[warah]

Hi guys, this is my first post here, i've been trying to get this rtmpe, i've read all the threads but im getting crazy, maybe you can help me:

website with all live streamings
https://ar.1xbet.com/es/live/

if you get an free account, you can see, if not use this:
u: 19676295 / p: vp7funtu

So, always is the same structure for all streamings, with rtmpsuck i get:

Streaming on rtmp://0.0.0.0:1935
Processing connect
app: xlive?vi=735320&
flashVer: MAC 26,0,0,137
swfUrl: https://ar.1xbet.com/getZone/VideoPlayer.swf
tcUrl: rtmpe://93.189.57.254:1935/xlive?vi=735320&
pageUrl: https://ar.1xbet.com/es/live/


So, i go to the rtmpdump with this, but i think that im forgeting the token or something... what u think?

p.d:I've also used wireshark to sniff, but it's encrypted, so I couldnt

I really appreciate your responses!

MM2015:nodejs matias$ rtmpdump -r "rtmp://93.189.57.254:1935/xlive?vi=735320&" -f "MAC 26,0,0,137" -W "https://ar.1xbet.com/getZone/VideoPlayer.swf" --live -y "xlive?vi=735320&" -z -o pepe.mp4

RTMPDump v2.4
(c) 2010 Andrej Stepanchuk, Howard Chu, The Flvstreamer Team; license: GPL
DEBUG: Protocol : RTMP
DEBUG: Hostname : 93.189.57.254
DEBUG: Port : 1935
DEBUG: Playpath : 735320
DEBUG: tcUrl : rtmp://93.189.57.254:1935/xlive?vi=735320&
DEBUG: swfUrl : https://ar.1xbet.com/getZone/VideoPlayer.swf
DEBUG: app : xlive?vi=735320&
DEBUG: flashVer : MAC 26,0,0,137
DEBUG: live : yes
DEBUG: timeout : 30 sec
DEBUG: SWFSHA256:
DEBUG: 08 03 08 b8 0c f4 20 76 b0 84 8a a4 f3 69 b2 ff
DEBUG: b6 eb 68 73 77 0b 0b 85 86 1d 8c 8d c7 d6 cf 39
DEBUG: SWFSize : 286540
DEBUG: Setting buffer time to: 36000000ms
Connecting ...
DEBUG: RTMP_Connect1, ... connected, handshaking
DEBUG: HandShake: Client type: 03
DEBUG: HandShake: Client digest offset: 244
DEBUG: HandShake: Initial client digest:
DEBUG: 20 04 1b d2 f7 9e d0 d5 31 c3 bb ef e3 68 30 71
DEBUG: 33 f8 59 5b 21 3f 1d 36 88 be 27 2c 7e 98 cc f6
DEBUG: HandShake: Type Answer : 03
DEBUG: HandShake: Server Uptime : 940081089
DEBUG: HandShake: FMS Version : 5.0.14.1
DEBUG: HandShake: Calculated digest key from secure key and server digest:
DEBUG: af 1f 24 f1 74 cc 0e c4 12 38 e5 a7 48 e4 41 6e
DEBUG: 90 20 b3 3a d8 f9 f8 fe e8 d3 a6 5d f8 bd 08 c9
DEBUG: HandShake: Client signature calculated:
DEBUG: 83 e0 31 6d f7 08 59 64 b3 ac d1 d9 49 f0 b4 63
DEBUG: 2c 76 c1 0e c2 f0 14 12 3f d6 6b bf bb cf a6 9c
DEBUG: HandShake: Server sent signature:
DEBUG: 27 64 64 fc ee cc 21 4d 41 a7 79 b5 c2 35 c6 3c
DEBUG: 31 cd d0 f3 ba 67 9c e8 49 d7 b0 68 c4 ef 15 da
DEBUG: HandShake: Digest key:
DEBUG: d4 f6 16 87 77 5c aa 92 60 07 b9 3a 81 f8 52 ee
DEBUG: 42 a6 93 e3 a9 7e de 6b c0 39 b4 32 cf b3 30 7b
DEBUG: HandShake: Signature calculated:
DEBUG: 27 64 64 fc ee cc 21 4d 41 a7 79 b5 c2 35 c6 3c
DEBUG: 31 cd d0 f3 ba 67 9c e8 49 d7 b0 68 c4 ef 15 da
DEBUG: HandShake: Genuine Adobe Flash Media Server
DEBUG: HandShake: Handshaking finished....
DEBUG: RTMP_Connect1, handshaked
DEBUG2: RTMP_SendPacket: fd=4, size=280
DEBUG2: 0000: 03 00 00 00 00 01 18 14 00 00 00 00 ............
DEBUG2: 0000: 02 00 07 63 6f 6e 6e 65 63 74 00 3f f0 00 00 00 ...connect.?....
DEBUG2: 0010: 00 00 00 03 00 03 61 70 70 02 00 10 78 6c 69 76 ......app...xliv
DEBUG2: 0020: 65 3f 76 69 3d 37 33 35 33 32 30 26 00 08 66 6c e?vi=735320&..fl
DEBUG2: 0030: 61 73 68 56 65 72 02 00 0e 4d 41 43 20 32 36 2c ashVer...MAC 26,
DEBUG2: 0040: 30 2c 30 2c 31 33 37 00 06 73 77 66 55 72 6c 02 0,0,137..swfUrl.
DEBUG2: 0050: 00 2c 68 74 74 70 73 3a 2f 2f 61 72 2e 31 78 62 .,https://ar.1xb
DEBUG2: 0060: 65 74 2e 63 6f 6d 2f 67 65 74 5a 6f 6e 65 2f 56 et.com/getZone/V
DEBUG2: 0070: 69 64 65 6f 50 6c 61 79 65 72 2e 73 77 66 00 05 ideoPlayer.swf..
DEBUG2: 0000: c3 .
DEBUG2: 0000: 74 63 55 72 6c 02 00 2a 72 74 6d 70 3a 2f 2f 39 tcUrl..*rtmp://9
DEBUG2: 0010: 33 2e 31 38 39 2e 35 37 2e 32 35 34 3a 31 39 33 3.189.57.254:193
DEBUG2: 0020: 35 2f 78 6c 69 76 65 3f 76 69 3d 37 33 35 33 32 5/xlive?vi=73532
DEBUG2: 0030: 30 26 00 04 66 70 61 64 01 00 00 0c 63 61 70 61 0&..fpad....capa
DEBUG2: 0040: 62 69 6c 69 74 69 65 73 00 40 2e 00 00 00 00 00 bilities.@......
DEBUG2: 0050: 00 00 0b 61 75 64 69 6f 43 6f 64 65 63 73 00 40 ...audioCodecs.@
DEBUG2: 0060: a8 ee 00 00 00 00 00 00 0b 76 69 64 65 6f 43 6f .........videoCo
DEBUG2: 0070: 64 65 63 73 00 40 6f 80 00 00 00 00 00 00 0d 76 decs.@o........v
DEBUG2: 0000: c3 .
DEBUG2: 0000: 69 64 65 6f 46 75 6e 63 74 69 6f 6e 00 3f f0 00 ideoFunction.?..
DEBUG2: 0010: 00 00 00 00 00 00 00 09 ........
DEBUG: Invoking connect
INFO: Connected...
DEBUG2: RTMP_ReadPacket: fd=4
DEBUG2: 0000: 02 00 00 00 00 00 04 05 00 00 00 00 ............
DEBUG2: 0000: 00 98 96 80 ....
DEBUG: HandleServerBW: server BW = 10000000
DEBUG2: RTMP_ReadPacket: fd=4
DEBUG2: 0000: 02 00 00 00 00 00 05 06 00 00 00 00 ............
DEBUG2: 0000: 00 98 96 80 02 .....
DEBUG: HandleClientBW: client BW = 10000000 2
DEBUG2: RTMP_ReadPacket: fd=4
DEBUG2: 0000: 02 00 00 00 00 00 04 01 00 00 00 00 ............
DEBUG2: 0000: 00 00 20 00 .. .
DEBUG: HandleChangeChunkSize, received: chunk size change to 8192
DEBUG2: RTMP_ReadPacket: fd=4
DEBUG2: 0000: 03 00 00 00 00 00 8b 14 00 00 00 00 ............
DEBUG2: 0000: 02 00 06 5f 65 72 72 6f 72 00 3f f0 00 00 00 00 ..._error.?.....
DEBUG2: 0010: 00 00 05 03 00 05 6c 65 76 65 6c 02 00 05 65 72 ......level...er
DEBUG2: 0020: 72 6f 72 00 04 63 6f 64 65 02 00 1e 4e 65 74 43 ror..code...NetC
DEBUG2: 0030: 6f 6e 6e 65 63 74 69 6f 6e 2e 43 6f 6e 6e 65 63 onnection.Connec
DEBUG2: 0040: 74 2e 52 65 6a 65 63 74 65 64 00 0b 64 65 73 63 t.Rejected..desc
DEBUG2: 0050: 72 69 70 74 69 6f 6e 02 00 12 43 6f 6e 6e 65 63 ription...Connec
DEBUG2: 0060: 74 69 6f 6e 20 66 61 69 6c 65 64 2e 00 0b 61 70 tion failed...ap
DEBUG2: 0070: 70 6c 69 63 61 74 69 6f 6e 02 00 0c 75 6e 6b 6e plication...unkn
DEBUG2: 0080: 6f 77 6e 20 72 6f 6c 65 00 00 09 own role...
DEBUG: RTMP_ClientPacket, received: invoke 139 bytes
DEBUG: (object begin)
DEBUG: Property: <Name: no-name., STRING: _error>
DEBUG: Property: <Name: no-name., NUMBER: 1.00>
DEBUG: Property: NULL
DEBUG: Property: <Name: no-name., OBJECT>
DEBUG: (object begin)
DEBUG: Property: <Name: level, STRING: error>
DEBUG: Property: <Name: code, STRING: NetConnection.Connect.Rejected>
DEBUG: Property: <Name: description, STRING: Connection failed.>
DEBUG: Property: <Name: application, STRING: unknown role>
DEBUG: (object end)
DEBUG: (object end)
DEBUG: HandleInvoke, server invoking <_error>
ERROR: rtmp server sent error
DEBUG2: RTMP_ReadPacket: fd=4
DEBUG2: 0000: 03 00 00 00 00 00 12 14 00 00 00 00 ............
DEBUG2: 0000: 02 00 05 63 6c 6f 73 65 00 00 00 00 00 00 00 00 ...close........
DEBUG2: 0010: 00 05 ..
DEBUG: RTMP_ClientPacket, received: invoke 18 bytes
DEBUG: (object begin)
DEBUG: Property: <Name: no-name., STRING: close>
DEBUG: Property: <Name: no-name., NUMBER: 0.00>
DEBUG: Property: NULL
DEBUG: (object end)
DEBUG: HandleInvoke, server invoking <close>
ERROR: rtmp server requested close
DEBUG: Closing connection.

[KSV]

Your command line is missing few parameters.

rtmpdump -r "rtmpe://93.189.62.10:1935/xlive" -a "xlive?vi=736124&" -f "WIN 26,0,0,131" -s "https://ar.1xbet.com/getZone/VideoPlayer.swf" -w "0ae480d0f1813574d803837d659c748d993899903b5adf8526 5513721c59ef2f" -x 600494 -p "https://ar.1xbet.com/" -C S:client -C S:3.0.3.23 -C S:en -C O:1 -C NB:disAllowScriptAccess:0 -C O:0 --live -y "raw:736124" -o "2017-07-17_07-07-59_raw_736124.flv"

RTMPDump v2.4 GIT-2015-12-23 (Compiled by KSV)
(c) 2010 Andrej Stepanchuk, Howard Chu, The Flvstreamer Team; license: GPL
Connecting ...
INFO: Connected...
ERROR: rtmp server sent error
Starting Live Stream
INFO: Metadata:
INFO: width 512.00
INFO: height 288.00
2045.760 kB / 27.58 sec

[troller12]

Hi,

You dont use a playpath what means rtmpsuck did fail to get entire streaming datas.The playpath you do use is a part of app.If rtmpsuck fail then you need to find the needed stream paramters manually.A quick way to do this is checking the memory (HxD or Wireshark etc).If I check your site you did postet (checking any stream) then playpath is looking like that...
mp4:xgame4_725804_360
...and now you can also check the rest and build a stream.
-v
-r "rtmpe://93.189.57.254:1935/xlive"
-a "xlive"
-W "https://ar.1xbet.com/getZone/VideoPlayer.swf"
-p "https://ar.1xbet.com/"
-y "mp4:xgame4_725881_360"
-C S:client
-C S:3.0.3.23
-C S:en
If you try it then it will fail to play the stream.Reason is the swf file which is compressed with LZMA (ZWS in Header) and rtmpsuck cant handle that format to decompress it and does use the compressed size to calculate the SHA256 hash.This results you can find the in the swfinfo file....
url: https://ar.1xbet.com/getZone/VideoPlayer.swf
ctim:
date:
size: 00045f4c = 286540 <--decimal
hash: 080308b80cf42076b0848aa4f369b2ffb6eb6873770b0b8586 1d8c8dc7d6cf39
In this case you need to handle that part by yourself to get the decompressed swf size and to calc the SHA256 hash you can use which are for your swf link....

decompressed size: 600494
SHA256:
0AE480D0F1813574D803837D659C748D993899903B5ADF8526 5513721C59EF2F

...now your paramter have to look so...
-v
-r "rtmpe://93.189.57.254:1935/xlive"
-a "xlive"
-s "https://ar.1xbet.com/getZone/VideoPlayer.swf"
-p "https://ar.1xbet.com/"
-y "mp4:xgame4_725881_360"
-C S:client
-C S:3.0.3.23
-C S:en
-w 0AE480D0F1813574D803837D659C748D993899903B5ADF8526 5513721C59EF2F
-x 600494

New & changed paramters..

--swfUrl|-s url URL to player swf file
--swfhash|-w hexstring SHA256 hash of the decompressed SWF file (32 bytes)
--swfsize|-x num Size of the decompressed SWF file, required for SWFVerification
Now if you try it will work and your player (add paramter for this too of course) will start also if the playpath not used for the moment (match finished etc) and does close after the timeout.

PS: To deompress LZMA in swf you can use tools like SWF ID and to calc the SHA256 (with HMAC) you can use PoweShell or also a hash tool what has that feature and for quick memory checks you can use HxD.

greetz

[warah]

Wow! really thanks you man!!


this code worked for me (obviously with the correct match data):

rtmpdump -r "rtmpe://93.189.62.10:1935/xlive" -a "xlive?vi=736124&" -f "WIN 26,0,0,131" -s "https://ar.1xbet.com/getZone/VideoPlayer.swf" -w "0ae480d0f1813574d803837d659c748d993899903b5adf8526 5513721c59ef2f" -x 600494 -p "https://ar.1xbet.com/" -C S:client -C S:3.0.3.23 -C S:en -C O:1 -C NB:disAllowScriptAccess:0 -C O:0 --live -y "raw:736124" -o "2017-07-17_07-07-59_raw_736124.flv"

I have one more question, im trying to learn this for further cases, how do you get this, so i:
- i've downloaded the "VideoPlayer.swf"
- checked the SHA-256 by this (but i get different of yours):
$ openssl sha -sha256 VideoPlayer.swf
SHA256(VideoPlayer.swf)= 76bb7337471558e104a1248bcac8c447e0d13f36dda2e798d6 e5c73e8da1986b

- UnCompress By swfunzip.py (a library that i found in google for macosx):
$ python swfunzip.py VideoPlayer.swf now.swf
info : Input file: VideoPlayer.swf
info : Output file: now.swf
info : Reading VideoPlayer.swf
info : lzma compressed swf detected.
info : Filesize in signature: 600494
info : Filesize decompressed: 600494 <<< I GET THIS SIZE OK!!
info : Generating uncompressed data
File decompressed, size increased: 110%

- BUT WHEN i try to know the SHA-256 is not the same as you send me:
$ openssl sha -sha256 now.swf
SHA256(now.swf)= 057abc658dd65dc11957f16e1302b9373e9737e90dc68132a0 58a907a232d328

im doing something wrong? because i've tried this sha-256 and doesn't work, and with yours hash it works well!

Really thanks you!

[mckv]

it's hmac on the decompressed swf file

openssl sha256 -hmac "Genuine Adobe Flash Player 001" now.swf

[warah]

Oh, i get it :)

Thank you very much, I really appreciate your answers!

[j_cool]

KSV,


Let the subject of this thread aside, I noticed that your rtmpdump version is:


RTMPDump v2.4 GIT-2015-12-23 (Compiled by KSV)



and mine is:

C:\MISC>rtmpdump
RTMPDump v2.4 GIT-2015-12-14 (Compiled by KSV)
(c) 2010 Andrej Stepanchuk, Howard Chu, The Flvstreamer Team; license: GPL
ERROR: You must specify a hostname (--host) or url (-r "rtmp://host[:port]/playpath") containing a hostname



Did I miss right download link somewhere for the latest release?

My Ubuntu also has it wrong:

j@j:~$ rtmpdump
RTMPDump v2.4 KSV-2015-12-14
(c) 2010 Andrej Stepanchuk, Howard Chu, The Flvstreamer Team; license: GPL
ERROR: You must specify a hostname (--host) or url (-r "rtmp://host[ort]/playpath") containing a hostname
j@j:~$

[Damianonymous]

You have the latest public release, the owner's compilation may have a different date.

[j_cool]

KSV,

What do you say to that?

Am I asking something that I should not be asking?

[KSV]

I haven't looked into rtmdump project for a longtime so public release binaries may not be based upon latest commits. Taking a look at the last commits into rtmpdump upstream, they were released few days after my last public release. I am sure if you apply my patch file over the last commit, it should apply without any problem.

Your Ubuntu version is just showing the string you used at the compile time. If you have compiled your binary after the last commit (23/12/2015), you already have the latest code in your binary.