1x BET: Rtmpdump maybe token?

warah · #1 07-16-2017, 10:00 PM

Hi guys, this is my first post here, i've been trying to get this rtmpe, i've read all the threads but im getting crazy, maybe you can help me:

website with all live streamings
https://ar.1xbet.com/es/live/

if you get an free account, you can see, if not use this:
u: 19676295 / p: vp7funtu

So, always is the same structure for all streamings, with rtmpsuck i get:

Code:

Streaming on rtmp://0.0.0.0:1935
Processing connect
app: xlive?vi=735320&
flashVer: MAC 26,0,0,137
swfUrl: https://ar.1xbet.com/getZone/VideoPlayer.swf
tcUrl: rtmpe://93.189.57.254:1935/xlive?vi=735320&
pageUrl: https://ar.1xbet.com/es/live/

So, i go to the rtmpdump with this, but i think that im forgeting the token or something... what u think?

p.d:I've also used wireshark to sniff, but it's encrypted, so I couldnt

I really appreciate your responses!

Code:

MM2015:nodejs matias$ rtmpdump -r "rtmp://93.189.57.254:1935/xlive?vi=735320&" -f "MAC 26,0,0,137" -W "https://ar.1xbet.com/getZone/VideoPlayer.swf" --live -y "xlive?vi=735320&" -z -o pepe.mp4

RTMPDump v2.4
(c) 2010 Andrej Stepanchuk, Howard Chu, The Flvstreamer Team; license: GPL
DEBUG: Protocol : RTMP
DEBUG: Hostname : 93.189.57.254
DEBUG: Port     : 1935
DEBUG: Playpath : 735320
DEBUG: tcUrl    : rtmp://93.189.57.254:1935/xlive?vi=735320&
DEBUG: swfUrl   : https://ar.1xbet.com/getZone/VideoPlayer.swf
DEBUG: app      : xlive?vi=735320&
DEBUG: flashVer : MAC 26,0,0,137
DEBUG: live     : yes
DEBUG: timeout  : 30 sec
DEBUG: SWFSHA256:
DEBUG: 08 03 08 b8 0c f4 20 76 b0 84 8a a4 f3 69 b2 ff
DEBUG: b6 eb 68 73 77 0b 0b 85 86 1d 8c 8d c7 d6 cf 39
DEBUG: SWFSize  : 286540
DEBUG: Setting buffer time to: 36000000ms
Connecting ...
DEBUG: RTMP_Connect1, ... connected, handshaking
DEBUG: HandShake: Client type: 03
DEBUG: HandShake: Client digest offset: 244
DEBUG: HandShake: Initial client digest: 
DEBUG: 20 04 1b d2 f7 9e d0 d5 31 c3 bb ef e3 68 30 71
DEBUG: 33 f8 59 5b 21 3f 1d 36 88 be 27 2c 7e 98 cc f6
DEBUG: HandShake: Type Answer   : 03
DEBUG: HandShake: Server Uptime : 940081089
DEBUG: HandShake: FMS Version   : 5.0.14.1
DEBUG: HandShake: Calculated digest key from secure key and server digest: 
DEBUG: af 1f 24 f1 74 cc 0e c4 12 38 e5 a7 48 e4 41 6e
DEBUG: 90 20 b3 3a d8 f9 f8 fe e8 d3 a6 5d f8 bd 08 c9
DEBUG: HandShake: Client signature calculated:
DEBUG: 83 e0 31 6d f7 08 59 64 b3 ac d1 d9 49 f0 b4 63
DEBUG: 2c 76 c1 0e c2 f0 14 12 3f d6 6b bf bb cf a6 9c
DEBUG: HandShake: Server sent signature:
DEBUG: 27 64 64 fc ee cc 21 4d 41 a7 79 b5 c2 35 c6 3c
DEBUG: 31 cd d0 f3 ba 67 9c e8 49 d7 b0 68 c4 ef 15 da
DEBUG: HandShake: Digest key: 
DEBUG: d4 f6 16 87 77 5c aa 92 60 07 b9 3a 81 f8 52 ee
DEBUG: 42 a6 93 e3 a9 7e de 6b c0 39 b4 32 cf b3 30 7b
DEBUG: HandShake: Signature calculated:
DEBUG: 27 64 64 fc ee cc 21 4d 41 a7 79 b5 c2 35 c6 3c
DEBUG: 31 cd d0 f3 ba 67 9c e8 49 d7 b0 68 c4 ef 15 da
DEBUG: HandShake: Genuine Adobe Flash Media Server
DEBUG: HandShake: Handshaking finished....
DEBUG: RTMP_Connect1, handshaked
DEBUG2: RTMP_SendPacket: fd=4, size=280
DEBUG2:   0000:  03 00 00 00 00 01 18 14  00 00 00 00               ............      
DEBUG2:   0000:  02 00 07 63 6f 6e 6e 65  63 74 00 3f f0 00 00 00   ...connect.?....  
DEBUG2:   0010:  00 00 00 03 00 03 61 70  70 02 00 10 78 6c 69 76   ......app...xliv  
DEBUG2:   0020:  65 3f 76 69 3d 37 33 35  33 32 30 26 00 08 66 6c   e?vi=735320&..fl  
DEBUG2:   0030:  61 73 68 56 65 72 02 00  0e 4d 41 43 20 32 36 2c   ashVer...MAC 26,  
DEBUG2:   0040:  30 2c 30 2c 31 33 37 00  06 73 77 66 55 72 6c 02   0,0,137..swfUrl.  
DEBUG2:   0050:  00 2c 68 74 74 70 73 3a  2f 2f 61 72 2e 31 78 62   .,https://ar.1xb  
DEBUG2:   0060:  65 74 2e 63 6f 6d 2f 67  65 74 5a 6f 6e 65 2f 56   et.com/getZone/V  
DEBUG2:   0070:  69 64 65 6f 50 6c 61 79  65 72 2e 73 77 66 00 05   ideoPlayer.swf..  
DEBUG2:   0000:  c3                                                 .                 
DEBUG2:   0000:  74 63 55 72 6c 02 00 2a  72 74 6d 70 3a 2f 2f 39   tcUrl..*rtmp://9  
DEBUG2:   0010:  33 2e 31 38 39 2e 35 37  2e 32 35 34 3a 31 39 33   3.189.57.254:193  
DEBUG2:   0020:  35 2f 78 6c 69 76 65 3f  76 69 3d 37 33 35 33 32   5/xlive?vi=73532  
DEBUG2:   0030:  30 26 00 04 66 70 61 64  01 00 00 0c 63 61 70 61   0&..fpad....capa  
DEBUG2:   0040:  62 69 6c 69 74 69 65 73  00 40 2e 00 00 00 00 00   bilities.@......  
DEBUG2:   0050:  00 00 0b 61 75 64 69 6f  43 6f 64 65 63 73 00 40   ...audioCodecs.@  
DEBUG2:   0060:  a8 ee 00 00 00 00 00 00  0b 76 69 64 65 6f 43 6f   .........videoCo  
DEBUG2:   0070:  64 65 63 73 00 40 6f 80  00 00 00 00 00 00 0d 76   decs.@o........v  
DEBUG2:   0000:  c3                                                 .                 
DEBUG2:   0000:  69 64 65 6f 46 75 6e 63  74 69 6f 6e 00 3f f0 00   ideoFunction.?..  
DEBUG2:   0010:  00 00 00 00 00 00 00 09                            ........          
DEBUG: Invoking connect
INFO: Connected...
DEBUG2: RTMP_ReadPacket: fd=4
DEBUG2:   0000:  02 00 00 00 00 00 04 05  00 00 00 00               ............      
DEBUG2:   0000:  00 98 96 80                                        ....              
DEBUG: HandleServerBW: server BW = 10000000
DEBUG2: RTMP_ReadPacket: fd=4
DEBUG2:   0000:  02 00 00 00 00 00 05 06  00 00 00 00               ............      
DEBUG2:   0000:  00 98 96 80 02                                     .....             
DEBUG: HandleClientBW: client BW = 10000000 2
DEBUG2: RTMP_ReadPacket: fd=4
DEBUG2:   0000:  02 00 00 00 00 00 04 01  00 00 00 00               ............      
DEBUG2:   0000:  00 00 20 00                                        .. .              
DEBUG: HandleChangeChunkSize, received: chunk size change to 8192
DEBUG2: RTMP_ReadPacket: fd=4
DEBUG2:   0000:  03 00 00 00 00 00 8b 14  00 00 00 00               ............      
DEBUG2:   0000:  02 00 06 5f 65 72 72 6f  72 00 3f f0 00 00 00 00   ..._error.?.....  
DEBUG2:   0010:  00 00 05 03 00 05 6c 65  76 65 6c 02 00 05 65 72   ......level...er  
DEBUG2:   0020:  72 6f 72 00 04 63 6f 64  65 02 00 1e 4e 65 74 43   ror..code...NetC  
DEBUG2:   0030:  6f 6e 6e 65 63 74 69 6f  6e 2e 43 6f 6e 6e 65 63   onnection.Connec  
DEBUG2:   0040:  74 2e 52 65 6a 65 63 74  65 64 00 0b 64 65 73 63   t.Rejected..desc  
DEBUG2:   0050:  72 69 70 74 69 6f 6e 02  00 12 43 6f 6e 6e 65 63   ription...Connec  
DEBUG2:   0060:  74 69 6f 6e 20 66 61 69  6c 65 64 2e 00 0b 61 70   tion failed...ap  
DEBUG2:   0070:  70 6c 69 63 61 74 69 6f  6e 02 00 0c 75 6e 6b 6e   plication...unkn  
DEBUG2:   0080:  6f 77 6e 20 72 6f 6c 65  00 00 09                  own role...       
DEBUG: RTMP_ClientPacket, received: invoke 139 bytes
DEBUG: (object begin)
DEBUG: Property: <Name:           no-name., STRING:	_error>
DEBUG: Property: <Name:           no-name., NUMBER:	1.00>
DEBUG: Property: NULL
DEBUG: Property: <Name:           no-name., OBJECT>
DEBUG: (object begin)
DEBUG: Property: <Name:              level, STRING:	error>
DEBUG: Property: <Name:               code, STRING:	NetConnection.Connect.Rejected>
DEBUG: Property: <Name:        description, STRING:	Connection failed.>
DEBUG: Property: <Name:        application, STRING:	unknown role>
DEBUG: (object end)
DEBUG: (object end)
DEBUG: HandleInvoke, server invoking <_error>
ERROR: rtmp server sent error
DEBUG2: RTMP_ReadPacket: fd=4
DEBUG2:   0000:  03 00 00 00 00 00 12 14  00 00 00 00               ............      
DEBUG2:   0000:  02 00 05 63 6c 6f 73 65  00 00 00 00 00 00 00 00   ...close........  
DEBUG2:   0010:  00 05                                              ..                
DEBUG: RTMP_ClientPacket, received: invoke 18 bytes
DEBUG: (object begin)
DEBUG: Property: <Name:           no-name., STRING:	close>
DEBUG: Property: <Name:           no-name., NUMBER:	0.00>
DEBUG: Property: NULL
DEBUG: (object end)
DEBUG: HandleInvoke, server invoking <close>
ERROR: rtmp server requested close
DEBUG: Closing connection.

KSV · #2 07-17-2017, 08:48 AM

Your command line is missing few parameters.

Code:

rtmpdump -r "rtmpe://93.189.62.10:1935/xlive" -a "xlive?vi=736124&" -f "WIN 26,0,0,131" -s "https://ar.1xbet.com/getZone/VideoPlayer.swf" -w "0ae480d0f1813574d803837d659c748d993899903b5adf85265513721c59ef2f" -x 600494 -p "https://ar.1xbet.com/" -C S:client -C S:3.0.3.23 -C S:en -C O:1 -C NB:disAllowScriptAccess:0 -C O:0 --live -y "raw:736124" -o "2017-07-17_07-07-59_raw_736124.flv"

Code:

RTMPDump v2.4 GIT-2015-12-23 (Compiled by KSV)
(c) 2010 Andrej Stepanchuk, Howard Chu, The Flvstreamer Team; license: GPL
Connecting ...
INFO: Connected...
ERROR: rtmp server sent error
Starting Live Stream
INFO: Metadata:
INFO:   width                   512.00
INFO:   height                  288.00
2045.760 kB / 27.58 sec

troller12 · #3 07-17-2017, 09:04 AM

Hi,

You dont use a playpath what means rtmpsuck did fail to get entire streaming datas.The playpath you do use is a part of app.If rtmpsuck fail then you need to find the needed stream paramters manually.A quick way to do this is checking the memory (HxD or Wireshark etc).If I check your site you did postet (checking any stream) then playpath is looking like that...

Code:

mp4:xgame4_725804_360

...and now you can also check the rest and build a stream.

Code:

-v
-r "rtmpe://93.189.57.254:1935/xlive" 
-a "xlive" 
-W "https://ar.1xbet.com/getZone/VideoPlayer.swf"
-p "https://ar.1xbet.com/"
-y "mp4:xgame4_725881_360" 
-C S:client 
-C S:3.0.3.23 
-C S:en

If you try it then it will fail to play the stream.Reason is the swf file which is compressed with LZMA (ZWS in Header) and rtmpsuck cant handle that format to decompress it and does use the compressed size to calculate the SHA256 hash.This results you can find the in the swfinfo file....

Code:

url: https://ar.1xbet.com/getZone/VideoPlayer.swf
ctim:
date: 
size: 00045f4c =  286540 <--decimal
hash: 080308b80cf42076b0848aa4f369b2ffb6eb6873770b0b85861d8c8dc7d6cf39

In this case you need to handle that part by yourself to get the decompressed swf size and to calc the SHA256 hash you can use which are for your swf link....

Code:

decompressed size: 600494 
SHA256:
0AE480D0F1813574D803837D659C748D993899903B5ADF85265513721C59EF2F

...now your paramter have to look so...

Code:

-v
-r "rtmpe://93.189.57.254:1935/xlive" 
-a "xlive" 
-s "https://ar.1xbet.com/getZone/VideoPlayer.swf"
-p "https://ar.1xbet.com/"
-y "mp4:xgame4_725881_360" 
-C S:client 
-C S:3.0.3.23 
-C S:en
-w 0AE480D0F1813574D803837D659C748D993899903B5ADF85265513721C59EF2F
-x 600494

New & changed paramters..

Code:

--swfUrl|-s url         URL to player swf file
--swfhash|-w hexstring  SHA256 hash of the decompressed SWF file (32 bytes)
--swfsize|-x num        Size of the decompressed SWF file, required for SWFVerification

Now if you try it will work and your player (add paramter for this too of course) will start also if the playpath not used for the moment (match finished etc) and does close after the timeout.

PS: To deompress LZMA in swf you can use tools like SWF ID and to calc the SHA256 (with HMAC) you can use PoweShell or also a hash tool what has that feature and for quick memory checks you can use HxD.

greetz

warah · #4 07-17-2017, 02:52 PM

Wow! really thanks you man!!

this code worked for me (obviously with the correct match data):

Code:

rtmpdump -r "rtmpe://93.189.62.10:1935/xlive" -a "xlive?vi=736124&" -f "WIN 26,0,0,131" -s "https://ar.1xbet.com/getZone/VideoPlayer.swf" -w "0ae480d0f1813574d803837d659c748d993899903b5adf85265513721c59ef2f" -x 600494 -p "https://ar.1xbet.com/" -C S:client -C S:3.0.3.23 -C S:en -C O:1 -C NB:disAllowScriptAccess:0 -C O:0 --live -y "raw:736124" -o "2017-07-17_07-07-59_raw_736124.flv"

I have one more question, im trying to learn this for further cases, how do you get this, so i:
- i've downloaded the "VideoPlayer.swf"
- checked the SHA-256 by this (but i get different of yours):

Code:

$ openssl sha -sha256 VideoPlayer.swf 
SHA256(VideoPlayer.swf)= 76bb7337471558e104a1248bcac8c447e0d13f36dda2e798d6e5c73e8da1986b

- UnCompress By swfunzip.py (a library that i found in google for macosx):

Code:

$ python swfunzip.py VideoPlayer.swf now.swf
info : Input file: VideoPlayer.swf
info : Output file: now.swf
info : Reading VideoPlayer.swf
info : lzma compressed swf detected.
info : Filesize in signature: 600494
info : Filesize decompressed: 600494 <<< I GET THIS SIZE OK!!
info : Generating uncompressed data
File decompressed, size increased: 110%

- BUT WHEN i try to know the SHA-256 is not the same as you send me:

Code:

$ openssl sha -sha256 now.swf 
SHA256(now.swf)= 057abc658dd65dc11957f16e1302b9373e9737e90dc68132a058a907a232d328

im doing something wrong? because i've tried this sha-256 and doesn't work, and with yours hash it works well!

Really thanks you!

mckv · #5 07-17-2017, 02:55 PM

it's hmac on the decompressed swf file

Code:

openssl sha256 -hmac "Genuine Adobe Flash Player 001" now.swf

warah · #6 07-17-2017, 03:06 PM

Oh, i get it

Thank you very much, I really appreciate your answers!

j_cool · #7 07-24-2017, 01:54 PM

KSV,

Let the subject of this thread aside, I noticed that your rtmpdump version is:

RTMPDump v2.4 GIT-2015-12-23 (Compiled by KSV)

and mine is:

C:\MISC>rtmpdump
RTMPDump v2.4 GIT-2015-12-14 (Compiled by KSV)
(c) 2010 Andrej Stepanchuk, Howard Chu, The Flvstreamer Team; license: GPL
ERROR: You must specify a hostname (--host) or url (-r "rtmp://host[

ort]/playpath") containing a hostname

Did I miss right download link somewhere for the latest release?

My Ubuntu also has it wrong:

j@j:~$ rtmpdump
RTMPDump v2.4 KSV-2015-12-14
(c) 2010 Andrej Stepanchuk, Howard Chu, The Flvstreamer Team; license: GPL
ERROR: You must specify a hostname (--host) or url (-r "rtmp://host[ort]/playpath") containing a hostname
j@j:~$

Damianonymous · #8 07-25-2017, 08:45 AM

You have the latest public release, the owner's compilation may have a different date.

j_cool · #9 07-25-2017, 10:59 AM

KSV,

What do you say to that?

Am I asking something that I should not be asking?

KSV · #10 07-26-2017, 06:08 AM

I haven't looked into rtmdump project for a longtime so public release binaries may not be based upon latest commits. Taking a look at the last commits into rtmpdump upstream, they were released few days after my last public release. I am sure if you apply my patch file over the last commit, it should apply without any problem.

Your Ubuntu version is just showing the string you used at the compile time. If you have compiled your binary after the last commit (23/12/2015), you already have the latest code in your binary.