[Release] WidevineProxy2 Extension; Bypass HMAC, 1-timetokens, Lic wrapping

[Tom Saurus]

Any way of making this work with an older version of FireFox?

If you are on Windows 7 they have extended releases of Firefox at least for now.

I do have the latest available version downloaded and I'm able to install the extension but it's not working. Doesn't give any keys...

what's the name of the website ??

I've tried it on multiple websites and can't get keys from any.

do you have the add-on pinned to the toolbar ??
and have a wvd file ??

I do.

I think the extension only works for people on Windows 10 or above that's why I was asking if there was a way it could be made to work on some older versions...

Have you looked around and thought about perhaps buying a cheap mini pc with Windows 11? They don't use much power and are small and they might be a nice edition to what you have now. They typically have HDMI output and quite often the USB slots are 3.0 which means quite a lot faster transferring of files. On top of that you don't have the 2 TB limit that older PCs have and sometimes you can find 4 and 5 TB hard drives on sale at not much of a higher price than the 2 TB hard drives. Pair them with a wireless keyboard with track pad built in you can make a big screen TV your computer monitor and sit back on the couch and relax with the keyboard some of which come with a few media keys.

[ytdlhelp]

Have you looked around and thought about perhaps buying a cheap mini pc with Windows 11?

Might as well try Linux on existing PC.

[Tom Saurus]

Have you looked around and thought about perhaps buying a cheap mini pc with Windows 11?

Might as well try Linux on existing PC.

That is a good suggestion if he could have both Linux and his current OS and switch between one or the other.

[ytdlhelp]

That's still not how the server's backend works

Can you bring it back? It is needed for testing and improving alternative DRM implementations.

[larley]

Now that I've updated the code to be more secure anyway I'll just post what the server's code looked like:

welp, deleted it when switching servers
this is what I remember:

blocked protocol version VERSION_2_1 because that's what pywidevine uses and Chrome uses VERSION_2_2
blocked unencrypted client IDs
blocked invalid pssh data (different from what's in the mpd)
blocked android requestIds
made sure that the an IP's request flow would happen like this: request html page -> request service certificate -> request license, otherwise block connections to larley.dev/auth (or whatever it was)

openwv got through because it doesn't care whether the widevine device is android or not: https://github.com/tchebb/openwv/blob/main/src/init_data.rs#L55
while pywidevine does: https://github.com/devine-dl/pywidevine/blob/master/pywidevine/cdm.py#L326


Regarding my new site:
Are you able to access it (just try to open https://larley.dev/)?
I've had some issues accessing it on specific networks

[ytdlhelp]

Regarding my new site:
Are you able to access it (just try to open https://larley.dev/)?
I've had some issues accessing it on specific networks

The website doesn't work for me.

By the way, is it possible to make custom Widevine/PlayReady license servers and not just proxies, or it requires to have certificate signed by Google/Microsoft? Then also use third-party license servers (like said Bitmovin one) for detecting revoked CDMs. If it is possible to generate a request without having CDM private key.

[larley]

The RSA device private key is used to sign the contents of a license request, you can't just omit it. Same goes for the client id blob.

[pesfacemaker]

Could you have a look at the PM I sent you @larley?

[ginko]

after chrome update 138.0.7204.101 it got disabled and says it was deactivated and will be no more supported.
great

[larley]

works completely fine?

[Attachment 87782 - Click to enlarge]

[Attachment 87783 - Click to enlarge]

[Attachment 87784 - Click to enlarge]

[ginko]

thx for checking.
weired, after new installation it works!

can you add the title of the video? i see it in the browser when i play a video but when downloading the save name gets crazy.

eg. for https://bitmovin.com/demos/drm

13:12:28.930 INFO : Loading URL: https://cdn.bitmovin.com/content/assets/art-of-motion_drm/mpds/11331.mpd
13:12:29.047 INFO : Content Matched: Dynamic Adaptive Streaming over HTTP
13:12:29.047 INFO : Parsing streams...
13:12:29.049 INFO : Match bitmovin!
13:12:29.073 WARN : Writing meta json
13:12:29.086 INFO : Extracted, there are 7 streams, with 6 basic streams, 1 audio streams, 0 subtitle streams
13:12:29.096 INFO : Vid *CENC 1920x1080 | 4800 Kbps | 1080_4800000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.133 INFO : Vid *CENC 1280x720 | 2400 Kbps | 720_2400000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.139 INFO : Vid *CENC 960x540 | 1200 Kbps | 540_1200000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.146 INFO : Vid *CENC 640x360 | 800 Kbps | 360_800000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.156 INFO : Vid *CENC 480x270 | 400 Kbps | 270_400000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.162 INFO : Vid *CENC 320x180 | 250 Kbps | 180_250000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.163 INFO : Aud *CENC 1_stereo_192000 | 192 Kbps | mp4a.40.2 | en | 2CH | 53 Segments | ~03m31s
13:12:29.164 INFO : Parsing streams...
13:12:29.165 INFO : Selected streams:
13:12:29.166 INFO : Vid *CENC 1920x1080 | 4800 Kbps | 1080_4800000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.167 INFO : Aud *CENC 1_stereo_192000 | 192 Kbps | mp4a.40.2 | en | 2CH | 53 Segments | ~03m31s
13:12:29.169 WARN : Writing meta json
13:12:29.172 INFO : Save Name: 11331_2025-07-12_13-12-29

[doctorm]

add:

--save-name "filename"

thx for checking.
weired, after new installation it works!

can you add the title of the video? i see it in the browser when i play a video but when downloading the save name gets crazy.

eg. for https://bitmovin.com/demos/drm

13:12:28.930 INFO : Loading URL: https://cdn.bitmovin.com/content/assets/art-of-motion_drm/mpds/11331.mpd
13:12:29.047 INFO : Content Matched: Dynamic Adaptive Streaming over HTTP
13:12:29.047 INFO : Parsing streams...
13:12:29.049 INFO : Match bitmovin!
13:12:29.073 WARN : Writing meta json
13:12:29.086 INFO : Extracted, there are 7 streams, with 6 basic streams, 1 audio streams, 0 subtitle streams
13:12:29.096 INFO : Vid *CENC 1920x1080 | 4800 Kbps | 1080_4800000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.133 INFO : Vid *CENC 1280x720 | 2400 Kbps | 720_2400000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.139 INFO : Vid *CENC 960x540 | 1200 Kbps | 540_1200000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.146 INFO : Vid *CENC 640x360 | 800 Kbps | 360_800000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.156 INFO : Vid *CENC 480x270 | 400 Kbps | 270_400000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.162 INFO : Vid *CENC 320x180 | 250 Kbps | 180_250000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.163 INFO : Aud *CENC 1_stereo_192000 | 192 Kbps | mp4a.40.2 | en | 2CH | 53 Segments | ~03m31s
13:12:29.164 INFO : Parsing streams...
13:12:29.165 INFO : Selected streams:
13:12:29.166 INFO : Vid *CENC 1920x1080 | 4800 Kbps | 1080_4800000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.167 INFO : Aud *CENC 1_stereo_192000 | 192 Kbps | mp4a.40.2 | en | 2CH | 53 Segments | ~03m31s
13:12:29.169 WARN : Writing meta json
13:12:29.172 INFO : Save Name: 11331_2025-07-12_13-12-29

[logipin]

I was able to install and grab keys, along with the cmd.

But when I run the command from WidevineProxy2:

N_m3u8DL-RE "https://varnish07-c05-lax1-dss-vod-dssc-shield.tr.na.prod.dssedge.com/dvt1=exp=1752471039~url=%2Fps01%2Fdisney%2Facddf46 3-2636-4cb3-81bb-77b0c79a2a7f%2F~psid=79f35f91-e00e-4ac4-b450-3636822d3e34~aid=81154747-daeb-422a-a4e9-9be54fcb3846~did=01ce5545-3c79-46f3-9890-2d98c4223342~kid=k01~hmac=e6cf15a1539bc652d36c0376 1c5908bd7fcb39cd8a72daecd0654a17f4df21e2/ps01/disney/acddf463-2636-4cb3-81bb-77b0c79a2a7f/ctr-all-15ae8a39-c5df-4cd2-affd-d50f8888e23b-c906e318-ae12-49f2-9f80-0ad2686ea079.m3u8?fr=30&v=1&hash=c037dfbb0c3b9408e f969596b3037a504d2b012c" -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0" -H "Accept: */*" -H "Origin: null" -H "Referer: https://www.disneyplus.com/" -H "DNT: 1" --key <1stkeyhash>:<2ndkeyhash> --use-shaka-packager -M format=mkv

I get this during the process

Failed to get KEY, ignore.: One or more errors occurred. (The 'data' scheme is not supported.)

But I was able to get the keys?

[ginko]

ah great, thx!

[Brish2023]

Thank you so much for this awesome tool.

I'm interested in capturing keys from a streaming service that streams only through an Android app. They don't have a website, so I couldn't use the Chrome extension.

Appreciate expert on that can describe the steps.

[alex_cross]

What to do if there is an one time mpd url (it changes when refreshing a video in a browser, so it can be used only once)? When I try to grab a video file using such an url I get an "401 Unauthorized" error. Any suggestions?

upd:

Resolved. All is ok.

[killer30]

Does anyone know why when I download from Discovery, at the end the audio is attached to the commercial? I don't understand why the video downloads without problems but the audio is not from the show but from the commercial.

[abhishek1967]

Thank you @Larley it is working as expected. Now I will be able to learn a lot of things online. Thanks.

[marcelov2]

Could someone help me download this series?

https://www.vrt.be/vrtmax/a-z/-likeme/

[ytdlhelp]

Please fix the provided example remote.json in README, the CDM name is "public", not "CDRM".

[larley]

fixed
https://github.com/DevLARLEY/WidevineProxy2/commit/f1a23bba3f44bdc4000fa507a7a7f4805f163d43

[Tom Saurus]

How is WidvineProxy2 updated? I notice when I look at the extensions section and the section for WidevineProxy2 it says "automatic updates" is turned on. So does that keep things updated or is there another way?

[ytdlhelp]

How is WidvineProxy2 updated? I notice when I look at the extensions section and the section for WidevineProxy2 it says "automatic updates" is turned on. So does that keep things updated or is there another way?

Not sure if the browser actually has a way to find a new version of the extension, as it is not published in official extension store. Better install the new version manually on top of the old one, when you notice it got updated.

However, I believe WidevineProxy2 is currently less relevant, and is more of a fallback legacy solution, due to Vineless existing, supporting PlayReady and not requiring a CDM plugin. Vineless is updated almost daily as I keep reporting bugs, though if using Firefox, you will need to use a version of it that allows running unsigned extensions as signed ones are only created on release versions.

[Gromyko]

ytdlhelp wrote

if using Firefox, you will need to use a version of it that allows running unsigned extensions as signed ones are only created on release versions.

Thank you for your edifying response. Is it possible that you can give a link or two to Firefox versions that satisfy this requirement. What are the key attributes that someone must look for in order to validate that version of Firefox pending download will accept unsigned extensions.


Thanks for your continuous debugging and error reporting of the Vineless extension.


[Maybe of interest, the openwv extension has been updated to v1.1.2]


Thanks