search

axiomatic-systems / Bento4

Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
http://www.bento4.com
2.02k stars 482 forks source link

mp4decrypt for sample-aes doesn't decrypt the file but playable on iPad #265

Closed praveenster closed 6 years ago

praveenster commented 6 years ago

I have an fmp4 file encrypted with a test key (SAMPLE-AES, cbcs) that plays back on the iPad (with a valid m3u8) but when I decrypt the same file using mp4decrypt and verify the decrypted output, the video looks garbled.

Has anyone seen this? I am using Version 1.5.1-622 compiled from source on Linux.

ghost commented 6 years ago

It usually means that you decrypted the video with the wrong kid:key

praveenster commented 6 years ago

Thanks for the suggestion @anorexicseal. I double checked the kid:key combination and it seems to be correct. After debugging further, I noticed that AP4_Processor::Process returns with an error as it is unable to find the SENC table, which I believe is optional at least as far as HLS is concerned.

barbibulle commented 6 years ago

@praveenster The decryptor shouldn't insist on finding an senc table. That table is optional, and the only thing that's required to correctly locate the decryption metadata are the saic and saio tables. Is it possible for you to provide a link to the file you're having trouble with, along with the key, so that I can check why the decryptor isn't finding what it needs?

praveenster commented 6 years ago

@barbibulle Yes, you are right! I recollect noticing that aspect during debugging. However, since the saiz and saio boxes don't seem to be mandatory, if they are not present, then the decryption fails. Unfortunately, I no longer have those files but they are relatively easy to create - just delete these boxes from the mp4 file. They will still play on Safari but will not be decrypted by the mp4decrypt utility.

barbibulle commented 6 years ago

@praveenster While a decoder is allowed to ignore saiz and saio (the Sample Auxiliary Information), and only rely on the elementary stream (which is what the Apple decrypter does), not all decoders are expected to do that (some decrypters are generic and decrypt the sample data without having any knowledge of the codec). The spec is pretty clear on that point: Section 10.4.1 of ISO-IEC 23001-7 3rd Edition : "The Sample Auxiliary Information SHALL be present and SHALL identify protected ranges as Subsamples." While the Bento4 encrypter does use codec-specific parsing when encrypting (to produce encrypted samples that comply with the layout required by the spec), the decrypter avoids the extra work of being codec specific, and thus relies on the content being compliant, with saio and saiz tables.

praveenster commented 6 years ago

@barbibulle, thanks for your continued discussion regarding this. I would like to take the time to mention that the bento4 library is an amazing utility and please don't consider my comments as trying to find fault in any way :-) That said, there seems to be a prefix of Unless it would be empty, as noted in 7.1, to the section that you mentioned and highlighted above, making me wonder if they mean that the sample auxiliary information can be empty and it also goes further to say It is therefore possible to decrypt a track using either (a) this algorithm, ignoring the Sample Auxiliary Information or (b) the Sample Auxiliary Information, ignoring this algorithm., which makes me feel that it is optional. The intent of my bug report was to try and find out how the Apple decrypter was able to decrypt it in the absence of these tables but after discussing with you, it seems to lead to an explanation. Thanks!