Page 1 of 3

Show 40 post(s) from this thread on one page

Audio/video stream recording forums (http://stream-recorder.com/forum/index.php)

- Video stream recording (http://stream-recorder.com/forum/forumdisplay.php?f=4)

- -

Decrypt AES-128 encrypted video files from a m3u8

(http://stream-recorder.com/forum/showthread.php?t=18317)

Dune	05-21-2014 05:47 AM

Decrypt AES-128 encrypted video files from a m3u8

Hello,

This thread is somewhat related to this recent topic.
The idea here is to decrypt the video that is described by a .m3u8 playlist:

Code:

#EXTM3U

#EXT-X-VERSION:3

#EXT-X-MEDIA-SEQUENCE:0

#EXT-X-ALLOW-CACHE:YES

#EXT-X-TARGETDURATION:20

#EXT-X-KEY:METHOD=AES-128,URI="key.key",IV=0xF85A5066CCB442181ACACA2E862A34DC

#EXTINF:10.368000,

segment-00000.ts

#EXTINF:14.252000,

segment-00001.ts

...

The .key file is just:

Code:

e2f96a0861cb381a8b52801f18bf04924c3472bc8f319930

I have tried ffmpeg but it is failing, so I'm now trying to decrypt separate .ts parts (TS is one of these formats which you can read even if you have a part of the file).

I have tried to use (as well as some online AES decrypting tools) openssl, with the following command:

Code:

openssl aes-128-cbc -d -in segment-00001.ts -out output.ts -K e2f96a0861cb381a8b52801f18bf04924c3472bc8f319930 -iv F85A5066CCB442181ACACA2E862A34DC

But this returns a "bad decrypt" error:

Code:

bad decrypt

139974157190984:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:596:

Does anyone here have a clue about this?
Thank you in advance! ;)
Dune

surya987

05-21-2014 08:39 AM

Re: Decrypt AES-128 encrypted video files from a m3u8

post actual link of video... i think i know how to do .. but post actual link..

Dune	05-21-2014 08:49 AM

Re: Decrypt AES-128 encrypted video files from a m3u8

That's nice of you, thanks.
What do you mean by "video"?
All you are missing from this are the TS segments (and the complete m3u8 that references all these segments).

I can download all the TS segments and zip them to you when I'm back home (within an hour).

If just one is enough, here is a link to the first one: https://www.mediafire.com/?7bx93bcs756o8d0

surya987

05-21-2014 08:54 AM

Re: Decrypt AES-128 encrypted video files from a m3u8

from where you got this m3u8 file... i am asking this ... or provide me m3u8 file...

thanks

Dune	05-21-2014 09:52 AM

Re: Decrypt AES-128 encrypted video files from a m3u8

You cannot directly download the m3u8 or the ts because of localization restrictions (or you'd have to use a proxy), so the automatic download of the .ts files by ffmpeg is likely not to work.

Here are the .m3u8 and the .key downloads:
.m3u8 download: http://www.mediafire.com/view/lhk7h6..._XTFCNSNV.m3u8
.key download: http://www.mediafire.com/view/wyf8ne...zrwtaxcilu.key

I'm working on uploading all the .ts chunks, in case this is not enough :)
I already linked one chunk to test on by the way (http://www.mediafire.com/download/7b...leeia-00001.ts)

surya987

05-21-2014 10:15 AM

Re: Decrypt AES-128 encrypted video files from a m3u8

bro just post link of actual weburl.....i have to look m3u8 file so that i can help you .... and also where is m3u8 file..???? there are lot of files..

i cnt locate it are you kidding me or what....???

Dune	05-21-2014 10:19 AM

Re: Decrypt AES-128 encrypted video files from a m3u8

Whoops, fixed the link :) (http://www.mediafire.com/view/lhk7h6..._XTFCNSNV.m3u8)

Sorry for the misclick.

surya987

05-21-2014 10:23 AM

Re: Decrypt AES-128 encrypted video files from a m3u8

got it PM me now.... i will tell you how to actully do it... :D

Dune	05-22-2014 04:42 AM

Re: Decrypt AES-128 encrypted video files from a m3u8

To the people who PMd me, this guy (surya987) didn't give me (yet) an actually working solution...
I am still desperately trying to figure that out.

blimey

05-22-2014 12:17 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

Quote:

Originally Posted by Dune (Post 67757)

To the people who PMd me, this guy (surya987) didn't give me (yet) an actually working solution...
I am still desperately trying to figure that out.

The key doesn't seem like what is typically used for hls/m3u8.

Usually the key is around 16 bytes varied hexadecimal (like shown at the start of the other thread you mention), and not like the alphanumeric key string you show.

What is the url original source (not some copy) for;

BlackBullet07C_HD.mp4_420kbps-zrwtaxcilu.key

and

BlackBullet07C_HD.mp4_420kbps_XTFCNSNV.m3u8

There doesn't seem to be any geo restriction on the ts segments. You say you don't need to post the original source url because you have already provided all of the pieces, but there is no way to verify that the key you provided is correct without the original source.

Dune	05-22-2014 12:22 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

There is no geo restriction on the segments, but there is on the .m3u8 and the .key.
I cannot directlink them because they are links that expire after a few seconds (you need to go through an adwall, and it's georestricted anyway).

We have indeed spotted that there is a problem on the key, they have recently changed their key format and that's probably where lies the problem. The .key used to be a binary file.

We have tried reencoding it into a binary file, but it doesn't work, the key is too long (48 chars instead of 32 iirc).

There is something that we need to do onto this key, but I don't see what. It's something that the player (JWPlayer, using HLS - HttpLiveStreaming, it has little doc on their site) manages to read though, so there must be some way?
Plus we have seen on some torrent sites that the videos keep being successfully ripped, but we are several to try and fail at decoding them.

blimey

05-22-2014 12:30 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

In that case it is likely that the key is somehow encoded (or specially interpreted by the player). But this is unusual for hls (m3u8) for compatibility reasons.

The only way to see if the key is encoded is to see how it is interpreted in real time in memory as it is being used to play the segments. This means playing the video from the original source webpage.

Dune	05-22-2014 12:45 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

Thank you for your answer!

Ok I got you, but you would need to play the stream from a French, Belgium, Swiss or other french-speaking country :(

Here is the link
http://preview.tinyurl.com/pwj4tqr

If you are not geoblocked, skip the adwalls and you get to the video page that you can play (if there is something i can do to help you with that please tell me (Ctrl+s on the page doesn't work)).

Do not click the "GetVideoPath" links when you look in the traffic, they get you site-banned. Click the redirections that the player did instead.

Edit: tinyurl'd the link

Dune	05-22-2014 03:31 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

Quote:

The only way to see if the key is encoded is to see how it is interpreted in real time in memory as it is being used to play the segments. This means playing the video from the original source webpage.

This is really an excellent idea, i need to figure out how to do this, since it looks unlikely that you will be able to.

blimey

05-22-2014 03:53 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

I've started to look at it, and will look at it more thoroughly tonight and tomorrow. Geo-restrictions or the need for proxies/VPNs are not a significant obstacle and something that the members here deal with routinely. Thanks for the tip about the booby-trapped network requests.

Dune	05-23-2014 02:29 AM

Re: Decrypt AES-128 encrypted video files from a m3u8

Quote:

Originally Posted by blimey (Post 67768)

Oh, really? Didn't know, apologizes for not providing the link earlier! :)

And thank you for that investment, that would help a lot of viewers - I've already received a few PMs by posting here and have other contacts stuck on the same problem as me, looking for a solution.

gaaara

05-23-2014 03:49 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

hello

I found something I am not sure if it can help but you never know
sorry for my english

Code:

def read_m3u8(m3u8)

    File.open(m3u8, 'r') do |file|

        keyfile = nil

        iv = 0

        file.each_line do |line|

            line.chomp!

            if line =~ /^#EXT-X-KEY:METHOD=AES-128,URI="(.*?)"(,IV=0x(.*))?/

                keyfile = $1

                if $2

                    iv = $3

                    iv_gen = :random

                else

                    iv_gen = :sequence

                end

            elsif not line =~ /^#/

                in_file = File.join(File.dirname(m3u8), line)

                ext = File.extname(in_file)

                out_file = File.join(File.dirname(in_file), File.basename(in_file, ext) + '.clear' + ext)

                decrypt(in_file, keyfile, iv, out_file)

                if iv_gen == :sequence

                    iv += 1

                end

            end

        end

    end

end



def decrypt(in_file, keyfile, iv, out_file)

    key = load_key(keyfile)

    iv_hex = sprintf('%032x', iv)

    %x{openssl aes-128-cbc -d -K #{key} -iv #{iv_hex} -nosalt -in #{in_file} -out #{out_file}}

end



def load_key(keyfile)

    File.open(keyfile, 'rb') do |file|

        file.read.unpack('H*')[0]

    end

end



read_m3u8(ARGV[0])

source website http://cesbo.com/forum/topic/611-dec...ttp-streaming/

Dune	05-24-2014 09:44 AM

Re: Decrypt AES-128 encrypted video files from a m3u8

Eh well thanks for your contribution, trying to figure which language that is.

Doesn't quite look like Python.

gaaara

05-24-2014 12:03 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

seems to be the language ruby code was in a file. rb

you speek french Dune ?

Nopt	05-24-2014 12:12 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

The answer indeed lies in the original source page :)
And since you like python :

Code:

import base64

from Crypto.Cipher import Blowfish

key = "Rev3rseEngIneeringIsN0tLeGal" #~ As if ;)

aes = Blowfish.new(key, Blowfish.MODE_ECB)

d = "e2f96a0861cb381a8b52801f18bf04924c3472bc8f319930"

d = d.decode("hex")

d = aes.decrypt(d)

d = base64.b64decode(d)

return d

chap	05-24-2014 01:51 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

Quote:

Originally Posted by Nopt (Post 67801)

The answer indeed lies in the original source page :)
And since you like python :

Code:

import base64

from Crypto.Cipher import Blowfish

key = "Rev3rseEngIneeringIsN0tLeGal" #~ As if ;)

aes = Blowfish.new(key, Blowfish.MODE_ECB)

d = "e2f96a0861cb381a8b52801f18bf04924c3472bc8f319930"

d = d.decode("hex")

d = aes.decrypt(d)

d = base64.b64decode(d)

return d

what it looks like in PHP?

Dune	05-24-2014 03:07 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

Quote:

Originally Posted by gaaara (Post 67800)

seems to be the language ruby code was in a file. rb

you speek french Dune ?

Indeed I do, we're quite a bunch of french people being concerned by this :)

Quote:

Originally Posted by Nopt (Post 67801)

The answer indeed lies in the original source page :)
And since you like python :

Code:

import base64

from Crypto.Cipher import Blowfish

key = "Rev3rseEngIneeringIsN0tLeGal" #~ As if ;)

aes = Blowfish.new(key, Blowfish.MODE_ECB)

d = "e2f96a0861cb381a8b52801f18bf04924c3472bc8f319930"

d = d.decode("hex")

d = aes.decrypt(d)

d = base64.b64decode(d)

return d

Thank you very much for the Python port! I'm gonna try this ASAP.

Nopt	05-24-2014 03:23 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

Quote:

Originally Posted by Dune (Post 67805)

Thank you very much for the Python port! I'm gonna try this ASAP.

I'm not sure what you mean by "port", it has nothing to do with the earlier ruby code (which only handle a classic HLS stream)
My code specifically and only address the problem of the encrypted .key file. (it even includes the secret - well not that secret anymore ;) - key !)

If you want a python port of the ruby code (to dump a classic HLS stream like ffmpeg would do) it's more like that :

Code:

import m3u8

from Crypto.Cipher import AES

f = open('file.ts','rb')

playlist = m3u8.loads(playlist) 

key = urllib2.urlopen(playlist.key.uri).read() # <- swap that line with my earlier snippet to handle encrypted keys

iv = ('%x' % int(playlist.key.iv,16)).decode("hex")

aes = AES.new(key, AES.MODE_CBC, iv)

for x in playlist.segments :

        r = urllib2.urlopen(x.uri)

        d = r.read()

        d = aes.decrypt(d)

        f.write(d)

f.close()

Spyne

05-24-2014 03:38 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

Can you explain how you find this key ?

Dune	05-24-2014 03:50 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

Quote:

Originally Posted by Nopt (Post 67807)

Code:

import m3u8

from Crypto.Cipher import AES

f = open('file.ts','rb')

playlist = m3u8.loads(playlist) 

key = urllib2.urlopen(playlist.key.uri).read() # <- swap that line with my earlier snippet to handle encrypted keys

iv = ('%x' % int(playlist.key.iv,16)).decode("hex")

aes = AES.new(key, AES.MODE_CBC, iv)

for x in playlist.segments :

        r = urllib2.urlopen(x.uri)

        d = r.read()

        d = aes.decrypt(d)

        f.write(d)

f.close()

Oh I'm sorry I didn't look too puch into the Ruby code and thought all you did was porting.

Thank you a HUGE lot for your investment!
I just tested it, and it works!!! It is going to help a lot of us, that's for sure :)

Dat key though :D

Huge thanks again!

Edit: as Spyne said, it would help us a bunch in the future if you could give a few directions&tip as to how to get this key.

CereFR

05-24-2014 04:09 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

You can access the key with every sniffer you can find on the net (personally I use Coojah). But take care to the banishment ! The criteria change weekly, they are still programming their system, then we never know when it changes.

I suggest to focus on the key we have to decrypt, because surrounding stuff can be solved with Google ;) .

Nopt	05-24-2014 04:14 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

Quote:

Originally Posted by Dune (Post 67809)

Edit: as Spyne said, it would help us a bunch in the future if you could give a few directions&tip as to how to get this key.

Well hint n°1 : the browser always know the key (or anything of that kind for that matter)
hint n°2 : everything the browser executes is basically plain text (or not so far from it)
hint n°3 : it's in the HLSProvider6.0.2.swf file :p

Dune	05-24-2014 04:34 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

Quote:

Originally Posted by CereFR (Post 67810)

Downloading the .key file really is no hard task... it's more about the way to decrypt it. You need another "key" ;)

Quote:

Originally Posted by Nopt (Post 67811)

Trying that on my own atm, thanks for the hints!

Dune	05-24-2014 04:44 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

Alright, I've looked into the .swf file, but I can't find anything there; what would you use track the execution/use of that file (or of the player in general)?

Damn I'm feeling incompetent now :/

gaaara

05-24-2014 05:35 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

how to use this for download video ?

blimey

05-24-2014 05:39 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

jwplayer.flash.swf passes to HLSProvider6.0.2.swf which loads the playlist and plays the segments. You can disassemble HLSProvider6.0.2.swf online at showmycode.com.

CereFR

05-24-2014 06:12 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

Code is too long to be shown.
http://www.mediafire.com/view/7bwvhl...ider6_Code.txt

Dune	05-25-2014 01:10 AM

Re: Decrypt AES-128 encrypted video files from a m3u8

Quote:

Originally Posted by blimey (Post 67815)

jwplayer.flash.swf passes to HLSProvider6.0.2.swf which loads the playlist and plays the segments. You can disassemble HLSProvider6.0.2.swf online at showmycode.com.

Thank you for the additional tip, it looks like they've changed it yet again and now use stronger obfuscation, I'm looking into this :)

chap	05-25-2014 01:14 AM

Re: Decrypt AES-128 encrypted video files from a m3u8

Quote:

Originally Posted by Dune (Post 67813)

Alright, I've looked into the .swf file, but I can't find anything there; what would you use track the execution/use of that file (or of the player in general)?

Damn I'm feeling incompetent now :/

use decompress SWF (example flasm)

Nopt	05-25-2014 01:58 AM

Re: Decrypt AES-128 encrypted video files from a m3u8

Quote:

Originally Posted by gaaara (Post 67814)

how to use this for download video ?

Since most of us speak French, I uploaded a ready-to-use python script in the French sub-forum. http://stream-recorder.com/forum/t-l...du-t18329.html

CereFR

05-25-2014 06:35 AM

Re: Decrypt AES-128 encrypted video files from a m3u8

Look back to the link I gave to the sfw code. Which function is used to crypt the key ? Is it the one called "keyCompleteHandler" ?

lenovog470

06-14-2014 01:06 AM

Re: Decrypt AES-128 encrypted video files from a m3u8

help me, decrypt this file

m3u8 : https://www.dropbox.com/s/b7192qline...3_011_800.m3u8
key :
https://www.dropbox.com/s/83pmysyvqop5k6t/key

mr.anderson

06-19-2014 09:29 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

Hi can anyone tell me how to download this

Here is the m3u8 encrypted link

Thanks

jkg	06-24-2014 04:07 PM

Re: Decrypt AES-128 encrypted video files from a m3u8

I'm trying to capture an HLS stream that is seemingly encrypted with AES-128. However I can't find any key file or a URI link. The m3u8 file contains this line:
#EXT-X-KEY:METHOD=NONE
which is usually where it lists AES-128 encryption along with a URI link or value of some kind, but obviously there's nothing there, it just says "NONE". It does mention AES-128 encryption elsewhere in the m3u8 file, but still no key or link, and the m3u8 file has basically nothing else in it except for the names of the TS chunks.

FFmpeg just gives me a generic "HTTP error 403 Forbidden" msg followed by "Input/output error" when I feed it the m3u8 link so I'm not sure what that's about, or if that's the normal msg for this type of situation.

I'd post the link but it's one of those pay-type sites where you need an account with login info. If anyone could PM me or try to help in any way I'd hugely appreciate it.

denobis

06-25-2014 08:29 AM

Re: Decrypt AES-128 encrypted video files from a m3u8

Quote:

Originally Posted by mr.anderson (Post 68495)

Hi can anyone tell me how to download this

Here is the m3u8 encrypted link

Thanks

use atresdownloader, although wait next update which fixes some bugs

All times are GMT -6. The time now is 06:42 AM.

Page 1 of 3

Show 40 post(s) from this thread on one page