#EXT-X or m3u8 or TS or AES-128? You got HLS.. Howto Beat it in 2017

[Yelloworanges]

Originally Posted by streamcrank

P.S. I only got in to streaming a couple days ago

Originally Posted by WHOOKIDSON

Last time I checked it was #EXT-X-KEY:METHOD=SAMPLE-AES,URI="faxs://faxs.adobe.com",KEYFORMAT="com.apple.streamingkeyd elivery",KEYFORMATVERSIONS="1",IV=

Nothing streamcrank has said indicates that he is familiar with flash access.

[kingstaytheking]

Originally Posted by WHOOKIDSON

I'm willing to donate as well. Keep us updated. Check your PM.

EDIT:

And btw. HBO and a few others don't use #EXT-X-KEY:METHOD=AES-128,URI=

Last time I checked it was #EXT-X-KEY:METHOD=SAMPLE-AES,URI="faxs://faxs.adobe.com",KEYFORMAT="com.apple.streamingkeyd elivery",KEYFORMATVERSIONS="1",IV=

crap.. you are right.. it is SAMPLE-AES

I didn't check on this for a while... was pretty sure it's AES-128

but now I see they use fairplay encryption with xs key delivery
faxs:// url points the player to the Adobe Access (XS) system ... key is probably never even passed through the browser

this completely bypasses widevine .. so netflix approach is a no go

maybe somebody out there knows the trick... but with written above... I just don't see it

[Yelloworanges]

Originally Posted by kingstaytheking

but now I see they use fairplay encryption with xs key delivery
faxs:// url points the player to the Adobe Access (XS) system ... key is probably never even passed through the browser

this completely bypasses widevine

maybe somebody out there knows the trick... but with written above... I just don't see it

I don't see it either. XS solution is probably closely held unless you've seen it on darkweb. I don't have hbo but is hls with XS the method they use on all device platforms?

[kingstaytheking]

that's what I'm wondering too

web one is a no go as far as i know...
but then again... I could be wrong

[WHOOKIDSON]

I'll try it on the Xbox One/Roku/Fire TV later on tonight.

They're probably still the same. HBO Now uses dash on the Xbox One and Roku. I'll try the HBO Go tonight.

[Yelloworanges]

dash is most commonly widevine but I have seen playready versions of it like on some content on nbcsports.

[kingstaytheking]

even if you grab dash link ... u can't do much with it..

key request is gonna be https ... fiddler or charles cert on device will be required to decrypt it .. and "man in the middle" is another topic that will be hard to pull off for something like this

i don't see them encrypting request of video itself.. that's gonna be http .. which means it;s easy to grab .mpd


but key exchange is httpS... 1000000% ... regardless of which device we are talking about

in so many words, it can't be done

[WHOOKIDSON]

I already sniffed the DASH stuff (which came from HBO NOW). I was just curious to see what kind of stuff was being used on those devices for that specific app. I was talking about doing HBO Go tonight. Far as ripping HBO goes the easiest way I've seen to rip it is to use the satellite or cable's provider's streaming site/service. I used to rip from XfinityTV and AT&T U-Verse. Last time was late summer of last year. Then I got into AMZN and NF stuff. I might have to dust off some old scripts to see if the old stuff still works for "HBO" (through the provider's login/site).

And more and more sites are blocking the certs from Fiddler and Charles. I remember last year some sites would work with Fiddler but not with Charles and vice versa. I've always had better success with Charles tho.

[kingstaytheking]

what are xfinity and att using?

if I'm not mistaking they have on demand content from hbo

[WHOOKIDSON]

"Last year" the key was being sent by "#EXT-X-KEY:METHOD=AES-128,URI=" (I'm sure XfinityTV is still using Adobe FlashAccess DRM tho)

I don't know about now. But that is how it was for XfinityTV so all you had to do was download the key and then all of the .ts files and decrypt that way locally. I can't really remember what U-Verse was. I was mainly ripping from their site. Far as U-Verse goes now "some" of their stuff uses DASH (Chrome) and the video can be "decrypted" using the tool. I haven't really had time to play with Xfinity since they did the major upgrade to their app and site.

And yeah, both of them have HBO content.