www.valkyria-anime.com: rtmpdump, rtmpe and a hard to download stream

ZargWolf · #1 06-25-2009, 07:38 PM

I've been successful with rtmpe and rtmpdump for quite a few stream but I've hit a problem with

Code:

http://www.valkyria-anime.com/special/movie/090324pv_m.html

The possible rtmpe streams are:

Code:

rtmpe://fms30-cache.stream.ne.jp:1935/aniplex-bc/_definst_&valkyria
rtmpe://fms30-cache.stream.ne.jp:1935/aniplex-bc/_definst_?videoId=17351026001&lineUpId=&pubId=10190186001&playerId=13598827001&playerTag=&affiliateId=

I've tried three different candidates for the swf player auth:

Code:

File: Deluxe.swf swfhash: 15036288dcfd24a7612dbf50ffce6f51c6d87d7e7b6ede1983da5e798f9e2950 swfsize: 35062
File: federated_video.swf swfhash: a2f68e1eb377949175d7153b7c0a3fcc37293fa38fd33f5210def0d7ee6c9b23 swfsize: 413247
File: OverlayMenu.swf swfhash: b54ce32b03a4da73e3058fc7c4ff52a53c35109fb3f5cd362333f51205eb15f5 swfsize: 77001

Is there anyone else that has more success?

#2 06-26-2009, 02:41 AM

When I try to watch the video I get the following message:
"Video is available. Please check back later."

The player used is federated_video.swf

Code:

http://c.brightcove.co.jp/services/viewer/federated_f9?&width=646&height=532&flashID=myExperience17351026001&bgcolor=%23FFFFFF&playerID=13598827001&publisherID=10190186001&isVid=true&%40videoPlayer=17351026001&autoStart=

or Deluxe.swf

Code:

http://admin.brightcove.co.jp/viewer/jp1.21.00.00/themes/widgets/videoPlayer/Deluxe.swf?id=1&pubId=10190186001&buildNumber=jp1.21.00.00

And I don't really know whether they use SWF verification or not.

This is the first video from brightcove that I see that supposedly RTMPE as well as SWF verification. How did you find the RTMPE stream URL?

ZargWolf · #3 06-26-2009, 06:30 AM

One of them is sent directly and findable with an url snooper.
The other one was built in memory.

#4 06-26-2009, 06:35 AM

I have found the following with URL Snooper:

Code:

rtmpe://fms30-cache.stream.ne.jp/aniplex-bc/_definst_&valkyria/valkyria_pv

But it should be a part of the URL.

What do you mean by built-in memory URL and how do you find it?

ZargWolf · #5 06-26-2009, 06:51 AM

By checking which strings in memory firefox accessed.

EDIT: have you been able to grab anything with that specific flv name?

EDIT2: how did you get it too?

#6 06-26-2009, 08:52 AM

Quote:

Originally Posted by ZargWolf

By checking which strings in memory firefox accessed.

What software can do that?

Quote:

Originally Posted by ZargWolf

have you been able to grab anything with that specific flv name?

It was Jaksta that created this name. It seems like Jaksta sends information about your recordings to their server.
However next time I was trying to record the name was different. I don't really know whether it is the server that changes names or Jaksta creates random names for its recordings.

ZargWolf · #7 06-26-2009, 09:03 AM

For the memory editor any debugger will do, or if you want to be lazy you can just dump the memory and search it using the windows debug tools.

In any case this isnt helping much...
Rtmpdump doesnt even seem able to pass the initial ping handshake... It doesnt even get to the swf auth part here.