What is SWF Verification? Can I save/record streams protected with SWF verification?

[any ANONYMOUS forum user]

What is SWF Verification?

SWF Verification is an Adobe copy protection mechanism employed by some sites streaming over RTMP and RTMPE:

Originally Posted by Adobe

SWF verification in Flash Media Server is a security feature that allows you to directly control which SWF files can connect to your server. Without implementing this feature, any SWF with the proper connection Uniform Resource Identifier (URI) and application name could freely
connect, potentially accessing your streams and using server resources.

With SWF verification, you can configure the server to check that the SWF file attempting to access a certain application or application instance belongs to a group of preapproved SWF files.

Enabling this feature in FMS is easy. You simply store a copy of the approved SWF file in the application directory and turn on the feature in the Application.xml file. When a SWF file connects to the server, the server verifies that the file exactly matches the SWF file in your application
directory, and then accepts the connection.

To approve a SWF file for any instance of a certain application, you place it in the SWFs directory in that application’s folder. To approve a SWF file for a specific instance, you place it in the SWFs directory inside that instance’s folder. This feature has been enhanced in Flash Media Server 3.5 to allow verification of SWF files without requiring copies on the server computer. You can now use the File plug-in to retrieve SWF files that are stored in distributed locations.

Here is the problem that SWF verification solves that secureToken does not solve. Decompiling an SWF file can reveal the secureToken shared secret. Then you can build your own swf to use the same key and steal all of the content you want. Decompiling an SWF is very easy. If I have an ad supported video service and I use secureToken, you could decompile my player, steal my secret key and release an 'ad free' version of my video player. You could even make your own player which does not even mention my website and just use my backend to serve all of your own users. While secureToken is a good start, using this in combination with SWF verification is the only reasonable way to protect content usage on other web-sites.

Although it is illegal for streaming video recording software to break any form of copy protection mechanism or digital rights management (DRM) due to violation of DMCA, it is possible to download/save/capture/record streams with SWF verification.


Is it possible to download/save/capture/record RTMP and RTMPE streams with SWF verification?
It is illegal in the U.S. to develop software that can download RTMPE streams or streams with SWF verification, because such programs violate DMCA.

rtmpdump project was taken down by Adobe, but the latest version of this freeware open-source command line utility was able to download RTMP and RTMPE streams, including the ones using SWF verification.

Replay Media Catcher 4 (Jaksta) can also detect these protected streams. Where possible it will try to record the stream as it plays in your browser instead of trying to download it (it can dowload RTMP streams only, not RTMPE streams). If this is not possible you will receive an error starting the stream is protected using SWF Verification.


If you can't record a protected stream, you may try to find another web-site that doesn't use any copy-protection mechanisms.
You can also contact the support staff of this web-site letting them know that you won't be returning to their site if they continue to employ such measures. You have paid for your computer and your Internet connection to get to their site and you should be able to view the content as and whenever you desire.