[anrelou]

Hey, guys. I am trying to get RTMPE streaming urls from Flash on a site.

I examined the source of the swf file (attached!) and realized that the mechanism is as this:
1. SWF fetches the XML .../xmls/tiesraide/pirmais_baltijas_kanals.xml

<player>
<media>
<type>live</type>
<mode>full</mode>
<image/>
<server>
<origin>195.13.206.152</origin>
<origin>195.13.216.8</origin>
</server>
<language code="lv">
<stream quality="hq">mp4:pirmais_baltijas_kanals_ru_hq.stream</stream>
<stream quality="lq">mp4:pirmais_baltijas_kanals_ru_lq.stream</stream>
</language>
</media>
<security>
<resource_id>c-pirmais_baltijas_kanals</resource_id>
<auth_token>
S0fgGLrKHh8lyUbOu7CE5IYG+dyKk122iNXtOxnPycWcClJKHx UKNKC+bs0bbWY+fA8ZnHwLBOB39U4bY3OP0ptnSbhvqoOWm+F/v8VMMjiGFRROxanClKa0Bg+2NQ6i
</auth_token>
</security>
</player>

2. Then it goes to the balancing server: 195.13.206.152:80/loadbalancer?stream=pirmais_baltijas_kanals_ru_hq. stream, which returns another XML
<server>
<status>1</status>
<edge>195.13.206.155</edge>
<client>109.229.197.168</client>
</server>

3. Judging by the code, SWF establishes connection to "rtmpe://195.13.206.151/live/"

[img=http://s29.postimg.org/f4js22our/Screen_Clip_1.jpg] (http://postimg.org/image/f4js22our/)

Although I couldn't find the exact URLs in Wireshark (you may see the log pic attached), the rtmpe link was confirmed when I took a dump Flash Player page and searched in HxD. So, at this moment I already have this rtmpe link, but the live stream is not downloaded still (neither with VLC, nor with rtmpdump.exe -r "rtmpe://195.13.206.151/live/" -W "https://www.<site url>/static/m_player.swf" --live -o downl.mp4).

Both ffmpeg and rtmpdump say:
Trying different position for server digest!
RTMP_ReadPacket, failed to read RTMP packet header

I'm concerned that the RTMPE url is so simple. What did I do wrongly?

[surya987]

post video link...

[anrelou]

post video link...

You might need to have Latvian IP for that, but I am not sure: https://www.lattelecom.tv/tiesraide/

[biezom]

hi
you can try to find m3u8 playlist with user agent switcher addon on firefox >>> switch iphone 3.0
if you don't find send login in PM

[anrelou]

hi
you can try to find m3u8 playlist with user agent switcher addon on firefox >>> switch iphone 3.0
if you don't find send login in PM

There cannot be any playlist or something like this. It's not a playlist but it's a list of tv channels.

[biezom]

There cannot be any playlist or something like this. It's not a playlist but it's a list of tv channels.

no you do not understand what I meant.

if you change the user agent of your browser, it changes the protocol

rtmp for default user agent
often m3u8 for iphone user agent

[hasomaso]

for rtmp:// protocolling you need secureToken

-T "252789c27626cb86de1ddfdff61d75f0"
token=252789c27626cb86de1ddfdff61d75f0

[anrelou]

for rtmp:// protocolling you need secureToken

-T "252789c27626cb86de1ddfdff61d75f0"
token=252789c27626cb86de1ddfdff61d75f0

Is this token an example or a real one? =D How do I get this token?

[hasomaso]

@anrelou

rtmpdump -v -r "rtmpe://195.13.206.150/live" -a "live/" -W "https://www.lattelecom.tv/static/m_player.swf?t=1426590732" -p "https://www.lattelecom.tv/tiesraide/" -y "mp4:lattelecom_lv_hq.stream" -T "252789c27626cb86de1ddfdff61d75f0" -o "output.flv"

Starting Live Stream
INFO: Metadata:
INFO: videocodecid avc1
INFO: width 853.00
INFO: height 480.00
INFO: frameWidth 640.00
INFO: frameHeight 480.00
INFO: displayWidth 853.00
INFO: displayHeight 480.00
INFO: framerate 25.00
INFO: audiochannels 2.00
INFO: audiosamplerate 44100.00
INFO: audiocodecid mp4a
INFO: trackinfo:
INFO: timescale 0.00
INFO: language eng
INFO: sampledescription:
INFO: type video
INFO: profile-level-id 4d401e
INFO: sprop-parameter-sets Z01AHpZSgUB7Yd6goKC+AAADAAIAAAMAZSg=,aP88gA==
INFO: description {H264CodecConfigInfo: codec:H264, profile:Main,
level:3.0, frameSize:640x480, displaySize:853x480, frameRate:25.0, PAR:4:3}
INFO: timescale 0.00
INFO: language eng
INFO: sampledescription:
INFO: type audio
INFO: config 1210
INFO: description {AACFrame: codec:AAC, channels:2, frequency:4410
0, samplesPerFrame:1024, objectType:LC}
INFO: rtpsessioninfo:
INFO: protocolversion 0
INFO: connectiondata IN IP4 239.255.15.30
INFO: timing 0 0
INFO: origin - -1115399521 -1115399521 IN IP4 127.0.0.1
INFO: name WowzaMediaServer
INFO: attributes:
INFO: range npt=now-
15693.220 kB / 63.23 sec

http://i.imgur.com/LzlGJfs.png

[anrelou]

@hasomaso

@anrelou

rtmpdump -v -r "rtmpe://195.13.206.150/live" -a "live/" -W "https://www.lattelecom.tv/static/m_player.swf?t=1426590732" -p "https://www.lattelecom.tv/tiesraide/" -y "mp4:lattelecom_lv_hq.stream" -T "252789c27626cb86de1ddfdff61d75f0" -o "output.flv"

Starting Live Stream
INFO: Metadata:
INFO: videocodecid avc1
INFO: width 853.00
INFO: height 480.00
INFO: frameWidth 640.00
INFO: frameHeight 480.00
INFO: displayWidth 853.00
INFO: displayHeight 480.00
INFO: framerate 25.00
INFO: audiochannels 2.00
INFO: audiosamplerate 44100.00
INFO: audiocodecid mp4a
INFO: trackinfo:
INFO: timescale 0.00
INFO: language eng
INFO: sampledescription:
INFO: type video
INFO: profile-level-id 4d401e
INFO: sprop-parameter-sets Z01AHpZSgUB7Yd6goKC+AAADAAIAAAMAZSg=,aP88gA==
INFO: description {H264CodecConfigInfo: codec:H264, profile:Main,
level:3.0, frameSize:640x480, displaySize:853x480, frameRate:25.0, PAR:4:3}
INFO: timescale 0.00
INFO: language eng
INFO: sampledescription:
INFO: type audio
INFO: config 1210
INFO: description {AACFrame: codec:AAC, channels:2, frequency:4410
0, samplesPerFrame:1024, objectType:LC}
INFO: rtpsessioninfo:
INFO: protocolversion 0
INFO: connectiondata IN IP4 239.255.15.30
INFO: timing 0 0
INFO: origin - -1115399521 -1115399521 IN IP4 127.0.0.1
INFO: name WowzaMediaServer
INFO: attributes:
INFO: range npt=now-
15693.220 kB / 63.23 sec


Wow, that is an amazing result, thanks! I tried the same code with another channel, which is now seeable only when logged in and it didn't work.

Command was:
rtmpdump -v -r "rtmpe://195.13.206.155/live" -a "live/" -W "https://www.lattelecom.tv/static/m_player.swf" -p "https://www.lattelecom.tv/tiesraide/ltv1" -y "mp4:ltv1_lv_lq.stream" -T "fi+x3eigJ5Bm3+LX+sP8j52y4MPpb7Uq3H6tlVrqHaX9udn0pa TgYHn3OOLqImu8b4/kxY/Y5YKPoRNXGItnvJqeXOvZ/Ns8" -o "output3.flv"

Output was:
RTMPDump v2.3
(c) 2010 Andrej Stepanchuk, Howard Chu, The Flvstreamer Team; license: GPL
ERROR: RTMP_HashSWF: connection lost while downloading swfurl https://www.lattelecom.tv/static/m_player.swf
Connecting ...
WARNING: Trying different position for server digest!
INFO: Connected...
ERROR: RTMP_ReadPacket, failed to read RTMP packet header

What did I miss out? I put the auth token from this xml: https://www.lattelecom.tv/xmls/tiesraide/ltv1.xml

UPD. Maybe, it might help, that for m3u8 link looks smth like: http://195.13.216.2/mobile/mp4:ltv1_lv_lq.stream/playlist.m3u8?resource_id=c-ltv1&auth_token=<.....>

[hasomaso]

secureToken is the same for all streams from the site
-T "252789c27626cb86de1ddfdff61d75f0"


and please use the latest rtmpdump from KSV
rtmpdump2.4 (https://github.com/K-S-V/Scripts/releases/download/v2.4/rtmpdump-2.4.zip)

[anrelou]

secureToken is the same for all streams from the site
-T "252789c27626cb86de1ddfdff61d75f0"


and please use the latest rtmpdump from KSV
rtmpdump2.4 (https://github.com/K-S-V/Scripts/releases/download/v2.4/rtmpdump-2.4.zip)

Oops, sorry for being an idiot. Where did you get this token from?
It means, that /auth_token/ is meaningless, I gather, right?

[killro0000]

Oops, sorry for being an idiot. Where did you get this token from?
It means, that /auth_token/ is meaningless, I gather, right?

He got it from m_player.swf

If you decompile it, take a look at line 2851 in MainTimeline.as. You can find the following code there:
this.nc.call("secureTokenResponse",new Responder(secureResult.onResult),TEA.decrypt(infoO bject.info.secureToken,"252789c27626cb86de1ddfdff61d75f0"));

Here is this token.

BTW Can anybody help me to download video from https://www.lattelecom.tv/arhivs/360tv_ideja/2015-11-06/1446707965393/tiesraide_techhub_riga_academy_2015 ?

I have tried
rtmpdump -v -r "rtmpe://195.13.216.2/records" -a "records/" -W "https://www.lattelecom.tv/static/m_player.swf" -p "https://www.lattelecom.tv/arhivs/360tv_ideja/2015-11-06/1446707965393/tiesraide_techhub_riga_academy_2015" -y "mp4:store1/2015_11_06/1446707965393_360tv_ideja_lv_hq.mp4" -T "252789c27626cb86de1ddfdff61d75f0" -o "output3.flv"

As well as @hasomaso example - it doesn't work anymore, I get ERROR: rtmp server requested close after ~7 secs

Here is data from debug before disconnect:
DEBUG2: 0000: 00 02 00 15 6f 6e 4c 74 6b 41 75 74 68 53 74 72 ....onLtkAut
hStr
DEBUG2: 0010: 65 61 6d 53 74 61 74 75 73 00 00 00 00 00 00 00 eamStatus...
....
DEBUG2: 0020: 00 00 05 02 00 09 66 6f 72 62 69 64 64 65 6e ......forbid
den
DEBUG: RTMP_ClientPacket, flex message, size 47 bytes, not fully supported
DEBUG: (object begin)
DEBUG: Property: <Name: no-name, STRING: onLtkAuthStreamStatus>
DEBUG: Property: <Name: no-name, NUMBER: 0.00>
DEBUG: Property: NULL
DEBUG: Property: <Name: no-name, STRING: forbidden>

Seems that I should provide something to rtmp server but what?