widevine

README

widevine

Theatricality and deception, powerful agents to the uninitiated. But we are initiated, aren’t we, Bruce?

The Dark Knight Rises (2012)

Widevine implementation. first Widevine commit was May 21 2022:

https://github.com/gucio321/mech/commit/9d3dff51

wvdumper/dumper

install Android Studio [1]. then create Android virtual device:

abi

x86

api level

24

target

Android 7.0 (Google APIs)

then download Widevine Dumper [2]. Then install:

pip install -r requirements.txt

then download Frida server [3], example file:

frida-server-15.1.17-android-x86.xz

then start Frida server:

adb root
adb push frida-server-15.1.17-android-x86 /data/frida-server
adb shell chmod +x /data/frida-server
adb shell /data/frida-server

then start Android Chrome and visit Shaka Player [4]. click the green play button. if you receive this prompt:

bitmovin.com wants to play protected content. Your device’s identity will be verified by Google.

click ALLOW. then start dumper:

$env:PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION = 'python'
python dump_keys.py

once you see "Hooks completed", go back to Chrome and click the green play button again. result:

2022-05-21 02:10:52 PM - Helpers.Scanner - 49 - INFO - Key pairs saved at
key_dumps\Android Emulator 5554/private_keys/4464/2770936375

1. https://developer.android.com/studio
2. https://github.com/wvdumper/dumper
3. https://github.com/frida/frida/releases
4. https://integration.widevine.com/player

where did proto file come from?

https://github.com/rlaphoenix/pywidevine/blob/master/pywidevine/license_protocol.proto

other tools

• https://github.com/Jnzzi/4464_L3-CDM
• https://github.com/FoxRefire/wvg
• https://github.com/hyugogirubato/KeyDive
• https://github.com/search?q=L3+CDM
• https://integration.widevine.com/diagnostics

Documentation

Index

• type Cdm
  • func (c *Cdm) Block(body ResponseBody) (cipher.Block, error)
  • func (c *Cdm) New(private_key, client_id, pssh []byte) error
  • func (c *Cdm) RequestBody() ([]byte, error)
• type KeyContainer
  • func (k KeyContainer) Id() []byte
  • func (k KeyContainer) Key(block cipher.Block) []byte
• type Pssh
  • func (p *Pssh) Marshal() []byte
• type ResponseBody
  • func (r ResponseBody) Container() func() (KeyContainer, bool)
  • func (r *ResponseBody) Unmarshal(data []byte) error

Types

type Cdm

type Cdm struct {
	// contains filtered or unexported fields
}

func (*Cdm) Block

func (c *Cdm) Block(body ResponseBody) (cipher.Block, error)

func (*Cdm) New

func (c *Cdm) New(private_key, client_id, pssh []byte) error

func (*Cdm) RequestBody

func (c *Cdm) RequestBody() ([]byte, error)

type KeyContainer

type KeyContainer [1]protobuf.Message

func (KeyContainer) Id

func (k KeyContainer) Id() []byte

func (KeyContainer) Key

func (k KeyContainer) Key(block cipher.Block) []byte

type Pssh

type Pssh struct {
	ContentId []byte
	KeyIds    [][]byte
}

func (*Pssh) Marshal

func (p *Pssh) Marshal() []byte

type ResponseBody

type ResponseBody [1]protobuf.Message

SignedMessage LICENSE = 2;

func (ResponseBody) Container

func (r ResponseBody) Container() func() (KeyContainer, bool)

func (*ResponseBody) Unmarshal

func (r *ResponseBody) Unmarshal(data []byte) error