[Release] WidevineProxy2 Extension; Bypass HMAC, 1-timetokens, Lic wrapping

[Tom Saurus]

Any way of making this work with an older version of FireFox?

If you are on Windows 7 they have extended releases of Firefox at least for now.

I do have the latest available version downloaded and I'm able to install the extension but it's not working. Doesn't give any keys...

what's the name of the website ??

I've tried it on multiple websites and can't get keys from any.

do you have the add-on pinned to the toolbar ??
and have a wvd file ??

I do.

I think the extension only works for people on Windows 10 or above that's why I was asking if there was a way it could be made to work on some older versions...

Have you looked around and thought about perhaps buying a cheap mini pc with Windows 11? They don't use much power and are small and they might be a nice edition to what you have now. They typically have HDMI output and quite often the USB slots are 3.0 which means quite a lot faster transferring of files. On top of that you don't have the 2 TB limit that older PCs have and sometimes you can find 4 and 5 TB hard drives on sale at not much of a higher price than the 2 TB hard drives. Pair them with a wireless keyboard with track pad built in you can make a big screen TV your computer monitor and sit back on the couch and relax with the keyboard some of which come with a few media keys.

[ytdlhelp]

Have you looked around and thought about perhaps buying a cheap mini pc with Windows 11?

Might as well try Linux on existing PC.

[Tom Saurus]

Have you looked around and thought about perhaps buying a cheap mini pc with Windows 11?

Might as well try Linux on existing PC.

That is a good suggestion if he could have both Linux and his current OS and switch between one or the other.

[ytdlhelp]

That's still not how the server's backend works

Can you bring it back? It is needed for testing and improving alternative DRM implementations.

[larley]

Now that I've updated the code to be more secure anyway I'll just post what the server's code looked like:

welp, deleted it when switching servers
this is what I remember:

blocked protocol version VERSION_2_1 because that's what pywidevine uses and Chrome uses VERSION_2_2
blocked unencrypted client IDs
blocked invalid pssh data (different from what's in the mpd)
blocked android requestIds
made sure that the an IP's request flow would happen like this: request html page -> request service certificate -> request license, otherwise block connections to larley.dev/auth (or whatever it was)

openwv got through because it doesn't care whether the widevine device is android or not: https://github.com/tchebb/openwv/blob/main/src/init_data.rs#L55
while pywidevine does: https://github.com/devine-dl/pywidevine/blob/master/pywidevine/cdm.py#L326


Regarding my new site:
Are you able to access it (just try to open https://larley.dev/)?
I've had some issues accessing it on specific networks

[ytdlhelp]

Regarding my new site:
Are you able to access it (just try to open https://larley.dev/)?
I've had some issues accessing it on specific networks

The website doesn't work for me.

By the way, is it possible to make custom Widevine/PlayReady license servers and not just proxies, or it requires to have certificate signed by Google/Microsoft? Then also use third-party license servers (like said Bitmovin one) for detecting revoked CDMs. If it is possible to generate a request without having CDM private key.

[larley]

The RSA device private key is used to sign the contents of a license request, you can't just omit it. Same goes for the client id blob.

[pesfacemaker]

Could you have a look at the PM I sent you @larley?

[ginko]

after chrome update 138.0.7204.101 it got disabled and says it was deactivated and will be no more supported.
great

[larley]

works completely fine?

[Attachment 87782 - Click to enlarge]

[Attachment 87783 - Click to enlarge]

[Attachment 87784 - Click to enlarge]

[ginko]

thx for checking.
weired, after new installation it works!

can you add the title of the video? i see it in the browser when i play a video but when downloading the save name gets crazy.

eg. for https://bitmovin.com/demos/drm

13:12:28.930 INFO : Loading URL: https://cdn.bitmovin.com/content/assets/art-of-motion_drm/mpds/11331.mpd
13:12:29.047 INFO : Content Matched: Dynamic Adaptive Streaming over HTTP
13:12:29.047 INFO : Parsing streams...
13:12:29.049 INFO : Match bitmovin!
13:12:29.073 WARN : Writing meta json
13:12:29.086 INFO : Extracted, there are 7 streams, with 6 basic streams, 1 audio streams, 0 subtitle streams
13:12:29.096 INFO : Vid *CENC 1920x1080 | 4800 Kbps | 1080_4800000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.133 INFO : Vid *CENC 1280x720 | 2400 Kbps | 720_2400000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.139 INFO : Vid *CENC 960x540 | 1200 Kbps | 540_1200000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.146 INFO : Vid *CENC 640x360 | 800 Kbps | 360_800000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.156 INFO : Vid *CENC 480x270 | 400 Kbps | 270_400000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.162 INFO : Vid *CENC 320x180 | 250 Kbps | 180_250000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.163 INFO : Aud *CENC 1_stereo_192000 | 192 Kbps | mp4a.40.2 | en | 2CH | 53 Segments | ~03m31s
13:12:29.164 INFO : Parsing streams...
13:12:29.165 INFO : Selected streams:
13:12:29.166 INFO : Vid *CENC 1920x1080 | 4800 Kbps | 1080_4800000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.167 INFO : Aud *CENC 1_stereo_192000 | 192 Kbps | mp4a.40.2 | en | 2CH | 53 Segments | ~03m31s
13:12:29.169 WARN : Writing meta json
13:12:29.172 INFO : Save Name: 11331_2025-07-12_13-12-29

[doctorm]

add:

--save-name "filename"

thx for checking.
weired, after new installation it works!

can you add the title of the video? i see it in the browser when i play a video but when downloading the save name gets crazy.

eg. for https://bitmovin.com/demos/drm

13:12:28.930 INFO : Loading URL: https://cdn.bitmovin.com/content/assets/art-of-motion_drm/mpds/11331.mpd
13:12:29.047 INFO : Content Matched: Dynamic Adaptive Streaming over HTTP
13:12:29.047 INFO : Parsing streams...
13:12:29.049 INFO : Match bitmovin!
13:12:29.073 WARN : Writing meta json
13:12:29.086 INFO : Extracted, there are 7 streams, with 6 basic streams, 1 audio streams, 0 subtitle streams
13:12:29.096 INFO : Vid *CENC 1920x1080 | 4800 Kbps | 1080_4800000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.133 INFO : Vid *CENC 1280x720 | 2400 Kbps | 720_2400000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.139 INFO : Vid *CENC 960x540 | 1200 Kbps | 540_1200000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.146 INFO : Vid *CENC 640x360 | 800 Kbps | 360_800000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.156 INFO : Vid *CENC 480x270 | 400 Kbps | 270_400000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.162 INFO : Vid *CENC 320x180 | 250 Kbps | 180_250000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.163 INFO : Aud *CENC 1_stereo_192000 | 192 Kbps | mp4a.40.2 | en | 2CH | 53 Segments | ~03m31s
13:12:29.164 INFO : Parsing streams...
13:12:29.165 INFO : Selected streams:
13:12:29.166 INFO : Vid *CENC 1920x1080 | 4800 Kbps | 1080_4800000 | avc1.42c00d | 53 Segments | ~03m32s
13:12:29.167 INFO : Aud *CENC 1_stereo_192000 | 192 Kbps | mp4a.40.2 | en | 2CH | 53 Segments | ~03m31s
13:12:29.169 WARN : Writing meta json
13:12:29.172 INFO : Save Name: 11331_2025-07-12_13-12-29

[logipin]

I was able to install and grab keys, along with the cmd.

But when I run the command from WidevineProxy2:

N_m3u8DL-RE "https://varnish07-c05-lax1-dss-vod-dssc-shield.tr.na.prod.dssedge.com/dvt1=exp=1752471039~url=%2Fps01%2Fdisney%2Facddf46 3-2636-4cb3-81bb-77b0c79a2a7f%2F~psid=79f35f91-e00e-4ac4-b450-3636822d3e34~aid=81154747-daeb-422a-a4e9-9be54fcb3846~did=01ce5545-3c79-46f3-9890-2d98c4223342~kid=k01~hmac=e6cf15a1539bc652d36c0376 1c5908bd7fcb39cd8a72daecd0654a17f4df21e2/ps01/disney/acddf463-2636-4cb3-81bb-77b0c79a2a7f/ctr-all-15ae8a39-c5df-4cd2-affd-d50f8888e23b-c906e318-ae12-49f2-9f80-0ad2686ea079.m3u8?fr=30&v=1&hash=c037dfbb0c3b9408e f969596b3037a504d2b012c" -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0" -H "Accept: */*" -H "Origin: null" -H "Referer: https://www.disneyplus.com/" -H "DNT: 1" --key <1stkeyhash>:<2ndkeyhash> --use-shaka-packager -M format=mkv

I get this during the process

Failed to get KEY, ignore.: One or more errors occurred. (The 'data' scheme is not supported.)

But I was able to get the keys?

[ginko]

ah great, thx!

[Brish2023]

Thank you so much for this awesome tool.

I'm interested in capturing keys from a streaming service that streams only through an Android app. They don't have a website, so I couldn't use the Chrome extension.

Appreciate expert on that can describe the steps.

[alex_cross]

What to do if there is an one time mpd url (it changes when refreshing a video in a browser, so it can be used only once)? When I try to grab a video file using such an url I get an "401 Unauthorized" error. Any suggestions?

upd:

Resolved. All is ok.

[killer30]

Does anyone know why when I download from Discovery, at the end the audio is attached to the commercial? I don't understand why the video downloads without problems but the audio is not from the show but from the commercial.

[abhishek1967]

Thank you @Larley it is working as expected. Now I will be able to learn a lot of things online. Thanks.

[marcelov2]

Could someone help me download this series?

https://www.vrt.be/vrtmax/a-z/-likeme/

[ytdlhelp]

Please fix the provided example remote.json in README, the CDM name is "public", not "CDRM".

[larley]

fixed
https://github.com/DevLARLEY/WidevineProxy2/commit/f1a23bba3f44bdc4000fa507a7a7f4805f163d43

[Tom Saurus]

How is WidvineProxy2 updated? I notice when I look at the extensions section and the section for WidevineProxy2 it says "automatic updates" is turned on. So does that keep things updated or is there another way?

[ytdlhelp]

How is WidvineProxy2 updated? I notice when I look at the extensions section and the section for WidevineProxy2 it says "automatic updates" is turned on. So does that keep things updated or is there another way?

Not sure if the browser actually has a way to find a new version of the extension, as it is not published in official extension store. Better install the new version manually on top of the old one, when you notice it got updated.

However, I believe WidevineProxy2 is currently less relevant, and is more of a fallback legacy solution, due to Vineless existing, supporting PlayReady and not requiring a CDM plugin. Vineless is updated almost daily as I keep reporting bugs, though if using Firefox, you will need to use a version of it that allows running unsigned extensions as signed ones are only created on release versions.

[Gromyko]

ytdlhelp wrote

if using Firefox, you will need to use a version of it that allows running unsigned extensions as signed ones are only created on release versions.

Thank you for your edifying response. Is it possible that you can give a link or two to Firefox versions that satisfy this requirement. What are the key attributes that someone must look for in order to validate that version of Firefox pending download will accept unsigned extensions.


Thanks for your continuous debugging and error reporting of the Vineless extension.


[Maybe of interest, the openwv extension has been updated to v1.1.2]


Thanks

[ytdlhelp]

Thank you for your edifying response. Is it possible that you can give a link or two to Firefox versions that satisfy this requirement. What are the key attributes that someone must look for in order to validate that version of Firefox pending download will accept unsigned extensions.


Thanks for your continuous debugging and error reporting of the Vineless extension.


[Maybe of interest, the openwv extension has been updated to v1.1.2]


Thanks

Firefox ESR or Nightly or whatever that is not the main release channel will be OK. Or some forks like LibreWolf. Then go to about:config and set xpinstall.signatures.required to false. Compress the contents of the Vineless repository into a zip archive with .xpi extension and try installing it then. The browser should display a warning, but let it be used.

As for openwv, I noticed the version number was not correctly updated, and reported it. Once fixed, will rebuild the Windows version and upload it. However, openwv is also less relevant currently, as it doesn't support PlayReady (which is done via system DLL on Windows, and doesn't exist on other platforms currently) and is complicated to use (can't swap a CDM without rebuilding openwv, only shows keys if the browser is started in a terminal).

[Gromyko]

With apologies to larley, not wishing to infringe on this thread ...

Firefox ESR or Nightly or whatever that is not the main release channel will be OK. Or some forks like LibreWolf. Then go to about:config and set xpinstall.signatures.required to false. Compress the contents of the Vineless repository into a zip archive with .xpi extension and try installing it then. The browser should display a warning, but let it be used.

Thanks for your reply.


With respects to openwv, you can script it so as to choose a .wvd file upon compilation. This will create as many widevinecdm.dll files as you wish.


Also, openwv, can be scripted to create a turnkey setup that will download, decrypt and save automatically. I think that this is the holy grail sought by many.

[doctorm]

I haven't tried it, but this might work with Pale Moon, which is what I use instead of Firefox... WVP2 I use with Chrome though.

[ytdlhelp]

With respects to openwv, you can script it so as to choose a .wvd file upon compilation. This will create as many widevinecdm.dll files as you wish.

I don't have issues with openwv personally, however I believe it might be difficult for an average user here to build openwv for their system. So I am talking about a public build that I uploaded here, rather than what I use. If someone wishes to use a different CDM with openwv, like a private L1 one, not like I can help.

I haven't tried it, but this might work with Pale Moon, which is what I use instead of Firefox... WVP2 I use with Chrome though.

Pale Moon doesn't support DRM. All the mentioned software requires DRM support. A further development of Vineless could be decryption in JS rather than relying on ClearKey handler, but it didn't happen yet.

[LZAA]

'https://larley.dev/' is now available.

[tad108]

I was able to install and grab keys, along with the cmd.

But when I run the command from WidevineProxy2:

N_m3u8DL-RE "https://varnish07-c05-lax1-dss-vod-dssc-shield.tr.na.prod.dssedge.com/dvt1=exp=1752471039~url=%2Fps01%2Fdisney%2Facddf46 3-2636-4cb3-81bb-77b0c79a2a7f%2F~psid=79f35f91-e00e-4ac4-b450-3636822d3e34~aid=81154747-daeb-422a-a4e9-9be54fcb3846~did=01ce5545-3c79-46f3-9890-2d98c4223342~kid=k01~hmac=e6cf15a1539bc652d36c0376 1c5908bd7fcb39cd8a72daecd0654a17f4df21e2/ps01/disney/acddf463-2636-4cb3-81bb-77b0c79a2a7f/ctr-all-15ae8a39-c5df-4cd2-affd-d50f8888e23b-c906e318-ae12-49f2-9f80-0ad2686ea079.m3u8?fr=30&v=1&hash=c037dfbb0c3b9408e f969596b3037a504d2b012c" -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0" -H "Accept: */*" -H "Origin: null" -H "Referer: https://www.disneyplus.com/" -H "DNT: 1" --key <1stkeyhash>:<2ndkeyhash> --use-shaka-packager -M format=mkv

I get this during the process

Failed to get KEY, ignore.: One or more errors occurred. (The 'data' scheme is not supported.)

But I was able to get the keys?

It happens to me too, the audio is not decrypted and the error points to failed key. Did you get all parts decrypted despite the error? Cheers