Python Script to download AES encrypted hls video

[GirlsGill]

Hi, I know the manual method for downloading an encrypted AES hls video by finding the key in decrypt function, its very complicated manual process, and also automating is super painful.
Was there any other script that i can use?

Hint:
My encrypted .m3u8 playlist look like this
#EXTM3U
#EXT-X-VERSION:3
#EXT-X-TARGETDURATION:2
#EXT-X-MEDIA-SEQUENCE:0
#EXT-X-KEY:METHOD=AES-128,URI="k/timestamp",IV=0x496daa1c6914000e408c65cead91fc29
#EXTINF:2.016000,
hls_audio_000.ts
#EXTINF:1.984000,
hls_audio_001.ts

audio and video seperately.

[larley]

How about N_m3u8DL-RE? It's available on GitHub

[2nHxWW6GkN1l916N3ayz8HQoi]

How about N_m3u8DL-RE? It's available on GitHub

I think OP meant a way to automatically obtain the hls aes decryption key. Usually when you see "k/timestamp" in a m3u8 file, it implies the key you get from the network requests is later modified in some javascript function.

[larley]

Yes, you're right, I didn't read the post properly. My answer seems to be more directed at the title than the question. The 'download' part threw me off

[2nHxWW6GkN1l916N3ayz8HQoi]

Now that I think more about it, you could attempt a somewhat "general" solution. It's gonna be a pain to maintain in the long run but it is possible. You could take most of the popular js libraries that deal with hls aes and inject some custom js code that only print in console/alert the final modified key that is used to decrypt. Then you're gonna copy and paste these modified js files according to site and you'll directly get the key. Most sites don't bother at all from stopping you to inject js code.

Obviously this won't work for all, but it's a good starting point.

[larley]

I was actually just researching if there are any ways to log javascript variable values on runtime. I'm sure you could somehow use a browser debugger to watch the runtime scope while the script is running

[2nHxWW6GkN1l916N3ayz8HQoi]

If a key rotation mechanism is added as well, things complicate a lot. I remember once for a video, I managed to get the keys through code injection, but they were useless, unless I also downloaded the encrypted content for that "run". But I don't think @OP's case fits into this rare scenario.