New License Request Response requires a second request

[bracarino]

I need pywidevine to read thru this License Response, to get KID2 and resend the license request to get the final decryption key.

I am unable to navigate to the following structure with pywidevine:

ContentIdentification (Tag 0x22 / "IAE=")
└── CENC (Tag 0x0A)
├── Key ID 1 (Tag 0x12): 3db65af8-8a74-30b1-aee6-e1a61a5ef362
├── Key ID 2 (Tag 0x12): 97aa4c21-3c37-b106-c9f5-453eee0d810b
├── Key ID 3 (Tag 0x12): a3d232a2-c0f8-2043-d789-7ba3fc2c1b08
└── Key ID 4 (Tag 0x12): aa3800dc-e673-bdfb-37ea-b8b5ba90c86d

The Key ID 2 rotates and gives a new decryption key.

[rlaphoenix]

There should be no reason you can't get all the Key ID values. See the key_ids() function of the PSSH class, which you should have an instance of:

pywidevine/pywidevine/pssh.py

Line 206 in 4298db7

def key_ids(self) -> list[UUID]:

Just call key_ids() and take the second value. There may be a scenario where you don't quite get multiple Key IDs output, but I'd need more information. Particularly the full raw PSSH box.

[bracarino]

There should be no reason you can't get all the Key ID values. See the key_ids() function of the PSSH class, which you should have an instance of:

pywidevine/pywidevine/pssh.py

Line 206 in 4298db7

def key_ids(self) -> list[UUID]:
Just call key_ids() and take the second value. There may be a scenario where you don't quite get multiple Key IDs output, but I'd need more information. Particularly the full raw PSSH box.

This will not work. This Key ID is not in the PSSH.

This website is using a key ladder in Widevine:

1. Read KID from PSSH
2. Makes a license request, receive a key and multiple KIDs (tabled response above)
3. Makes a second license request using KID2, receives the final decryption key

I am unable to read KID2 from the first license response. I build this table sharing the base-64 response to an AI.

[rlaphoenix]

When doing the following, you don't get a 2nd item in the for loop?

# parse license challenge
cdm.parse_license(session_id, licence)
log.info("[+] License Parsed Successfully")

# print keys
for key in cdm.get_keys(session_id):
    log.info("[%s] %s:%s", key.type, key.kid.hex, key.key.hex())

If you don't get a second item, then this kind of license response is somewhat unordinary. I'd need to see the decrypted license response to really be able to understand it. The table you generated from AI doesn't really explain anything to me. The only thing I can possibly see is the license response might contain another PSSH, which you would need to extract from the license response message and parse with the PSSH class, then you could probably call key_ids() to get a list of the 2nd and other Key IDs.

[bracarino]

License response:

CAISlAIKTAogQTAzRkFCNTIwMDAwMDAwMDAxMDAwMDAwMDAwMDAwMDASJDUzMGIyYjNiLWVmM2QtNDRjOS1hY2YzLTg1ZmRlYWViN2VlYSABKAASHwgBEAAYACAAKAAwADgAQgBIAFAAWABgAHAAeAGAAQAalgEKEPyNPrvogD6rurGBBBviCo4SEB0P5vUkT0tfeghSnqvir7YaIGxS+AYOj5y1TDAUbTdW/bKLsg3lHERdu9MRGBzzYTUsIAIoATIICAAQKhgAIAA6CAgAECoYACAAQjQKIBCvZtt/2Lhumr32zXAjxz0wUFGx9WiuN+hZ4oc/fS2vEhAer9mjXljS8bLWsTFLZDcDYgAgtKCTzQY449yVmwYaIGbG+ZgaDIfVWmh0xCJXluwQvVLtVwAPmtCYh96U/4ikIoACGcOrccXP0EUOWEh2m9cCX/XoPnnWfBJ3IFDonJuPtIxnz2wtoEVWTzq7DFT3cHnSPAnfG/zDGv1dspL981Zzabs2xLPMABvsyzjhriCU9nePanY6N31yU3oDhYNvWVVR5SDA4l/x4tuu2tKOWZFvnYon2FzSJdffnxRaSB9JrFCkIqBWYjxp4aI0mqqw9hX+EPi6c5aHyrMZyC7o3c+u4VYuYuRvYYpBZaEIqf3skCtA9M1M5vZHItIK5hJPcnQnB8mS/2jKONcyZm4g4qou1QHRQ+DtUAat3EW9iJ4qMsN1aeubnaIfEqOZ032SiJDX4IG14r563EEElU8MqWOFIDoICgYxOC4yLjFAAVgA