l3

Recently I took it upon myself to learn how to rip a film that I had rented online. After finding a download for it in the Chrome Network tab, I realized it was encrypted and looked into decrypting it. I was eventually successful in the decryption, so I thought I would share the steps I took here for anyone interested.

Google's WideVine L3 Encryption is used by numerous streaming sites including Netflix, HBO, Hulu, Amazon Prime, Criterion, etc. The film I grabbed was from NouveauCinema. Note that this guide doesn't include information on how to rip the encrypted video files from these streaming platforms, as it may vary between each one. 

NouveaCinema's was simple enough, I found the encrypted .mp4 and .m4a tracks sitting in Chrome's Network tab. It may be more difficult for other streaming platforms. If anyone has any tips for ripping from other platforms, please let me know!

Also, I have currently only tested this on Windows, but it should work on other browsers too.

Setup

There are two components you'll need for this. The first is a Chrome extension that extracts decryption keys from streaming video. The second is a console application that can use those keys to decrypt the video.

Widevine Decryptor Chrome Extension:

The Chrome extension can be found on Github here. Either clone the repository or download the .zip under the "Code" button and extract it somewhere where it won't be deleted.

To import the extension into Chrome, visit chrome://extensions as a URL, enable the developer mode button at the top-right, and click "Load Unpacked" at the top-left. Select the widevine-l3-decryptor folder and you should be good to go.

MP4 Decrypt Console Application:

While you could use ffmpeg to decrypt the video, you may come across issues if it the video encryption is fragmented. To get around this, you can use MP4 Decrypt. You can download the binaries for it here. It is contained within a package of applications called Bento4. Simply, extract the zip somewhere and you'll find the mp4decrypt executable in the bin/ folder.

Usage

Widevine Decryptor Chrome Extension:

Once you have the Chrome Extension installed, the process to pull decryption keys is easy. Simply visit any streaming page that uses widevine decryption, start the video, and check your Chrome Console (press F12 to open the Console, hit the Console tab if it takes you to another one).

You should see several messages that look like this:

WidevineDecryptor: Found key: 4e8967f7beab7284107bff01301ffd89 (KID=8ad784f6c5965197b2459185cc258fa8)

WidevineDecryptor: Found key: 17a3ce1262f99fcaa1db47ebdcc125a6 (KID=d2d05abe71ed584e96022a05dd971b13)

WidevineDecryptor: Found key: d5e06f2db2fd459ae1a14517c19c0f5a (KID=2ba96b8ce8205b648c669373a460f05d)

WidevineDecryptor: Found key: fe37ca0108886ff3ae1f2f1240ac2fb7 (KID=aa0ec276ec0a5b0a9cc33256bf86fb8d)

Keep these messages for later.

MP4 Decrypt Console Application:

To use mp4decrypt, open a console window in the same location as the executable and run this command:

./mp4decrypt.exe --key {kid}:{key} --key {kid}:{key} --key {kid}:{key} <input_file> <output_filename>

Replace {kid} with the KID and {key} with the matching key. And repeat for all keys given to you by WidevineDecryptor. Run the command, give it some time to do the decryption, and tada! You should have your playable file now.

Extra:

If WidevineDecryptor only gives you a single key, you can choose to use ffmpeg if you prefer. The command for this would be

ffmpeg -decryption_key {key} -i <input_file> -codec copy <output_filename>

If you have the audio and video as two separate files, you can join them using this ffmpeg command (do this after the decryption):

ffmpeg -i <input_video_file> -i <input_audio_file> -c:v copy -c:a aac <output_filename>

Hope someone finds this useful! Thanks for reading.