widevine

README

widevine

Theatricality and deception, powerful agents to the uninitiated. But we are initiated, aren’t we, Bruce?

The Dark Knight Rises (2012)

Widevine implementation. first Widevine commit was May 21 2022:

https://github.com/gucio321/mech/commit/9d3dff51fbfe8e9ceec5db8d328b7da7434953dc

wvdumper/dumper

install Android Studio [1]. then create Android virtual device:

abi

x86

api level

24

target

Android 7.0 (Google APIs)

then download Widevine Dumper [2]. Then install:

pip install -r requirements.txt

then download Frida server [3], example file:

frida-server-15.1.17-android-x86.xz

then start Frida server:

adb root
adb push frida-server-15.1.17-android-x86 /data/frida-server
adb shell chmod +x /data/frida-server
adb shell /data/frida-server

then start Android Chrome and visit Shaka Player [4]. click the green play button. if you receive this prompt:

bitmovin.com wants to play protected content. Your device’s identity will be verified by Google.

click ALLOW. then start dumper:

$env:PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION = 'python'
python dump_keys.py

once you see "Hooks completed", go back to Chrome and click the green play button again. result:

2022-05-21 02:10:52 PM - Helpers.Scanner - 49 - INFO - Key pairs saved at
key_dumps\Android Emulator 5554/private_keys/4464/2770936375

1. https://developer.android.com/studio
2. https://github.com/wvdumper/dumper
3. https://github.com/frida/frida/releases
4. https://integration.widevine.com/player

where did proto file come from?

media_cas_proxy_sdk\ubuntu\protos\public

other tools

• https://github.com/Jnzzi/4464_L3-CDM
• https://github.com/FoxRefire/wvg
• https://github.com/hyugogirubato/KeyDive
• https://github.com/search?q=L3+CDM
• https://integration.widevine.com/diagnostics

Documentation

Overview

crypto.go

errors.go

pssh.go

request.go

response.go

Index

• func DecodePrivateKey(pemData []byte) (*rsa.PrivateKey, error)
• func EncodeSignedMessage(requestData []byte, privateKey *rsa.PrivateKey) ([]byte, error)
• func GetKey(keys []*KeyContainer, id []byte) ([]byte, error)
• type KeyContainer
  • func DecodeLicenseResponse(responseData []byte, requestData []byte, privateKey *rsa.PrivateKey) ([]*KeyContainer, error)
• type LicenseError
  • func (le *LicenseError) Error() string
• type PsshData
  • func DecodePsshData(data []byte) (*PsshData, error)
  • func (p *PsshData) Encode() ([]byte, error)
  • func (p *PsshData) EncodeLicenseRequest(clientId []byte) ([]byte, error)

Functions

func DecodePrivateKey

func DecodePrivateKey(pemData []byte) (*rsa.PrivateKey, error)

func EncodeSignedMessage

func EncodeSignedMessage(requestData []byte, privateKey *rsa.PrivateKey) ([]byte, error)

EncodeSignedMessage envelopes the request with an RSA signature.

func GetKey

func GetKey(keys []*KeyContainer, id []byte) ([]byte, error)

GetKey searches for a key by its ID in a slice of KeyContainers. If the key is found, it returns the key and a nil error. If the key is not found, it returns nil and an error.

Types

type KeyContainer

type KeyContainer struct {
	Id  []byte
	Iv  []byte
	Key []byte
}

func DecodeLicenseResponse

func DecodeLicenseResponse(responseData []byte, requestData []byte, privateKey *rsa.PrivateKey) ([]*KeyContainer, error)

type LicenseError

type LicenseError struct {
	ErrorCode *protobuf.Field
}

LicenseError reflects the structure of the Widevine LicenseError protobuf.

func (*LicenseError) Error

func (le *LicenseError) Error() string

Error implements the standard Go error interface.

type PsshData

type PsshData struct {
	KeyIds    [][]byte
	ContentId []byte
}

PsshData represents the Widevine-specific protobuf message.

func DecodePsshData

func DecodePsshData(data []byte) (*PsshData, error)

DecodePsshData parses the protobuf wire format into a PsshData struct.

func (*PsshData) Encode

func (p *PsshData) Encode() ([]byte, error)

Encode serializes the PsshData struct into the protobuf wire format.

func (*PsshData) EncodeLicenseRequest

func (p *PsshData) EncodeLicenseRequest(clientId []byte) ([]byte, error)

EncodeLicenseRequest creates and serializes a LicenseRequest protobuf message.