Dump L3 CDM from any Android device
This repository has been archived on 2024-04-03. You can view files and clone it, but cannot push or open issues/pull-requests.
Go to file
wvdumper d667c67655 Update README.md 2021-12-03 14:12:37 +01:00
Helpers Closes #2; Fix TextEncoder error 2021-12-03 08:54:48 +01:00
.gitignore Update .gitignore 2021-12-03 12:29:36 +01:00
README.md Update README.md 2021-12-03 14:12:37 +01:00
dump_keys.py Add shebang 2021-10-23 17:27:12 +02:00
requirements.txt Add requirements.txt 2021-12-03 13:35:13 +01:00



Dumper is a Frida script to dump L3 CDMs from any Android device.


Use pip to install the dependencies:

pip3 install -r requirements.txt


  • Enable USB debugging
  • Start frida-server on the device
  • Execute dump_keys.py
  • Start streaming some DRM-protected content

Temporary disabling L1 to use L3 instead

A few phone brands let us use the L1 keybox even after unlocking the bootloader (like Xiaomi). In this case, installation of a Magisk module called liboemcrypto-disabler is necessary.

Known issues

It seems like Google made some changes in their OEMCrypto library and it broke the script. Further investigation is needed to make it work on Android 11+, feel free to open PRs.


Thanks to the original author of the code.