How to find RTMPE stream URLs

I don't know any URL Finders that can reveal RTMPE URLs.

I have seen 2 ways of finding RTMPE URLs:

1. analyzing HTML, XML and other files used by the web-site
2. getting it from the memory dump of your browser with a debugger

[noob2001204]

Stream Recorder,can you explain the 2nd method in steps by steps?
i wanna try the 2nd method,what debugger do you use?
how to find out the url?

ZargWolf managed to find RTMPE URLs

Originally Posted by ZargWolf

By checking which strings in memory firefox accessed.

Originally Posted by ZargWolf

For the memory editor any debugger will do, or if you want to be lazy you can just dump the memory and search it using the windows debug tools.

[compn]

i wonder if you can get gnash or swfdec to be used instead of adobe flash player, and if those will return rtmpe urls for you?

maybe with 'media player connectivity' firefox extension
http://www.getgnash.org/packages/snapshots/windows/

[any ANONYMOUS forum user]

Stream Recorder i think the option 2 is better and i found this information with debuger ollydbg maybe works

http://sh1zuka.wordpress.com/2009/02...opular-demand/

[any ANONYMOUS forum user]

i've been reading your posts about rtmpdump and i must admit it looks great! i have managed to flasm the size and get the hash from openssl with no problems, but i'm having problems finding the rtmpe urls..

i read on here that some people are plucking these from memory grabs, but i've been unsucessfull so far and was wondering whether you can help.

hope to hear from you soon.

[noob2001204]

This is not a very effective method,but its worth a try

Step 1. Use PMDump to dump your browser memory to your hard disk when you are watching the video you want to rip (you can pause it to avoid the lag)
Step 2. Use a hex editor to open the memory dump file,I use HxD Editor,its free and portable
Step 3. Press Ctrl + F to search keywords such as "rtmpe://" "mp4:" "stream start" "connect to",there you can find the url you want

rtmpdump 1.9 can successfully download the videos I couldn't download before

[teselli]

Originally Posted by noob2001204

This is not a very effective method,but its worth a try

Step 1. Use PMDump to dump your browser memory to your hard disk when you are watching the video you want to rip (you can pause it to avoid the lag)
Step 2. Use a hex editor to open the memory dump file,I use HxD Editor,its free and portable
Step 3. Press Ctrl + F to search keywords such as "rtmpe://" "mp4:" "stream start" "connect to",there you can find the url you want

rtmpdump 1.9 can successfully download the videos I couldn't download before

how do you want to find the url in hxd editor,
i can not read the url, it is unicode or like that;(

please help

[noob2001204]

Originally Posted by teselli

how do you want to find the url in hxd editor,
i can not read the url, it is unicode or like that;(

please help

Usually,if you search the keywords like "rtmpe://" "mp4:",you can find the direct url within a xml file,along with other videos info
you should press F3 to continue to search until you find the correct url
If you have some problems,you can post the url here,i can help you to find it

The newest version of rtmpdump 2.1 comes with two additional server programs, rtmpsrv and rtmpsuck:

rtmpsrv is a stub for a server; it logs the connect and play parameters from a regular client that connects to it. These parameters can then be used with rtmpdump to retrieve a stream.

rtmpsuck is a transparent proxy; it intercepts connections from a client and then makes an outbound connection to the real server. After all handshaking is complete and encryption keys with both sides are negotiated, it records the cleartext stream data into files while relaying the data from the server to the client.

Originally Posted by rtmpdump

You can also use "make rtmpsrv" to build a stub server. Note that this is very incomplete code, and I haven't yet decided whether or not to finish it. In its current form it is useful for obtaining all the parameters that a real Flash client would send to an RTMP server, so that they can be used with rtmpdump.

You can also use "make rtmpsuck" to build a proxy server. See below...

All you need to do is redirect your Flash clients to the machine running this server and it will dump out all the connect / play parameters that the Flash client sent. The simplest way to cause the redirect is by editing /etc/hosts when you know the hostname of the RTMP server, and point it to localhost while running rtmpsrv on your machine. (This approach should work on any OS; on Windows you would edit %SystemRoot%\system32\drivers\etc\hosts.)

On Linux you can also use iptables to redirect all outbound RTMP traffic.
You can do this as root:

iptables -t nat -A OUTPUT -p tcp --dport 1935 -j REDIRECT

In my original plan I would have the transparent proxy running as a special user (e.g. user "proxy"), and regular Flash clients running as any other user. In that case the proxy would make the connection to the real RTMP server. The
iptables rule would look like this:

iptables -t nat -A OUTPUT -p tcp --dport 1935 -m owner \! --uid-owner proxy \ -j REDIRECT

A rule like the above will be needed to use rtmpsuck.

Using it in this mode takes advantage of the Linux support for IP redirects; in particular it uses a special getsockopt() call to retrieve the original
destination address of the connection. That way the proxy can create the real outbound connection without any other help from the user. I'm not aware of equivalent functionality on BSD, Windows, or any other platform; if you know how to handle this I'd be interested in hearing about it.

The rtmpsuck command has only one option: "-z" to turn on debug logging. It listens on port 1935 for RTMP sessions, but you can also redirect other ports to it as needed (read the iptables docs). It first performs an RTMP handshake with the client, then waits for the client to send a connect request. It parses and prints the connect parameters, then makes an outbound connection to the real RTMP server. It performs an RTMP handshake with that server, forwards the connect request, and from that point on it just relays packets back and forth between the two endpoints.

It also checks for a few packets that it treats specially: a play packet from the client will get parsed so that the playpath can be displayed. It
also handles SWF Verification requests from the server, without forwarding them to the client. (There would be no point, since the response is tied to each session's handshake.)

Once the play command is processed, all subsequent audio/video data received from the server will be written to a file, as well as being delivered back to the client.

The point of all this, instead of just using a sniffer, is that since rtmpsuck has performed real handshakes with both the client and the server, it can negotiate whatever encryption keys are needed and so record the unencrypted
data.