hyugogirubato / KeyDive

Extract Widevine L3 keys from Android devices effortlessly, spanning multiple Android versions for DRM research and education.
https://pypi.org/project/keydive/
MIT License
333 stars 66 forks source link

Failed to set challenge data: Field number 0 is illegal. #33

Closed andersthuesen closed 2 weeks ago

andersthuesen commented 1 month ago

I get the following error:

2024-09-11 11:10:48 [I] KeyDive: Version: 2.0.8
2024-09-11 11:10:48 [I] Core: Device: Android Emulator 5554 (emulator-5554)
2024-09-11 11:10:48 [I] Core: SDK API: 34
2024-09-11 11:10:48 [I] Core: ABI CPU: arm64-v8a
2024-09-11 11:10:48 [I] Core: Script loaded successfully
2024-09-11 11:10:48 [I] KeyDive: Watcher delay: 1s
2024-09-11 11:10:48 [D] KeyDive: Analysing...
2024-09-11 11:10:49 [W] Core: Library not found: libwvdrmengine.so
2024-09-11 11:10:49 [W] Core: Library not found: libwvaidl.so
2024-09-11 11:10:49 [I] Core: Library: android.hardware.drm-service.widevine (/apex/com.google.android.widevine/bin/hw/android.hardware.drm-service.widevine)
2024-09-11 11:10:49 [D] Script: Hooked (0x5f2f280350): wvcdm::Properties::UsePrivacyMode
2024-09-11 11:10:49 [D] Script: Hooked (0x5f2f2b84d4): wvcdm::CdmLicense::PrepareKeyRequest
2024-09-11 11:10:49 [D] Script: Hooked (0x5f2f3439ac): ehmduqyt
2024-09-11 11:10:49 [I] Script: Library liboemcrypto.so was not found
2024-09-11 11:10:49 [I] KeyDive: Process: 13244 (android.hardware.drm-service.widevine)
2024-09-11 11:10:49 [I] KeyDive: Successfully hooked
2024-09-11 11:10:49 [I] KeyDive: Starting DRM player launch process...
2024-09-11 11:15:15 [D] Script: [+] onEnter: UsePrivacyMode
2024-09-11 11:15:15 [D] Script: [-] onLeave: UsePrivacyMode
2024-09-11 11:15:16 [D] Script: [+] onEnter: UsePrivacyMode
2024-09-11 11:15:16 [D] Script: [-] onLeave: UsePrivacyMode
2024-09-11 11:15:16 [D] Script: [+] onEnter: PrepareKeyRequest
2024-09-11 11:15:16 [D] Script: [+] onEnter: UsePrivacyMode
2024-09-11 11:15:16 [D] Script: [-] onLeave: UsePrivacyMode
2024-09-11 11:15:16 [D] Script: [-] onLeave: PrepareKeyRequest
2024-09-11 11:15:16 [D] Cdm: Failed to set challenge data: Field number 0 is illegal.
2024-09-11 11:15:17 [D] Cdm: Receive client id: 

{
  "application_name": "com.android.chrome",
  "origin": "35146204DB34B6A54164B5078EBF1DB1",
  "package_certificate_hash_bytes": "8P1sW0EPJcslw7UzRsiXL64w+O50Ed+RBICtay1g24M=",
  "company_name": "Google",
  "model_name": "sdk_gphone64_arm64",
  "architecture_name": "arm64-v8a",
  "device_name": "emu64a",
  "product_name": "sdk_gphone64_arm64",
  "build_info": "google/sdk_gphone64_arm64/emu64a:14/UE1A.230829.050/12077443:userdebug/dev-keys",
  "widevine_cdm_version": "18.0.0@340720000",
  "oem_crypto_security_patch_level": "0",
  "oem_crypto_build_information": "{\"soc_vendor\":\"L3_28613\",\"soc_model\":\"ARM 64 bit\",\"ta_ver\":\"18.1.0+May  1 2023_06:32:58_\",\"uses_opk\":false,\"tee_os\":\"none\",\"tee_os_ver\":\"0.0.0\",\"form_factor\":\"L3\",\"implementer\":\"Widevine\",\"fused\":false}"
}

I'm running frida-server-16.5.1-android-arm64 and extracted the functions.xml using Ghidra.

hyugogirubato commented 1 month ago

Did you manage to dump your CDM?

Sometimes errors occur but they are not blocking. There will definitely be a problem if you can't dump.

andersthuesen commented 1 month ago

Unfortunately I did not - no files were created. I tried with different DRM test sites including https://www.nuevodevel.com/nuevo/showcase/drm and https://www.theoplayer.com/theoplayer-drm-aes-128-encryption (using the DRM option) and I got different parsing errors (like some end-tag error)

hyugogirubato commented 1 month ago

Mmm, it's a rather strange behavior that no one has pointed out to me until now and that I personally haven't encountered. Contacted me via discord so that we can do a TeamViewer so that I can try a live debug