hulu

README

Hulu

1. hulu.com
2. change plan to Hulu
3. with ads has free trial, but I think no ads has more UHD
4. email
   • mailsac.com
5. password
6. name
7. birthdate
8. gender
9. agree & continue
10. name on card
11. card number
12. expiration
13. cvc
14. zip code
15. agree & subscribe

Android

• https://play.google.com/store/apps/details?id=com.hulu.livingroomplus
• https://play.google.com/store/apps/details?id=com.hulu.plus

Create Android 6 device. Install user certificate. after entering password, if you click LOG IN you get this:

Hmm. Something’s up. Please check your internet settings and try again. If all’s fine on your end, visit our Help Center.

system certificate? same result. if we disable proxy? it works. next:

https://github.com/httptoolkit/frida-interception-and-unpinning

pip install frida-tools

download and extract server:

https://github.com/frida/frida/releases

for example:

frida-server-16.1.4-android-x86.xz

install app, then push server:

adb root
adb push frida-server-16.1.5-android-x86 /data/app/frida-server
adb shell chmod +x /data/app/frida-server
adb shell /data/app/frida-server

then:

frida -U `
-l config.js `
-l android/android-certificate-unpinning.js `
-f com.hulu.plus

this worked a couple of times:

+++ b/android/android-certificate-unpinning.js
@@ -223,7 +223,7 @@ const PINNING_FIXES = {

     'okhttp3.CertificatePinner': [
         {
-            methodName: 'check',
+            methodName: 'a',
             overload: ['java.lang.String', 'java.util.List'],
             replacement: () => NO_OP
         },

but it seems to be a race condition or something, as it only works sometimes. like it might fail the first time, but then if I restart the app it will work. not sure.

https://github.com/httptoolkit/frida-interception-and-unpinning/issues/55

Documentation

Index

• Variables
• func Id(rawUrl string) (string, error)
• type DeepLink
• type Playlist
  • func (p *Playlist) PlayReady(data []byte) ([]byte, error)
  • func (p *Playlist) Widevine(data []byte) ([]byte, error)
• type Session
  • func (s *Session) DeepLink(id string) (*DeepLink, error)
  • func (s *Session) Playlist(deep *DeepLink) (*Playlist, error)
  • func (s *Session) Refresh() error
  • func (s *Session) Unmarshal(data SessionData) error
• type SessionData
  • func FetchSession(email, password string) (SessionData, error)

Variables

var Transport = http.Transport{
	Proxy: func(req *http.Request) (*url.URL, error) {
		if path.Ext(req.URL.Path) != ".mp4" {
			log.Println(req.Method, req.URL)
		}
		return http.ProxyFromEnvironment(req)
	},
}

Functions

func Id

func Id(rawUrl string) (string, error)

hulu.com/movie/05e76ad8-c3dd-4c3e-bab9-df3cf71c6871 hulu.com/movie/alien-romulus-05e76ad8-c3dd-4c3e-bab9-df3cf71c6871

Types

type DeepLink

type DeepLink struct {
	EabId   string `json:"eab_id"`
	Message string
}

type Playlist

type Playlist struct {
	DashPrServer string `json:"dash_pr_server"`
	WvServer     string `json:"wv_server"`
	Message      string
	StreamUrl    string `json:"stream_url"` // MPD
}

func (*Playlist) PlayReady

func (p *Playlist) PlayReady(data []byte) ([]byte, error)

func (*Playlist) Widevine

func (p *Playlist) Widevine(data []byte) ([]byte, error)

type Session

type Session struct {
	DeviceToken string `json:"device_token"`
	UserToken   string `json:"user_token"`
}

func (*Session) DeepLink

func (s *Session) DeepLink(id string) (*DeepLink, error)

func (*Session) Playlist

func (s *Session) Playlist(deep *DeepLink) (*Playlist, error)

1080p (FHD) L3, SL2000 1440p (QHD) L1, SL3000 2160p (UHD) L1, SL3000

func (*Session) Refresh

func (s *Session) Refresh() error

returns user_token only

func (*Session) Unmarshal

func (s *Session) Unmarshal(data SessionData) error

type SessionData

type SessionData []byte

func FetchSession

func FetchSession(email, password string) (SessionData, error)