How to Download AES Encrypted Stream

[MOZ]

I'm wondering if you experts can give me any help? I'm trying to download a few different AES encrypted streams and am having no luck. Below is the m3u8 file for the particular stream I am after.

M3U8 File or Direct Link to the m3u8 file.

It's a stream from www.premierleaguepass.com. Can anybody help me please? Would be happy to send a small paypal donation for anyone who can teach me how to do this.

Thanks!

[BlueCop]

normally i would say ffmpeg can do it.

ffmpeg -i "http://nlds4.cdnllnwnl.lon.neulion.com/nlds_vod/coliseum/vod/2014/08/30/420/2_420_manchesterunited_burnley_2014_h_whole_1_4500 .mp4.m3u8" -c copy video.ts

this gets a 403 error on retrieving the key. there might be some auth or parameters or cookies you need to get the key.

this is the key url that returns 403
http://solr.zon.neulion.com/nlsk/hls...mobile_vod.key

you could monitor the requests and figure out what the need parameters are to get the key. Maybe then you could download it.

[MOZ]

Originally Posted by BlueCop

normally i would say ffmpeg can do it.



this gets a 403 error on retrieving the key. there might be some auth or parameters or cookies you need to get the key.

this is the key url that returns 403
http://solr.zon.neulion.com/nlsk/hls...mobile_vod.key

you could monitor the requests and figure out what the need parameters are to get the key. Maybe then you could download it.

So I had a look through Web Developer > Network when I first load the video and this is what requests are made:



This points to a different key to the one in m3u8 playlist? The key it points to in the Network tools can be downloaded here without a 403.

Is that the correct key to be able to decrypt it? If I change the part at the top of the m3u8 to below:

#EXTM3U
#EXT-X-TARGETDURATION:10
#EXT-X-MEDIA-SEQUENCE:0
#EXT-X-KEY:METHOD=AES-128,URI="http://nlds4.lon.neulion.com:443/nlds_vod/coliseum/vod/2014/08/30/420/2_420_manchesterunited_burnley_2014_h_whole_1_4500 .mp4/adaptive.key?clientKey=ffbd0f4faa2546d359cc074c228 c8e6b"
#EXTINF:10,

I get the following error from ffmpeg:

[http @ 0x7f9f094536a0] HTTP error 403 Forbidden
Unable to open key file http://nlds4.lon.neulion.com:443/nld...074c228 c8e6b
[crypto @ 0x7f9f094536a0] Unable to open input
[hls,applehttp @ 0x7f9f09821800] Failed to open segment of playlist 0
[hls,applehttp @ 0x7f9f09821800] Error when loading first segment '2_420_manchesterunited_burnley_2014_h_whole_1_450 0_000000.ts'
2_420_manchesterunited_burnley_2014_h_whole_1_4500 .mp4.m3u8: No such file or directory

If I download the adaptive.key and open it up in TextEdit it shows me the following:



Thanks for your help so far BlueCop. Any more help from yourself or anybody else to crack this one will be greatly appreciated.

[surya987]

the key is encrypted... use hexdump to get decrypted key value..

hexdump will give you the hex value of key to use for decryption via manual open ssl method ... the site is geo blocked otherwise may b i could find some other way to do it...

thanks

[MOZ]

Originally Posted by surya987

the key is encrypted... use hexdump to get decrypted key value..

hexdump will give you the hex value of key to use for decryption via manual open ssl method ... the site is geo blocked otherwise may b i could find some other way to do it...

thanks

Thanks for your reply. How do I do this? I have access to either OSX or Windows.

I feel within touching distance of getting this file! Thanks once again for everybody's continued help.

[BlueCop]

Originally Posted by surya987

the key is encrypted... use hexdump to get decrypted key value..

hexdump will give you the hex value of key to use for decryption via manual open ssl method ... the site is geo blocked otherwise may b i could find some other way to do it...

thanks

the key isn't encrypted. that is data encoding. that is the text representation of the actual data and not encrypted at all.

MOZ: There is authorization tokens/headers used somewhere. Can you can get the full url used to retrieve the orginal m3u8 by the client and then try to download that with ffmpeg?

if that doesn't work then we can add some cookies to the header to get the download working correctly for you.

[MOZ]

Originally Posted by BlueCop

the key isn't encrypted. that is data encoding. that is the text representation of the actual data and not encrypted at all.

MOZ: There is authorization tokens/headers used somewhere. Can you can get the full url used to retrieve the orginal m3u8 by the client and then try to download that with ffmpeg?

if that doesn't work then we can add some cookies to the header to get the download working correctly for you.

Is this the link you're looking for? -

http://nlds4.lon.neulion.com:443/pla...3u8;*.ts;*.mp4

So looking further I have two more parameters that I've found:

NLAuth:

"e053a2875d8625d30de0b049f58d7586-0-32"

serverKey_internal_ASV3:

"8aacac8811168c78ac54864d3ace607f-c2d79d7058e903b534adbe3cc470633e-0-32"

Not sure if that helps at all.

[MOZ]

Okay so loaded the stream on my iPad and sniffed the original m3u8 which is available here

Does that help? When run through ffmpeg I get the same problem:

Unable to open key file http://solr.zon.neulion.com/nlsk/hls...mobile_vod.key

Shows the Following under Cookie:

nlqptid=nltid=plp&nltdt=6&nltnt=1&uid=28845&hdnea= expires%3D1408315446%7Eaccess%3D%2F*%7Emd5%3Dbd2f4 b735763cc1c66b2f432b160cf1a

[surya987]

i need orignal video url and country name from where i can acces the website...

thanks

[BlueCop]

You have everything you need to download the video if you have the key file saved already. The video segments aren't protected. I could download them myself.

if you save the key file as "coliseum_mobile_vod.key" and then save the modified m3u8 from below as "video.m3u8"

then this command will work.

ffmpeg -i video.m3u8 -c copy video.ts

will download the decrypted video.

here is the modified m3u8. http://pastebin.com/KhcU8Z3v The changes are making the video files to full urls and changing the key file to a local file.

surya987: it isn't geo-protected on the server. it just needs authorization.