Re: dumping Ilive.to

Telofy · #11 10-04-2013, 06:41 PM

That method seems very promising. The hulu.sh script is written for Cygwin, but I borrowed a little from it.

Code:

$ MOZ_DISABLE_OOP_PLUGINS=1 firefox -no-remote -profile . <URL>
[1] 30552
$ ./dump-pid.sh 30552
$ strings -10 *.dump | grep -B 1 "Connection succeeded\."
I8772LDKksadhGHGagf#
Connection succeeded.

The complicated Firefox invocation avoids interference with running Firefoxies, dump-pid.sh comes from Server Fault, and the final grep is highly experimental, since I’ve only tested this once so far. Thanks!

gorilla.maguila · #12 10-05-2013, 05:24 AM

Unfortunately it's not working for me.

Do you have any other conf in mms.cfg aside from:

Code:

ProtectedMode=0

RedPenguin · #13 10-05-2013, 06:08 AM

Well I am having issues myself, but it's very bizarre.

I am using the following script:

http://goo.gl/XJv0UU

Winstrings is simply the strings.exe from SysInternals, a Win version of strings, as strings -10 from above was taking forever in Cygwin. Also I did two grep lines because for some reason in hex, sometimes the token is before "Connection succeeded" while other times it seems to be after, instead.

It works perfectly on my Win 7 64-bit desktop, tested at least 5 times.

Yet if I try it on my XP Pro 32-bit, Laptop Win 8 64-bit, or my Vista 64-bit, they all fail.

Something seems to be failing at the dump of Firefox because opening the said dumps in HxD definitely does not show the token.

I am just confused how the exact same script and even using the exact same baby-cygwin on each PC would cause such behavior.

EDIT: It appears that I simply wasn't providing enough sleep between dump and kill Firefox, which was causing it to sometimes get the token and sometimes not, but it still once in a while doesn't get the token. I hope to find a more consistent approach as this will cause serious issues with scheduled recordings.

evol · #14 10-05-2013, 08:07 AM

DMW on another forum has just posted this http://ge.tt/7vL8zot/v/0?c

RedPenguin · #15 10-05-2013, 08:14 AM

Quote:

Originally Posted by evol

DMW on another forum has just posted this http://ge.tt/7vL8zot/v/0?c

Leave it to DMW to always create really cool things.

Thanks again for the link. I know I probably would have seen it anyway on the other forum, but my method was driving me insane, LoL.

gorilla.maguila · #16 10-05-2013, 11:44 AM

So here goes another method:

Disassembly / Assembly Method:

First modify you mms.cfg like this as we want to see the output of the trace() method.

Code:

#Hardware video decoding
#EnableLinuxHWVideoDecode=1
ProtectedMode=0
ErrorReportingEnable=1
TraceOutputFileEnable=1
MaxWarnings=50
AS3Trace=1

Then grab a flash player with debug enabled. In my case Projector content debugger for linux from http://www.adobe.com/support/flashplayer/downloads.html. (The linux version it's only 32 bits so if you are running a 64 bit distro make sure you download the required lib32 libs, like lib32-alsa-plugins lib32-curl lib32-gtk2 lib32-libxt lib32-nss)

Now we are going to disassemble the swf file insert a print and assembly again. I'm going to use https://github.com/CyberShadow/RABCDAsm.

In this case we want to see the output of the function _a_-_---._a_--_--(-1820302793)

The trace it's going to be inserted in the PlayerSetup class so we only have to open the swf file to trigger our trace.

Now we disassemble:

Code:

$ abcexport secure_player_ilive_z.swf
$ rabcdasm secure_player_ilive_z-1.abc

Now we are going to modify the Player.class.asasm to insert our trace method in assembly code:

Code:

findpropstrict      QName(PackageNamespace(""), "trace")
getlex              QName(PackageNamespace("", "#0"), "_a_-_---")
pushint             -1820302793
callproperty        QName(PackageNamespace("", "#1"), "_a_--_--"), 1
coerce_s
callpropvoid        QName(PackageNamespace(""), "trace"), 1

which equals trace(a_-_---._a_--_--(-1820302793));

We want to trigger this trace as soon as the swf it's opened so we insert it in Player.class.asasm like this:

Code:

class
 refid "com.longtailvideo.jwplayer.player:Player"
 instance QName(PackageNamespace("com.longtailvideo.jwplayer.player"), "Player")
  extends QName(PackageNamespace("flash.display"), "Sprite")
  implements Multiname("IPlayer", [PackageNamespace("com.longtailvideo.jwplayer.player")])
  implements Multiname("IGlobalEventDispatcher", [PackageNamespace("com.longtailvideo.jwplayer.events")])
  flag SEALED
  flag PROTECTEDNS
  protectedns ProtectedNamespace("com.longtailvideo.jwplayer.player:Player")
  iinit
   refid "com.longtailvideo.jwplayer.player:Player/instance/init"
   flag NEED_ACTIVATION
   body
    maxstack 4
    localcount 3
    initscopedepth 10
    maxscopedepth 15
    code
     getlocal0
     pushscope

     newactivation
     newfunction         "com.longtailvideo.jwplayer.player:Player/instance/init/inline_method"
     pop
     findpropstrict      QName(PackageNamespace(""), "trace")
     getlex              QName(PackageNamespace("", "#0"), "_a_-_---")
     pushint             -1820302793
     callproperty        QName(PackageNamespace("", "#1"), "_a_--_--"), 1
     coerce_s
     callpropvoid        QName(PackageNamespace(""), "trace"), 1

     jump                L9

......

Now we assemble again:

Code:

$ rabcasm secure_player_ilive_z-1/secure_player_ilive_z-1.main.asasm
$abcreplace secure_player_ilive_z.swf 1 secure_player_ilive_z-1/secure_player_ilive_z-1.main.abc

Now we launch our flash debugger and open our modified swf file and we see:

Code:

I8772LDKksadhGHGagf#
Error: Error #2067: The ExternalInterface is not available in this container. ExternalInterface requires Internet Explorer ActiveX, Firefox, Mozilla 1.7.5 and greater, or other browsers that support NPRuntime.
	at Error$/throwError()
	at flash.external::ExternalInterface$/addCallback()
	at com.longtailvideo.jwplayer.controller::Controller/preRollAdLoad()
	at com.longtailvideo.jwplayer.controller::Controller/setupPlayer()
	at com.longtailvideo.jwplayer.player::Player/setupPlayer()

That's all folks

Telofy · #17 10-05-2013, 12:40 PM

Wow, now we have three different methods! Awesome! (Yet the stream was down at the precise moment I needed it. :-P)

And to answer that question from much earlier, I didn’t touch any file “mms.cfg”; I don’t even seem to have one on my system.

coolcar1 · #18 10-08-2013, 09:54 AM

Lol I'm a noob at coding/decoding this secure tokens. I'm willing to pay $5 to who ever can teach me personalty in teamviewer. PM ME.

pwish · #19 11-02-2013, 06:43 AM

Hi all,

I was trying to download iguide.to links. Unfortunately looks like they
Any one know how to get Iguide.to token?
Example link = http://www.iguide.to/view/3/

Thanks