Errors Decrypting VdoCipher Keys

[Ademir]

Guys, I finally made it! I am editing the post now.

For Vdocipher, you will need:

1) A proper CDM from a real device -> Read the Angela thread for that.

2) Block the license on the hosts file, or use some app/extension that can do that. Just copy and paste these into the hosts file (C:\Windows\System32\drivers\etc\hosts):

127.0.0.1 license.vdocipher.com/auth
127.0.0.1 license.vdocipher.com

3) After reading the Angela thread, you will know how to get the auth token. Then, use this script: https://github.com/Diazole/vdocipher-dl (but remember, vdocipher will show two tokens, they are identical. It will be "method: POST"
Now, you just need to change a small detail in the script: comment out these three lines:

def get_license_response(license_challenge: str, mpd: str, video_reference: str):
origin_url = urlparse(mpd)
headers = {
'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36',
'origin': f'{origin_url.scheme}://{origin_url.hostname}/',
'referer': f'{origin_url.scheme}://{origin_url.hostname}/',
'vdo-ref': video_reference
}
You need to disable these lines, or else you will get an error.

# 'origin': f'{origin_url.scheme}://{origin_url.hostname}/',
# 'referer': f'{origin_url.scheme}://{origin_url.hostname}/',
# 'vdo-ref': video_reference

Now that you have the keys, it's all done. Just use N_m3u8DL-RE or a similar tool to download and merge. There are a lot of instructions about it on https://cdm-project.com/.

Thanks to @pram0dm and Angela.

[CrymanChen]

I once wrote a script in March when it was still working. But I couldn't make it when I tried last month.

[LittleSoldier]

Hey, I read a ton of threads, consulted every piece of information I found, but I'm stuck trying to decrypt VdoCipher keys.

I already have a real CDM (It's unbelievable that it hasn't been revoked/banned yet).
I already have the PSSH, mdb, headers, and a cURL with a blocked token.
I tried three scripts that I found and tried to modify one of my own but still got different errors.

angel - https://forum.videohelp.com/threads/407216-Decryption-The-Dungeon-of-Despair - Got 400 Bad Request (maybe a headers problem?).
Diazole - https://github.com/Diazole/vdocipher-dl - Too old, the token feature doesn't work anymore.
2nHxWW6GkN1l916N3ayz8HQoi - https://forum.videohelp.com/threads/413153-Decryption-fails-with-keys - Sounded promising, but I got pywidevine.exceptions.InvalidLicenseMessage: Could not parse license_message as a SignedMessage, Error parsing message.
cdm-project: https://cdm-project.com/How-To/Obtaining-Keys-VDOCipher -> Tpd-key doenst have vdochiper option nor drmheaders.py

I have no idea what to do anymore, if anyone want to help I can give access to the account.

If you've real device cdm then give a try to Widevine L3 Guesser Extension once with enable licence blocking option

[whs912km]

... once with enable licence blocking option

interesting feature. but where is this option ?
no from guesser window


[Attachment 80383 - Click to enlarge]

also i can't find with right key on guesser icon


[Attachment 80384 - Click to enlarge]

[A_n_g_e_l_a]

If you've real device cdm then give a try to Widevine L3 Guesser Extension once with enable licence blocking option

I write in general for the technicality of the issue; nothing more.

If a site uses a one-time-only token then the browser uses it up. In normal use, that is.

However, in the browser there is a menu item in the Web-Tools window, (shift+ctrl+c), under the network tab, that allows you to disable a particular request for a url. So if you allow the browser to load properly once, find the url for the license and then block it requesting, then Ctrl+R to reload the page, it will deliver you a license url with an unused token. Allhell3.py will work in these circumstances BUT ONLY with your own CDM. The one in the kit is an emulated CDM and will not work on heavily protected sites.

[LZAA]

https://www.vdocipher.com/blog/2014/12/add-text-to-videos-with-watermark/

Block:

license.vdocipher.com/auth
license.vdocipher.com

Firefox Browser doesn't show auth token.

[A_n_g_e_l_a]

Try F5

[LittleSoldier]

@whs912km Just right click on page you'll find enable licence blocking in context menu

P.S. - Just make sure to select appropriate challenge scheme for your desired service

@A_n_g_e_l_a Thanks for the Explanation

I'll try with Allhell3.py as you've explained above once i dump physical cdm again

[LZAA]

LittleSoldier

Your address 'license.vdocipher.com/auth' is not blocked.

A_n_g_e_l_a

OK. Using 'F5' it works. Thanks!
But the token is only present in the first browser request 'license.vdocipher.com/auth'. It is not present in the second request 'license.vdocipher.com/auth'.

[LittleSoldier]

LittleSoldier

Your address 'license.vdocipher.com/auth' is not blocked.

Got it.
I thought you were unable to find that token in normal (unblocked licence request) scenario so posted that Screenshot

[A_n_g_e_l_a]

LittleSoldier

Your address 'license.vdocipher.com/auth' is not blocked.

A_n_g_e_l_a

OK. Using 'F5' it works. Thanks!
But the token is only present in the first browser request 'license.vdocipher.com/auth'. It is not present in the second request 'license.vdocipher.com/auth'.

I'm only passing on what I'm told:-
"yea you just watch the waterfall and see which call requests the token, click the blocking button
F5 the page and when the page loads again the video wont play, it will stop at the token request
Just right click on it, copy it, use that to then get yur key (once the videos playing the token has been used) "

[Ademir]

LittleSoldier

Your address 'license.vdocipher.com/auth' is not blocked.

A_n_g_e_l_a

OK. Using 'F5' it works. Thanks!
But the token is only present in the first browser request 'license.vdocipher.com/auth'. It is not present in the second request 'license.vdocipher.com/auth'.

Doenst matter, I just notice now that the first and second token is exactly the same (if the token is blocked). For some reason, firefox, firefox developer and Opera didnt show the "payload" of the blocked request. The only one that really shows the blocked token is Google chrome (last version, at least)

[Ademir]

I found out that the script vdocipher-dl actually gets the keys, but your CDM will be banned (it doesn't matter if you use it just one time, it will be banned no matter what). So, if you want to clone 10 videos, you will need 10 .wvd files. The other scripts (all of them) don't work at all. Good luck. I am out.

[aqzs]

CDM get banned only if you make bad requests.. You have to make a custom script for every websites to avoid getting banned. I managed to get keys from 3 services with a single .wvd that never got banned.