chaturbate.com: SecureToken problems

[greenythebeast]

I wrote a program for Mac that allowed myself to download videos from a site using rtmpdump by entering the username of the person broadcasting. It used the -T flag of rtmpdump because the site used SecureToken authentication in its .swf file. They just updated the .swf file today and it doesn't work anymore. The code went from this:

if (_local2.secureToken != null){
this._-7E.call("secureTokenResponse", null, _-0D._-2W(_local2.secureToken, "m9z#$dO0qe34Rxe@sMYxx%"));

to this:

if (_local2.secureToken != null){
this._-3a.call(_-2I._-3p(-366, 769), null, _-26._-3p(_local2.secureToken, _-2I._-3p(-344, 807)));

What am I supposed to enter for the SecureToken now?

[KSV]

strings are encrypted now. you have to figure out the obfuscation scheme. or wait till i am back (after 3-4 days)

[greenythebeast]

Originally Posted by KSV

strings are encrypted now. you have to figure out the obfuscation scheme. or wait till i am back (after 3-4 days)

oh my god, if you figure it out i will personally send you 100 virgins for your pleasure =P

[greenythebeast]

Originally Posted by KSV

strings are encrypted now. you have to figure out the obfuscation scheme. or wait till i am back (after 3-4 days)

im just curious, but how would one go about figuring out the obfuscation scheme?

[greenythebeast]

Is there any other way to capture the SecureToken or is deobfuscation the only way?

[greenythebeast]

After doing some research it looks like the .swf file was obfuscated using SecureSWF. Hope that helps.

[Bahman]

KSV, Would you mind please teaching us how to figure out the obfuscation scheme too? I'm so interested in knowing it!! A short instruction is enough, please!!
The only things that I could find on the net was, It's related to Java!! but I don't have any idea if it be right!!

[KSV]

SecureToken key is still same as shown in post #1. now their flash player sends an extra command CheckPublicAccess before sending play command. you need to modify rtmp.c to emulate this. i am not interested to do so for adult websites. you are on your own. it's easy anyway. checkout the patch file in my package for similar code.

[greenythebeast]

Originally Posted by KSV

SecureToken key is still same as shown in post #1. now their flash player sends an extra command CheckPublicAccess before sending play command. you need to modify rtmp.c to emulate this. i am not interested to do so for adult websites. you are on your own. it's easy anyway. checkout the patch file in my package for similar code.

Thank you for your hard work in figuring this out. I'm not trying to be rude or anything but do you actually expect someone who can't program to be able to modify this? I'm totally fine in doing the legwork here but are there any hints that you could give me that would help me get started?

[svnpenn]

If you cant program, that is your problem. This is not a forum to teach that.