Is there a somewhat accurate and up to date guide on how to WebDL / WebRIP from streaming services?

All other I2P Bittorrent related talk
farder

Is there a somewhat accurate and up to date guide on how to WebDL / WebRIP from streaming services?

Post by farder »

Title.
Is there anyone here that knows a working guide / is capable of explaining a little in depth how to extract video and audio from steaming services like Amazon, Netflix or Spotify. IS it even possible without any special intermediate device to bypass the DRM encryption? If yes, how would I go on about it, what do I need for it and are there any risks one should consider if one plans to share the ripped content via Bittorrent?

Thanks in advance, I hope someone here can help me :3
User avatar
cumlord
Posts: 31
Joined: Thu Oct 05, 2023 5:01 pm
Location: Erect, NC
Contact:

Re: Is there a somewhat accurate and up to date guide on how to WebDL / WebRIP from streaming services?

Post by cumlord »

i'll share what i know with caveat that i don't have a working tool for this. problem with tracking this down is exposing an exploit results in it getting patched, so there's incentive to be secretive about such things. hopefully someone here has experience doing this, it's has been changing rapidly.

it can be done, depends on your background (real CS knowledge helps immensely) and amount of time you have. but there's a steady stream of easily available content from tons of groups that don't require the extra time, work and risk. it needs multiple people doing different roles to divide the labor and liability. it can become costly. even if you have the chops to get L1 keys, its a lot of work for one person. all reasons i've chosen to stay out of doing that myself. it'd be nice to have that ability within i2p so trying to give a realistic view here not discourage.

I've noticed a resurgence in 4k webrip content and even some 1080p content, it seems to avoid needing to sacrifice a device for a new single episode.

L1 ups the difficulty by a huge margin from what i can tell and i have ZERO real experience with L1, but it seems for better than 720p you need to break this. hopefully someone here does have experience with this.

Hard part #1: Keys
the way widevine works generally:
Streaming Service Verification Tokens ---> (a) Client Issues Widevine Challenge ---> Server Issues Widevine License ---> Client Extracts Key and Stores in White-Box ---> Decryption of Content ---> Decrypted Content Held Within Memory Buffers ---> (b) Video Sent Securely via HDCP

there are different levels of widevine decryption:
L1: highest level, hardware based protection. both cryptography and media processing operations occur in a trusted execution environment (TEE). services like netflix will use this for 4k/1080p content
L2: Only cryptography operations are executed in a TEE, not media processing.
L3: software based DRM only (keys can be accessed without dealing with TEE but are obfuscated, also are not tied to device)

with L1, compatible devices have a hardware based secure storage area (the TEE). to my understanding rooting a device will cause it to drop use of L1 and go to L3, so you'll be stuck with non 1080p+. a successful exploit will get the public/private key pair from the devices keybox.

on safety side, information is embedded in the stream. this is a reason not everything is L1 encrypted, it's more intensive since the server can be modifying the stream to include identifiable information. so when the media is shared, the device keys (core part of the CDM/content delivery module) will get blacklisted and the CDM is burned.

so a single CDM is expensive in both the device (nividia shields for ex) and time/skills to crack and get the keys. if you don't have unlimited time and money you want this CDM to go as far as possible, which can include rate limiting downloads and releasing things in batch that use that CDM since it will be lost when shared.

To get keys out of the TEE there needs to be an exploit specific to the hardware that will give you read/write access, without signaling that the keybox has been compromised. seems that android based devices have the most available exploits. the whole point of having hardware dedicated TEE is to shield information there from the broader CPU using a private key set by the factory. the private key is never supposed to physically leave the TEE. From there need to be able to extract the contents from the TEE.

so the real trouble is getting a working CDM, there may be someone out there that can provide this, but if you want to do consistent releases you need to have a supply of CDMs. With L1, it seems to me like the only way to do this is to have a steady stream of devices to get keys from, so your best bet is to learn how to do this aspect or find someone that can. If you're capable of doing this than OPSEC should be a breeze at least. whoever is doing this needs to understand how to do it, not just run a script that will inevitably break one day, because things will get patched and a new method (likely requiring a different device load out) will be needed.

I'll have to look but there are some tools that might be usable, but you still need a working CDM for them to work.

Some groups may have figured out how to erase identifiable embedded info from the stream, which would save their CDMs from getting burned. from what i've gleaned i couldn't imagine how this would be done and looks much more difficult than comparing 2 streams obtained with different CDMs to find the changed bits, but if you had the time and skills anything is possible. if i had to guess i don't think this is done and groups need to constantly acquire keys.

webrips are way simpler to do but can be a pain, only need to bypass HDCP which is easily done with an off market hdmi splitter. to be safe you'd still want to be concerned about visual watermarking and have good opsec. with settings tuned right and a decent re-encode the quality can be ok, and for some things it CAN make sense to do this. Some groups have opted to webrip certain 4k content of popular tv series to avoid needing to sacrifice an expensive CDM for a single episode and some less popular content is still being webripped at 1080p.

Some useful background:
https://i.blackhat.com/asia-21/Thursday ... n-QTEE.pdf
https://github.com/enovella/TEE-reversing
https://github.com/tomer8007/widevine-l ... ion-Module
https://github.com/Satsuoni/widevine-l3-guesser
https://tamirzb.com/attacking-android-k ... -trustzone
https://forum.videohelp.com/forums/48-V ... ownloading
https://github.com/CloudRealm/widevine- ... /README.md

Hard part #2: OPSEC/INFOSEC
you need burner accounts as well as a stream of crackable devices. accounts will get banned for suspicious activity, so you need to be careful or could lose a valuable CDM and the burner account. burner accounts and devices need to be purchased safely like with prepaid cards, cash, "alternatively obtained" cc's/accounts, crypto (not bitcoin) etc.

i wouldn't trust a vpn for obfuscation, would probably want something like 2+ vps's from different providers (obviously purchased anonymously) to multihop through wiregaurd. I would assume that the stream is going to embeded identifiable info should it be shared, so you should be careful with this setup and test it. it's been a while since i've looked at specifics of what is embedded but i think it's safest to just assume the worst in this scenario.

have a separate system just for webdl, do hardening, connect only wired, remove all wireless hardware physically, put it on a separate subnet by itself with no non-associated devices (especially iot), make a deadman switch, full disk encryption and/or whatever else. i might have been over the top and encryption is probably good enough. it's a good time to re-examine your own "normal" network. wire everything you can, use wiregaurd, examine every device and view it as a potential source of compromise, throw a physical firewall in there. keep your attack surface small and simple.

some people may consider some of this unnecessary and over the top. be paranoid, do an appraisal of the state of your opsec/infosec, bolt it down best you can, test it, repeat. seems people tend to get tracked down more from following money and real life personal contacts. more in line with what i'd think of as basic police work. no reason to think more sophisticated tools aren't or won't be utilized though. So major weak links here as far as easily traceable activities go are acquiring devices. Other necessary tools like VPS's and burner streamer accounts should be able to be acquired more safely.

streams can also have imperceptible visual watermarks that can (potentially) include identifiable info and both visual and digital embeds are supposed to survive through re-encodes. so would also want to be reasonably careful with webrips. seems like most browsers/os's will only stream 720p, so with L1 being the norm capping needs to come through a device that supports it for max resolution, but it also doesn't seem like devices are being lost this way.

some basic security things:
https://madaidans-insecurities.github.i ... ening.html

Easiest part: dissemination and storage
not much different than regular torrenting, but you accept more risk as a source of new raw content. So you should be careful with your opsec, on i2p this is an added level of protection on one hand but on the other you still need to ensure you are not leaking information, so no reason not to do general hardening for anything used for this.

seed boxes are good for getting new content out especially on private trackers. storage can get expensive, though so they only make sense for seeding new content. the most cost effective way to keep the rest (if you intend to do that) is to self host. in my opinion it's safer to do this in a residence where you control the hardware, not necessarily your own residence though. or better yet (if you are doing the ripping) find someone willing to handle this end of things.

there's a lot of ways to do this but the main idea is the same, keep it separate and hidden in how you connect to it and where it is physically. there's lots of consumer nas's out there but this is a situation where it makes sense to make your own. get something with room to grow. stash or smash drives if you think you're compromised.
farder

Re: Is there a somewhat accurate and up to date guide on how to WebDL / WebRIP from streaming services?

Post by farder »

Hello, many thanks to such an in-depth and thought-out response. I do have some basic CS knowledge but def not enough to replicate what has to be done here. I will just stick to downloading my favorite movies/shows and seeding them afterwards. Might as well download the content from cheap 720p clear net streamhosters, that let you download the videos by fiddeling around with inspect element a little, and seed it here. Or maybe share some bdrips. Everything beyond that doesn't seem to be worth it for me since it's too big of a hassle.

Still many thanks for this response, I really didn't expect that anyone will even see this post lmao.
Though, are there any OPSEC risks in releasing reencoded BDrips, or remuxes? Or am I fine sharing these?
User avatar
cumlord
Posts: 31
Joined: Thu Oct 05, 2023 5:01 pm
Location: Erect, NC
Contact:

Re: Is there a somewhat accurate and up to date guide on how to WebDL / WebRIP from streaming services?

Post by cumlord »

Welcome, figure the more people sharing stuff on i2p the better so if not you maybe someone else could do this sort of thing or learn to. 720p is still good though and some people like the small file sizes. rips from physical media are generally more safe, i wouldn't worry too much about that as long as you have some experience seeding things safely and you're not using some spam-ware filled software to rip.

handful of people pop on here from time to time :lol:
farder

Re: Is there a somewhat accurate and up to date guide on how to WebDL / WebRIP from streaming services?

Post by farder »

Okay, then I'm fine with my blu-ray strategy. I wouldn't call MakeMKV a bloated ripping software. And I'd re-encode the files anyway so it should be even more safe.
I see you are responsible for like half of postmans uploaded torrents. Thats pretty incredible tbh.

Last question from my side: is there a somewhat easy way to make multi dubs / multi sub releases. I think focusing on this stuff more would make everything a lot easier because its 1 torrent with 1 video stream and 5-ish audio / subtitle streams instead of 5 videos streams - 1 for each language.
Is it possible to just download the different language versions of the same movie/show and combine, take the audio tracks and "combine" them to 1 file using MKVtoolnix for example? How would I get rid of asynchronous audio/video? And what about quality? The english version that I've downloaded might have used AAC 192 Bit while the french version has used AAC 256 Bit. Thats worrying me a little xd
farder

Re: Is there a somewhat accurate and up to date guide on how to WebDL / WebRIP from streaming services?

Post by farder »

Okay, then I'm fine with my blu-ray strategy. I wouldn't call MakeMKV a bloated ripping software. And I'd re-encode the files anyway so it should be even more safe.
I see you are responsible for like half of postmans uploaded torrents. Thats pretty incredible tbh.

Last question from my side: is there a somewhat easy way to make multi dubs / multi sub releases. I think focusing on this stuff more would make everything a lot easier because its 1 torrent with 1 video stream and 5-ish audio / subtitle streams instead of 5 videos streams - 1 for each language.
Is it possible to just download the different language versions of the same movie/show and combine, take the audio tracks and "combine" them to 1 file using MKVtoolnix for example? How would I get rid of asynchronous audio/video? And what about quality? The english version that I've downloaded might have used AAC 192 Bit while the french version has used AAC 256 Bit. Thats worrying me a little xd
User avatar
cumlord
Posts: 31
Joined: Thu Oct 05, 2023 5:01 pm
Location: Erect, NC
Contact:

Re: Is there a somewhat accurate and up to date guide on how to WebDL / WebRIP from streaming services?

Post by cumlord »

no MakeMKV is great for that along with MKVtoolnix. For now, others been adding lots of stuff way before i was adding here, i stick to tv shows for the most part :D

Blu guide: https://sometimes-archives-things.githu ... ith-offset
other archived guides: https://github.com/sometimes-archives-t ... ved-things

and it's a good question, for audio streams you basically described how to do it. find the content in another language, pull the stream out and add it with a tool like MKVtoolnix. with the audio streams it can be a pain to get them synced sometimes. there's a couple ways to do this with mkvtoolnix you can set a delay for tracks that need it. mergemkv can be automated for doing batches. lots of respect for people that do this it can take a good amount of time and effort.

luckily subtitles are easier to deal with, bazarr for example will do this for you although you do need to check manually they're synced. It attempts to sync them but doesn't always work right, but otherwise does a good job of finding subtitles automatically.

for audio, you need to find the offset time. you can open both video files and find the same frame. then find the offset between the two sources, i used to have a script that could find this if it had the same frame found but i bet there's something on github. then convert the frame difference to seconds and put that into mkvtoolnix.

or pull the audio files out and put them into an editor, match the waves, find the delay in seconds that way.

the audio quality can be all over the place though for different languages, sometimes it comes down to the source itself. Or if pulling from an encode they (usually) will have compressed it already so would want to avoid re-compressing or try to find a better source. but if you think it sounds good (192 is probably good for aac) then i'd just leave it at that.
farder

Re: Is there a somewhat accurate and up to date guide on how to WebDL / WebRIP from streaming services?

Post by farder »

Seriously thanks alot man, you're a legend
Guest

Re: Is there a somewhat accurate and up to date guide on how to WebDL / WebRIP from streaming services?

Post by Guest »

For audio synchronizing, i suggest you to do the following:

Download a good video source, the one you would like to use in the torrent.

Download other version of the movie (the ones which have the desired audio language), try to download the ones that have the most resemblance in time with the original. This will make your works easier. (for example, if your torrent will be about a BluRay, check for audios coming from BluRay versions, not DVDs, when possible).

After you downloaded the audio movies, check the 'audio-movies' FPS. they should match or be almost the same number as the 'video-movie'. You can use ffmpeg rubberband audio filter. Do this using the .mp4 or mkv of the audio file as input, something as:

ffmpeg -i INPUT.mkv -map 0:1 -af "rubberband=tempo=0.95904096" -vn -c:a aac -ac 2 OUTPUT-2398.m4a

This will make the audio first audio stream (0:1) to fit the 23.98FPS. The tempo value is obtained by dividing:

DESIRED-FPS-VALUE / ORIGINAL-FPS-VALUE

You can obtain FPS value of the movie using several programs. The closer you get to the tempo value, the less you will have to sync.

Check for more info about this thing in ffmpeg documentation.

After you have done that, you can load the video torrent in kdenlive, and the audio you want to sync. I suggest you to use the 'Separate audio channels' option in Kdenlive (Settings>Configure Kdenlive>Timeline) and the 'editing' mode.

Then you have to sync the waves of the audios. My suggestion is to check all the audio wave, in case some part of the audio is broken or missing, plus checking that the audio voices fit what corresponds to the scene.

After syncing the audio waves, mute/disable the original movie audio, then go to the audio panel and make the desired audio to have '0' as value in the speakers(0 means that the sound will be sent to both sides equally). Now you have to render the audio, it is not necesary to render the whole video with the audio, since that part was not touched. For this go to 'Project>Render' then select an 'audio only' preset. The option you have to select depends on your audio input(mp3,aac,ac3,etc).

After rendering the audio, check that the audio obtained matches the video, this can be done in some advanced video players as smplayer (which also shows an accurate value of FPS). Load the audio with some subtitles you understand, and jump through the video to see that everything is OK.

For subtitles you have several guides in the internet, i suggest using subtitlecomposer which has a lot of useful functions.

After you have your audios and subtitles, you have to join them. This can be done with several programs too, my suggestions is that you use .mkv containers and 'soft-subtitles'(not hard-coded or burned ones). This is because you can easily switch subtitles by this, without touching the video (faster generation of the final file). Personally, i use a ffmpeg script that loads the subtitles and audio files, and makes the final file.

Extra: If by chance you have subtitles that are in the .idx format or 'image subtitles', i have found a fast way to transform them in .srt or .ass:

You need to use: mkvtoolnix (mkvextract command, to obtain the .idx subtitles). Then you have to use something that transform those files in the desired ones. For that i have used vobsub2srt which uses tesseract, and i have found good results.
farder

Re: Is there a somewhat accurate and up to date guide on how to WebDL / WebRIP from streaming services?

Post by farder »

OK, I've tried doing exactly that:
Take Audio of an NTSC show (so 23,976 fps)
user rubberband tempo to speed the audio up to 24 fps

Sadly, the outcome was noticeably pitched and still a little out of sync the longer the movie progressed

There HAS to be a simple and super reliable way of doing this, or we just can't put different framerate sources into one torrent
Post Reply