36 lines
2.3 KiB
Markdown
36 lines
2.3 KiB
Markdown
# ModKey2Key
|
|
|
|
Simple C++ library to decrypt ModKey values used to authorize StreamFab API requests.
|
|
|
|
## Background
|
|
|
|
The team behind DVDFab, a software that does everything you could imagine with DVDs and Blu-rays, later released a new tool called StreamFab.
|
|
StreamFab lets you download online videos that are protected by DRM from places like Netflix, Prime Video, Disney+, Hulu, and more.
|
|
|
|
It worked by sending video and audio decryption jobs to an API they control. Their API would internally send a Widevine license request to the
|
|
relevant streaming platform to obtain the video and audio decryption keys. These keys would then be sent back by the API to the StreamFab client
|
|
for decryption.
|
|
|
|
The DVDFab team did not want to allow their API to be used by other software or groups, understandably so it cannot be abused, overused, or re-sold.
|
|
The API would ask for a certain key to be provided during API calls as authorization.
|
|
|
|
## So, how was the API authorized?
|
|
|
|
I don't fully remember anymore, as this project was written years before I created this README.
|
|
However, generally from what I remember, at a high level, it would send you a relatively large amount of data.
|
|
This data contained various information including an 'encrypted' key. These were referred to as 'modkeys'.
|
|
|
|
## How was it reversed?
|
|
|
|
This was relatively trivial to reverse engineer, thanks to the DVDFab team making a large mistake in one of the
|
|
StreamFab releases. One of them had way less obfuscation then it typically has, including no virtualization or
|
|
any kind of anti-debugging tricks. It had some obfuscation, but very very little.
|
|
|
|
Because the encryption/decryption algorithm used is a typicall memory jumping bitwise operation, translating the code to another language was not possible.
|
|
This is why I made it as a DLL that could be easily imported and used by other software, even Python 64-bit.
|
|
Simply pass the ModKey to the `modkey2key` function, and voila it returns the real key you can use to authorize StreamFab API requests and decrypt responses.
|
|
|
|
I simply took the function from the StreamFab.exe client, looked for the relevant function, had ghidra generate pseudocode, and made small changes to rework
|
|
it as a new project in Visual Studio as a library. I also had to make some small changes to do with memory addressing to operate correctly when compiled as
|
|
a 64-bit library.
|