Help to understand Movistar+ on SmartTV process

[harrenkyym]

Hi everyone.

I noticed that the content from Movistar+ on my Google TV is different from the browser one. (It's not just UHD, which I don't care, it is the video itself, the content on the browser has an age rating symbol in a corner over the video... ) So I used mitmproxy to sniff my TV traffic when I play the content and I only got 2 interesting things.

A POST call to https://securetime.playready.microsoft.com/securetime

Flow Details
2025-01-08 23:11:13 POST https://securetime.playready.microsoft.com/securetime
← 200 OK text/plain 1.5k 1.81s
Request Response Detail
Host: securetime.playready.microsoft.com
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept: /
Accept-Encoding: deflate
Content-Type: application/xml
SOAPAction: http://schemas.microsoft.com/DRM/2007/03/protocols/AcquireLicense
Pragma: no-cache
Content-Length: 175
XML [m:auto]<SECURETIME TYPE="CHALLENGE">
<DATA>UFJLQgAAAAEAAABYAAGFDSGSDG3AQAOAB4AAAAAAAA A/azkh7OdAbL+CoIM2IgQCrsGADRFHpWUAAQACAAAAIAABABJDDA AAk8UgMCr/E6+azooSzZushQ==</DATA> (I've changed the data a little bit)
</SECURETIME>

and a GET where I get the MPD


Host: infinity-c38.youboranqs01.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Linux; Android 11; Smart TV Pro Build/RP1A.200622.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/131.0.6778.135 Mobile Safari/537.36
Accept: /
Origin: http://vodclientui.dof6.com/
X-Requested-With: com.movistarplus.androidtv
Referer: http://vodclientui.dof6.com/
Accept-Encoding: gzip, deflate
Accept-Language: es-ES,es;q=0.9,en-US;q=0.8,en;q=0.7

Query
accountCode: movistar_plus
username: XXXXXXXXXXXXXXXX
deviceInfo: {"deviceCode":"AndroidTV"}
title: XXX
live: false
mediaDuration: 2959
mediaResource: https://vod-dash4k-movistarplus.emisiondof6.com/prod/uhd_dash/cplus-2192664-uhd-02_cpl...anifestuhd.mpd
playerVersion: Exoplayer MTV
param1: 22
param8: HZ
param9: 0
param10: ExoPlayer 11
param11: XXXXXXXXXXXX
playerStartupTime: 54287
obfuscateIp: false
p2pEnabled: false
pluginVersion: 6.5.0-movistarexocustom-js
pluginInfo: {"lib":"6.8.50","adapter":"6.5.0-movistarexocustom-js","adAdapter":null}
connectionType: ethernet
referer: http://vodclientui.dof6.com/android.tv/production_app_nux_2.3/index.html
userType: OTT
adsExpected: false
deviceUUID: XXXXXXXXXXXXXXX
libVersion: 6.8.50
appName: movistarplus_smarttv
appReleaseVersion: 4.2.3
contentType: vod
playbackType: VoD
contentId: 2192664
contractedResolution: 4K
timemark: 1736060063240
system: movistar_plus
sessionRoot: V_20001667_2iq4ibtwphznvm4
pingTime: 5
code: V_20001667_2iq4ibtwphznvm4_1736060063236
cdn: TELEFO
nodeHost: ceimpe1-04.Madrid_Penuelas.1,
nodeType: 1
nodeTypeString: c

When I use pyplayready I get a WRMHEADER

<WRMHEADER xmlns="http://schemas.microsoft.com/DRM/2007/03/PlayReadyHeader" version="4.0.0.0"><DATA><PROTECTINFO><KEYLEN>16</KEYLEN><ALGID>AESCTR</ALGID></PROTECTINFO><KID>LyUAbFGVT067yNGxmVlzsQ==</KID><CHECKSUM>jSDhcUOFG2o=</CHECKSUM><LA_URL>https://sspplayreadyls/TFAESP/prls/contentlicenseservice/v1/licenses</LA_URL><CUSTOMATTRIBUTES><nv:ContentId xmlns:nv="urnchema-ssp-nagra-com">1193538</nv:ContentId></CUSTOMATTRIBUTES></DATA></WRMHEADER>

where the URL clearly is not usefull as it's not a domain...

I've decompiled the apk and the only useful thing I see is that:

@Override // com.google.android.exoplayer2.drm.MediaDrmCallback
public byte[] executeProvisionRequest(UUID uuid, ExoMediaDrm.ProvisionRequest provisionRequest) throws IOException {
return executePost(this.dataSourceFactory, provisionRequest.getDefaultUrl() + "&signedRequest=" + Util.fromUtf8Bytes(provisionRequest.getData()), null, null);
}

@Override // com.google.android.exoplayer2.drm.MediaDrmCallback
public byte[] executeKeyRequest(UUID uuid, ExoMediaDrm.KeyRequest keyRequest) throws Exception {
String str;
String licenseServerUrl = keyRequest.getLicenseServerUrl();
if (this.forceDefaultLicenseUrl || TextUtils.isEmpty(licenseServerUrl)) {
licenseServerUrl = this.defaultLicenseUrl;
}
HashMap hashMap = new HashMap();
if (C.PLAYREADY_UUID.equals(uuid)) {
str = "text/xml";
} else {
str = C.CLEARKEY_UUID.equals(uuid) ? "application/json" : PlayerTV.DRM_HEADERS_ACCEPT_VALUE;
}
hashMap.put(PlayerTV.DRM_HEADERS_CONTENT_TYPE_KEY, str);
if (C.PLAYREADY_UUID.equals(uuid)) {
hashMap.put("SOAPAction", "http://schemas.microsoft.com/DRM/2007/03/protocols/AcquireLicense");
}
synchronized (this.keyRequestProperties) {
hashMap.putAll(this.keyRequestProperties);
}
return executePost(this.dataSourceFactory, licenseServerUrl, keyRequest.getData(), hashMap);
}

that confirms the call to the microsoft server, but after that... I'm lost. I just want to understand the process. :/ (And well, yeah, in the end, get a key)

[Baldrick]

Movistar+ is not a free service.

https://forum.videohelp.com/threads/404993-Please-ONLY-ask-for-help-videos-that-everyo...ere-is-my-post