Decrypt AES-128 encrypted video files from a m3u8

[Dune]

There is no geo restriction on the segments, but there is on the .m3u8 and the .key.
I cannot directlink them because they are links that expire after a few seconds (you need to go through an adwall, and it's georestricted anyway).

We have indeed spotted that there is a problem on the key, they have recently changed their key format and that's probably where lies the problem. The .key used to be a binary file.

We have tried reencoding it into a binary file, but it doesn't work, the key is too long (48 chars instead of 32 iirc).

There is something that we need to do onto this key, but I don't see what. It's something that the player (JWPlayer, using HLS - HttpLiveStreaming, it has little doc on their site) manages to read though, so there must be some way?
Plus we have seen on some torrent sites that the videos keep being successfully ripped, but we are several to try and fail at decoding them.

[blimey]

In that case it is likely that the key is somehow encoded (or specially interpreted by the player). But this is unusual for hls (m3u8) for compatibility reasons.

The only way to see if the key is encoded is to see how it is interpreted in real time in memory as it is being used to play the segments. This means playing the video from the original source webpage.

[Dune]

Thank you for your answer!

Ok I got you, but you would need to play the stream from a French, Belgium, Swiss or other french-speaking country

Here is the link
http://preview.tinyurl.com/pwj4tqr

If you are not geoblocked, skip the adwalls and you get to the video page that you can play (if there is something i can do to help you with that please tell me (Ctrl+s on the page doesn't work)).

Do not click the "GetVideoPath" links when you look in the traffic, they get you site-banned. Click the redirections that the player did instead.

Edit: tinyurl'd the link

[Dune]

The only way to see if the key is encoded is to see how it is interpreted in real time in memory as it is being used to play the segments. This means playing the video from the original source webpage.

This is really an excellent idea, i need to figure out how to do this, since it looks unlikely that you will be able to.

[blimey]

I've started to look at it, and will look at it more thoroughly tonight and tomorrow. Geo-restrictions or the need for proxies/VPNs are not a significant obstacle and something that the members here deal with routinely. Thanks for the tip about the booby-trapped network requests.

[Dune]

Originally Posted by blimey

I've started to look at it, and will look at it more thoroughly tonight and tomorrow. Geo-restrictions or the need for proxies/VPNs are not a significant obstacle and something that the members here deal with routinely. Thanks for the tip about the booby-trapped network requests.

Oh, really? Didn't know, apologizes for not providing the link earlier!

And thank you for that investment, that would help a lot of viewers - I've already received a few PMs by posting here and have other contacts stuck on the same problem as me, looking for a solution.

[gaaara]

hello

I found something I am not sure if it can help but you never know
sorry for my english

def read_m3u8(m3u8)
    File.open(m3u8, 'r') do |file|
        keyfile = nil
        iv = 0
        file.each_line do |line|
            line.chomp!
            if line =~ /^#EXT-X-KEY:METHOD=AES-128,URI="(.*?)"(,IV=0x(.*))?/
                keyfile = $1
                if $2
                    iv = $3
                    iv_gen = :random
                else
                    iv_gen = :sequence
                end
            elsif not line =~ /^#/
                in_file = File.join(File.dirname(m3u8), line)
                ext = File.extname(in_file)
                out_file = File.join(File.dirname(in_file), File.basename(in_file, ext) + '.clear' + ext)
                decrypt(in_file, keyfile, iv, out_file)
                if iv_gen == :sequence
                    iv += 1
                end
            end
        end
    end
end

def decrypt(in_file, keyfile, iv, out_file)
    key = load_key(keyfile)
    iv_hex = sprintf('%032x', iv)
    %x{openssl aes-128-cbc -d -K #{key} -iv #{iv_hex} -nosalt -in #{in_file} -out #{out_file}}
end

def load_key(keyfile)
    File.open(keyfile, 'rb') do |file|
        file.read.unpack('H*')[0]
    end
end

read_m3u8(ARGV[0])

source website http://cesbo.com/forum/topic/611-dec...ttp-streaming/

[Dune]

Eh well thanks for your contribution, trying to figure which language that is.

Doesn't quite look like Python.

[gaaara]

seems to be the language ruby code was in a file. rb

you speek french Dune ?

[Nopt]

The answer indeed lies in the original source page
And since you like python :

import base64
from Crypto.Cipher import Blowfish
key = "Rev3rseEngIneeringIsN0tLeGal" #~ As if ;)
aes = Blowfish.new(key, Blowfish.MODE_ECB)
d = "e2f96a0861cb381a8b52801f18bf04924c3472bc8f319930"
d = d.decode("hex")
d = aes.decrypt(d)
d = base64.b64decode(d)
return d