[Release] WidevineProxy2 Extension; Bypass HMAC, 1-timetokens, Lic wrapping

[larley]

WidevineProxy2
Hi all, this is the release of my newest creation: WidevineProxy2.
A browser extension for Chrome/Firefox that intercepts challenges/licenses right after/before EME. Its Widevine implementation is completely JavaScript based (huge thanks to node-widevine) and easy to use.
The text below is a copy of the README from its GitHub repository:

Demo
A demo video can be found here

Features
+ User-friendly / GUI-based
+ Bypasses one-time tokens, hashes and license wrapping
+ JavaScript native Widevine implementation
+ Supports Widevine Device files
+ Manifest V3 compliant

Widevine Devices
This addon requires a Widevine Device file to work, which is not provided by this project.
+ Follow this guide if you want to dump your own device.
+ Ready-to-use Widevine Devices can be found here.

Compatibility
+ Compatible (tested) browsers: Firefox/Chrome on Windows/Linux.
+ Works with any service that accepts challenges from Android devices on the same endpoint.

Installation
+ Chrome
‎1. Download this repository as a ZIP file
2. Navigate to `chrome://extensions/`
3. Enable `Developer mode`
4. Click `Load unpacked` and the select downloaded file

+ Firefox
+ Persistent installation
1. Download the XPI file from the releases section
2. Navigate to `about:addons`
3. Click the settings icon and choose `Install Add-on From File...`
4. Select the downloaded file

+ Temporary installation
1. Download this repository as a ZIP file
2. Navigate to `about:debugging#/runtime/this-firefox`
3. Click `Load Temporary Add-on...` and select the downloaded file

Setup
+ Once installed, open the extension, click `Choose File` and select your Widevine Device file.
+ The files are saved in the extension's `chrome.storage.sync` storage and will be synchronized across any browsers into which the user is signed in with their Google account.
+ Due to the sync storage limit of 100KB, the maximum amount of installable of devices at the same time is ~30.
+ Check `Enabled` to activate the message interception and you're done.

Usage
All the user has to do is to play a DRM protected video and the decryption keys should appear in the `Keys` group box (if the service is not unsupported, as stated above).
Keys are saved:
+ Temporarily until the extension is either refreshed manually (if installed temporarily) or a removal of the keys is manually initiated.
+ Permanently in the extension's `chrome.storage.local` storage until manually wiped or exported via the command line.
Note: The video will not play when the interception is active, as the Widevine CDM library isn't able to decrypt the Android CDM license.
+ Click the `+` button to expand the section to reveal the PSSH and keys.

Issues
+ DRM playback won't work when the extension is disabled and EME Logger is active. This caused by my fix for dealing with EME Logger interference (solutions are welcome).

Hope you like it!

[2nHxWW6GkN1l916N3ayz8HQoi]

Nice. Would it be possible for a new feature that copies to clipboard a generated N_m3u8DL-RE command? Basically N_m3u8DL-RE "manifest" --key "keys" --save-name "video" and all the rest of the headers. Kinda like what stream detector does. I know I can combine the 2 addons but was wondering if it's possible for an all in one solution.

Amazing addon

[larley]

Unfortunately not, The Stream Detector seems to be using the webRequest API, which will be inaccesible on Chrome with the deprecation of MV2. I'm really trying to by compliant with the spec so that the extension can live as long as possible, so I guess users will have to install both extensions.
I think there's a way for extensions to communicate with one another (chrome.runtime.onMessageExternal), so maybe you could implement a bridge of some sort...

[notaghost]

Good work

[ddll]

best

[lomero]

wonderful tool. thanks for share it

[whs912km]

oooops issue here

tried your last tool from here https://mediasetinfinity.mediaset.it/movie/thenextthreedays/the-next-three-days_F303277101000102

but
1) can't play video with your tool ON. put OFF i can play without problem
2) i'm stuck here, no key, no play video ... (tried with Brave browser latest stable version)


[Attachment 83029 - Click to enlarge]

[larley]

Everything is working as it's supposed to. I should put that into the Usage guide:
+ Videos can't be played when the intercepting is ON, because the WidevineCDM library can't decrypt the license generated by the Android CDM. Sometimes videos are playable, but that's just because the website might try to request the license again and WidevineProxy2 won't intercept it again because the keys were already obtained.
+ The keys are right in front of you, just press the `+` button to expand the section ;D

[Gromyko]

Excellent. Thanks for the share.

[Silv3r]

fantastic work it would be nice if you could also add MPD url/link display

[larley]

That unfortunately not possible, as I don't (or won't soon) have access to the webRequest API (see post #3)

[whs912km]

yes, yu're right. all work fine

Videos can't be played when the intercepting is ON: nice to know

just press the '+' button to expand the section: also this nice to know. I thought '+' was used to add a link or something else, as generally happens. I thought the key was automatically generated like in widvFetch

[LZAA]

Installation.

Code:

"background": {
"scripts": ["background.js"],
"service_worker": "background.js",
"type": "module"
},

Error: ,,The "background.scripts" key cannot be used with manifest_version 3. Use the "background.service_worker" key instead."

Work code:

"background": {
"service_worker": "background.js",
"type": "module"
},

[larley]

Both are required to allow for Chrome and Firefox support at the same time: `service_worker` is for chrome, and `scripts` is for Firefox, as it doesn't support service workers yet. If you leave out the `scripts` property, you'll get:

Extension is invalid
Reading manifest: Error processing background: Value must either: contain the required "page" property, contain the required "scripts" property, or not contain an unexpected "type" property

[LZAA]

I edited 'manifest.json' only for 'Chromium' browsers because it gives an error during installation.

[larley]

That's indeed an error but it doesn't stop the extension from working. It's shown under `Errors` but it's actually just a warning.

[billybanana]

False positive ?


[Attachment 83038 - Click to enlarge]

[larley]

Yes, definitely:

[Attachment 83039 - Click to enlarge]

[whs912km]

first of all i would like to thank you for this new tool, i appreciate your work and your efforts for this.

just one question: why did you make this new tool when there was already have FoxRefire/cdrm guesser that both do the same stuff?
what's vantage of this latest work?
mine does not want to be a negative criticism, but just a simple curiosity question

[larley]

Some advantages:
+ Works on any site, regardless of the challenge encryption on the API endpoint (if the API accepts android challenges), so even Peacock, Vodafone TV, Fastevo, etc. out of the box
+ Will survive if Manifest V2 is deprecated soon by Chrome
+ Faster, because it uses a JavaScript native Widevine implementation (courtesy of node-widevine)

[larley]

I accidentally broke the video being allowed to play when the keys were already retrieved in v0.3. This was fixed in v0.4

[whs912km]

Some advantages:
+ Works on any site, regardless of the challenge encryption on the API endpoint (if the API accepts android challenges), so even Peacock, Vodafone TV, Fastevo, etc. out of the box
+ Will survive if Manifest V2 is deprecated soon by Chrome
+ Faster, because it uses a JavaScript native Widevine implementation (courtesy of node-widevine)

Thanks for the explanation.

and thanks again for your wonderful new tool

[fogers]

Big thanks larley for your work. This one works on sites that none of previous extensions worked. Appreciated for your work!