119edeb71b1ce3cc98/6aeb40d3f4c27467?&autoplay=true&expires=1718922603&layout=2&signature=oB%2BxP4JgyEAVPhYas4q0%2F8NRw3I%3D
Sec-Ch-Ua: "Google Chrome";v="125", "Chromium";v="125", "Not.A/Brand";v="24"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "macOS"
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

As this is a video that activates in its full version only when I log in, I now understand that it changes some values in its URL each time, so I have to grab new m3u8 urls to try to download it...

Applied some -h to my commands but still unsuccessful.

[LZAA]

Need access.

[VinzOP]

Need access.

This is the current valid URL

https://hls2.videos.sproutvideo.com/c9a8ce796e95905e51bfb56668dec3de/c5336e6679d7b2316c858bd7089c6e55/video/1080.m3u8?Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9obHMyLnZpZGVvcy5zcHJvdXR2aWRlby5jb20vYzlhOGNlNzk2ZTk1OTA1ZTUxYmZiNTY2NjhkZWMzZGUvYzUzMzZlNjY3OWQ3YjIzMTZjODU4YmQ3MDg5YzZlNTUvKi5tM3U4P3Nlc3Npb25JRD0yYjU4MTM4Ny05ZjkzLTQ1ODEtOWIwZi0yYjVmZjcwZDdhMGQiLCJDb25kaXRpb24iOnsiRGF0ZUxlc3NUaGFuIjp7IkFXUzpFcG9jaFRpbWUiOjE3MTg5NDQxMDR9fX1dfQ__&Signature=X66C~LSyVXbnGhlBCW2LvpEh0MfG1SQb2-18Gmlh1~MtujrQ21Qm2rMsZSf1iM5cOJYpHFs9wX-ef734~ZgW~6Ujw9O64PTsUYEYRrpa-L-GA1yZY~cHl6EN-m1z5MzPJy8bUcY~BtB3Lj6KZcYfL2Un1maar~Y5UBvQlrrllLk7bCDQ75rT0VmNrGoWLv2t76sfMROxQhpS4mJY2xcp74X5R49kTAGU6rV1B2waW0k7~ypuEsostE49t2RronPE~9WNTCRTr91Kbzjr9jRSQ-pcr~Dy6cCsSGpQVpW2C1EAchcXWZso0l8fHpo5W~2-f9FThk2BvVPQ6o7RM7gpkg__&Key-Pair-Id=APKAIB5DGCGAQJ4GGIUQ&sessionID=2b581387-9f93-4581-9b0f-2b5ff70d7a0d

[LZAA]

URL&Access?