[traveler9559]

So I am new here (obviously) and I have been trying to get some videos off 3dbuzz so I can watch them while I am offline. I have tried many variations of the rtmpdump commands and always end up with an error.

Here is a link to a video like that I want to download. I can't show the exact videos as they are for subscribers. However, this video has the same setup as the subscriber videos.

http://www.3dbuzz.com/training/view/comprehensive-aspnet-mvc/introduction/series-introduction

Here are some commands that I have used to try to get this video:

rtmpdump -r "rtmp://vs.3dbuzz.com/buzz/" -a "buzz/" -f "WIN 14,0,0,177" -W "http://www.3dbuzz.com/content/flash/Player3.swf" -p "http://www.3dbuzz.com/training/view/comprehensive-aspnet-mvc/introduction/series-ntroduction" -y "a3AOjCPW0Dvl2dcyaUnBr6CnLxR" -o "out.flv"

rtmpdump -r "rtmp://vs.3dbuzz.com/buzz/" -a "buzz/" -f "WIN 14,0,0,177" -W "http://www.3dbuzz.com/content/flash/Player3.swf" -p "http://www.3dbuzz.com/training/view/comprehensive-aspnet-mvc/introduction/series-ntroduction" -y "a3AOjCPW0Dvl2dcyaUnBr6CnLxR" -o "out.flv" -V -R --buffer 2000

I have also tried to use wireshark and see if there is a token that I am missing, but I can not find anything. There error I usually get is:

DEBUG: RTMPSockBuf_Fill, recv returned -1. GetSockError(): 10060 (Unknown error)
ERROR: RTMP_ReadPacket, failed to read RTMP packet header

Any help would be greatly appreciated.

[hasomaso]

found token but by me same problem
don't works :confused: sorry Bro

-T "92J3ax!077M6%.EZckS776^J$i8=}I"

RTMPDump v2.4 GIT-2014-03-02 (Compiled by KSV)
(c) 2010 Andrej Stepanchuk, Howard Chu, The Flvstreamer Team; license: GPL
Connecting ...
INFO: Connected...
Starting download at: 0.000 kB
ERROR: RTMP_ReadPacket, failed to read RTMP packet header
0.000 kB / 0.00 sec
Download complete

[traveler9559]

That actually helped man. I'm assuming you got that from the swf? It looks like 3dbuzz added a separate call into the rtmp connect call. going to try a few things to see if I can get it to work

[hasomaso]

please also inform me :D

[denobis]

Well,

to catch the stream you need to, after the "NetConnection.Connect.Success", send the command

this._connection.call("rr", null, $decrypt);

where decrypt is the tea_decryption of the r2-property received and transformed. See https://github.com/denobis/4od/blob/master/tea_decrypt.php where i've implemented the decryption process in php.

For example, when connecting we received

r2=5n251623p7q688po5s9o89p8249so8oqs399r7os8982srs 70852662qpq14r2409r6q58r8

which is decrypted to

55a7b6f3-ba33-4596-8965-b46d2247ea51

But you need to implement this in the c-sources of rtmpdump and compile it. Funny.

[denobis]

I think it's only needed to append a special case in rtmp.c

Instead of

if (RTMP_FindFirstMatchingProperty(&obj, &av_secureToken, &p))
{
DecodeTEA(&r->Link.token, &p.p_vu.p_aval);
SendSecureTokenResponse(r, &p.p_vu.p_aval);
}

we have to consider &av_r2 and apply to it the transformation before the DecodeTEA.

[hasomaso]

i think with next release of rtmpdump can @KSV this implement
can you move this here (http://stream-recorder.com/forum/customized-rtmpdump-binaries-patch-file-t16103p24.html)

[traveler9559]

denobis, that is exactly what I was thinking and what I have been testing. I've been trying to implement it a java rtmp client (because I know java the best), but am having trouble with the decryption stuff. I'll keep messing with it and get about to you guys.

For some reason whenever I try to decrypt the r2 value, i get weird characters.... even on known working implementations of the tea decryption....

[traveler9559]

For some reason I cannot get the TEA decryption to work. Even the implementation denobis provided does not work. They all come back with strings like this oA¤4?2?{¸iá»3??")Zd?,@Âî·ë?[?`q??

I don't know what I am doing wrong....

[denobis]

Sorry, i dont know what you're doing but the code i provided works, not beeing anything else that a pure php implementation of the tea-decrypt algorithm, exactly like the DecodeTEA(AVal *key, AVal *text) from rtmp.c.

Remember that before make de tea-decription you need to transform the r2-string to make it hex-number:

function transform_r2($r2)
{
$_local2 = "";
$_local3 = 0;
$chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMabcdefghijk lmnopqrstuvwxyzabcdefghijklm";

while ($_local3 < strlen($r2))
{
$_local5 = $r2[$_local3];
if (strpos($chars,$_local5) or $_local5=="A")
{
$_local5 = $chars[strpos($chars,$_local5) + 13];
}
$_local2.= $_local5;
$_local3++;
}
return $_local2;
}

I've just implemented the code in rtmp.c and now it's compiled and throwing the right response, but there is some pings i must resolve.

C code for transposition

int local8,local3,r2size;
char *chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMabcdefghijk lmnopqrstuvwxyzabcdefghijklm";
char *local6 = text;
r2size = strlen(local6);
char local2[r2size];

local3 = 0;

while (local3 < r2size)
{
local8 = local6[local3];

char *b = strchr (chars, local8);
int pos = pos ? b - chars : -1;

if (pos>-1)
{local8=chars[pos + 13];}

char local52[2];
memcpy( local52, &local8, 1 );
local2[local3]=local52[0];

local3++;
}

memcpy(text, local2, r2size);:cool: :cool:

[denobis]

Also, its very important to take account of the following notes:

"In other languages: remember always to use either unsigned right-shift operators or unsigned type declarations, according to features available in the language – signed right shift operations will fail; also, in strToLongs(), to avoid running off the end of the string, some languages may need the string to be padded to a multiple of 4 characters, with the equivalent of for (var p=0; p<3-(s.length-1)%4; p++) s += '\0';."

(Chris Veness)

[traveler9559]

Hmmmm.... I'll have to use the actuall php.exe when I get home. I was using an online interpreter to test your code. I got the actionscript to process it correctly. Must be something wrong with my bitwise operations. I swear I am using unsigned right-shift operators....

[denobis]

Ok, it's working. You must calculate the path too

- from rtmp://vs.3dbuzz.com/buzz/nmX0fNaK0Qgta2cwD3eZqgkDu4o take the token=nmX0fNaK0Qgta2cwD3eZqgkDu4o to construct the path which results in CrjmqAnX0DwGOhxWLmtxF6SKRk4. That's invariable, so you need only to work the r2-response.

Here the compiled rtmpdump

http://speedy.sh/6wGcv/rtmpdump.exe

[traveler9559]

Thanks for this denobis. I'll have to try it sometime soon. I finally got my decryption to work (java is very picky about the bitwise stuff).