MAC address controll in the proxy?

[stuckwi]

Thank you for this program. I have a device purchased from a service provider that only allow connections based on the mac address. Would it be possible to use this proxy with that device?

[warren-bank]

Hi. I'll apologize.. because I got very little sleep last night.. and I'm super groggy atm. Could you please explain this situation with greater detail?

1. What is the network component that has restricted access (ex: phone, laptop, router, modem, ..)?
2. How does this restriction interfere with your ability to connect a client (ex: phone, laptop, TV box, Chromecast, ...) to a proxy server?
3. Is it safe to assume that both client and server are connected to the same LAN?

[stuckwi]

My apologies if I'm not using the proper terms. The device I'm referring to is an android tv box. There's a custom app created by the service provider in this box. The app connects to a remote server somewhere to pull down m3u's and present the VOD's inside this custom app. However, my understanding is that this communication is locked on the serverside by some ACL on the server authenticating via the mac address of the box. I should be able to point the box to your HLS-Proxy via network settings inside the box or transparently using my pfsense router. My hope in using your HLS-proxy is to be a MITM of this communication in order to:

1. find the m3u's and present the VOD's in jellyfin.
2. when jellyfin opens the stream, the request is proxied through HLS-proxy to pass the appropriate mac address in the request.

[warren-bank]

initial thoughts:

• wireshark and curl should be your starting point
  • wireshark to inspect the network traffic between your (locked down) tv box and the service provider
  • curl to test your ability to make requests from another device
• if the service API endpoints use MAC to restrict access
  • then you'd need to use make all network requests (ie: curl or HLS Proxy) from a device that allows its MAC to be changed
  • Android devices usually require root, and risks breaking your ROM (if you aren't careful)
  • desktop OS should be easy and without much risk
  • a light-weight virtual machine is the least risky way to test using a spoofed MAC
    • VirtualBox has per-VM network adapter settings that allow you to simply enter the desired MAC address
• if you do fully understand the service API and can reproduce requests with curl
  • then you'll still need to come up with some kind of integration between this service API and jellyfin
  • this integration would only need to use a proxy if the service API endpoints restrict access in some way that prevents a client from making a direct connection (ex: MAC, HTTP headers, ...)

clarification:

• you said "pull down m3u's"
  • the first thing to check in wireshark is the format of the video streams
  • HLS Proxy only supports HLS..
  • manifests are ".m3u8"
  • the text content of manifests include URLs for ".ts" video segments

[stuckwi]

Thank you for your help! My recollection from using wireshark many months ago on this device was that the communication with the service API was encrypted in ssl. But perhaps, I didn't quite know what I was looking at back then. I will attempt to packet capture this communication again and see if I can find some useful information to understand the service API.

This box came jailbroken to some degree. I'm able to ssh into it and explore files in various folders, however, I don't believe I have root (sudo) access though.

Thank you for your suggestion to use a VM to spoof the mac address of the TV box. My home network is run on a proxmox server so VM's & LXC's are easy enough. I just need to somehow obtain the m3u playlist from the API.

Integrating the m3u playlist to Jellyfin is not a problem for me. I've already created an automated program in R to do exactly that with a different IPTV service provider to present all of the Series and Movies available on that service in Jellyfin.

I suppose, if I can obtain the m3u playlist for all streams, then all I need to do is spoof the mac address on the LXC that my Jellyfin is running on.

Come to think of it, maybe I just need to somehow extract all of the stream info I need from the app data...

[warren-bank]

if you are able to copy the apk from the tv box to your computer, then (if you're so inclined).. you can decompile the apk.

• jadx decompiles to Java, but the resulting code can't round-trip and be compiled back into an apk
• apktool decompiles to Smali (which is lower level.. but still very readable/editable), and does (nearly always) successfully recompile back into an apk (that you'd sign using your own key)

even if you have no intention to modify the apk.. being able to read its code in Java.. and inspect its resource strings.. is always very informative to understand the innerworkings of any app.

[warren-bank]

but, I should reiterate.. wrt HLS Proxy.. you're talking IPTV and m3u manifests.. in my experience, these are not HLS streams.. and would not work with HLS Proxy

[stuckwi]

I will try and decompile the apk to inspect its resource strings. Even if it is simply to understand how and where the apk stores it's downloaded data from the service API. If I can get that, I don't think I even need any proxy... Thank you so much!