PDA

View Full Version : How to Download AES Encrypted Stream


MOZ
09-10-2014, 10:57 AM
I'm wondering if you experts can give me any help? I'm trying to download a few different AES encrypted streams and am having no luck. Below is the m3u8 file for the particular stream I am after.

M3U8 File (http://www57.zippyshare.com/v/93287433/file.html) or Direct Link (http://nlds4.cdnllnwnl.lon.neulion.com/nlds_vod/coliseum/vod/2014/08/30/420/2_420_manchesterunited_burnley_2014_h_whole_1_4500 .mp4.m3u8) to the m3u8 file.

It's a stream from www.premierleaguepass.com. Can anybody help me please? Would be happy to send a small paypal donation for anyone who can teach me how to do this.

Thanks!

BlueCop
09-10-2014, 12:52 PM
normally i would say ffmpeg can do it.

ffmpeg -i "http://nlds4.cdnllnwnl.lon.neulion.com/nlds_vod/coliseum/vod/2014/08/30/420/2_420_manchesterunited_burnley_2014_h_whole_1_4500 .mp4.m3u8" -c copy video.ts

this gets a 403 error on retrieving the key. there might be some auth or parameters or cookies you need to get the key.

this is the key url that returns 403
http://solr.zon.neulion.com/nlsk/hls/securekey?id=4&app=lon&url=nlds_vod/coliseum/coliseum_mobile_vod.key

you could monitor the requests and figure out what the need parameters are to get the key. Maybe then you could download it.

MOZ
09-11-2014, 04:03 AM
normally i would say ffmpeg can do it.



this gets a 403 error on retrieving the key. there might be some auth or parameters or cookies you need to get the key.

this is the key url that returns 403
http://solr.zon.neulion.com/nlsk/hls/securekey?id=4&app=lon&url=nlds_vod/coliseum/coliseum_mobile_vod.key

you could monitor the requests and figure out what the need parameters are to get the key. Maybe then you could download it.

So I had a look through Web Developer > Network when I first load the video and this is what requests are made:

http://i.imgur.com/tYwhJUA.png

This points to a different key to the one in m3u8 playlist? The key it points to in the Network tools can be downloaded here (http://nlds4.lon.neulion.com:443/nlds_vod/coliseum/vod/2014/08/30/420/2_420_manchesterunited_burnley_2014_h_whole_1_4500 .mp4/adaptive.key?clientKey=ffbd0f4faa2546d359cc074c228 c8e6b) without a 403.

Is that the correct key to be able to decrypt it? If I change the part at the top of the m3u8 to below:

#EXTM3U
#EXT-X-TARGETDURATION:10
#EXT-X-MEDIA-SEQUENCE:0
#EXT-X-KEY:METHOD=AES-128,URI="http://nlds4.lon.neulion.com:443/nlds_vod/coliseum/vod/2014/08/30/420/2_420_manchesterunited_burnley_2014_h_whole_1_4500 .mp4/adaptive.key?clientKey=ffbd0f4faa2546d359cc074c228 c8e6b"
#EXTINF:10,

I get the following error from ffmpeg:

[http @ 0x7f9f094536a0] HTTP error 403 Forbidden
Unable to open key file http://nlds4.lon.neulion.com:443/nlds_vod/coliseum/vod/2014/08/30/420/2_420_manchesterunited_burnley_2014_h_whole_1_4500 .mp4/adaptive.key?clientKey=ffbd0f4faa2546d359cc074c228 c8e6b
[crypto @ 0x7f9f094536a0] Unable to open input
[hls,applehttp @ 0x7f9f09821800] Failed to open segment of playlist 0
[hls,applehttp @ 0x7f9f09821800] Error when loading first segment '2_420_manchesterunited_burnley_2014_h_whole_1_450 0_000000.ts'
2_420_manchesterunited_burnley_2014_h_whole_1_4500 .mp4.m3u8: No such file or directory


If I download the adaptive.key and open it up in TextEdit it shows me the following:

http://i.imgur.com/dQ6gcHG.png

Thanks for your help so far BlueCop. Any more help from yourself or anybody else to crack this one will be greatly appreciated.

surya987
09-11-2014, 04:45 AM
the key is encrypted... use hexdump to get decrypted key value..

hexdump will give you the hex value of key to use for decryption via manual open ssl method ... the site is geo blocked otherwise may b i could find some other way to do it...

thanks

MOZ
09-11-2014, 06:43 AM
the key is encrypted... use hexdump to get decrypted key value..

hexdump will give you the hex value of key to use for decryption via manual open ssl method ... the site is geo blocked otherwise may b i could find some other way to do it...

thanks

Thanks for your reply. How do I do this? I have access to either OSX or Windows.

I feel within touching distance of getting this file! Thanks once again for everybody's continued help.

BlueCop
09-11-2014, 07:00 AM
the key is encrypted... use hexdump to get decrypted key value..

hexdump will give you the hex value of key to use for decryption via manual open ssl method ... the site is geo blocked otherwise may b i could find some other way to do it...

thanks
the key isn't encrypted. that is data encoding. that is the text representation of the actual data and not encrypted at all.

MOZ: There is authorization tokens/headers used somewhere. Can you can get the full url used to retrieve the orginal m3u8 by the client and then try to download that with ffmpeg?

if that doesn't work then we can add some cookies to the header to get the download working correctly for you.

MOZ
09-11-2014, 07:18 AM
the key isn't encrypted. that is data encoding. that is the text representation of the actual data and not encrypted at all.

MOZ: There is authorization tokens/headers used somewhere. Can you can get the full url used to retrieve the orginal m3u8 by the client and then try to download that with ffmpeg?

if that doesn't work then we can add some cookies to the header to get the download working correctly for you.

Is this the link you're looking for? -

http://nlds4.lon.neulion.com:443/play?url=%2Fnlds_vod%2Fcoliseum%2Fvod%2F2014%2F08% 2F30%2F420%2F2_420_manchesterunited_burnley_2014_h _whole_1_pc.mp4&plid=c2d79d7058e903b534adbe3cc470633e&auth_key=bf0984bb54bc470ce7204bae471bf34e-1410441417-32-*.m3u8;*.ts;*.mp4

So looking further I have two more parameters that I've found:

NLAuth:

"e053a2875d8625d30de0b049f58d7586-0-32"

serverKey_internal_ASV3:

"8aacac8811168c78ac54864d3ace607f-c2d79d7058e903b534adbe3cc470633e-0-32"

Not sure if that helps at all.

BlueCop
09-11-2014, 07:24 AM
maybe I am not sure if that is the m3u8 or not. It won't let me connect.

I meant for you to use the full authorized url with ffmpeg to download the video. cookies might be required though.

MOZ
09-11-2014, 07:41 AM
maybe I am not sure if that is the m3u8 or not. It won't let me connect.

I meant for you to use the full authorized url with ffmpeg to download the video. cookies might be required though.

I'm not sure if I know what you mean? The only m3u8 url is the one I provided. Let me run it on my phone with iOS and sniff out some parameters and come back with the full m3u8 url from there.

MOZ
09-11-2014, 08:20 AM
Okay so loaded the stream on my iPad and sniffed the original m3u8 which is available here (http://nlds4.cdnak.lon.neulion.com/nlds_vod/coliseum/vod/2014/08/30/420/2_420_manchesterunited_burnley_2014_h_whole_1_ipad .mp4.m3u8?nltid=plp&nltdt=6&nltnt=1&uid=28845&hdnea=expires%3D1410469984%7Eaccess%3D%2F*%7Emd5%3 D775a2525481f4fa979bb9b08a5112fa0)

Does that help? When run through ffmpeg I get the same problem:
Unable to open key file http://solr.zon.neulion.com/nlsk/hls/securekey?id=4&app=lon&url=nlds_vod/coliseum/coliseum_mobile_vod.key

Shows the Following under Cookie:
nlqptid=nltid=plp&nltdt=6&nltnt=1&uid=28845&hdnea=expires%3D1408315446%7Eaccess%3D%2F*%7Emd5%3 Dbd2f4b735763cc1c66b2f432b160cf1a

surya987
09-11-2014, 11:03 AM
i need orignal video url and country name from where i can acces the website...

thanks

BlueCop
09-11-2014, 01:00 PM
You have everything you need to download the video if you have the key file saved already. The video segments aren't protected. I could download them myself.

if you save the key file as "coliseum_mobile_vod.key" and then save the modified m3u8 from below as "video.m3u8"

then this command will work.
ffmpeg -i video.m3u8 -c copy video.ts
will download the decrypted video.

here is the modified m3u8. http://pastebin.com/KhcU8Z3v The changes are making the video files to full urls and changing the key file to a local file.

surya987: it isn't geo-protected on the server. it just needs authorization.

MOZ
09-11-2014, 02:42 PM
You have everything you need to download the video if you have the key file saved already. The video segments aren't protected. I could download them myself.

if you save the key file as "coliseum_mobile_vod.key" and then save the modified m3u8 from below as "video.m3u8"

then this command will work.

will download the decrypted video.

here is the modified m3u8. http://pastebin.com/KhcU8Z3v The changes are making the video files to full urls and changing the key file to a local file.

surya987: it isn't geo-protected on the server. it just needs authorization.

Thanks a lot for the modified m3u8. How did you get it to display full URL's? Guessing you wrote a script? Would you mind sharing the script if so?

The only problem is downloading the key. I get a 403 forbidden. I can download the other adaptive.key. Do you mean just saving that and naming that as coliseum_mobile_vod.key? Thanks again BlueCop for your continued assistance. Really do appreciate it.

BlueCop
09-11-2014, 03:00 PM
no script just search & replace in a text edioter.
search for
"2_420_manchesterunited_burnley_2014_h_whole_1_4500 _"
replace with
"http://nlds4.cdnllnwnl.lon.neulion.com/nlds_vod/coliseum/vod/2014/08/30/420/2_420_manchesterunited_burnley_2014_h_whole_1_4500 _"

I thought you said you already obtained the key. I misunderstood. If you are proxying the connection then you should be able to see the key as it is transferred. Can you save it from there?

MOZ
09-15-2014, 05:34 AM
no script just search & replace in a text edioter.
search for
"2_420_manchesterunited_burnley_2014_h_whole_1_4500 _"
replace with
"http://nlds4.cdnllnwnl.lon.neulion.com/nlds_vod/coliseum/vod/2014/08/30/420/2_420_manchesterunited_burnley_2014_h_whole_1_4500 _"

I thought you said you already obtained the key. I misunderstood. If you are proxying the connection then you should be able to see the key as it is transferred. Can you save it from there?

Brilliant. Thankyou BlueCop. Think it's working. Getting some errors from ffmpeg but I think that's to do with my build rather than anything else.

How do you download an encrypted stream when their isn't a key file then?

m3u8 shows this....

#EXTM3U
#EXT-X-VERSION:3
#EXT-X-TARGETDURATION:12
#EXT-X-MEDIA-SEQUENCE:0
#EXT-X-KEY:METHOD=AES-128,URI="8170110000080C0050568706890008F75A6E9600",IV=0XEA9FED27DF30C5E5531B0F2F6F449B30

MOZ
09-17-2014, 01:43 AM
How do you download an encrypted stream when their isn't a key file then?

m3u8 shows this....

#EXTM3U
#EXT-X-VERSION:3
#EXT-X-TARGETDURATION:12
#EXT-X-MEDIA-SEQUENCE:0
#EXT-X-KEY:METHOD=AES-128,URI="8170110000080C0050568706890008F75A6E9600" ,IV=0XEA9FED27DF30C5E5531B0F2F6F449B30

Still looking for help with this if anybody could give me any assistance? Thanks in advance.

surya987
09-17-2014, 03:53 AM
did you try ffmpeg -i "rmodified.m3u8" -c copy video.ts


or use openssl to decrypt it manually.....

h80862004
11-11-2014, 03:27 PM
I've just get coliseum_mobile_vod.key
And sucessfully decrypt full 720P video

for exchange,I want all previous game (2014/08~10) *.m3u8s since premierleaguepass.com exists even which had deleted on scedule but actually videos are not

give me,then I'll teach u how:)

jse
02-04-2015, 07:50 PM
Hello, I'm trying to do the same thing as you.
How did you find the coliseum_mobile_vod.key ? all I can find is the adaptive.key if I save the adaptive.key and modify the video.m3u8 to point at the files and the adaptive.key ffmpeg gives the error

[crypto @ 04383620] Unable to open resource: http://nlds2.cdnak.lon.neulion.com:443/nlds_vod/coliseum/vod/2015/01/31/622/2_622_newcastleunited_hullcity_2014_h_whole_1_4500 _000000.ts
[hls,applehttp @ 04381d40] Failed to open segment of playlist 0
[hls,applehttp @ 04381d40] Error when loading first segment 'http://nlds2.cdnak.lon.neulion.com:443/nlds_vod/coliseum/vod/2015/01/31/622/2_622_newcastleunited_hullcity_2014_h_whole_1_4500 _000000.ts'
test.m3u8: Unknown error

I assume I just need the coliseum_mobile_vod.key and it will work.
thanks in advance
jse

EDIT: I have the following keys, none seem to work :(
adaptive key
nl auth
serverkey internal

MOZ
02-05-2015, 07:44 AM
You need to stream from your mobile and it will give you the link to the coliseum_mobile_vod.key

I used debookee to sniff my iPhone and then just use a curl command to download it. Cause IIRC just putting the direct link into an address bar will give you a forbidden error.

If you have any problems I'll get the key for you (if I still have my PLP account!)

Hello, I'm trying to do the same thing as you.
How did you find the coliseum_mobile_vod.key ? all I can find is the adaptive.key if I save the adaptive.key and modify the video.m3u8 to point at the files and the adaptive.key ffmpeg gives the error

[crypto @ 04383620] Unable to open resource: http://nlds2.cdnak.lon.neulion.com:443/nlds_vod/coliseum/vod/2015/01/31/622/2_622_newcastleunited_hullcity_2014_h_whole_1_4500 _000000.ts
[hls,applehttp @ 04381d40] Failed to open segment of playlist 0
[hls,applehttp @ 04381d40] Error when loading first segment 'http://nlds2.cdnak.lon.neulion.com:443/nlds_vod/coliseum/vod/2015/01/31/622/2_622_newcastleunited_hullcity_2014_h_whole_1_4500 _000000.ts'
test.m3u8: Unknown error

I assume I just need the coliseum_mobile_vod.key and it will work.
thanks in advance
jse

EDIT: I have the following keys, none seem to work :(
adaptive key
nl auth
serverkey internal

jse
02-05-2015, 08:37 AM
Hey man that would be great. I can lend you my login if yours is no longer active.

danielko
06-19-2017, 03:22 PM
Tried everything, not working. Desperately need a hand for this:

http://nlds278.neulion.com/nlds_vod/nfl/vod/2017/01/14/57162/789daa/3_57162_hou_ne_2016_h_whole_1_4500.mp4/000000.adaptive.key?clientKey=1f4c8dddb56ffb46627a b22596048d9b

Thank you

limiteddi
08-24-2017, 04:32 PM
Folks, can someone shed some light on how to get this stream going? Not sure where to start. The key file link seems to be in the m3u8 file and I was able to download it, what would be the next steps?

#EXTM3U
#EXT-X-VERSION:3
#EXT-X-MEDIA-SEQUENCE:1647918
#EXT-X-TARGETDURATION:6
#EXT-X-KEY:METHOD=AES-128,URI="https://49.40.0.149/streams_live/History_HD/History_HD_1200-1503604608000.key",IV=0x00000000000000000000015E15D18C00
#EXTINF:6.000,
History_HD_1200-1503605052000.ts
#EXTINF:6.000,
History_HD_1200-1503605058000.ts
#EXTINF:6.000,
History_HD_1200-1503605062000.ts
#EXTINF:6.000,
History_HD_1200-1503605068000.ts
#EXTINF:6.000,
History_HD_1200-1503605076000.ts
#EXTINF:6.000,
History_HD_1200-1503605082000.ts
#EXTINF:6.000,
History_HD_1200-1503605088000.ts
#EXTINF:6.000,
History_HD_1200-1503605094000.ts
#EXTINF:6.000,
History_HD_1200-1503605100000.ts
#EXTINF:6.000,
History_HD_1200-1503605104000.ts
#EXTINF:6.000,
History_HD_1200-1503605110000.ts
#EXTINF:6.000,
History_HD_1200-1503605116000.ts
#EXTINF:6.000,
History_HD_1200-1503605122000.ts
#EXTINF:6.000,
History_HD_1200-1503605128000.ts
#EXTINF:6.000,
History_HD_1200-1503605134000.ts
#EXTINF:6.000,
History_HD_1200-1503605142000.ts
#EXTINF:6.000,
History_HD_1200-1503605148000.ts
#EXTINF:6.000,
History_HD_1200-1503605154000.ts
#EXTINF:6.000,
History_HD_1200-1503605160000.ts
#EXTINF:6.000,
History_HD_1200-1503605166000.ts
#EXTINF:6.000,
History_HD_1200-1503605172000.ts
#EXTINF:6.000,
History_HD_1200-1503605178000.ts
#EXTINF:6.000,
History_HD_1200-1503605182000.ts
#EXTINF:6.000,
History_HD_1200-1503605188000.ts
#EXTINF:6.000,
History_HD_1200-1503605194000.ts
#EXTINF:6.000,
History_HD_1200-1503605200000.ts
#EXTINF:6.000,
History_HD_1200-1503605206000.ts
#EXTINF:6.000,
History_HD_1200-1503605212000.ts
#EXTINF:6.000,
History_HD_1200-1503605220000.ts
#EXTINF:6.000,
History_HD_1200-1503605226000.ts
#EXTINF:6.000,
History_HD_1200-1503605232000.ts
#EXTINF:6.000,
History_HD_1200-1503605238000.ts
#EXTINF:6.000,
History_HD_1200-1503605244000.ts
#EXTINF:6.000,
History_HD_1200-1503605250000.ts
#EXTINF:6.000,
History_HD_1200-1503605256000.ts
#EXTINF:6.000,
History_HD_1200-1503605262000.ts
#EXTINF:6.000,
History_HD_1200-1503605268000.ts
#EXTINF:6.000,
History_HD_1200-1503605274000.ts
#EXTINF:6.000,
History_HD_1200-1503605280000.ts
#EXTINF:6.000,
History_HD_1200-1503605284000.ts
#EXTINF:6.000,
History_HD_1200-1503605292000.ts
#EXTINF:6.000,
History_HD_1200-1503605296000.ts
#EXTINF:6.000,
History_HD_1200-1503605302000.ts
#EXTINF:6.000,
History_HD_1200-1503605308000.ts
#EXTINF:6.000,
History_HD_1200-1503605316000.ts
#EXTINF:6.000,
History_HD_1200-1503605322000.ts
#EXTINF:6.000,
History_HD_1200-1503605326000.ts
#EXTINF:6.000,
History_HD_1200-1503605334000.ts
#EXTINF:6.000,
History_HD_1200-1503605338000.ts
#EXTINF:6.000,

jse
08-28-2017, 10:48 AM
If you have the .key, edit the m3u8 to point the the key locally on your machine so instead of "https://49.40.0.149/streams_live/History_HD/History_HD_1200-1503604608000.key" change it to like C:\history.key or whatever. Then you need to find the actual url of the .ts files, Set it playing legitimatly then press F12 in your browser of check fiddler to get the url of the .ts files so when you find Http://Some_Url_here.com/History_HD_1200-1503605052000.ts you can then do a find and replace in the m3u8 so it actually points to the .ts files. so for example you would do a

find for
/History
and replace it with
Http://Some_Url_here.com/History
for all instances.

When you have done that you should have a .key file locally, a m3u8 that points to your keyfile and an m3u8 that actually points to the .ts files.

Then you can get ffmpeg and just do this

ffmpeg -i whatever.m3u8 -vcodec copy -acodec copy output.mp4