77 lines
3.0 KiB
Python
77 lines
3.0 KiB
Python
 
|
#!/usr/bin/env python3
|
||
|
|
"""
|
||
|
|
Triggers the Android DRM HAL without a browser, using adb shell + app_process
|
||
|
|
to call MediaDrm from the Java layer via a one-liner Java invocation.
|
||
|
|
|
||
|
|
This avoids the browser entirely. Run while dump_wvd2.py is active in another
|
||
|
|
terminal so the Frida hooks catch the resulting DRM HAL calls.
|
||
|
|
"""
|
||
|
|
import subprocess, sys, time, base64
|
||
|
|
|
||
|
|
ADB = subprocess.check_output(['which', 'adb']).decode().strip()
|
||
|
|
if not ADB:
|
||
|
|
ADB = '/home/lukas/Android/Sdk/platform-tools/adb'
|
||
|
|
|
||
|
|
PSSH_B64 = 'AAAAOnBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAABoIARIQ1DG5TL5NQ/2zoimqi0ixiUjj3JWbBg=='
|
||
|
|
|
||
|
|
# Use 'am instrument' or 'app_process' to invoke MediaDrm in a shell process
|
||
|
|
# The simplest method: use the 'media' command or a small Java one-liner via
|
||
|
|
# the dalvikvm/app_process tool (available in Android shell).
|
||
|
|
JAVA_ONELINER = r"""
|
||
|
|
import android.media.MediaDrm;
|
||
|
|
import java.util.UUID;
|
||
|
|
class T {
|
||
|
|
public static void main(String[] a) throws Exception {
|
||
|
|
UUID wv = UUID.fromString("edef8ba9-79d6-4ace-a3c9-27dcd51d21ed");
|
||
|
|
MediaDrm drm = new MediaDrm(wv);
|
||
|
|
byte[] sid = drm.openSession();
|
||
|
|
System.out.println("SESSION:" + sid.length);
|
||
|
|
byte[] pssh = android.util.Base64.decode(
|
||
|
|
"AAAAOnBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAABoIARIQ1DG5TL5NQ/2zoimqi0ixiUjj3JWbBg==", 0);
|
||
|
|
MediaDrm.KeyRequest req = drm.getKeyRequest(sid, pssh, "video/mp4", MediaDrm.KEY_TYPE_STREAMING, null);
|
||
|
|
byte[] ch = req.getData();
|
||
|
|
System.out.println("CHALLENGE:" + ch.length);
|
||
|
|
drm.closeSession(sid);
|
||
|
|
drm.release();
|
||
|
|
System.out.println("DONE");
|
||
|
|
}
|
||
|
|
}
|
||
|
|
"""
|
||
|
|
|
||
|
|
def run_adb(*args):
|
||
|
|
return subprocess.run([ADB] + list(args), capture_output=True, text=True)
|
||
|
|
|
||
|
|
def adb_shell(cmd):
|
||
|
|
r = run_adb('shell', cmd)
|
||
|
|
return r.stdout + r.stderr
|
||
|
|
|
||
|
|
print('[*] Checking if frida-server is running...')
|
||
|
|
procs = adb_shell('ps -A | grep frida')
|
||
|
|
if 'frida-server' not in procs:
|
||
|
|
print('[!] frida-server not found. Start it first:')
|
||
|
|
print(' adb shell su -c /data/local/tmp/frida-server &')
|
||
|
|
sys.exit(1)
|
||
|
|
|
||
|
|
print('[*] Triggering DRM via MediaDrm shell command...')
|
||
|
|
|
||
|
|
# Method 1: Use am start with a streaming URL (triggers ExoPlayer/MediaDrm)
|
||
|
|
# Open the TVP VOD page in a browser that uses MediaDrm
|
||
|
|
tvp_url = 'https://vod.tvp.pl/video/natanek,natanek-odc-1,3013220'
|
||
|
|
|
||
|
|
# Try using the stock media player / browser
|
||
|
|
print('[*] Trying Method 1: adb shell am start (browser + TVP URL)')
|
||
|
|
r = adb_shell(f'am start -a android.intent.action.VIEW -d "{tvp_url}"')
|
||
|
|
print(f' am start: {r.strip()}')
|
||
|
|
print(' Waiting 5 seconds for DRM initialization...')
|
||
|
|
time.sleep(5)
|
||
|
|
|
||
|
|
# Method 2: Use Frida's Java.perform via a spawn approach on com.google.android.gms
|
||
|
|
print()
|
||
|
|
print('[*] Method 2: Try MediaDrm via Frida + Java.perform')
|
||
|
|
print(' Run in parallel: python3 trigger_mediadrm.py')
|
||
|
|
print()
|
||
|
|
print('[*] Method 3: Use drm_test.html in browser (most reliable)')
|
||
|
|
print(' 1. In separate terminal: python3 -m http.server 8765')
|
||
|
|
print(' 2. Run: adb reverse tcp:8765 tcp:8765')
|
||
|
|
print(' 3. Open http://localhost:8765/drm_test.html in Opera or Firefox')
|