Trouble downloading/merging DASH CENC from OneDrive (SharePoint)

[impasser]

How can I download the video from the URL below? I can’t obtain the KEY. Although I saw a set of keywords from another link, decryption still seems to fail. How should I handle this?

My issue has already been addressed. Please refer to the link below:

https://gist.github.com/mfd/c990a01d626847a6d7e823dceca598e1

[notaghost]

I don’t know why would you remove the video link but you don’t need to download CENC dash you can get HLS manifest by changing the user agents.

With HLS you may need to append parameters to the segment. But you do not need to duplicate the parameters.
For now it doesn’t work with yt-dlp Streamlink N_m3u8DL-RE hlsdl

Whenever I mention this issue, they suggest writing your own extractor.

https://github.com/streamlink/streamlink/issues/6082

In YT-DLP Discord, they also suggest writing your own extractor for it.

[slayer36]

How can I download the video from the URL below? I can’t obtain the KEY. Although I saw a set of keywords from another link, decryption still seems to fail. How should I handle this?

My issue has already been addressed. Please refer to the link below:

https://gist.github.com/mfd/c990a01d626847a6d7e823dceca598e1

video url?

[impasser]

How can I download the video from the URL below? I can’t obtain the KEY. Although I saw a set of keywords from another link, decryption still seems to fail. How should I handle this?

My issue has already been addressed. Please refer to the link below:

https://gist.github.com/mfd/c990a01d626847a6d7e823dceca598e1

video url?

If you share a video from the enterprise version of OneDrive with the setting “Anyone with the link can view” and enable “Block download,” the video can be viewed. In practice, it will be played in Stream, but there will be no download button.

The reason it was removed is:

I have found a currently workable method.
The “anyone with the link” share link was accessed by too many people, which caused the server to block access.

[slayer36]

How can I download the video from the URL below? I can’t obtain the KEY. Although I saw a set of keywords from another link, decryption still seems to fail. How should I handle this?

My issue has already been addressed. Please refer to the link below:

https://gist.github.com/mfd/c990a01d626847a6d7e823dceca598e1

video url?

If you share a video from the enterprise version of OneDrive with the setting “Anyone with the link can view” and enable “Block download,” the video can be viewed. In practice, it will be played in Stream, but there will be no download button.

The reason it was removed is:

I have found a currently workable method.
The “anyone with the link” share link was accessed by too many people, which caused the server to block access.

may be useful, who knows


[Attachment 88715 - Click to enlarge]

{\"BlockSize\":128,\"EncryptionAlgorithm\":0,\"EncryptionMode\":1,\"IV\":\"myo4w5MPa3kz0Yc6zx9UXQ==\",\"Key\":\"Oe5XMCCw5lD96XNw4agluA==\",\"KeySize\":128,\"Kid\":\"e032846068c.223704.81102\",\"Padding\":\"None\"}

[notaghost]

Looks like IV and key buffer.
Does it work on segment?

I don’t think the standard methods will work in this case. Can’t say much without video url.

[notaghost]

the keys @slayer36 pointed are correct.

key_hex = "39ee573020b0e650fde97370e1a825b8"
iv_hex = "9B2A38C3930F6B7933D1873ACF1F545D"

we only need to decrypt the response of segments with AES CBC.
Usually, the initial segment is not encrypted, but that is not the case here.


I used mitm+yt-dlp a bit unusual method. I am sure there are better ways to do it.

mitmdump -s decrypt_mitm.py

from mitmproxy import http
from Crypto.Cipher import AES
from binascii import unhexlify
import logging

logging.basicConfig(level=logging.INFO)
logger = logging.getLogger("decrypt_mitm")

KEY_HEX = "39ee573020b0e650fde97370e1a825b8"
IV_HEX  = "9B2A38C3930F6B7933D1873ACF1F545D"

KEY = unhexlify(KEY_HEX)
IV  = unhexlify(IV_HEX)

TARGET_KID = "e032846068c.223704.81102"

class DecryptAddon:
    def __init__(self):
        self.counter = 0

    def response(self, flow: http.HTTPFlow) -> None:
        """
        Called for each HTTP response. If the request contains query param
        kid=TARGET_KID, attempt AES-CBC decrypt of the response body and
        replaces the response body with the decrypted bytes.
        """
        try:
            kid_val = flow.request.query.get("kid")
            if kid_val != TARGET_KID:
                return

            self.counter += 1
            url = flow.request.pretty_url
            logger.info(f"[{self.counter}] Matching flow: {url}")

            ciphertext = flow.response.content  # bytes

            cipher = AES.new(KEY, AES.MODE_CBC, IV)
            plaintext_padded = cipher.decrypt(ciphertext)

            pad_len = plaintext_padded[-1]
            if isinstance(pad_len, int) and 1 <= pad_len <= AES.block_size:
                if plaintext_padded[-pad_len:] == bytes([pad_len]) * pad_len:
                    plaintext = plaintext_padded[:-pad_len]
                else:
                    logger.warning("PKCS7 padding does not validate; writing raw decrypted bytes.")
                    plaintext = plaintext_padded
            else:
                logger.warning("Invalid padding byte; writing raw decrypted bytes.")
                plaintext = plaintext_padded

            flow.response.content = plaintext

        except Exception as e:
            logger.exception(f"Error while decrypting flow: {e}")


addons = [
    DecryptAddon()
]

and then used yt-dlp

yt-dlp --allow-un -o test.mp4 --proxy 127.0.0.1:8080 --no-check-certificates "https://japaneast1-mediap.svc.ms/transform/videomanifest?provider=spo&inputFormat=mp4&cs=fFNQTw&correlationId=c5bec5a1-7021-5000-cff2-0685d3033ccb&docid=https%3A%2F%2Ficka02-my.sharepoint.com%2Fpersonal%2Ficka_icka_in%2F_api%2Fv2.0%2Fdrives%2Fb%21n_CrQuCHekGJrUK-3jUQmWWMBlepmuNFouoiZtZAQhd09EMX2BJ7RrVC7uRNEus0%2Fitems%2F01C3EO2XJVTT75SN4UDFFYZ356AOGCAN27%3Ftempauth%3Dv1.eyJzaXRlaWQiOiI0MmFiZjA5Zi04N2UwLTQxN2EtODlhZC00MmJlZGUzNTEwOTkiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvaWNrYTAyLW15LnNoYXJlcG9pbnQuY29tQDlhZjIwYmJmLTJkMTktNGZmNi04N2Q4LTdmNzVkOTQzOTgwZSIsImV4cCI6IjE3NTc5MDA1MDkifQ.CiMKCXNoYXJpbmdpZBIWMEFlUzdwc2ZmRStYU1BTbGd4aWttUQoLCgRzbmlkEgMxNTQSCwi2_Kz8mPS5PhAFGg0xNTQuNTcuMjIzLjI1IhRtaWNyb3NvZnQuc2hhcmVwb2ludCosRDROdGtPaVRCZzJ4RzRUOThYZG9yZitHdGJnTEZPVHQwOWYva0YzM0thST0wswE4AUIQocW-xSFwAFDP8gaF0wM8y0oQaGFzaGVkcHJvb2Z0b2tlbmIEdHJ1ZXJLMGguZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYXRlbmFudGFub24jOWFmMjBiYmYtMmQxOS00ZmY2LTg3ZDgtN2Y3NWQ5NDM5ODBlegEwwgFLMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYXRlbmFudGFub24jOWFmMjBiYmYtMmQxOS00ZmY2LTg3ZDgtN2Y3NWQ5NDM5ODBlyAEB.9e8PAlrJ_Ci1zMJDNpl_hpipf0SA3Iz1-7bDdTrRyLw%26version%3DPublished&psi=5ca83257-bc76-4979-a9e2-3eca79ffab1d&enhanceAudio=true&cTag=%22c%3A%7BD9FF9C35-9437-4B19-8CEF-BE038C20375F%7D%2C1%22&action=Access&part=index&format=dash&altManifestMetadata=eyJBdWRpb0NvZGVjSW5mbyI6ImFhYyIsIkF1ZGlvRnJhbWVTaXplIjoxMDI0LCJBdWRpb1NhbXBsaW5nUmF0ZSI6NDgwMDAsIkF1ZGlvU3RhcnRUaW1lSW4xMDBOYW5vIjowLCJBdWRpb1N0cmVhbUR1cmF0aW9uMTAwTmFubyI6MTU1MzA2NDU4LCJCaXRyYXRlIjo0MzI4NzcsIkNUYWciOiJcImM6e2Q5ZmY5YzM1LTk0MzctNGIxOS04Y2VmLWJlMDM4YzIwMzc1Zn0sMVwiIiwiQ29udGFpbmVyU3RhcnRUaW1lSW4xMDBOYW5vIjowLCJDb250YWluc0F1ZGlvIjp0cnVlLCJDb250YWluc1ZpZGVvIjp0cnVlLCJDb250ZW50Q2F0ZWdvcnkiOiJub25fdGVhbXNfbWVldGluZyIsIkNyZWF0aW9uVW5peFRpbWVzdGFtcFNlY29uZHMiOjE3NTc0MzI2NDAsIkNyeXB0b2dyYXBoaWNEYXRhQ3JlYXRlZERhdGVVbml4IjoxNzU3NDMyNjQwLCJDcnlwdG9ncmFwaGljRGF0YUlWIjoiMHg5QjJBMzhDMzkzMEY2Qjc5MzNEMTg3M0FDRjFGNTQ1RCIsIkNyeXB0b2dyYXBoaWNEYXRhS2lkIjoiZTAzMjg0NjA2OGMuMjIzNzA0LjgxMTAyIiwiRHVyYXRpb24xMDBOYW5vIjoxNTUzMDY0NjAsIkZyYW1lU2l6ZSI6eyJoZWlnaHQiOjEwODAsIndpZHRoIjoxOTIwfSwiR29wU2l6ZSI6MTU0MzMzMDAwLCJIMjY0TGV2ZWwiOjUyLCJIYXNCRnJhbWVzIjpmYWxzZSwiSGVhZGVyT2Zmc2V0SW5CeXRlcyI6MTIwOTY2NywiSGVhZGVyU2l6ZSI6NjIzMSwiTWV0YWRhdGFTb3VyY2VJbmZvcm1hdGlvbiI6eyJBdWRpb1N0cmVhbUR1cmF0aW9uU291cmNlIjoxLCJBdWRpb1N0cmVhbVJlYWRCdWZmZXJTaXplSW5CeXRlcyI6ODE5MjAsIkNvbnRhaW5lckR1cmF0aW9uU291cmNlIjoxLCJWaWRlb0JpdHJhdGVTb3VyY2UiOjEsIlZpZGVvU3RyZWFtRHVyYXRpb25Tb3VyY2UiOjEsIlZpZGVvU3RyZWFtUmVhZEJ1ZmZlclNpemVJbkJ5dGVzIjo4MTkyMH0sIlBhY2tlZEZyYW1lUmF0ZSI6eyJIaWdoIjoyMDcwMDAwLCJMb3ciOjQ2Mzk5OX0sIlByZW1pdW1WaWRlb1ByZXRyYW5zY29kZURhdGEiOm51bGwsIlJlYWxCYXNlRnJhbWVSYXRlIjp7IkhpZ2giOjMwLCJMb3ciOjF9LCJVcGRhdGVhYmxlQXVkaW9UcmFja3MiOltdLCJWZXJzaW9uIjp7Il9CdWlsZCI6LTEsIl9NYWpvciI6OCwiX01pbm9yIjowLCJfUmV2aXNpb24iOi0xfSwiVmlkZW9Db2RlY0luZm8iOiJoMjY0IiwiVmlkZW9QcmV0cmFuc2NvZGVEYXRhIjp7IkF1ZGlvUXVhbGl0eUlkcyI6ImF1ZG1lZCxhdWRoaWdoIiwiU2VnbWVudENvdW50IjoyLCJWaWRlb1F1YWxpdHlJZHMiOiJ2MjQwcCx2NDgwcCx2NzIwcCx2MTA4MHAifSwiVmlkZW9TdGFydFRpbWVJbjEwME5hbm8iOjAsIlZpZGVvU3RyZWFtRHVyYXRpb24xMDBOYW5vIjoxNTQ2NjYzMzN9&altTranscode=1&useScf=true&pretranscode=0&transcodeahead=0&enableCdn=1&hybridPlayback=false&oif=4kp&pn=hostApp-OnePlayer-Web&hedging=2"

[slayer36]

the keys @slayer36 pointed are correct.

key_hex = "39ee573020b0e650fde97370e1a825b8"
iv_hex = "9B2A38C3930F6B7933D1873ACF1F545D"

we only need to decrypt the response of segments with AES CBC.
Usually, the initial segment is not encrypted, but that is not the case here.


I used mitm+yt-dlp a bit unusual method. I am sure there are better ways to do it.

mitmdump -s decrypt_mitm.py

from mitmproxy import http
from Crypto.Cipher import AES
from binascii import unhexlify
import logging

logging.basicConfig(level=logging.INFO)
logger = logging.getLogger("decrypt_mitm")

KEY_HEX = "39ee573020b0e650fde97370e1a825b8"
IV_HEX  = "9B2A38C3930F6B7933D1873ACF1F545D"

KEY = unhexlify(KEY_HEX)
IV  = unhexlify(IV_HEX)

TARGET_KID = "e032846068c.223704.81102"

class DecryptAddon:
    def __init__(self):
        self.counter = 0

    def response(self, flow: http.HTTPFlow) -> None:
        """
        Called for each HTTP response. If the request contains query param
        kid=TARGET_KID, attempt AES-CBC decrypt of the response body and
        replaces the response body with the decrypted bytes.
        """
        try:
            kid_val = flow.request.query.get("kid")
            if kid_val != TARGET_KID:
                return

            self.counter += 1
            url = flow.request.pretty_url
            logger.info(f"[{self.counter}] Matching flow: {url}")

            ciphertext = flow.response.content  # bytes

            cipher = AES.new(KEY, AES.MODE_CBC, IV)
            plaintext_padded = cipher.decrypt(ciphertext)

            pad_len = plaintext_padded[-1]
            if isinstance(pad_len, int) and 1 <= pad_len <= AES.block_size:
                if plaintext_padded[-pad_len:] == bytes([pad_len]) * pad_len:
                    plaintext = plaintext_padded[:-pad_len]
                else:
                    logger.warning("PKCS7 padding does not validate; writing raw decrypted bytes.")
                    plaintext = plaintext_padded
            else:
                logger.warning("Invalid padding byte; writing raw decrypted bytes.")
                plaintext = plaintext_padded

            flow.response.content = plaintext

        except Exception as e:
            logger.exception(f"Error while decrypting flow: {e}")


addons = [
    DecryptAddon()
]

and then used yt-dlp

yt-dlp --allow-un -o test.mp4 --proxy 127.0.0.1:8080 --no-check-certificates "https://japaneast1-mediap.svc.ms/transform/videomanifest?provider=spo&inputFormat=mp4&cs=fFNQTw&correlationId=c5bec5a1-7021-5000-cff2-0685d3033ccb&docid=https%3A%2F%2Ficka02-my.sharepoint.com%2Fpersonal%2Ficka_icka_in%2F_api%2Fv2.0%2Fdrives%2Fb%21n_CrQuCHekGJrUK-3jUQmWWMBlepmuNFouoiZtZAQhd09EMX2BJ7RrVC7uRNEus0%2Fitems%2F01C3EO2XJVTT75SN4UDFFYZ356AOGCAN27%3Ftempauth%3Dv1.eyJzaXRlaWQiOiI0MmFiZjA5Zi04N2UwLTQxN2EtODlhZC00MmJlZGUzNTEwOTkiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvaWNrYTAyLW15LnNoYXJlcG9pbnQuY29tQDlhZjIwYmJmLTJkMTktNGZmNi04N2Q4LTdmNzVkOTQzOTgwZSIsImV4cCI6IjE3NTc5MDA1MDkifQ.CiMKCXNoYXJpbmdpZBIWMEFlUzdwc2ZmRStYU1BTbGd4aWttUQoLCgRzbmlkEgMxNTQSCwi2_Kz8mPS5PhAFGg0xNTQuNTcuMjIzLjI1IhRtaWNyb3NvZnQuc2hhcmVwb2ludCosRDROdGtPaVRCZzJ4RzRUOThYZG9yZitHdGJnTEZPVHQwOWYva0YzM0thST0wswE4AUIQocW-xSFwAFDP8gaF0wM8y0oQaGFzaGVkcHJvb2Z0b2tlbmIEdHJ1ZXJLMGguZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYXRlbmFudGFub24jOWFmMjBiYmYtMmQxOS00ZmY2LTg3ZDgtN2Y3NWQ5NDM5ODBlegEwwgFLMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYXRlbmFudGFub24jOWFmMjBiYmYtMmQxOS00ZmY2LTg3ZDgtN2Y3NWQ5NDM5ODBlyAEB.9e8PAlrJ_Ci1zMJDNpl_hpipf0SA3Iz1-7bDdTrRyLw%26version%3DPublished&psi=5ca83257-bc76-4979-a9e2-3eca79ffab1d&enhanceAudio=true&cTag=%22c%3A%7BD9FF9C35-9437-4B19-8CEF-BE038C20375F%7D%2C1%22&action=Access&part=index&format=dash&altManifestMetadata=eyJBdWRpb0NvZGVjSW5mbyI6ImFhYyIsIkF1ZGlvRnJhbWVTaXplIjoxMDI0LCJBdWRpb1NhbXBsaW5nUmF0ZSI6NDgwMDAsIkF1ZGlvU3RhcnRUaW1lSW4xMDBOYW5vIjowLCJBdWRpb1N0cmVhbUR1cmF0aW9uMTAwTmFubyI6MTU1MzA2NDU4LCJCaXRyYXRlIjo0MzI4NzcsIkNUYWciOiJcImM6e2Q5ZmY5YzM1LTk0MzctNGIxOS04Y2VmLWJlMDM4YzIwMzc1Zn0sMVwiIiwiQ29udGFpbmVyU3RhcnRUaW1lSW4xMDBOYW5vIjowLCJDb250YWluc0F1ZGlvIjp0cnVlLCJDb250YWluc1ZpZGVvIjp0cnVlLCJDb250ZW50Q2F0ZWdvcnkiOiJub25fdGVhbXNfbWVldGluZyIsIkNyZWF0aW9uVW5peFRpbWVzdGFtcFNlY29uZHMiOjE3NTc0MzI2NDAsIkNyeXB0b2dyYXBoaWNEYXRhQ3JlYXRlZERhdGVVbml4IjoxNzU3NDMyNjQwLCJDcnlwdG9ncmFwaGljRGF0YUlWIjoiMHg5QjJBMzhDMzkzMEY2Qjc5MzNEMTg3M0FDRjFGNTQ1RCIsIkNyeXB0b2dyYXBoaWNEYXRhS2lkIjoiZTAzMjg0NjA2OGMuMjIzNzA0LjgxMTAyIiwiRHVyYXRpb24xMDBOYW5vIjoxNTUzMDY0NjAsIkZyYW1lU2l6ZSI6eyJoZWlnaHQiOjEwODAsIndpZHRoIjoxOTIwfSwiR29wU2l6ZSI6MTU0MzMzMDAwLCJIMjY0TGV2ZWwiOjUyLCJIYXNCRnJhbWVzIjpmYWxzZSwiSGVhZGVyT2Zmc2V0SW5CeXRlcyI6MTIwOTY2NywiSGVhZGVyU2l6ZSI6NjIzMSwiTWV0YWRhdGFTb3VyY2VJbmZvcm1hdGlvbiI6eyJBdWRpb1N0cmVhbUR1cmF0aW9uU291cmNlIjoxLCJBdWRpb1N0cmVhbVJlYWRCdWZmZXJTaXplSW5CeXRlcyI6ODE5MjAsIkNvbnRhaW5lckR1cmF0aW9uU291cmNlIjoxLCJWaWRlb0JpdHJhdGVTb3VyY2UiOjEsIlZpZGVvU3RyZWFtRHVyYXRpb25Tb3VyY2UiOjEsIlZpZGVvU3RyZWFtUmVhZEJ1ZmZlclNpemVJbkJ5dGVzIjo4MTkyMH0sIlBhY2tlZEZyYW1lUmF0ZSI6eyJIaWdoIjoyMDcwMDAwLCJMb3ciOjQ2Mzk5OX0sIlByZW1pdW1WaWRlb1ByZXRyYW5zY29kZURhdGEiOm51bGwsIlJlYWxCYXNlRnJhbWVSYXRlIjp7IkhpZ2giOjMwLCJMb3ciOjF9LCJVcGRhdGVhYmxlQXVkaW9UcmFja3MiOltdLCJWZXJzaW9uIjp7Il9CdWlsZCI6LTEsIl9NYWpvciI6OCwiX01pbm9yIjowLCJfUmV2aXNpb24iOi0xfSwiVmlkZW9Db2RlY0luZm8iOiJoMjY0IiwiVmlkZW9QcmV0cmFuc2NvZGVEYXRhIjp7IkF1ZGlvUXVhbGl0eUlkcyI6ImF1ZG1lZCxhdWRoaWdoIiwiU2VnbWVudENvdW50IjoyLCJWaWRlb1F1YWxpdHlJZHMiOiJ2MjQwcCx2NDgwcCx2NzIwcCx2MTA4MHAifSwiVmlkZW9TdGFydFRpbWVJbjEwME5hbm8iOjAsIlZpZGVvU3RyZWFtRHVyYXRpb24xMDBOYW5vIjoxNTQ2NjYzMzN9&altTranscode=1&useScf=true&pretranscode=0&transcodeahead=0&enableCdn=1&hybridPlayback=false&oif=4kp&pn=hostApp-OnePlayer-Web&hedging=2"

thanks for the help man, really appreciated.