#EXT-X or m3u8 or TS or AES-128? You got HLS.. Howto Beat it in 2017

[streamcrank]

It's called HTTP Live Streaming and it's a standard..

There is usually a master m3u8 with, for example different resolutions or audio only. Then each version of the content has it's own m3u8 that has the ts files you download and copy(copy *.ts example.mp4 on Windows for example). Then run it through ffmpeg to clean it up.

If it uses encryption then each .ts has it's own crypto key url("#EXT-X-KEY:METHOD=AES-128,URI=") and iv(example:"IV=0x00000000000000000000000000000007" ) that is used to decrypt it. The key is the body of the response of that http GET to the key url. Each key is for each TS there is no inheritor or weird padding or mixing going on..

How big networks make it more secure: The spec allows for a global key also in the ts-m3u8 that is used to decrypt each ts key, and the hosts usually timeout sessions on these and only server over https/tls. FFMPEG can still beat this security if you pass it a fresh enough URL. Sometime you have to manually dump using a cookie but not often. Grab the page with python and use the cookie header to grab ts files and either decrypt with a python encryption library(no native library) or use openssl CLI. Some might start using HTML5 storage too. With spec security just use the following.

How to easily get the m3u8:

//F12 then in console:
document.getElementsByTagName('video')[0]

How to rip even the secure ones(since HTML5 player has strict rules on key exchange). NOTE: if FFMPEG stops for any reason use the -ss option in front of input to resume ripping to a new file and just concat later; this happens with me with 1080 stream ripping.

ffmpeg -protocol_whitelist file,udp,rtp,crypto,tcp,https,rtsp,tls -i "TS-M3U8 URL HERE" -c:a copy -c:v copy "OUTPUT FILE HERE.ts"

Best transcode

//remove -hwaccel auto if you get errors
ffmpeg.exe -hwaccel auto -i "TS FILE HERE" -c:a copy -c:v x265 "OUTPUT PATH HERE.mp4"

P.S. I only got in to streaming a couple days ago but have seen this before on paid podcast networks except not encrypted.. It's easy.. If you use it I suggest tighter rulers on the global key. THE future: Using TPM hardware for decryption with binding to HTML5 video internals.

[kingstaytheking]

this isn't gonna work for encrypted streams .. like hbogo, showtime anytime etc...

[streamcrank]

Originally Posted by kingstaytheking

this isn't gonna work for encrypted streams .. like hbogo, showtime anytime etc...

If it works on Uplynk HLS streams it'll work on all of them. Uplynk uses master+segment keys in AES-128.. I feed them directly to FFMPEG and get clean 1080p rips..

Unless they use a custom player with FlashPlayer they have to comply with the HLS standard to get it to work with HTML5 <video>.. Most browsers shut off FlashPlayer based on domain policy or MAC so HTML5 is pretty much their only option.. Third party players like JWPlayer are even defaulting to HLS standard now.. All of their developers have to be force fed knowledge like most textbook CS grad software people so don't expect them to tighten security around the key URIs anytime soon..

[arec]

This is the kind of stream I am having difficulty with. When I try your code...

ffmpeg -protocol_whitelist file,udp,rtp,crypto,tcp,https,rtsp,tls -i "TS-M3U8 URL HERE" -c:a copy -c:v copy "OUTPUT FILE HERE.ts"

using my own filenames I get an error about "unable to open key file". I am not sure how to get that key file from the m3u8 file. I have read that it could be found in a cookie but also that it could be found in them m3u8 file itself.

[streamcrank]

Originally Posted by arec

This is the kind of stream I am having difficulty with. When I try your code...

ffmpeg -protocol_whitelist file,udp,rtp,crypto,tcp,https,rtsp,tls -i "TS-M3U8 URL HERE" -c:a copy -c:v copy "OUTPUT FILE HERE.ts"

using my own filenames I get an error about "unable to open key file". I am not sure how to get that key file from the m3u8 file. I have read that it could be found in a cookie but also that it could be found in them m3u8 file itself.

second red text is from first red text. They likely use cookies or referrer or timeout or all of the above to protect individual and/or master key URI. With these you need to use a python script the uses cookie header and sets referrer header. This isn't an uplynk thing it's a client thing.

[arec]

Roger that, thank you steamcrank!

[kingstaytheking]

I still don't buy it

I will share my personal hbogo account with you .. if you get streams working I'll even donate you some money

but I just don't see it working

contact me if interested

[streamcrank]

Originally Posted by kingstaytheking

I still don't buy it

I will share my personal hbogo account with you .. if you get streams working I'll even donate you some money

but I just don't see it working

contact me if interested

I'll do it if the donation is bitcoin. I have to go through a proxy or VPN that isn't blacklisted by HBO because I'm outside the US right now.

Unless your target site is using a flash player they're forced to stick to the standards supported by the target browser HTML5 <video> support. There is no if and or but.. Both HTML5 DRM and HLS use clear key exchanges only protected by weak session policies. FFMPEG does great with HLS encrypted as long as you have the bandwidth for HD and they don't check cookie and referrer headers on key URIs.

[WHOOKIDSON]

Originally Posted by streamcrank

I'll do it if the donation is bitcoin. I have to go through a proxy or VPN that isn't blacklisted by HBO because I'm outside the US right now.

Unless your target site is using a flash player they're forced to stick to the standards supported by the target browser HTML5 <video> support. There is no if and or but.. Both HTML5 DRM and HLS use clear key exchanges only protected by weak session policies. FFMPEG does great with HLS encrypted as long as you have the bandwidth for HD and they don't check cookie and referrer headers on key URIs.

I'm willing to donate as well. Keep us updated. Check your PM.

EDIT:

And btw. HBO and a few others don't use #EXT-X-KEY:METHOD=AES-128,URI=

Last time I checked it was #EXT-X-KEY:METHOD=SAMPLE-AES,URI="faxs://faxs.adobe.com",KEYFORMAT="com.apple.streamingkeyd elivery",KEYFORMATVERSIONS="1",IV=

[kingstaytheking]

hbo works with vpn

and sure .. btc is fine