6.8 KiB
KeyDive: Widevine L3 Extractor for Android
KeyDive is a sophisticated Python script designed for precise extraction of Widevine L3 DRM (Digital Rights Management) keys from Android devices. This tool leverages the capabilities of the Widevine CDM (Content Decryption Module) to facilitate the recovery of DRM keys, enabling a deeper understanding and analysis of the Widevine L3 DRM implementation across various Android SDK versions.
Important
Support for OEM API 18+ (SDK > 33) requires the use of functions extracted from Ghidra.
Features
- 🚀 Seamless Installation via pip
- 🔄 Automated extraction of Widevine L3 DRM keys
- 📱 Compatibility with a wide range of Android versions (SDK > 22), ensuring broad applicability
- 💾 Seamless extraction process, yielding essential DRM components
- 🌐 Offline extraction mode for environments without internet access
- 🖥️ Command-line options for flexible usage
- 🛠️ Support for custom functions extracted from Widevine libraries using Ghidra
- ❤️ Fully Open-Source! Pull Requests Welcome
Prerequisites
Before you begin, ensure you have the following prerequisites in place:
- ADB (Android Debug Bridge): Make sure to install ADB and include it in your system's PATH environment variable for easy command-line access.
- Frida-Server: Install
frida-server
on your target Android device. This requires root access on the device. For installation instructions and downloads, visit the official Frida documentation.
Installation
Follow these steps to set up KeyDive:
- Ensure all prerequisites are met (see above).
- Install KeyDive from PyPI using Poetry:
pip install keydive
Usage
- Play a DRM-protected video on the target device.
- Launch the KeyDive script.
- Reload the DRM-protected video on your device.
- The script will automatically extract the Widevine L3 keys, saving them as follows:
client_id.bin
- This file contains device identification information.private_key.pem
- This file contains the RSA private key for decryption.
This sequence ensures that the DRM-protected content is active and ready for key extraction by the time the KeyDive script is initiated, optimizing the extraction process.
Command-Line Options
usage: keydive [-h] [-d <id>] [-v] [-l <dir>] [--delay <delay>] [--version] [-a] [-c <file>] [-w] [-o <dir>] [-f <file>]
Extract Widevine L3 keys from an Android device.
options:
-h, --help show this help message and exit
Global options:
-d <id>, --device <id>
Specify the target Android device ID to connect with via ADB.
-v, --verbose Enable verbose logging for detailed debug output.
-l <dir>, --log <dir>
Directory to store log files.
--delay <delay> Delay (in seconds) between process checks in the watcher.
--version Display KeyDive version information.
Cdm options:
-a, --auto Automatically open Bitmovin's demo.
-c <file>, --challenge <file>
Path to unencrypted challenge for extracting client ID.
-w, --wvd Generate a pywidevine WVD device file.
-o <dir>, --output <dir>
Output directory path for extracted data.
-f <file>, --functions <file>
Path to Ghidra XML functions file.
Advanced Usage
Extracting Functions
For advanced users looking to use custom functions with KeyDive, a comprehensive guide on extracting functions from Widevine libraries using Ghidra is available. Please refer to our Functions Extraction Guide for detailed instructions.
Offline Extraction
KeyDive supports offline extraction mode for situations without internet access. This mode allows you to extract DRM keys directly from your Android device. Ensure all necessary dependencies are installed and follow the detailed Offline Mode Guide for step-by-step instructions.
Obtaining Unencrypted Challenge Data
Note
Usage of unencrypted challenge is not required by default. It is only necessary when the script cannot extract the client id.
To extract the unencrypted challenge data required for KeyDive's advanced features, follow the steps outlined in our Challenge Extraction Guide. This data is crucial for analyzing DRM-protected content and enhancing your DRM key extraction capabilities.
Temporary Disabling L1 for L3 Extraction
Warning
Usage of the module is now deprecated because the deactivation of the library was natively added.
Some manufacturers (e.g., Xiaomi) allow the use of L1 keyboxes even after unlocking the bootloader. In such cases, it's necessary to install a Magisk module called liboemcrypto-disabler to temporarily disable L1, thereby facilitating L3 key extraction.
Disclaimer
KeyDive is intended for educational and research purposes only. The use of this tool in unauthorized testing of protected content is strictly prohibited. Please ensure you have permission before proceeding with DRM key extraction.
Contributors
Licensing
This software is licensed under the terms of MIT License.
You can find a copy of the license in the LICENSE file in the root folder.
© hyugogirubato 2024