Adobe HDS Downloader

[shani_08]

Originally Posted by KSV

@IV
following is the info i posted long ago in now deleted thread. This is only related to custom encryption used by Akamai CDN (Packet type 10 & 11) not FlashAccess DRM (Packet type 40 & 41).

==========
I am just posting it publicly. this info is based on actual reversing i tried few months ago. global key is different for each session. SessionID and KeyUrl are not of much relevance because they are only used to retrieve GlobalKey. mysterious salt block in each packet header can be broken into 4 different blocks. first was always 01 and third block was always all zeros.

SessionID: 010075cd3e8441c5f40f4427ae4f93e8b2b00a1b6740eda2fd0049958d1532318bd1423ec94a2c3f4074ede220dd615b9d588f6ad1ef
GlobalKey: acfab40e035ee120520fc77d1e532c20

FirstTag:
Header: 0c000000004fae27440000ffff IV: e7b25c7a1d67280a8681ba4314e1e66d KeyUrl: /z/0809/20090106_1_dvorak_slavonic-dance/h264_high_,0700,1100,1500,2000,2500,.mp4.csmil/key_AQB1zT6EQcX0D0Qnrk+T6LKwDRtnQO2i%2fQBJlY0VMjGL0UI+yUosP0B07eIg3WFbnViPatHv
Salt?:  01 b7199175c7c7dbea80f9eda39a5b6b0abf2b17dac035636c6667331243aefdec 0000000000000000000000000000000000000000 dc11391dd7c0211c95c3c1e597665f850f01d2c0

EncryptedBlock:      2df9494fdac3355db2cb942258641fe0 2709b1ec662e8897bf78ad0acf14184b e5c7e47f9e95d918bd6dad1560f2c6a2 31c1da18311e01000568e98d3525
DecryptedVideoFrame: 170000000001640028ffe10029676400 28ac2ca703c045fbc05a808080a00000 0300200000065c1400186a0000e4e17e 31c1da18311e01000568e98d3525

SecondTag:
Header: 0c000000004fae27440000fffb IV: e7b25c7a1d67280a8681ba4314e1e66d
Salt?:  01 25bfbacb92b3c6b837ca6a47ef20a8a77defbc631124bfa5b5e6b2cc0c58fe6d 0000000000000000000000000000000000000000 46d3344f230830a040d4fc6d3751f6ff83f8cbea

EncryptedBlock:      af0011900000
DecryptedAudioFrame: af0011900000

Encryption scheme used is AES-128-CBC. i couldn't figure out the KDF (key derivation function) used to derive individual packet decryption key from global key using the salt block as shown above. KDF function is executed inside Alchemy VM (a method used to execute c code from ActionScript VM) which makes it very hard to reverse engineer from disassembled code.
==========

Hi KSV,
I have been trying to look into the akamai HD player verification and packet decryption.
After few weeks of work, i am able to get player verification working understood what was happening, using the player hash and encrypted string it creates the HMAC etc.

Now, looking into tagDecrypt function, it takes the key (fetched via keyUrl by parsing the first packet) and the Packet Data. it then creates multiple HMAC with the key and then with internal data to get to the final stage, which i believe you call a global key.

Here, i am little lost. I can see that its using a block cipher algorithm, possibly aes (but not sure ecb or cbc) where it operates using what look like aes code and then xor using some data then finally append it to response. Also, i dont know how we figure out when the encoded data starts as it definately got the header of some sort and then encrypted data section 16 byte long each.

I can show you the code in PM about the PV code or this function that i am talking about. Let me know.

[shani_08]

ok some more information and the confirmation that this is definately AES cbc.

Basic info for the first packet.

the cipher key is

31dc4a65c4d06334b61bc43653544915

The data is full encrypted tag

0c0000000055e6de3d0000ffff8f107971716510636c4095195d0687592f7a2f5353315f31403330393730312f6b65795f415142534c5a6843507677387a7a3365356c58705a777461445958304644763345455a686e4c78576232524443376c705754382b5274427644614643385075396b5763394e396c720001399eedccbc8f2a0e59cecdd0f899410435387fce8bf4a20289a91a20d64254f50000000000000000000000000000000000000000b159aee6bed571bb8449ad3ab868d8be420a487379ffc80dea46f51351a892e6e0ef8b26b0af6998979c68e0f945f155075aaa9f14c7335f093b79355e15b039947655ce468001000428f96bc8

based on above packet
This is header
This is IV
This is Key Url Data
This is encrypted data

if you chop the encrypted data in 16bytes multiple then you get
79ffc80dea46f51351a892e6e0ef8b26b0af6998979c68e0f9 45f155075aaa9f14c7335f093b79355e15b039947655ce

They cipher key converts into global key which is

a930fb441df4db669815e4bbab0e33c9

so use the above encrypted data, then use the IV listed above and the globak key, apply AES cbc and you should endup with 48 bytes of data starting with 0x1700
remaining data will then append to make the final output which is

1700000000014d401fffe10025274d401fb90c02802dd80880000003008000001970300013d6200027ac77bdc07c2211468001000428f96bc8

You can use http://aes.online-domain-tools.com/ to get the result without writing any code.

so now i have to find proper methods to know when the encrypted data starts and when the header finishes! feeling i am getting there. the global key calculation is not very far off but i am reusing the same key for the same data till i get reliably generate that.

[KSV]

I had reversed the Akamai Player Verification long time ago and posted it here. many downloading software's and scripts around the web still use the same key i posted above. as for Akamai DRM the main hurdle was to derive per packet decryption key from global key as i have explained earlier in my old post.

[shani_08]

Originally Posted by KSV

I had reversed the Akamai Player Verification long time ago and posted it here. many downloading software's and scripts around the web still use the same key i posted above. as for Akamai DRM the main hurdle was to derive per packet decryption key from global key as i have explained earlier in my old post.

That verification process still valid, i am using the same method, thanks your post, however, the key is not valid anymore, hence my take on getting verification working again. Now, i am off to packet decryption, so trying to figure out a sure shot way of saparating headers, IV, keydata and encrypted data.

As for finding the global key for the request, there 5 steps, for various HMAC creation, using key and the portion of the encrypted packet, all 5 hmac are linked to each other, there is only one step left which i need to figure out how we are generating the key for that step so just there yet far away!

[KSV]

I haven't looked into it for long time so things may have changed in the meantime. can you send me the swf file, encrypted fragment, related key and any other details via pm? I can take another look into it.

[KSV]

I have pushed new update to the repo which enables the script to remove Akamai media encryption. KDF function to generate per packet decryption key from global session key was reverse engineered by user shani_08. i already had the details of encrypted packet header and some other ancillary information. I have tested it on few videos and it seems to work well at the moment. They may soon try to patch it. if you wanna keep it working longer then don't try to plaster it everywhere you can think of. enjoy while it lasts .

[stinkfoot]

yes much thanking you shani_08 and ksv!!

no hoping likewise curing flashaccess hds?

[joejones15]

Originally Posted by stinkfoot

yes much thanking you shani_08 and ksv!!

ditto, many thanks to you both, amazing work!!!

[Kasandra]

can your script download this kind of links

hds/XXXX.XXXX.ism/XXXX.XXXXX.drmmeta

or

hds/mediaDelivery/media/XXXXXXXXXXXXXXXXXXXXX.f4m?cdn=l3

give me: " this stream is encrypted with FlashAccess DRM.

can you fix this Pls

[BaboonHD]

Any chance on TSN or Turner like Cartoon Network F4M ?