MPCrypto

MPCrypto is a Python helper for generating authentication tokens and request signatures.

This project intentionally implements legacy and non-standard behaviors (custom hashes, double-encoding, legacy crypto) required for compatibility reasons.

Features

Device-aware behavior for webplayer, android.tv, phone.android, and tablet.android
Basic token generation tied to device class
Request signature generation (HMAC-SHA1)
Support for Basic and Bearer authentication schemes
OpenSSL-compatible salted AES-CBC decryption (EVP_BytesToKey) used to derive Consumer Key and Consumer Secret values
Android app Consumer Key and Consumer Secret reconstruction via MockDateConverter, which implements a SHA-256–like hash with XOR masking

XOR template generation (Ghidra)

The XOR templates required by MockDateConverter are extracted from the original Android native library using Ghidra.

This repository includes a Ghidra Python script that automates the extraction process by:

Locating JNI-exported functions related to MockDateConverter
Decompiling each function
Recovering the XOR byte sequences used internally
Normalizing function names into the Python-friendly XOR_TEMPLATES format

The script supports both DAT-backed byte arrays accessed through pointer arithmetic and hardcoded local-variable XOR sequences produced by the compiler.

The output is a ready-to-use dictionary compatible with the MockDateConverter constructor.

Supported device classes

webplayer
android.tv
phone.android
tablet.android

Initialization

MPCrypto can be initialized in two distinct ways depending on the device class.

Web-based devices (`webplayer`, `android.tv`)

For web-based clients, configuration data is fetched remotely and decrypted. You must provide:

config_url: URL pointing to the remote configuration source
config_pattern: Regular expression used to extract the configuration payload from the response

These values are device and version specific and must be supplied by the user.

Initialization example:

from mp_crypto import MPCrypto

mp_crypto = MPCrypto(
    device_class="webplayer",
    config_url="https://example.com/config.php",
    config_pattern=r"some_regex_pattern_here",
)

Android app devices (`phone.android`, `tablet.android`)

For Android-based clients, no remote configuration is fetched. Instead, key material is reconstructed locally using MockDateConverter.

In this case, you must provide:

A fully initialized MockDateConverter instance
A valid package_name
A populated xor_templates dictionary (typically generated via the provided Ghidra script)

The library validates that all required XOR templates for the selected device class are present before proceeding.

Initialization example:

from mp_crypto import MPCrypto
from mock_date_converter import MockDateConverter

XOR_TEMPLATES = {
    'key': bytes.fromhex("0123456789abcdef"),
    #...
}

mock_date_converter = MockDateConverter(
    package_name="com.example.app",
    xor_templates=XOR_TEMPLATES,
)

mp_crypto = MPCrypto(
    device_class="phone.android",
    mock_date_converter=mock_date_converter,
)

Basic authentication example

This example shows how to sign requests using a Basic token for web-based devices.

new_device_id = str(uuid.uuid4())
basic_token = mp_crypto.get_basic_token(new_device_id)

signature = mp_crypto.get_signature(
    method="POST",
    url=url,
    token=basic_token,
    scheme="Basic",
    params=data,
)

headers = {
    **default_auth_headers,
    "Authorization": f"OPPlus Basic={basic_token},Signature={signature}",
}

resp = requests.post(
    url,
    data=data,
    headers=headers,
)

Bearer authentication example

This example shows how to sign requests using a previously obtained Bearer token.

signature = mp_crypto.get_signature(
    method="GET",
    url=url,
    token=login_token,
    scheme="Bearer",
)

headers = {
    **default_account_info_headers,
    "Authorization": f"OPPlus Bearer={login_token},Signature={signature}",
}

resp = requests.get(
    url,
    headers=headers,
)

Disclaimer

This project is provided for educational and interoperability purposes only.

This project does not condone piracy or violations of DRM systems.
All techniques are the result of reverse engineering, publicly available research, and empirical analysis.
Do not use this software to access, decrypt, or distribute content without proper authorization.
Unauthorized access or redistribution of protected content may violate applicable laws.
This software must not be used for illegal activities, including DRM circumvention.
The authors and contributors are not responsible for misuse of this project.
By using this software, you agree to comply with all applicable laws and regulations.

The authors assume no responsibility for misuse.

4.9 KiB Raw Blame History Unescape Escape