Decrypt AES-128 encrypted video files from a m3u8

[chap]

Originally Posted by Nopt

The answer indeed lies in the original source page
And since you like python :

import base64
from Crypto.Cipher import Blowfish
key = "Rev3rseEngIneeringIsN0tLeGal" #~ As if ;)
aes = Blowfish.new(key, Blowfish.MODE_ECB)
d = "e2f96a0861cb381a8b52801f18bf04924c3472bc8f319930"
d = d.decode("hex")
d = aes.decrypt(d)
d = base64.b64decode(d)
return d

what it looks like in PHP?

[Dune]

Originally Posted by gaaara

seems to be the language ruby code was in a file. rb

you speek french Dune ?

Indeed I do, we're quite a bunch of french people being concerned by this

Originally Posted by Nopt

The answer indeed lies in the original source page
And since you like python :

import base64
from Crypto.Cipher import Blowfish
key = "Rev3rseEngIneeringIsN0tLeGal" #~ As if ;)
aes = Blowfish.new(key, Blowfish.MODE_ECB)
d = "e2f96a0861cb381a8b52801f18bf04924c3472bc8f319930"
d = d.decode("hex")
d = aes.decrypt(d)
d = base64.b64decode(d)
return d

Thank you very much for the Python port! I'm gonna try this ASAP.

[Nopt]

Originally Posted by Dune

Thank you very much for the Python port! I'm gonna try this ASAP.

I'm not sure what you mean by "port", it has nothing to do with the earlier ruby code (which only handle a classic HLS stream)
My code specifically and only address the problem of the encrypted .key file. (it even includes the secret - well not that secret anymore - key !)

If you want a python port of the ruby code (to dump a classic HLS stream like ffmpeg would do) it's more like that :

import m3u8
from Crypto.Cipher import AES
f = open('file.ts','rb')
playlist = m3u8.loads(playlist) 
key = urllib2.urlopen(playlist.key.uri).read() # <- swap that line with my earlier snippet to handle encrypted keys
iv = ('%x' % int(playlist.key.iv,16)).decode("hex")
aes = AES.new(key, AES.MODE_CBC, iv)
for x in playlist.segments :
	r = urllib2.urlopen(x.uri)
	d = r.read()
	d = aes.decrypt(d)
	f.write(d)
f.close()

[Spyne]

Can you explain how you find this key ?

[Dune]

Originally Posted by Nopt

I'm not sure what you mean by "port", it has nothing to do with the earlier ruby code (which only handle a classic HLS stream)
My code specifically and only address the problem of the encrypted .key file. (it even includes the secret - well not that secret anymore - key !)

If you want a python port of the ruby code (to dump a classic HLS stream like ffmpeg would do) it's more like that :

import m3u8
from Crypto.Cipher import AES
f = open('file.ts','rb')
playlist = m3u8.loads(playlist) 
key = urllib2.urlopen(playlist.key.uri).read() # <- swap that line with my earlier snippet to handle encrypted keys
iv = ('%x' % int(playlist.key.iv,16)).decode("hex")
aes = AES.new(key, AES.MODE_CBC, iv)
for x in playlist.segments :
	r = urllib2.urlopen(x.uri)
	d = r.read()
	d = aes.decrypt(d)
	f.write(d)
f.close()

Oh I'm sorry I didn't look too puch into the Ruby code and thought all you did was porting.

Thank you a HUGE lot for your investment!
I just tested it, and it works!!! It is going to help a lot of us, that's for sure

Dat key though

Huge thanks again!

Edit: as Spyne said, it would help us a bunch in the future if you could give a few directions&tip as to how to get this key.

[CereFR]

You can access the key with every sniffer you can find on the net (personally I use Coojah). But take care to the banishment ! The criteria change weekly, they are still programming their system, then we never know when it changes.

I suggest to focus on the key we have to decrypt, because surrounding stuff can be solved with Google .

[Nopt]

Originally Posted by Dune

Edit: as Spyne said, it would help us a bunch in the future if you could give a few directions&tip as to how to get this key.

Well hint n°1 : the browser always know the key (or anything of that kind for that matter)
hint n°2 : everything the browser executes is basically plain text (or not so far from it)
hint n°3 : it's in the HLSProvider6.0.2.swf file

[Dune]

Originally Posted by CereFR

You can access the key with every sniffer you can find on the net (personally I use Coojah). But take care to the banishment ! The criteria change weekly, they are still programming their system, then we never know when it changes.

I suggest to focus on the key we have to decrypt, because surrounding stuff can be solved with Google .

Downloading the .key file really is no hard task... it's more about the way to decrypt it. You need another "key"

Originally Posted by Nopt

Well hint n°1 : the browser always know the key (or anything of that kind for that matter)
hint n°2 : everything the browser executes is basically plain text (or not so far from it)
hint n°3 : it's in the HLSProvider6.0.2.swf file

Trying that on my own atm, thanks for the hints!

[Dune]

Alright, I've looked into the .swf file, but I can't find anything there; what would you use track the execution/use of that file (or of the player in general)?

Damn I'm feeling incompetent now :/

[gaaara]

how to use this for download video ?