New

pywidevine/cdm/cdm.py

@@ -0,0 +1,380 @@
+import base64
+
+import os
+import time
+import binascii
+
+from google.protobuf.message import DecodeError
+from google.protobuf import text_format
+
+from pywidevine.cdm.formats import wv_proto2_pb2 as wv_proto2
+from pywidevine.cdm.session import Session
+from pywidevine.cdm.key import Key
+from Crypto.Random import get_random_bytes
+from Crypto.Random import random
+from Crypto import Random
+from Crypto.Cipher import PKCS1_OAEP, AES
+from Crypto.Hash import CMAC, SHA256, HMAC, SHA1
+from Crypto.PublicKey import RSA
+from Crypto.Signature import pss
+from Crypto.Util import Padding
+from pywidevine.cdm import cdmapi
+import logging
+
+
+class Cdm:
+    def __init__(self):
+        self.logger = logging.getLogger(__name__)
+        self.sessions = {}
+
+    def open_session(self, init_data_b64, device, raw_init_data=None, offline=False):
+        self.logger.debug("open_session(init_data_b64={}, device={}".format(init_data_b64, device))
+        self.logger.info("opening new cdm session")
+        if device.session_id_type == 'android':
+            # format: 16 random hexdigits, 2 digit counter, 14 0s
+            rand_ascii = ''.join(random.choice('ABCDEF0123456789') for _ in range(16))
+            counter = '01' # this resets regularly so its fine to use 01
+            rest = '00000000000000'
+            session_id = rand_ascii + counter + rest
+            session_id = session_id.encode('ascii')
+        elif device.session_id_type == 'chrome':
+            rand_bytes = get_random_bytes(16)
+            session_id = rand_bytes
+        else:
+            # other formats NYI
+            self.logger.error("device type is unusable")
+            return 1
+        if raw_init_data and isinstance(raw_init_data, (bytes, bytearray)):
+            # used for NF key exchange, where they don't provide a valid PSSH
+            init_data = raw_init_data
+            self.raw_pssh = True
+        else:
+            init_data = self._parse_init_data(init_data_b64)
+            self.raw_pssh = False
+
+        if init_data:
+            new_session = Session(session_id, init_data, device, offline)
+        else:
+            self.logger.error("unable to parse init data")
+            return 1
+        self.sessions[session_id] = new_session
+        self.logger.info("session opened and init data parsed successfully")
+        return session_id
+
+    def _parse_init_data(self, init_data_b64):
+        parsed_init_data = wv_proto2.WidevineCencHeader()
+        try:
+            self.logger.debug("trying to parse init_data directly")
+            parsed_init_data.ParseFromString(base64.b64decode(init_data_b64)[32:])
+        except DecodeError:
+            self.logger.debug("unable to parse as-is, trying with removed pssh box header")
+            try:
+                id_bytes = parsed_init_data.ParseFromString(base64.b64decode(init_data_b64)[32:])
+            except DecodeError:
+                self.logger.error("unable to parse, unsupported init data format")
+                return None
+        self.logger.debug("init_data:")
+        for line in text_format.MessageToString(parsed_init_data).splitlines():
+            self.logger.debug(line)
+        return parsed_init_data
+
+    def close_session(self, session_id):
+        self.logger.debug("close_session(session_id={})".format(session_id))
+        self.logger.info("closing cdm session")
+        if session_id in self.sessions:
+            self.sessions.pop(session_id)
+            self.logger.info("cdm session closed")
+            return 0
+        else:
+            self.logger.info("session {} not found".format(session_id))
+            return 1
+
+    def set_service_certificate(self, session_id, cert_b64):
+        self.logger.debug("set_service_certificate(session_id={}, cert={})".format(session_id, cert_b64))
+        self.logger.info("setting service certificate")
+
+        if session_id not in self.sessions:
+            self.logger.error("session id doesn't exist")
+            return 1
+
+        session = self.sessions[session_id]
+
+        message = wv_proto2.SignedMessage()
+
+        try:
+            message.ParseFromString(base64.b64decode(cert_b64))
+        except DecodeError:
+            self.logger.error("failed to parse cert as SignedMessage")
+
+        service_certificate = wv_proto2.SignedDeviceCertificate()
+
+        if message.Type:
+            self.logger.debug("service cert provided as signedmessage")
+            try:
+                service_certificate.ParseFromString(message.Msg)
+            except DecodeError:
+                self.logger.error("failed to parse service certificate")
+                return 1
+        else:
+            self.logger.debug("service cert provided as signeddevicecertificate")
+            try:
+                service_certificate.ParseFromString(base64.b64decode(cert_b64))
+            except DecodeError:
+                self.logger.error("failed to parse service certificate")
+                return 1
+
+        self.logger.debug("service certificate:")
+        for line in text_format.MessageToString(service_certificate).splitlines():
+            self.logger.debug(line)
+
+        session.service_certificate = service_certificate
+        session.privacy_mode = True
+        return 0
+
+    def sign_license_request(self, data):
+        em = binascii.b2a_hex((pss._EMSA_PSS_ENCODE(data, 2047, Random.get_random_bytes, lambda x, y: pss.MGF1(x, y, data), 20)))
+        sig = cdmapi.encrypt(em.decode('utf-8'))
+        return (binascii.a2b_hex(sig))
+
+    def get_license_request(self, session_id):
+        self.logger.debug("get_license_request(session_id={})".format(session_id))
+        self.logger.info("getting license request")
+
+        if session_id not in self.sessions:
+            self.logger.error("session ID does not exist")
+            return 1
+
+        session = self.sessions[session_id]
+
+        # raw pssh will be treated as bytes and not parsed
+        if self.raw_pssh:
+            license_request = wv_proto2.SignedLicenseRequestRaw()
+        else:
+            license_request = wv_proto2.SignedLicenseRequest()
+        client_id = wv_proto2.ClientIdentification()
+
+        if not os.path.exists(session.device_config.device_client_id_blob_filename):
+            self.logger.error("no client ID blob available for this device")
+            return 1
+
+        with open(session.device_config.device_client_id_blob_filename, "rb") as f:
+            try:
+                cid_bytes = client_id.ParseFromString(f.read())
+            except DecodeError:
+                self.logger.error("client id failed to parse as protobuf")
+                return 1
+
+        self.logger.debug("building license request")
+        if not self.raw_pssh:
+            license_request.Type = wv_proto2.SignedLicenseRequest.MessageType.Value('LICENSE_REQUEST')
+            license_request.Msg.ContentId.CencId.Pssh.CopyFrom(session.init_data)
+        else:
+            license_request.Type = wv_proto2.SignedLicenseRequestRaw.MessageType.Value('LICENSE_REQUEST')
+            license_request.Msg.ContentId.CencId.Pssh = session.init_data # bytes
+
+        if session.offline:
+            license_type = wv_proto2.LicenseType.Value('OFFLINE')
+        else:
+            license_type = wv_proto2.LicenseType.Value('DEFAULT')
+        license_request.Msg.ContentId.CencId.LicenseType = license_type
+        license_request.Msg.ContentId.CencId.RequestId = session_id
+        license_request.Msg.Type = wv_proto2.LicenseRequest.RequestType.Value('NEW')
+        license_request.Msg.RequestTime = int(time.time())
+        license_request.Msg.ProtocolVersion = wv_proto2.ProtocolVersion.Value('CURRENT')
+        if session.device_config.send_key_control_nonce:
+            license_request.Msg.KeyControlNonce = random.randrange(1, 2**31)
+
+        if session.privacy_mode:
+
+            if session.device_config.vmp:
+                self.logger.debug("vmp required, adding to client_id")
+                self.logger.debug("reading vmp hashes")
+                vmp_hashes = wv_proto2.FileHashes()
+                with open(session.device_config.device_vmp_blob_filename, "rb") as f:
+                    try:
+                        vmp_bytes = vmp_hashes.ParseFromString(f.read())
+                    except DecodeError:
+                        self.logger.error("vmp hashes failed to parse as protobuf")
+                        return 1
+                client_id._FileHashes.CopyFrom(vmp_hashes)
+            self.logger.debug("privacy mode & service certificate loaded, encrypting client id")
+            self.logger.debug("unencrypted client id:")
+            for line in text_format.MessageToString(client_id).splitlines():
+                self.logger.debug(line)
+            cid_aes_key = get_random_bytes(16)
+            cid_iv = get_random_bytes(16)
+
+            cid_cipher = AES.new(cid_aes_key, AES.MODE_CBC, cid_iv)
+
+            encrypted_client_id = cid_cipher.encrypt(Padding.pad(client_id.SerializeToString(), 16))
+
+            service_public_key = RSA.importKey(session.service_certificate._DeviceCertificate.PublicKey)
+
+            service_cipher = PKCS1_OAEP.new(service_public_key)
+
+            encrypted_cid_key = service_cipher.encrypt(cid_aes_key)
+
+            encrypted_client_id_proto = wv_proto2.EncryptedClientIdentification()
+
+            encrypted_client_id_proto.ServiceId = session.service_certificate._DeviceCertificate.ServiceId
+            encrypted_client_id_proto.ServiceCertificateSerialNumber = session.service_certificate._DeviceCertificate.SerialNumber
+            encrypted_client_id_proto.EncryptedClientId = encrypted_client_id
+            encrypted_client_id_proto.EncryptedClientIdIv = cid_iv
+            encrypted_client_id_proto.EncryptedPrivacyKey = encrypted_cid_key
+
+            license_request.Msg.EncryptedClientId.CopyFrom(encrypted_client_id_proto)
+        else:
+            license_request.Msg.ClientId.CopyFrom(client_id)
+
+        if session.device_config.private_key_available:
+            key = RSA.importKey(open(session.device_config.device_private_key_filename).read())
+            print(key)
+            session.device_key = key
+        else:
+            self.logger.info("need device private key, other methods unimplemented")
+            # return 1
+
+        self.logger.debug("signing license request")
+
+        hash = SHA1.new(license_request.Msg.SerializeToString())
+        if(session.device_key is not None):
+            signature = pss.new(key).sign(hash)
+        else:
+            signature = self.sign_license_request(hash)
+
+        license_request.Signature = signature
+
+        session.license_request = license_request
+
+        self.logger.debug("license request:")
+        for line in text_format.MessageToString(session.license_request).splitlines():
+            self.logger.debug(line)
+        self.logger.info("license request created")
+        self.logger.debug("license request b64: {}".format(base64.b64encode(license_request.SerializeToString())))
+        return license_request.SerializeToString()
+
+    def provide_license(self, session_id, license_b64):
+        self.logger.debug("provide_license(session_id={}, license_b64={})".format(session_id, license_b64))
+        self.logger.info("decrypting provided license")
+
+        if session_id not in self.sessions:
+            self.logger.error("session does not exist")
+            return 1
+
+        session = self.sessions[session_id]
+
+        if not session.license_request:
+            self.logger.error("generate a license request first!")
+            return 1
+
+        license = wv_proto2.SignedLicense()
+        try:
+
+            license.ParseFromString(base64.b64decode(license_b64))
+
+        except DecodeError:
+            self.logger.error("unable to parse license - check protobufs")
+            return 1
+
+        session.license = license
+
+        self.logger.debug("license:")
+        for line in text_format.MessageToString(license).splitlines():
+            self.logger.debug(line)
+
+        self.logger.debug("deriving keys from session key")
+
+        oaep_cipher = PKCS1_OAEP.new(session.device_key)
+
+        if(session.device_key is not None):
+            session.session_key = oaep_cipher.decrypt(license.SessionKey)
+        else:
+            session_key = cdmapi.decrypt(binascii.b2a_hex(license.SessionKey).decode('utf-8'))
+            session.session_key = binascii.a2b_hex(session_key)
+
+        lic_req_msg = session.license_request.Msg.SerializeToString()
+
+        enc_key_base = b"ENCRYPTION\000" + lic_req_msg + b"\0\0\0\x80"
+        auth_key_base = b"AUTHENTICATION\0" + lic_req_msg + b"\0\0\2\0"
+
+        enc_key = b"\x01" + enc_key_base
+        auth_key_1 = b"\x01" + auth_key_base
+        auth_key_2 = b"\x02" + auth_key_base
+        auth_key_3 = b"\x03" + auth_key_base
+        auth_key_4 = b"\x04" + auth_key_base
+
+        cmac_obj = CMAC.new(session.session_key, ciphermod=AES)
+        cmac_obj.update(enc_key)
+
+        enc_cmac_key = cmac_obj.digest()
+
+        cmac_obj = CMAC.new(session.session_key, ciphermod=AES)
+        cmac_obj.update(auth_key_1)
+        auth_cmac_key_1 = cmac_obj.digest()
+
+        cmac_obj = CMAC.new(session.session_key, ciphermod=AES)
+        cmac_obj.update(auth_key_2)
+        auth_cmac_key_2 = cmac_obj.digest()
+
+        cmac_obj = CMAC.new(session.session_key, ciphermod=AES)
+        cmac_obj.update(auth_key_3)
+        auth_cmac_key_3 = cmac_obj.digest()
+
+        cmac_obj = CMAC.new(session.session_key, ciphermod=AES)
+        cmac_obj.update(auth_key_4)
+        auth_cmac_key_4 = cmac_obj.digest()
+
+        auth_cmac_combined_1 = auth_cmac_key_1 + auth_cmac_key_2
+        auth_cmac_combined_2 = auth_cmac_key_3 + auth_cmac_key_4
+
+        session.derived_keys['enc'] = enc_cmac_key
+        session.derived_keys['auth_1'] = auth_cmac_combined_1
+        session.derived_keys['auth_2'] = auth_cmac_combined_2
+
+        self.logger.debug('verifying license signature')
+
+        lic_hmac = HMAC.new(session.derived_keys['auth_1'], digestmod=SHA256)
+        lic_hmac.update(license.Msg.SerializeToString())
+
+        self.logger.debug("calculated sig: {} actual sig: {}".format(lic_hmac.hexdigest(), binascii.hexlify(license.Signature)))
+
+        if lic_hmac.digest() != license.Signature:
+            self.logger.info("license signature doesn't match - writing bin so they can be debugged")
+            with open("original_lic.bin", "wb") as f:
+                f.write(base64.b64decode(license_b64))
+            with open("parsed_lic.bin", "wb") as f:
+                f.write(license.SerializeToString())
+            self.logger.info("continuing anyway")
+
+        self.logger.debug("key count: {}".format(len(license.Msg.Key)))
+        for key in license.Msg.Key:
+            if key.Id:
+                key_id = key.Id
+            else:
+                key_id = wv_proto2.License.KeyContainer.KeyType.Name(key.Type).encode('utf-8')
+            encrypted_key = key.Key
+            iv = key.Iv
+            type = wv_proto2.License.KeyContainer.KeyType.Name(key.Type)
+
+            cipher = AES.new(session.derived_keys['enc'], AES.MODE_CBC, iv=iv)
+            decrypted_key = cipher.decrypt(encrypted_key)
+            if type == "OPERATOR_SESSION":
+                permissions = []
+                perms = key._OperatorSessionKeyPermissions
+                for (descriptor, value) in perms.ListFields():
+                    if value == 1:
+                        permissions.append(descriptor.name)
+
+            else:
+                permissions = []
+            session.keys.append(Key(key_id, type, Padding.unpad(decrypted_key, 16), permissions))
+
+        self.logger.info("decrypted all keys")
+        return 0
+
+    def get_keys(self, session_id):
+        if session_id in self.sessions:
+            return self.sessions[session_id].keys
+        else:
+            self.logger.error("session not found")
+            return 1

pywidevine/cdm/cdm_debug.py

@@ -0,0 +1,324 @@
+import base64
+
+import os
+import time
+import binascii
+
+from google.protobuf.message import DecodeError
+from google.protobuf import text_format
+
+from pywidevine.cdm.formats import wv_proto2_pb2 as wv_proto2
+from pywidevine.cdm.session import Session
+from pywidevine.cdm.key import Key
+from Cryptodome.Random import get_random_bytes
+from Cryptodome.Random import random
+from Cryptodome.Cipher import PKCS1_OAEP, AES
+from Cryptodome.Hash import CMAC, SHA256, HMAC, SHA1
+from Cryptodome.PublicKey import RSA
+from Cryptodome.Signature import pss
+from Cryptodome.Util import Padding
+import logging
+
+class Cdm:
+	def __init__(self):
+		self.logger = logging.getLogger(__name__)
+		self.sessions = {}
+
+	def open_session(self, init_data_b64, device):
+		print("open_session(init_data_b64={}, device={}".format(init_data_b64, device))
+		print("opening new cdm session")
+		if device.session_id_type == 'android':
+			# format: 16 random hexdigits, 2 digit counter, 14 0s
+			rand_ascii = ''.join(random.choice('ABCDEF0123456789') for _ in range(16))
+			counter = '01' # this resets regularly so its fine to use 01
+			rest = '00000000000000'
+			session_id = rand_ascii + counter + rest
+			session_id = session_id.encode('ascii')
+		elif device.session_id_type == 'chrome':
+			rand_bytes = get_random_bytes(16)
+			session_id = rand_bytes
+		else:
+			# other formats NYI
+			print("device type is unusable")
+			return 1
+		init_data = self._parse_init_data(init_data_b64)
+		if init_data:
+			new_session = Session(session_id, init_data, device)
+		else:
+			print("unable to parse init data")
+			return 1
+		self.sessions[session_id] = new_session
+		print("session opened and init data parsed successfully")
+		return session_id
+
+	def _parse_init_data(self, init_data_b64):
+		parsed_init_data = wv_proto2.WidevineCencHeader()
+		try:
+			print("trying to parse init_data directly")
+			parsed_init_data.ParseFromString(base64.b64decode(init_data_b64))
+		except DecodeError:
+			print("unable to parse as-is, trying with removed pssh box header")
+			try:
+				id_bytes = parsed_init_data.ParseFromString(base64.b64decode(init_data_b64)[32:])
+			except DecodeError:
+				print("unable to parse, unsupported init data format")
+				return None
+		print("init_data:")
+		for line in text_format.MessageToString(parsed_init_data).splitlines():
+			print(line)
+		return parsed_init_data
+
+	def close_session(self, session_id):
+		print("close_session(session_id={})".format(session_id))
+		print("closing cdm session")
+		if session_id in self.sessions:
+			self.sessions.pop(session_id)
+			print("cdm session closed")
+			return 0
+		else:
+			print("session {} not found".format(session_id))
+			return 1
+
+	def set_service_certificate(self, session_id, cert_b64):
+		print("set_service_certificate(session_id={}, cert={})".format(session_id, cert_b64))
+		print("setting service certificate")
+
+		if session_id not in self.sessions:
+			print("session id doesn't exist")
+			return 1
+
+		session = self.sessions[session_id]
+
+		message = wv_proto2.SignedMessage()
+
+		try:
+			message.ParseFromString(base64.b64decode(cert_b64))
+		except DecodeError:
+			print("failed to parse cert as SignedMessage")
+
+		service_certificate = wv_proto2.SignedDeviceCertificate()
+
+		if message.Type:
+			print("service cert provided as signedmessage")
+			try:
+				service_certificate.ParseFromString(message.Msg)
+			except DecodeError:
+				print("failed to parse service certificate")
+				return 1
+		else:
+			print("service cert provided as signeddevicecertificate")
+			try:
+				service_certificate.ParseFromString(base64.b64decode(cert_b64))
+			except DecodeError:
+				print("failed to parse service certificate")
+				return 1
+
+		print("service certificate:")
+		for line in text_format.MessageToString(service_certificate).splitlines():
+			print(line)
+
+		session.service_certificate = service_certificate
+		session.privacy_mode = True
+
+		return 0
+
+	def get_license_request(self, session_id):
+		print("get_license_request(session_id={})".format(session_id))
+		print("getting license request")
+
+		if session_id not in self.sessions:
+			print("session ID does not exist")
+			return 1
+
+		session = self.sessions[session_id]
+
+		license_request = wv_proto2.SignedLicenseRequest()
+		client_id = wv_proto2.ClientIdentification()
+
+		if not os.path.exists(session.device_config.device_client_id_blob_filename):
+			print("no client ID blob available for this device")
+			return 1
+
+		with open(session.device_config.device_client_id_blob_filename, "rb") as f:
+			try:
+				cid_bytes = client_id.ParseFromString(f.read())
+			except DecodeError:
+				print("client id failed to parse as protobuf")
+				return 1
+
+		print("building license request")
+
+		license_request.Type = wv_proto2.SignedLicenseRequest.MessageType.Value('LICENSE_REQUEST')
+		license_request.Msg.ContentId.CencId.Pssh.CopyFrom(session.init_data)
+		license_request.Msg.ContentId.CencId.LicenseType = wv_proto2.LicenseType.Value('DEFAULT')
+		license_request.Msg.ContentId.CencId.RequestId = session_id
+		license_request.Msg.Type = wv_proto2.LicenseRequest.RequestType.Value('NEW')
+		license_request.Msg.RequestTime = int(time.time())
+		license_request.Msg.ProtocolVersion = wv_proto2.ProtocolVersion.Value('CURRENT')
+		if session.device_config.send_key_control_nonce:
+			license_request.Msg.KeyControlNonce = random.randrange(1, 2**31)
+
+		if session.privacy_mode:
+			print("privacy mode & service certificate loaded, encrypting client id")
+			print("unencrypted client id:")
+			for line in text_format.MessageToString(client_id).splitlines():
+				print(line)
+			cid_aes_key = get_random_bytes(16)
+			cid_iv = get_random_bytes(16)
+
+			cid_cipher = AES.new(cid_aes_key, AES.MODE_CBC, cid_iv)
+
+			encrypted_client_id = cid_cipher.encrypt(Padding.pad(client_id.SerializeToString(), 16))
+
+			service_public_key = RSA.importKey(session.service_certificate._DeviceCertificate.PublicKey)
+
+			service_cipher = PKCS1_OAEP.new(service_public_key)
+
+			encrypted_cid_key = service_cipher.encrypt(cid_aes_key)
+
+			encrypted_client_id_proto = wv_proto2.EncryptedClientIdentification()
+
+			encrypted_client_id_proto.ServiceId = session.service_certificate._DeviceCertificate.ServiceId
+			encrypted_client_id_proto.ServiceCertificateSerialNumber = session.service_certificate._DeviceCertificate.SerialNumber
+			encrypted_client_id_proto.EncryptedClientId = encrypted_client_id
+			encrypted_client_id_proto.EncryptedClientIdIv = cid_iv
+			encrypted_client_id_proto.EncryptedPrivacyKey = encrypted_cid_key
+
+			license_request.Msg.EncryptedClientId.CopyFrom(encrypted_client_id_proto)
+		else:
+			license_request.Msg.ClientId.CopyFrom(client_id)
+
+		if session.device_config.private_key_available:
+			 key = RSA.importKey(open(session.device_config.device_private_key_filename).read())
+			 session.device_key = key
+		else:
+			 print("need device private key, other methods unimplemented")
+			 return 1
+
+		print("signing license request")
+
+		hash = SHA1.new(license_request.Msg.SerializeToString())
+		signature = pss.new(key).sign(hash)
+
+		license_request.Signature = signature
+
+		session.license_request = license_request
+
+		print("license request:")
+		for line in text_format.MessageToString(session.license_request).splitlines():
+			print(line)
+		print("license request created")
+		print("license request b64: {}".format(base64.b64encode(license_request.SerializeToString())))
+		return license_request.SerializeToString()
+
+	def provide_license(self, session_id, license_b64):
+		print("provide_license(session_id={}, license_b64={})".format(session_id, license_b64))
+		print("decrypting provided license")
+
+		if session_id not in self.sessions:
+			print("session does not exist")
+			return 1
+
+		session = self.sessions[session_id]
+
+		if not session.license_request:
+			print("generate a license request first!")
+			return 1
+
+		license = wv_proto2.SignedLicense()
+		try:
+			license.ParseFromString(base64.b64decode(license_b64))
+		except DecodeError:
+			print("unable to parse license - check protobufs")
+			return 1
+
+		session.license = license
+
+		print("license:")
+		for line in text_format.MessageToString(license).splitlines():
+			print(line)
+
+		print("deriving keys from session key")
+
+		oaep_cipher = PKCS1_OAEP.new(session.device_key)
+
+		session.session_key = oaep_cipher.decrypt(license.SessionKey)
+
+		lic_req_msg = session.license_request.Msg.SerializeToString()
+
+		enc_key_base = b"ENCRYPTION\000" + lic_req_msg + b"\0\0\0\x80"
+		auth_key_base = b"AUTHENTICATION\0" + lic_req_msg + b"\0\0\2\0"
+
+		enc_key = b"\x01" + enc_key_base
+		auth_key_1 = b"\x01" + auth_key_base
+		auth_key_2 = b"\x02" + auth_key_base
+		auth_key_3 = b"\x03" + auth_key_base
+		auth_key_4 = b"\x04" + auth_key_base
+
+		cmac_obj = CMAC.new(session.session_key, ciphermod=AES)
+		cmac_obj.update(enc_key)
+
+		enc_cmac_key = cmac_obj.digest()
+
+		cmac_obj = CMAC.new(session.session_key, ciphermod=AES)
+		cmac_obj.update(auth_key_1)
+		auth_cmac_key_1 = cmac_obj.digest()
+
+		cmac_obj = CMAC.new(session.session_key, ciphermod=AES)
+		cmac_obj.update(auth_key_2)
+		auth_cmac_key_2 = cmac_obj.digest()
+
+		cmac_obj = CMAC.new(session.session_key, ciphermod=AES)
+		cmac_obj.update(auth_key_3)
+		auth_cmac_key_3 = cmac_obj.digest()
+
+		cmac_obj = CMAC.new(session.session_key, ciphermod=AES)
+		cmac_obj.update(auth_key_4)
+		auth_cmac_key_4 = cmac_obj.digest()
+
+		auth_cmac_combined_1 = auth_cmac_key_1 + auth_cmac_key_2
+		auth_cmac_combined_2 = auth_cmac_key_3 + auth_cmac_key_4
+
+		session.derived_keys['enc'] = enc_cmac_key
+		session.derived_keys['auth_1'] = auth_cmac_combined_1
+		session.derived_keys['auth_2'] = auth_cmac_combined_2
+
+		print('verifying license signature')
+
+		lic_hmac = HMAC.new(session.derived_keys['auth_1'], digestmod=SHA256)
+		lic_hmac.update(license.Msg.SerializeToString())
+
+		print("calculated sig: {} actual sig: {}".format(lic_hmac.hexdigest(), binascii.hexlify(license.Signature)))
+
+		if lic_hmac.digest() != license.Signature:
+			print("license signature doesn't match - writing bin so they can be debugged")
+			with open("original_lic.bin", "wb") as f:
+				f.write(base64.b64decode(license_b64))
+			with open("parsed_lic.bin", "wb") as f:
+				f.write(license.SerializeToString())
+			print("continuing anyway")
+
+		print("key count: {}".format(len(license.Msg.Key)))
+		for key in license.Msg.Key:
+			if key.Id:
+				key_id = key.Id
+			else:
+				key_id = wv_proto2.License.KeyContainer.KeyType.Name(key.Type).encode('utf-8')
+			encrypted_key = key.Key
+			iv = key.Iv
+			type = wv_proto2.License.KeyContainer.KeyType.Name(key.Type)
+
+			cipher = AES.new(session.derived_keys['enc'], AES.MODE_CBC, iv=iv)
+			decrypted_key = cipher.decrypt(encrypted_key)
+
+			session.keys.append(Key(key_id, type, Padding.unpad(decrypted_key, 16)))
+
+		print("decrypted all keys")
+		return 0
+
+	def get_keys(self, session_id):
+		if session_id in self.sessions:
+			return self.sessions[session_id].keys
+		else:
+			print("session not found")
+			return 1

pywidevine/cdm/deviceconfig.py

@@ -0,0 +1,54 @@
+import os
+
+device_asus_x00dd = {
+    'name': 'asus_x00dd',
+    'description': 'asus cdm',
+    'security_level': 1,
+    'session_id_type': 'android',
+    'private_key_available': True,
+    'vmp': False,
+    'send_key_control_nonce': True
+}
+
+devices_available = [device_asus_x00dd]
+
+FILES_FOLDER = 'devices'
+
+
+class DeviceConfig:
+    def __init__(self, device):
+        self.device_name = device['name']
+        self.description = device['description']
+        self.security_level = device['security_level']
+        self.session_id_type = device['session_id_type']
+        self.private_key_available = device['private_key_available']
+        self.vmp = device['vmp']
+        self.send_key_control_nonce = device['send_key_control_nonce']
+
+        if 'keybox_filename' in device:
+            self.keybox_filename = os.path.join(os.path.dirname(__file__), FILES_FOLDER, device['name'], device['keybox_filename'])
+        else:
+            self.keybox_filename = os.path.join(os.path.dirname(__file__), FILES_FOLDER, device['name'], 'keybox')
+
+        if 'device_cert_filename' in device:
+            self.device_cert_filename = os.path.join(os.path.dirname(__file__), FILES_FOLDER, device['name'], device['device_cert_filename'])
+        else:
+            self.device_cert_filename = os.path.join(os.path.dirname(__file__), FILES_FOLDER, device['name'], 'device_cert')
+
+        if 'device_private_key_filename' in device:
+            self.device_private_key_filename = os.path.join(os.path.dirname(__file__), FILES_FOLDER, device['name'], device['device_private_key_filename'])
+        else:
+            self.device_private_key_filename = os.path.join(os.path.dirname(__file__), FILES_FOLDER, device['name'], 'device_private_key')
+
+        if 'device_client_id_blob_filename' in device:
+            self.device_client_id_blob_filename = os.path.join(os.path.dirname(__file__), FILES_FOLDER, device['name'], device['device_client_id_blob_filename'])
+        else:
+            self.device_client_id_blob_filename = os.path.join(os.path.dirname(__file__), FILES_FOLDER, device['name'], 'device_client_id_blob')
+
+        if 'device_vmp_blob_filename' in device:
+            self.device_vmp_blob_filename = os.path.join(os.path.dirname(__file__), FILES_FOLDER, device['name'], device['device_vmp_blob_filename'])
+        else:
+            self.device_vmp_blob_filename = os.path.join(os.path.dirname(__file__), FILES_FOLDER, device['name'], 'device_vmp_blob')
+
+    def __repr__(self):
+        return "DeviceConfig(name={}, description={}, security_level={}, session_id_type={}, private_key_available={}, vmp={})".format(self.device_name, self.description, self.security_level, self.session_id_type, self.private_key_available, self.vmp)

pywidevine/cdm/deviceconfig.py.example

@@ -0,0 +1,88 @@
+import os
+
+device_nexus6_lvl1 = {
+    'name': 'nexus6_lvl1',
+    'description': 'nexus 6 firmware 5.1.1 lvl1 security level',
+    'security_level': 1,
+    'session_id_type': 'android',
+    'private_key_available': True,
+    'vmp': False,
+    'send_key_control_nonce': True
+}
+
+device_chromecdm_903 = {
+    'name': 'chromecdm_903',
+    'description': 'chrome cdm windows 903',
+    'security_level': 3,
+    'session_id_type': 'chrome',
+    'private_key_available': True,
+    'vmp': False,
+    'send_key_control_nonce': False
+}
+
+device_chromecdm_984 = {
+    'name': 'chromecdm_984',
+    'description': 'chrome cdm windows 984',
+    'security_level': 3,
+    'session_id_type': 'chrome',
+    'private_key_available': True,
+    'vmp': True,
+    'send_key_control_nonce': False
+}
+
+device_chromecdm_1022 = {
+    'name': 'chromecdm_1022',
+    'description': 'chrome cdm windows 1022',
+    'security_level': 3,
+    'session_id_type': 'chrome',
+    'private_key_available': True,
+    'vmp': True,
+    'send_key_control_nonce': False
+}
+
+
+devices_available = [device_nexus6_lvl1, device_chromecdm_903, device_chromecdm_984, device_chromecdm_1022]
+
+from __main__ import dirPath
+#main_folder = os.path.dirname(__file__)
+main_folder = os.path.join(dirPath, 'pywidevine', 'cdm')
+
+FILES_FOLDER = 'devices'
+
+class DeviceConfig:
+    def __init__(self, device):
+        self.device_name = device['name']
+        self.description = device['description']
+        self.security_level = device['security_level']
+        self.session_id_type = device['session_id_type']
+        self.private_key_available = device['private_key_available']
+        self.vmp = device['vmp']
+        self.send_key_control_nonce = device['send_key_control_nonce']
+
+        if 'keybox_filename' in device:
+            self.keybox_filename = os.path.join(main_folder, FILES_FOLDER, device['name'], device['keybox_filename'])
+        else:
+            self.keybox_filename = os.path.join(main_folder, FILES_FOLDER, device['name'], 'keybox')
+
+        if 'device_cert_filename' in device:
+            self.device_cert_filename = os.path.join(main_folder, FILES_FOLDER, device['name'], device['device_cert_filename'])
+        else:
+            self.device_cert_filename = os.path.join(main_folder, FILES_FOLDER, device['name'], 'device_cert')
+
+        if 'device_private_key_filename' in device:
+            self.device_private_key_filename = os.path.join(main_folder, FILES_FOLDER, device['name'], device['device_private_key_filename'])
+        else:
+            self.device_private_key_filename = os.path.join(main_folder, FILES_FOLDER, device['name'], 'device_private_key')
+
+        if 'device_client_id_blob_filename' in device:
+            self.device_client_id_blob_filename = os.path.join(main_folder, FILES_FOLDER, device['name'], device['device_client_id_blob_filename'])
+        else:
+            self.device_client_id_blob_filename = os.path.join(main_folder, FILES_FOLDER, device['name'], 'device_client_id_blob')
+
+        if 'device_vmp_blob_filename' in device:
+            self.device_vmp_blob_filename = os.path.join(main_folder, FILES_FOLDER, device['name'], device['device_vmp_blob_filename'])
+        else:
+            self.device_vmp_blob_filename = os.path.join(main_folder, FILES_FOLDER, device['name'], 'device_vmp_blob')
+
+    def __repr__(self):
+        return "DeviceConfig(name={}, description={}, security_level={}, session_id_type={}, private_key_available={}, vmp={})".format(self.device_name, self.description, self.security_level, self.session_id_type, self.private_key_available, self.vmp)

pywidevine/cdm/formats/wv_proto2.proto

@@ -0,0 +1,466 @@
+syntax = "proto2";
+
+// from x86 (partial), most of it from the ARM version:
+message ClientIdentification {
+    enum TokenType {
+        KEYBOX = 0;
+        DEVICE_CERTIFICATE = 1;
+        REMOTE_ATTESTATION_CERTIFICATE = 2;
+    }
+    message NameValue {
+        required string Name = 1;
+        required string Value = 2;
+    }
+    message ClientCapabilities {
+        enum HdcpVersion {
+            HDCP_NONE = 0;
+            HDCP_V1 = 1;
+            HDCP_V2 = 2;
+            HDCP_V2_1 = 3;
+            HDCP_V2_2 = 4;
+        }
+        optional uint32 ClientToken = 1;
+        optional uint32 SessionToken = 2;
+        optional uint32 VideoResolutionConstraints = 3;
+        optional HdcpVersion MaxHdcpVersion = 4;
+        optional uint32 OemCryptoApiVersion = 5;
+    }
+    required TokenType Type = 1;
+    //optional bytes Token = 2; // by default the client treats this as blob, but it's usually a DeviceCertificate, so for usefulness sake, I'm replacing it with this one:
+    optional SignedDeviceCertificate Token = 2; // use this when parsing, "bytes" when building a client id blob
+    repeated NameValue ClientInfo = 3;
+    optional bytes ProviderClientToken = 4;
+    optional uint32 LicenseCounter = 5;
+    optional ClientCapabilities _ClientCapabilities = 6; // how should we deal with duped names? will have to look at proto docs later
+    optional FileHashes _FileHashes = 7; // vmp blob goes here
+}
+
+message DeviceCertificate {
+    enum CertificateType {
+        ROOT = 0;
+        INTERMEDIATE = 1;
+        USER_DEVICE = 2;
+        SERVICE = 3;
+    }
+    required CertificateType Type = 1; // the compiled code reused this as ProvisionedDeviceInfo.WvSecurityLevel, however that is incorrect (compiler aliased it as they're both identical as a structure)
+    optional bytes SerialNumber = 2;
+    optional uint32 CreationTimeSeconds = 3;
+    optional bytes PublicKey = 4;
+    optional uint32 SystemId = 5;
+    optional uint32 TestDeviceDeprecated = 6; // is it bool or int?
+    optional bytes ServiceId = 7; // service URL for service certificates
+}
+
+// missing some references,
+message DeviceCertificateStatus {
+    enum CertificateStatus {
+        VALID = 0;
+        REVOKED = 1;
+    }
+    optional bytes SerialNumber = 1;
+    optional CertificateStatus Status = 2;
+    optional ProvisionedDeviceInfo DeviceInfo = 4; // where is 3? is it deprecated?
+}
+
+message DeviceCertificateStatusList {
+    optional uint32 CreationTimeSeconds = 1;
+    repeated DeviceCertificateStatus CertificateStatus = 2;
+}
+
+message EncryptedClientIdentification {
+    required string ServiceId = 1;
+    optional bytes ServiceCertificateSerialNumber = 2;
+    required bytes EncryptedClientId = 3;
+    required bytes EncryptedClientIdIv = 4;
+    required bytes EncryptedPrivacyKey = 5;
+}
+
+// todo: fill (for this top-level type, it might be impossible/difficult)
+enum LicenseType {
+    ZERO = 0;
+    DEFAULT = 1; // 1 is STREAMING/temporary license; on recent versions may go up to 3 (latest x86); it might be persist/don't persist type, unconfirmed
+    OFFLINE = 2;
+}
+
+// todo: fill (for this top-level type, it might be impossible/difficult)
+// this is just a guess because these globals got lost, but really, do we need more?
+enum ProtocolVersion {
+    CURRENT = 21; // don't have symbols for this
+}
+
+
+message LicenseIdentification {
+    optional bytes RequestId = 1;
+    optional bytes SessionId = 2;
+    optional bytes PurchaseId = 3;
+    optional LicenseType Type = 4;
+    optional uint32 Version = 5;
+    optional bytes ProviderSessionToken = 6;
+}
+
+
+message License {
+    message Policy {
+        optional bool CanPlay = 1; // changed from uint32 to bool
+        optional bool CanPersist = 2;
+        optional bool CanRenew = 3;
+        optional uint32 RentalDurationSeconds = 4;
+        optional uint32 PlaybackDurationSeconds = 5;
+        optional uint32 LicenseDurationSeconds = 6;
+        optional uint32 RenewalRecoveryDurationSeconds = 7;
+        optional string RenewalServerUrl = 8;
+        optional uint32 RenewalDelaySeconds = 9;
+        optional uint32 RenewalRetryIntervalSeconds = 10;
+        optional bool RenewWithUsage = 11; // was uint32
+    }
+    message KeyContainer {
+        enum KeyType {
+            SIGNING = 1;
+            CONTENT = 2;
+            KEY_CONTROL = 3;
+            OPERATOR_SESSION = 4;
+        }
+        enum SecurityLevel {
+            SW_SECURE_CRYPTO = 1;
+            SW_SECURE_DECODE = 2;
+            HW_SECURE_CRYPTO = 3;
+            HW_SECURE_DECODE = 4;
+            HW_SECURE_ALL = 5;
+        }
+        message OutputProtection {
+            enum CGMS {
+                COPY_FREE = 0;
+                COPY_ONCE = 2;
+                COPY_NEVER = 3;
+                CGMS_NONE = 0x2A; // PC default!
+            }
+            optional ClientIdentification.ClientCapabilities.HdcpVersion Hdcp = 1; // it's most likely a copy of Hdcp version available here, but compiler optimized it away
+            optional CGMS CgmsFlags = 2;
+        }
+        message KeyControl {
+            required bytes KeyControlBlock = 1; // what is this?
+            required bytes Iv = 2;
+        }
+        message OperatorSessionKeyPermissions {
+            optional uint32 AllowEncrypt = 1;
+            optional uint32 AllowDecrypt = 2;
+            optional uint32 AllowSign = 3;
+            optional uint32 AllowSignatureVerify = 4;
+        }
+        message VideoResolutionConstraint {
+            optional uint32 MinResolutionPixels = 1;
+            optional uint32 MaxResolutionPixels = 2;
+            optional OutputProtection RequiredProtection = 3;
+        }
+        optional bytes Id = 1;
+        optional bytes Iv = 2;
+        optional bytes Key = 3;
+        optional KeyType Type = 4;
+        optional SecurityLevel Level = 5;
+        optional OutputProtection RequiredProtection = 6;
+        optional OutputProtection RequestedProtection = 7;
+        optional KeyControl _KeyControl = 8; // duped names, etc
+        optional OperatorSessionKeyPermissions _OperatorSessionKeyPermissions = 9; // duped names, etc
+        repeated VideoResolutionConstraint VideoResolutionConstraints = 10;
+    }
+    optional LicenseIdentification Id = 1;
+    optional Policy _Policy = 2; // duped names, etc
+    repeated KeyContainer Key = 3;
+    optional uint32 LicenseStartTime = 4;
+    optional uint32 RemoteAttestationVerified = 5; // bool?
+    optional bytes ProviderClientToken = 6;
+    // there might be more, check with newer versions (I see field 7-8 in a lic)
+    // this appeared in latest x86:
+    optional uint32 ProtectionScheme = 7; // type unconfirmed fully, but it's likely as WidevineCencHeader describesit (fourcc)
+}
+
+message LicenseError {
+    enum Error {
+        INVALID_DEVICE_CERTIFICATE = 1;
+        REVOKED_DEVICE_CERTIFICATE = 2;
+        SERVICE_UNAVAILABLE = 3;
+    }
+    //LicenseRequest.RequestType ErrorCode; // clang mismatch
+    optional Error ErrorCode = 1;
+}
+
+message LicenseRequest {
+    message ContentIdentification {
+        message CENC {
+            //optional bytes Pssh = 1; // the client's definition is opaque, it doesn't care about the contents, but the PSSH has a clear definition that is understood and requested by the server, thus I'll replace it with:
+            optional WidevineCencHeader Pssh = 1;
+            optional LicenseType LicenseType = 2; // unfortunately the LicenseType symbols are not present, acceptable value seems to only be 1 (is this persist/don't persist? look into it!)
+            optional bytes RequestId = 3;
+        }
+        message WebM {
+            optional bytes Header = 1; // identical to CENC, aside from PSSH and the parent field number used
+            optional LicenseType LicenseType = 2;
+            optional bytes RequestId = 3;
+        }
+        message ExistingLicense {
+            optional LicenseIdentification LicenseId = 1;
+            optional uint32 SecondsSinceStarted = 2;
+            optional uint32 SecondsSinceLastPlayed = 3;
+            optional bytes SessionUsageTableEntry = 4; // interesting! try to figure out the connection between the usage table blob and KCB!
+        }
+        optional CENC CencId = 1;
+        optional WebM WebmId = 2;
+        optional ExistingLicense License = 3;
+    }
+    enum RequestType {
+        NEW = 1;
+        RENEWAL = 2;
+        RELEASE = 3;
+    }
+    optional ClientIdentification ClientId = 1;
+    optional ContentIdentification ContentId = 2;
+    optional RequestType Type = 3;
+    optional uint32 RequestTime = 4;
+    optional bytes KeyControlNonceDeprecated = 5;
+    optional ProtocolVersion ProtocolVersion = 6; // lacking symbols for this
+    optional uint32 KeyControlNonce = 7;
+    optional EncryptedClientIdentification EncryptedClientId = 8;
+}
+
+// raw pssh hack
+message LicenseRequestRaw {
+    message ContentIdentification {
+        message CENC {
+            optional bytes Pssh = 1; // the client's definition is opaque, it doesn't care about the contents, but the PSSH has a clear definition that is understood and requested by the server, thus I'll replace it with:
+            //optional WidevineCencHeader Pssh = 1;
+            optional LicenseType LicenseType = 2; // unfortunately the LicenseType symbols are not present, acceptable value seems to only be 1 (is this persist/don't persist? look into it!)
+            optional bytes RequestId = 3;
+        }
+        message WebM {
+            optional bytes Header = 1; // identical to CENC, aside from PSSH and the parent field number used
+            optional LicenseType LicenseType = 2;
+            optional bytes RequestId = 3;
+        }
+        message ExistingLicense {
+            optional LicenseIdentification LicenseId = 1;
+            optional uint32 SecondsSinceStarted = 2;
+            optional uint32 SecondsSinceLastPlayed = 3;
+            optional bytes SessionUsageTableEntry = 4; // interesting! try to figure out the connection between the usage table blob and KCB!
+        }
+        optional CENC CencId = 1;
+        optional WebM WebmId = 2;
+        optional ExistingLicense License = 3;
+    }
+    enum RequestType {
+        NEW = 1;
+        RENEWAL = 2;
+        RELEASE = 3;
+    }
+    optional ClientIdentification ClientId = 1;
+    optional ContentIdentification ContentId = 2;
+    optional RequestType Type = 3;
+    optional uint32 RequestTime = 4;
+    optional bytes KeyControlNonceDeprecated = 5;
+    optional ProtocolVersion ProtocolVersion = 6; // lacking symbols for this
+    optional uint32 KeyControlNonce = 7;
+    optional EncryptedClientIdentification EncryptedClientId = 8;
+}
+
+
+message ProvisionedDeviceInfo {
+    enum WvSecurityLevel {
+        LEVEL_UNSPECIFIED = 0;
+        LEVEL_1 = 1;
+        LEVEL_2 = 2;
+        LEVEL_3 = 3;
+    }
+    optional uint32 SystemId = 1;
+    optional string Soc = 2;
+    optional string Manufacturer = 3;
+    optional string Model = 4;
+    optional string DeviceType = 5;
+    optional uint32 ModelYear = 6;
+    optional WvSecurityLevel SecurityLevel = 7;
+    optional uint32 TestDevice = 8; // bool?
+}
+
+
+// todo: fill
+message ProvisioningOptions {
+}
+
+// todo: fill
+message ProvisioningRequest {
+}
+
+// todo: fill
+message ProvisioningResponse {
+}
+
+message RemoteAttestation {
+    optional EncryptedClientIdentification Certificate = 1;
+    optional string Salt = 2;
+    optional string Signature = 3;
+}
+
+// todo: fill
+message SessionInit {
+}
+
+// todo: fill
+message SessionState {
+}
+
+// todo: fill
+message SignedCertificateStatusList {
+}
+
+message SignedDeviceCertificate {
+
+    //optional bytes DeviceCertificate = 1; // again, they use a buffer where it's supposed to be a message, so we'll replace it with what it really is:
+    optional DeviceCertificate _DeviceCertificate = 1; // how should we deal with duped names? will have to look at proto docs later
+    optional bytes Signature = 2;
+    optional SignedDeviceCertificate Signer = 3;
+}
+
+
+// todo: fill
+message SignedProvisioningMessage {
+}
+
+// the root of all messages, from either server or client
+message SignedMessage {
+    enum MessageType {
+        LICENSE_REQUEST = 1;
+        LICENSE = 2;
+        ERROR_RESPONSE = 3;
+        SERVICE_CERTIFICATE_REQUEST = 4;
+        SERVICE_CERTIFICATE = 5;
+    }
+    optional MessageType Type = 1; // has in incorrect overlap with License_KeyContainer_SecurityLevel
+    optional bytes Msg = 2; // this has to be casted dynamically, to LicenseRequest, License or LicenseError (? unconfirmed), for Request, no other fields but Type need to be present
+    // for SERVICE_CERTIFICATE, only Type and Msg are present, and it's just a DeviceCertificate with CertificateType set to SERVICE
+    optional bytes Signature = 3; // might be different type of signatures (ex. RSA vs AES CMAC(??), unconfirmed for now)
+    optional bytes SessionKey = 4; // often RSA wrapped for licenses
+    optional RemoteAttestation RemoteAttestation = 5;
+}
+
+
+
+// This message is copied from google's docs, not reversed:
+message WidevineCencHeader {
+    enum Algorithm {
+        UNENCRYPTED = 0;
+        AESCTR = 1;
+    };
+    optional Algorithm algorithm = 1;
+    repeated bytes key_id = 2;
+
+    // Content provider name.
+    optional string provider = 3;
+
+    // A content identifier, specified by content provider.
+    optional bytes content_id = 4;
+
+    // Track type. Acceptable values are SD, HD and AUDIO. Used to
+    // differentiate content keys used by an asset.
+    optional string track_type_deprecated = 5;
+
+    // The name of a registered policy to be used for this asset.
+    optional string policy = 6;
+
+    // Crypto period index, for media using key rotation.
+    optional uint32 crypto_period_index = 7;
+
+    // Optional protected context for group content. The grouped_license is a
+    // serialized SignedMessage.
+    optional bytes grouped_license = 8;
+
+    // Protection scheme identifying the encryption algorithm.
+    // Represented as one of the following 4CC values:
+    // 'cenc' (AESCTR), 'cbc1' (AESCBC),
+    // 'cens' (AESCTR subsample), 'cbcs' (AESCBC subsample).
+    optional uint32 protection_scheme = 9;
+
+    // Optional. For media using key rotation, this represents the duration
+    // of each crypto period in seconds.
+    optional uint32 crypto_period_seconds = 10;
+}
+
+
+// remove these when using it outside of protoc:
+
+// from here on, it's just for testing, these messages don't exist in the binaries, I'm adding them to avoid detecting type programmatically
+message SignedLicenseRequest {
+    enum MessageType {
+        LICENSE_REQUEST = 1;
+        LICENSE = 2;
+        ERROR_RESPONSE = 3;
+        SERVICE_CERTIFICATE_REQUEST = 4;
+        SERVICE_CERTIFICATE = 5;
+    }
+    optional MessageType Type = 1; // has in incorrect overlap with License_KeyContainer_SecurityLevel
+    optional LicenseRequest Msg = 2; // this has to be casted dynamically, to LicenseRequest, License or LicenseError (? unconfirmed), for Request, no other fields but Type need to be present
+    // for SERVICE_CERTIFICATE, only Type and Msg are present, and it's just a DeviceCertificate with CertificateType set to SERVICE
+    optional bytes Signature = 3; // might be different type of signatures (ex. RSA vs AES CMAC(??), unconfirmed for now)
+    optional bytes SessionKey = 4; // often RSA wrapped for licenses
+    optional RemoteAttestation RemoteAttestation = 5;
+}
+
+// hack
+message SignedLicenseRequestRaw {
+    enum MessageType {
+        LICENSE_REQUEST = 1;
+        LICENSE = 2;
+        ERROR_RESPONSE = 3;
+        SERVICE_CERTIFICATE_REQUEST = 4;
+        SERVICE_CERTIFICATE = 5;
+    }
+    optional MessageType Type = 1; // has in incorrect overlap with License_KeyContainer_SecurityLevel
+    optional LicenseRequestRaw Msg = 2; // this has to be casted dynamically, to LicenseRequest, License or LicenseError (? unconfirmed), for Request, no other fields but Type need to be present
+    // for SERVICE_CERTIFICATE, only Type and Msg are present, and it's just a DeviceCertificate with CertificateType set to SERVICE
+    optional bytes Signature = 3; // might be different type of signatures (ex. RSA vs AES CMAC(??), unconfirmed for now)
+    optional bytes SessionKey = 4; // often RSA wrapped for licenses
+    optional RemoteAttestation RemoteAttestation = 5;
+}
+
+
+message SignedLicense {
+    enum MessageType {
+        LICENSE_REQUEST = 1;
+        LICENSE = 2;
+        ERROR_RESPONSE = 3;
+        SERVICE_CERTIFICATE_REQUEST = 4;
+        SERVICE_CERTIFICATE = 5;
+    }
+    optional MessageType Type = 1; // has in incorrect overlap with License_KeyContainer_SecurityLevel
+    optional License Msg = 2; // this has to be casted dynamically, to LicenseRequest, License or LicenseError (? unconfirmed), for Request, no other fields but Type need to be present
+    // for SERVICE_CERTIFICATE, only Type and Msg are present, and it's just a DeviceCertificate with CertificateType set to SERVICE
+    optional bytes Signature = 3; // might be different type of signatures (ex. RSA vs AES CMAC(??), unconfirmed for now)
+    optional bytes SessionKey = 4; // often RSA wrapped for licenses
+    optional RemoteAttestation RemoteAttestation = 5;
+}
+
+message SignedServiceCertificate {
+    enum MessageType {
+        LICENSE_REQUEST = 1;
+        LICENSE = 2;
+        ERROR_RESPONSE = 3;
+        SERVICE_CERTIFICATE_REQUEST = 4;
+        SERVICE_CERTIFICATE = 5;
+    }
+    optional MessageType Type = 1; // has in incorrect overlap with License_KeyContainer_SecurityLevel
+    optional SignedDeviceCertificate Msg = 2; // this has to be casted dynamically, to LicenseRequest, License or LicenseError (? unconfirmed), for Request, no other fields but Type need to be present
+    // for SERVICE_CERTIFICATE, only Type and Msg are present, and it's just a DeviceCertificate with CertificateType set to SERVICE
+    optional bytes Signature = 3; // might be different type of signatures (ex. RSA vs AES CMAC(??), unconfirmed for now)
+    optional bytes SessionKey = 4; // often RSA wrapped for licenses
+    optional RemoteAttestation RemoteAttestation = 5;
+}
+
+//vmp support
+message FileHashes {
+   message Signature {
+     optional string filename = 1;
+     optional bool test_signing = 2; //0 - release, 1 - testing
+     optional bytes SHA512Hash = 3;
+     optional bool main_exe = 4; //0 for dlls, 1 for exe, this is field 3 in file
+     optional bytes signature = 5;
+   }
+   optional bytes signer = 1;
+   repeated Signature signatures = 2;
+}

pywidevine/cdm/formats/wv_proto3.proto

@@ -0,0 +1,389 @@
+// beware proto3 won't show missing fields it seems, need to change to "proto2" and add "optional" before every field, and remove all the dummy enum members I added:
+syntax = "proto3";
+
+// from x86 (partial), most of it from the ARM version:
+message ClientIdentification {
+  enum TokenType {
+    KEYBOX = 0;
+    DEVICE_CERTIFICATE = 1;
+    REMOTE_ATTESTATION_CERTIFICATE = 2;
+  }
+  message NameValue {
+    string Name = 1;
+    string Value = 2;
+  }
+  message ClientCapabilities {
+    enum HdcpVersion {
+      HDCP_NONE = 0;
+      HDCP_V1 = 1;
+      HDCP_V2 = 2;
+      HDCP_V2_1 = 3;
+      HDCP_V2_2 = 4;
+    }
+    uint32 ClientToken = 1;
+    uint32 SessionToken = 2;
+    uint32 VideoResolutionConstraints = 3;
+    HdcpVersion MaxHdcpVersion = 4;
+    uint32 OemCryptoApiVersion = 5;
+  }
+  TokenType Type = 1;
+  //bytes Token = 2; // by default the client treats this as blob, but it's usually a DeviceCertificate, so for usefulness sake, I'm replacing it with this one:
+  SignedDeviceCertificate Token = 2; 
+  repeated NameValue ClientInfo = 3;
+  bytes ProviderClientToken = 4;
+  uint32 LicenseCounter = 5;
+  ClientCapabilities _ClientCapabilities = 6; // how should we deal with duped names? will have to look at proto docs later
+}
+
+message DeviceCertificate {
+  enum CertificateType {
+    ROOT = 0;
+    INTERMEDIATE = 1;
+    USER_DEVICE = 2;
+    SERVICE = 3;
+  }
+  //ProvisionedDeviceInfo.WvSecurityLevel Type = 1; // is this how one is supposed to call it? (it's an enum) there might be a bug here, with CertificateType getting confused with WvSecurityLevel, for now renaming it (verify against other binaries)
+  CertificateType Type = 1;
+  bytes SerialNumber = 2; 
+  uint32 CreationTimeSeconds = 3;
+  bytes PublicKey = 4;
+  uint32 SystemId = 5;
+  uint32 TestDeviceDeprecated = 6; // is it bool or int?
+  bytes ServiceId = 7; // service URL for service certificates
+}
+
+// missing some references, 
+message DeviceCertificateStatus {
+  enum CertificateStatus {
+    VALID = 0;
+    REVOKED = 1;
+  }
+  bytes SerialNumber = 1;
+  CertificateStatus Status = 2; 
+  ProvisionedDeviceInfo DeviceInfo = 4; // where is 3? is it deprecated?
+}
+
+message DeviceCertificateStatusList {
+  uint32 CreationTimeSeconds = 1;
+  repeated DeviceCertificateStatus CertificateStatus = 2;
+}
+
+message EncryptedClientIdentification {
+  string ServiceId = 1;
+  bytes ServiceCertificateSerialNumber = 2;
+  bytes EncryptedClientId = 3;
+  bytes EncryptedClientIdIv = 4;
+  bytes EncryptedPrivacyKey = 5;
+}
+
+// todo: fill (for this top-level type, it might be impossible/difficult)
+enum LicenseType {
+  ZERO = 0;
+  DEFAULT = 1; // do not know what this is either, but should be 1; on recent versions may go up to 3 (latest x86)
+}
+
+// todo: fill (for this top-level type, it might be impossible/difficult)
+// this is just a guess because these globals got lost, but really, do we need more? 
+enum ProtocolVersion {
+  DUMMY = 0;
+  CURRENT = 21; // don't have symbols for this
+}
+
+
+message LicenseIdentification {
+  bytes RequestId = 1;
+  bytes SessionId = 2;
+  bytes PurchaseId = 3;
+  LicenseType Type = 4;
+  uint32 Version = 5;
+  bytes ProviderSessionToken = 6;
+}
+
+
+message License {
+  message Policy {
+    uint32 CanPlay = 1;
+    uint32 CanPersist = 2;
+    uint32 CanRenew = 3;
+    uint32 RentalDurationSeconds = 4;
+    uint32 PlaybackDurationSeconds = 5;
+    uint32 LicenseDurationSeconds = 6;
+    uint32 RenewalRecoveryDurationSeconds = 7;
+    string RenewalServerUrl = 8;
+    uint32 RenewalDelaySeconds = 9;
+    uint32 RenewalRetryIntervalSeconds = 10;
+    uint32 RenewWithUsage = 11;
+	uint32 UnknownPolicy12 = 12;
+  }
+  message KeyContainer {
+    enum KeyType {
+      _NOKEYTYPE = 0; // dummy, added to satisfy proto3, not present in original
+      SIGNING = 1;
+      CONTENT = 2;
+      KEY_CONTROL = 3;
+      OPERATOR_SESSION = 4;
+    }
+    enum SecurityLevel {
+      _NOSECLEVEL = 0; // dummy, added to satisfy proto3, not present in original
+      SW_SECURE_CRYPTO = 1;
+      SW_SECURE_DECODE = 2;
+      HW_SECURE_CRYPTO = 3;
+      HW_SECURE_DECODE = 4;
+      HW_SECURE_ALL = 5;
+    }
+    message OutputProtection {
+      enum CGMS {
+        COPY_FREE = 0;
+        COPY_ONCE = 2;
+        COPY_NEVER = 3;
+        CGMS_NONE = 0x2A; // PC default!
+      }
+      ClientIdentification.ClientCapabilities.HdcpVersion Hdcp = 1; // it's most likely a copy of Hdcp version available here, but compiler optimized it away
+      CGMS CgmsFlags = 2;
+    }
+    message KeyControl {
+      bytes KeyControlBlock = 1; // what is this?
+      bytes Iv = 2;
+    }
+    message OperatorSessionKeyPermissions {
+      uint32 AllowEncrypt = 1;
+      uint32 AllowDecrypt = 2;
+      uint32 AllowSign = 3;
+      uint32 AllowSignatureVerify = 4;
+    }
+    message VideoResolutionConstraint {
+      uint32 MinResolutionPixels = 1;
+      uint32 MaxResolutionPixels = 2;
+      OutputProtection RequiredProtection = 3;
+    }
+    bytes Id = 1;
+    bytes Iv = 2;
+    bytes Key = 3;
+    KeyType Type = 4;
+    SecurityLevel Level = 5;
+    OutputProtection RequiredProtection = 6;
+    OutputProtection RequestedProtection = 7;
+    KeyControl _KeyControl = 8; // duped names, etc
+    OperatorSessionKeyPermissions _OperatorSessionKeyPermissions = 9; // duped names, etc
+    repeated VideoResolutionConstraint VideoResolutionConstraints = 10;
+  }
+  LicenseIdentification Id = 1;
+  Policy _Policy = 2; // duped names, etc
+  repeated KeyContainer Key = 3;
+  uint32 LicenseStartTime = 4;
+  uint32 RemoteAttestationVerified = 5; // bool?
+  bytes ProviderClientToken = 6;
+  // there might be more, check with newer versions (I see field 7-8 in a lic)
+  // this appeared in latest x86:
+  uint32 ProtectionScheme = 7; // type unconfirmed fully, but it's likely as WidevineCencHeader describesit (fourcc)
+  bytes UnknownHdcpDataField = 8;
+}
+
+message LicenseError {
+  enum Error {
+    DUMMY_NO_ERROR = 0; // dummy, added to satisfy proto3
+    INVALID_DEVICE_CERTIFICATE = 1;
+    REVOKED_DEVICE_CERTIFICATE = 2;
+    SERVICE_UNAVAILABLE = 3;
+  }
+  //LicenseRequest.RequestType ErrorCode; // clang mismatch
+  Error ErrorCode = 1;
+}
+
+message LicenseRequest {
+  message ContentIdentification {
+    message CENC {
+      // bytes Pssh = 1; // the client's definition is opaque, it doesn't care about the contents, but the PSSH has a clear definition that is understood and requested by the server, thus I'll replace it with:
+      WidevineCencHeader Pssh = 1;
+      LicenseType LicenseType = 2; // unfortunately the LicenseType symbols are not present, acceptable value seems to only be 1
+      bytes RequestId = 3;
+    }
+    message WebM {
+      bytes Header = 1; // identical to CENC, aside from PSSH and the parent field number used
+      LicenseType LicenseType = 2;
+      bytes RequestId = 3;
+    }
+    message ExistingLicense {
+      LicenseIdentification LicenseId = 1;
+      uint32 SecondsSinceStarted = 2;
+      uint32 SecondsSinceLastPlayed = 3;
+      bytes SessionUsageTableEntry = 4;
+    }
+    CENC CencId = 1;
+    WebM WebmId = 2;
+    ExistingLicense License = 3;
+  }
+  enum RequestType {
+    DUMMY_REQ_TYPE = 0; // dummy, added to satisfy proto3
+    NEW = 1;
+    RENEWAL = 2;
+    RELEASE = 3;
+  }   
+  ClientIdentification ClientId = 1;
+  ContentIdentification ContentId = 2;
+  RequestType Type = 3;
+  uint32 RequestTime = 4;
+  bytes KeyControlNonceDeprecated = 5;
+  ProtocolVersion ProtocolVersion = 6; // lacking symbols for this
+  uint32 KeyControlNonce = 7;
+  EncryptedClientIdentification EncryptedClientId = 8;
+}
+
+message ProvisionedDeviceInfo {
+  enum WvSecurityLevel {
+    LEVEL_UNSPECIFIED = 0;
+    LEVEL_1 = 1;
+    LEVEL_2 = 2;
+    LEVEL_3 = 3;
+  }
+  uint32 SystemId = 1;
+  string Soc = 2;
+  string Manufacturer = 3;
+  string Model = 4;
+  string DeviceType = 5;
+  uint32 ModelYear = 6;
+  WvSecurityLevel SecurityLevel = 7;
+  uint32 TestDevice = 8; // bool?
+} 
+
+
+// todo: fill
+message ProvisioningOptions {
+}
+
+// todo: fill
+message ProvisioningRequest {
+}
+
+// todo: fill
+message ProvisioningResponse {
+}
+
+message RemoteAttestation {
+  EncryptedClientIdentification Certificate = 1;
+  string Salt = 2;
+  string Signature = 3;
+}
+
+// todo: fill
+message SessionInit {
+}
+
+// todo: fill
+message SessionState {
+}
+
+// todo: fill
+message SignedCertificateStatusList {
+}
+
+message SignedDeviceCertificate {
+  
+  //bytes DeviceCertificate = 1; // again, they use a buffer where it's supposed to be a message, so we'll replace it with what it really is:
+  DeviceCertificate _DeviceCertificate = 1; // how should we deal with duped names? will have to look at proto docs later
+  bytes Signature = 2;
+  SignedDeviceCertificate Signer = 3;
+}
+
+
+// todo: fill
+message SignedProvisioningMessage {
+}
+
+// the root of all messages, from either server or client
+message SignedMessage {
+  enum MessageType {
+    DUMMY_MSG_TYPE = 0; // dummy, added to satisfy proto3
+    LICENSE_REQUEST = 1;
+    LICENSE = 2;
+    ERROR_RESPONSE = 3;
+    SERVICE_CERTIFICATE_REQUEST = 4;
+    SERVICE_CERTIFICATE = 5;
+  }
+  MessageType Type = 1; // has in incorrect overlap with License_KeyContainer_SecurityLevel
+  bytes Msg = 2; // this has to be casted dynamically, to LicenseRequest, License or LicenseError (? unconfirmed), for Request, no other fields but Type need to be present
+                 // for SERVICE_CERTIFICATE, only Type and Msg are present, and it's just a DeviceCertificate with CertificateType set to SERVICE
+  bytes Signature = 3; // might be different type of signatures (ex. RSA vs AES CMAC(??), unconfirmed for now)
+  bytes SessionKey = 4; // often RSA wrapped for licenses
+  RemoteAttestation RemoteAttestation = 5;
+}
+
+
+
+// This message is copied from google's docs, not reversed:
+message WidevineCencHeader {
+  enum Algorithm {
+    UNENCRYPTED = 0;
+    AESCTR = 1;
+  };
+  Algorithm algorithm = 1;
+  repeated bytes key_id = 2;
+
+  // Content provider name.
+  string provider = 3;
+
+  // A content identifier, specified by content provider.
+  bytes content_id = 4;
+
+  // Track type. Acceptable values are SD, HD and AUDIO. Used to
+  // differentiate content keys used by an asset.
+  string track_type_deprecated = 5;
+
+  // The name of a registered policy to be used for this asset.
+  string policy = 6;
+
+  // Crypto period index, for media using key rotation.
+  uint32 crypto_period_index = 7;
+
+  // Optional protected context for group content. The grouped_license is a
+  // serialized SignedMessage.
+  bytes grouped_license = 8;
+
+  // Protection scheme identifying the encryption algorithm.
+  // Represented as one of the following 4CC values:
+  // 'cenc' (AESCTR), 'cbc1' (AESCBC),
+  // 'cens' (AESCTR subsample), 'cbcs' (AESCBC subsample).
+  uint32 protection_scheme = 9;
+
+  // Optional. For media using key rotation, this represents the duration
+  // of each crypto period in seconds.
+  uint32 crypto_period_seconds = 10;
+}
+
+
+
+
+// from here on, it's just for testing, these messages don't exist in the binaries, I'm adding them to avoid detecting type programmatically
+message SignedLicenseRequest {
+  enum MessageType {
+    DUMMY_MSG_TYPE = 0; // dummy, added to satisfy proto3
+    LICENSE_REQUEST = 1;
+    LICENSE = 2;
+    ERROR_RESPONSE = 3;
+    SERVICE_CERTIFICATE_REQUEST = 4;
+    SERVICE_CERTIFICATE = 5;
+  }
+  MessageType Type = 1; // has in incorrect overlap with License_KeyContainer_SecurityLevel
+  LicenseRequest Msg = 2; // this has to be casted dynamically, to LicenseRequest, License or LicenseError (? unconfirmed), for Request, no other fields but Type need to be present
+                 // for SERVICE_CERTIFICATE, only Type and Msg are present, and it's just a DeviceCertificate with CertificateType set to SERVICE
+  bytes Signature = 3; // might be different type of signatures (ex. RSA vs AES CMAC(??), unconfirmed for now)
+  bytes SessionKey = 4; // often RSA wrapped for licenses
+  RemoteAttestation RemoteAttestation = 5;
+}
+
+message SignedLicense {
+  enum MessageType {
+    DUMMY_MSG_TYPE = 0; // dummy, added to satisfy proto3
+    LICENSE_REQUEST = 1;
+    LICENSE = 2;
+    ERROR_RESPONSE = 3;
+    SERVICE_CERTIFICATE_REQUEST = 4;
+    SERVICE_CERTIFICATE = 5;
+  }
+  MessageType Type = 1; // has in incorrect overlap with License_KeyContainer_SecurityLevel
+  License Msg = 2; // this has to be casted dynamically, to LicenseRequest, License or LicenseError (? unconfirmed), for Request, no other fields but Type need to be present
+                 // for SERVICE_CERTIFICATE, only Type and Msg are present, and it's just a DeviceCertificate with CertificateType set to SERVICE
+  bytes Signature = 3; // might be different type of signatures (ex. RSA vs AES CMAC(??), unconfirmed for now)
+  bytes SessionKey = 4; // often RSA wrapped for licenses
+  RemoteAttestation RemoteAttestation = 5;
+}

pywidevine/cdm/key.py

@@ -0,0 +1,15 @@
+import binascii
+
+
+class Key:
+    def __init__(self, kid, type, key, permissions=[]):
+        self.kid = kid
+        self.type = type
+        self.key = key
+        self.permissions = permissions
+
+    def __repr__(self):
+        if self.type == "OPERATOR_SESSION":
+            return "key(kid={}, type={}, key={}, permissions={})".format(binascii.hexlify(self.kid), self.type, binascii.hexlify(self.key), self.permissions)
+        else:
+            return "key(kid={}, type={}, key={})".format(binascii.hexlify(self.kid), self.type, binascii.hexlify(self.key))

pywidevine/cdm/session.py

@@ -0,0 +1,18 @@
+class Session:
+    def __init__(self, session_id, init_data, device_config, offline):
+        self.session_id = session_id
+        self.init_data = init_data
+        self.offline = offline
+        self.device_config = device_config
+        self.device_key = None
+        self.session_key = None
+        self.derived_keys = {
+            'enc': None,
+            'auth_1': None,
+            'auth_2': None
+        }
+        self.license_request = None
+        self.license = None
+        self.service_certificate = None
+        self.privacy_mode = False
+        self.keys = []

pywidevine/cdm/vmp.py

@@ -0,0 +1,102 @@
+try:
+  from google.protobuf.internal.decoder import _DecodeVarint as _di # this was tested to work with protobuf 3, but it's an internal API (any varint decoder might work)
+except ImportError:
+  # this is generic and does not depend on pb internals, however it will decode "larger" possible numbers than pb decoder which has them fixed
+  def LEB128_decode(buffer, pos, limit = 64):
+    result = 0
+    shift = 0
+    while True:
+      b = buffer[pos]
+      pos += 1  
+      result |= ((b & 0x7F) << shift)
+      if not (b & 0x80): 
+         return (result, pos)
+      shift += 7
+      if shift > limit: 
+         raise Exception("integer too large, shift: {}".format(shift))
+  _di = LEB128_decode
+
+
+class FromFileMixin:
+  @classmethod
+  def from_file(cls, filename):
+    """Load given a filename"""
+    with open(filename,"rb") as f:
+      return cls(f.read())
+
+# the signatures use a format internally similar to 
+# protobuf's encoding, but without wire types
+class VariableReader(FromFileMixin):
+  """Protobuf-like encoding reader"""
+
+  def __init__(self, buf):
+      self.buf = buf
+      self.pos = 0
+      self.size = len(buf)
+ 
+  def read_int(self):
+    """Read a variable length integer"""
+    # _DecodeVarint will take care of out of range errors
+    (val, nextpos) = _di(self.buf, self.pos)
+    self.pos = nextpos
+    return val
+
+  def read_bytes_raw(self, size):      
+    """Read size bytes"""
+    b = self.buf[self.pos:self.pos+size]
+    self.pos += size
+    return b
+
+  def read_bytes(self):
+    """Read a bytes object""" 
+    size = self.read_int()
+    return self.read_bytes_raw(size)
+
+  def is_end(self):
+    return (self.size == self.pos)
+
+   
+class TaggedReader(VariableReader):
+  """Tagged reader, needed for implementing a WideVine signature reader"""
+
+  def read_tag(self):
+    """Read a tagged buffer"""
+    return (self.read_int(), self.read_bytes())
+
+  def read_all_tags(self, max_tag=3):
+      tags = {}
+      while (not self.is_end()):
+        (tag, bytes) = self.read_tag()
+        if (tag > max_tag):
+           raise IndexError("tag out of bound: got {}, max {}".format(tag, max_tag))
+
+        tags[tag] = bytes
+      return tags
+
+class WideVineSignatureReader(FromFileMixin):
+  """Parses a widevine .sig signature file."""
+
+  SIGNER_TAG = 1
+  SIGNATURE_TAG = 2
+  ISMAINEXE_TAG = 3
+
+  def __init__(self, buf):
+      reader = TaggedReader(buf)
+      self.version = reader.read_int()
+      if (self.version != 0):
+         raise Exception("Unsupported signature format version {}".format(self.version))
+      self.tags = reader.read_all_tags()
+
+      self.signer = self.tags[self.SIGNER_TAG]
+      self.signature = self.tags[self.SIGNATURE_TAG]
+
+      extra = self.tags[self.ISMAINEXE_TAG]
+      if (len(extra) != 1 or (extra[0] > 1)):
+         raise Exception("Unexpected 'ismainexe' field value (not '\\x00' or '\\x01'), please check: {0}".format(extra))
+      
+      self.mainexe = bool(extra[0])
+
+  @classmethod
+  def get_tags(cls, filename):
+    """Return a dictionary of each tag in the signature file"""
+    return cls.from_file(filename).tags

pywidevine/clients/dictionary.py

@@ -0,0 +1,44 @@
+import re
+from unidecode import unidecode
+
+def get_release_tag(default_filename, vcodec, video_height, acodec, channels, bitrate, module, tag, isDual):
+    video_codec = ''
+
+    if 'avc' in vcodec:
+        video_codec = 'x264'
+    if 'hvc' in vcodec:
+        video_codec = 'x265'
+    elif 'dvh' in vcodec:
+        video_codec = 'HDR'
+    if isDual==True:
+        video_codec = video_codec + '.DUAL'
+        
+    audio_codec = ''
+    if 'mp4a' in acodec:
+        audio_codec = 'AAC'
+    if acodec == 'ac-3':
+        audio_codec = 'DD'
+    if acodec == 'ec-3':
+        audio_codec = 'DDP'
+    elif acodec == 'ec-3' and bitrate > 700000:
+        audio_codec = 'Atmos'
+
+    audio_channels = ''
+    if channels == '2':
+        audio_channels = '2.0'
+    elif channels == '6':
+        audio_channels = '5.1'
+    audio_format = audio_codec + audio_channels
+        
+    #if isDual==True:
+    #    audio_format = audio_codec + '.DUAL'
+    
+
+    default_filename = default_filename.replace('&', '.and.')
+    default_filename = re.sub(r'[]!"#$%\'()*+,:;<=>?@\\^_`{|}~[-]', '', default_filename)
+    default_filename = default_filename.replace(' ', '.')
+    default_filename = re.sub(r'\.{2,}', '.', default_filename)
+    default_filename = unidecode(default_filename)
+
+    output_name = '{}.{}p.{}.WEB-DL.{}.{}-{}'.format(default_filename, video_height, str(module), audio_format, video_codec, tag)
+    return output_name

pywidevine/clients/paramountplus/config.py

@@ -0,0 +1,35 @@
+from shutil import which
+from os.path import dirname, realpath, join
+from os import pathsep, environ
+
+SCRIPT_PATH = dirname(realpath('paramountplus'))
+
+BINARIES_FOLDER = join(SCRIPT_PATH, 'binaries')
+
+MP4DECRYPT_BINARY = 'mp4decrypt'
+MEDIAINFO_BINARY = 'mediainfo'
+MP4DUMP_BINARY = 'mp4dump'
+MKVMERGE_BINARY = 'mkvmerge'
+FFMPEG_BINARY = 'ffmpeg'
+FFMPEG_BINARY = 'ffmpeg'
+ARIA2C_BINARY = 'aria2c'
+SUBTITLE_EDIT_BINARY = 'subtitleedit'
+
+# Add binaries folder to PATH as the first item
+environ['PATH'] = pathsep.join([BINARIES_FOLDER, environ['PATH']])
+
+MP4DECRYPT = which(MP4DECRYPT_BINARY)
+MEDIAINFO = which(MEDIAINFO_BINARY)
+MP4DUMP = which(MP4DUMP_BINARY)
+MKVMERGE = which(MKVMERGE_BINARY)
+FFMPEG = which(FFMPEG_BINARY)
+ARIA2C = which(ARIA2C_BINARY)
+SUBTITLE_EDIT = which(SUBTITLE_EDIT_BINARY)
+
+class WvDownloaderConfig(object):
+    def __init__(self, xml, base_url, output_file, track_id, format_id):
+        self.xml = xml
+        self.base_url = base_url
+        self.output_file = output_file
+        self.track_id = track_id
+        self.format_id = format_id

pywidevine/clients/paramountplus/downloader.py

@@ -0,0 +1,116 @@
+import requests, pathlib
+import math, subprocess
+import os, sys, shutil
+
+class WvDownloader(object):
+    def __init__(self, config):
+        self.xml = config.xml
+        self.output_file = config.output_file
+        self.config = config
+
+    def download_track(self, aria2c_infile, file_name):
+        aria2c_opts = [
+                'aria2c',
+                '--enable-color=false',
+                '--allow-overwrite=true',
+                '--summary-interval=0',
+                '--download-result=hide',
+                '--async-dns=false',
+                '--check-certificate=false',
+                '--auto-file-renaming=false',
+                '--file-allocation=none',
+                '--console-log-level=warn',
+                '-x16', '-s16', '-j16',
+                '-i', aria2c_infile]
+        subprocess.run(aria2c_opts)
+                
+        source_files = pathlib.Path(temp_folder).rglob(r'./*.mp4')
+        with open(file_name, mode='wb') as (destination):
+            for file in source_files:
+                with open(file, mode='rb') as (source):
+                    shutil.copyfileobj(source, destination)
+        if os.path.exists(temp_folder):
+            shutil.rmtree(temp_folder)
+        os.remove(aria2c_infile)
+        print('\nDone!')
+
+    def process_url_templace(self, template, representation_id, bandwidth, time, number):
+        if representation_id is not None: result = template.replace('$RepresentationID$', representation_id)
+        if number is not None:
+            nstart = result.find('$Number')
+            if nstart >= 0:
+                nend = result.find('$', nstart+1)
+                if nend >= 0:
+                    var = result[nstart+1 : nend]
+                    if 'Number%' in var:
+                        value = var[6:] % (int(number))
+                    else:
+                        value = number
+                    result = result.replace('$'+var+'$', value)
+        if bandwidth is not None:         result = result.replace('$Bandwidth$', bandwidth)
+        if time is not None:              result = result.replace('$Time$', time)
+        result = result.replace('$$', '$').replace('../', '')
+        return result
+
+    def generate_segments(self):
+        segment_template = self.get_segment_template()
+        return self.get_segments(segment_template)
+
+    def get_segments(self, segment_template):
+        urls = []
+        urls.append(self.config.base_url + segment_template['@initialization'].replace('$RepresentationID$', self.config.format_id))
+        current_number = 1
+        for seg in self.force_segmentimeline(segment_template):
+            if '@t' in seg:
+                current_time = seg['@t']
+            for i in range(int(seg.get('@r', 0)) + 1):
+                urls.append(self.config.base_url + self.process_url_templace(segment_template['@media'], 
+                            representation_id=self.config.format_id,
+                            bandwidth=None, time=str(current_time), number=str(current_number)))
+                current_number += 1
+                current_time += seg['@d']
+        return urls
+
+    def force_segmentimeline(self, segment_timeline):
+        if isinstance(segment_timeline['SegmentTimeline']['S'], list):
+            x16 = segment_timeline['SegmentTimeline']['S']
+        else:
+            x16 = [segment_timeline['SegmentTimeline']['S']]
+        return x16
+
+    def force_instance(self, x):
+        if isinstance(x['Representation'], list):
+            X = x['Representation']
+        else:
+            X = [x['Representation']]
+        return X
+
+    def get_segment_template(self):
+        x = [item for (i, item) in enumerate(self.xml['MPD']['Period']['AdaptationSet']) if self.config.track_id == item["@id"]][0]
+        segment_level = [item['SegmentTemplate'] for (i, item) in enumerate(self.force_instance(x)) if self.config.format_id == item["@id"]][0]
+        return segment_level
+
+    def run(self):
+        urls = self.generate_segments()
+
+        print('\n' + self.output_file)
+        global temp_folder
+        aria2c_infile = 'aria2c_infile.txt'
+        if os.path.isfile(aria2c_infile): 
+            os.remove(aria2c_infile)
+        temp_folder = self.output_file.replace('.mp4', '')
+        if os.path.exists(temp_folder): 
+            shutil.rmtree(temp_folder)
+        if not os.path.exists(temp_folder):
+            os.makedirs(temp_folder)
+
+        if len(urls) > 1:
+            num_segments = int(math.log10(len(urls))) + 1
+        with open(aria2c_infile, 'a', encoding='utf8') as (file):
+            for (i, url) in enumerate(urls):
+                file.write(f'{url}\n')
+                file.write(f'\tout={temp_folder}.{i:0{num_segments}d}.mp4\n')
+                file.write(f'\tdir={temp_folder}\n')
+                file.flush()
+        self.download_track(aria2c_infile, self.output_file)
+        print('Done!')

pywidevine/clients/proxy_config.py

@@ -0,0 +1,15 @@
+
+config = {
+    'proxies': {
+        'none': None
+    },
+}
+
+class ProxyConfig(object):
+    def __init__(self, proxies):
+        self.config = config
+        self.config['proxies'] = proxies
+
+    def get_proxy(self, proxy):
+        return self.config['proxies'].get(proxy)
+

pywidevine/decrypt/wvdecrypt.py

@@ -0,0 +1,53 @@
+import logging, subprocess, re, base64
+from pywidevine.cdm import cdm, deviceconfig
+
+class WvDecrypt(object):
+    WV_SYSTEM_ID = [
+     237, 239, 139, 169, 121, 214, 74, 206, 163, 200, 39, 220, 213, 29, 33, 237]
+
+    def __init__(self, init_data_b64, cert_data_b64):
+        self.init_data_b64 = init_data_b64
+        self.cert_data_b64 = cert_data_b64
+        self.cdm = cdm.Cdm()
+
+        def check_pssh(pssh_b64):
+            pssh = base64.b64decode(pssh_b64)
+            if not pssh[12:28] == bytes(self.WV_SYSTEM_ID):
+                new_pssh = bytearray([0, 0, 0])
+                new_pssh.append(32 + len(pssh))
+                new_pssh[4:] = bytearray(b'pssh')
+                new_pssh[8:] = [0, 0, 0, 0]
+                new_pssh[13:] = self.WV_SYSTEM_ID
+                new_pssh[29:] = [0, 0, 0, 0]
+                new_pssh[31] = len(pssh)
+                new_pssh[32:] = pssh
+                return base64.b64encode(new_pssh)
+            else:
+                return pssh_b64
+
+        self.session = self.cdm.open_session(check_pssh(self.init_data_b64), deviceconfig.DeviceConfig(deviceconfig.device_android_generic))
+        if self.cert_data_b64:
+            self.cdm.set_service_certificate(self.session, self.cert_data_b64)
+
+    def log_message(self, msg):
+        return ('{}').format(msg)
+
+    def start_process(self):
+        keyswvdecrypt = []
+        try:
+            for key in self.cdm.get_keys(self.session):
+                if key.type == 'CONTENT':
+                    keyswvdecrypt.append(self.log_message('{}:{}'.format(key.kid.hex(),key.key.hex())))
+        except Exception:
+            return (
+             False, keyswvdecrypt)
+
+        return (
+         True, keyswvdecrypt)
+
+    def get_challenge(self):
+        return self.cdm.get_license_request(self.session)
+
+    def update_license(self, license_b64):
+        self.cdm.provide_license(self.session, license_b64)
+        return True

pywidevine/decrypt/wvdecryptcustom.py

@@ -0,0 +1,59 @@
+# uncompyle6 version 3.7.3
+# Python bytecode 3.6 (3379)
+# Decompiled from: Python 3.7.8 (tags/v3.7.8:4b47a5b6ba, Jun 28 2020, 08:53:46) [MSC v.1916 64 bit (AMD64)]
+# Embedded file name: pywidevine\decrypt\wvdecryptcustom.py
+import logging, subprocess, re, base64
+from pywidevine.cdm import cdm, deviceconfig
+
+class WvDecrypt(object):
+    WV_SYSTEM_ID = [
+     237, 239, 139, 169, 121, 214, 74, 206, 163, 200, 39, 220, 213, 29, 33, 237]
+
+    def __init__(self, init_data_b64, cert_data_b64, device):
+        self.init_data_b64 = init_data_b64
+        self.cert_data_b64 = cert_data_b64
+        self.device = device
+        self.cdm = cdm.Cdm()
+
+        def check_pssh(pssh_b64):
+            pssh = base64.b64decode(pssh_b64)
+            if not pssh[12:28] == bytes(self.WV_SYSTEM_ID):
+                new_pssh = bytearray([0, 0, 0])
+                new_pssh.append(32 + len(pssh))
+                new_pssh[4:] = bytearray(b'pssh')
+                new_pssh[8:] = [0, 0, 0, 0]
+                new_pssh[13:] = self.WV_SYSTEM_ID
+                new_pssh[29:] = [0, 0, 0, 0]
+                new_pssh[31] = len(pssh)
+                new_pssh[32:] = pssh
+                return base64.b64encode(new_pssh)
+            else:
+                return pssh_b64
+
+        self.session = self.cdm.open_session(check_pssh(self.init_data_b64), deviceconfig.DeviceConfig(self.device))
+        if self.cert_data_b64:
+            self.cdm.set_service_certificate(self.session, self.cert_data_b64)
+
+    def log_message(self, msg):
+        return '{}'.format(msg)
+
+    def start_process(self):
+        keyswvdecrypt = []
+        try:
+            for key in self.cdm.get_keys(self.session):
+                if key.type == 'CONTENT':
+                    keyswvdecrypt.append(self.log_message('{}:{}'.format(key.kid.hex(), key.key.hex())))
+
+        except Exception:
+            return (
+             False, keyswvdecrypt)
+        else:
+            return (
+             True, keyswvdecrypt)
+
+    def get_challenge(self):
+        return self.cdm.get_license_request(self.session)
+
+    def update_license(self, license_b64):
+        self.cdm.provide_license(self.session, license_b64)
+        return True

pywidevine/muxer/muxer.py

@@ -0,0 +1,271 @@
+# -*- coding: utf-8 -*-
+import os
+import subprocess
+
+class Muxer(object):
+	def __init__(self, CurrentName, SeasonFolder, CurrentHeigh, Type, mkvmergeexe):
+		self.CurrentName = CurrentName
+		self.SeasonFolder = SeasonFolder
+		self.CurrentHeigh = CurrentHeigh
+		self.Type = Type
+		self.mkvmergeexe = mkvmergeexe
+
+	def mkvmerge_muxer(self, lang):
+		VideoInputNoExist = False
+		if os.path.isfile(self.CurrentName + ' [' + self.CurrentHeigh + 'p] [CBR].h264'):
+			VideoInputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p] [CBR].h264'
+			if self.Type == "show":
+				VideoOutputName = os.path.join(self.SeasonFolder, self.CurrentName + ' [' + self.CurrentHeigh + 'p] [CBR].mkv')
+			else:
+				VideoOutputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p] [CBR].mkv'
+
+		if os.path.isfile(self.CurrentName + ' [' + self.CurrentHeigh + 'p].h264'):
+			VideoInputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p].h264'
+			if self.Type == "show":
+				VideoOutputName = os.path.join(self.SeasonFolder, self.CurrentName + ' [' + self.CurrentHeigh + 'p].mkv')
+			else:
+				VideoOutputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p].mkv'
+
+		elif os.path.isfile(self.CurrentName + ' [' + self.CurrentHeigh + 'p] [HEVC].mp4'):
+			VideoInputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p] [HEVC].mp4'
+			if self.Type == "show":
+				VideoOutputName = os.path.join(self.SeasonFolder, self.CurrentName + ' [' + self.CurrentHeigh + 'p] [HEVC].mkv')
+			else:
+				VideoOutputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p] [HEVC].mkv'
+
+		elif os.path.isfile(self.CurrentName + ' [' + self.CurrentHeigh + 'p] [HEVC].h265'):
+			VideoInputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p] [HEVC].h265'
+			if self.Type == "show":
+				VideoOutputName = os.path.join(self.SeasonFolder, self.CurrentName + ' [' + self.CurrentHeigh + 'p] [HEVC].mkv')
+			else:
+				VideoOutputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p] [HEVC].mkv'
+
+		elif os.path.isfile(self.CurrentName + ' [' + self.CurrentHeigh + 'p] [VP9].mp4'):
+			VideoInputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p] [VP9].mp4'
+			if self.Type == "show":
+				VideoOutputName = os.path.join(self.SeasonFolder, self.CurrentName + ' [' + self.CurrentHeigh + 'p] [VP9].mkv')
+			else:
+				VideoOutputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p] [VP9].mkv'
+
+		elif os.path.isfile(self.CurrentName + ' [' + self.CurrentHeigh + 'p] [VP9].vp9'):
+			VideoInputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p] [VP9].vp9'
+			if self.Type == "show":
+				VideoOutputName = os.path.join(self.SeasonFolder, self.CurrentName + ' [' + self.CurrentHeigh + 'p] [VP9].mkv')
+			else:
+				VideoOutputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p] [VP9].mkv'
+
+		elif os.path.isfile(self.CurrentName + ' [' + self.CurrentHeigh + 'p] [HDR].mp4'):
+			VideoInputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p] [HDR].mp4'
+			if self.Type == "show":
+				VideoOutputName = os.path.join(self.SeasonFolder, self.CurrentName + ' [' + self.CurrentHeigh + 'p] [HDR].mkv')
+			else:
+				VideoOutputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p] [HDR].mkv'
+
+		elif os.path.isfile(self.CurrentName + ' [' + self.CurrentHeigh + 'p] [HDR].h265'):
+			VideoInputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p] [HDR].h265'
+			if self.Type == "show":
+				VideoOutputName = os.path.join(self.SeasonFolder, self.CurrentName + ' [' + self.CurrentHeigh + 'p] [HDR].mkv')
+			else:
+				VideoOutputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p] [HDR].mkv'
+
+		elif os.path.isfile(self.CurrentName + ' [' + self.CurrentHeigh + 'p] [AVC HIGH].mp4'):
+			VideoInputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p] [AVC HIGH].mp4'
+			if self.Type == "show":
+				VideoOutputName = os.path.join(self.SeasonFolder, self.CurrentName + ' [' + self.CurrentHeigh + 'p] [AVC HIGH].mkv')
+			else:
+				VideoOutputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p] [AVC HIGH].mkv'
+
+		elif os.path.isfile(self.CurrentName + ' [' + self.CurrentHeigh + 'p] [AVC HIGH].h264'):
+			VideoInputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p] [AVC HIGH].h264'
+			if self.Type == "show":
+				VideoOutputName = os.path.join(self.SeasonFolder, self.CurrentName + ' [' + self.CurrentHeigh + 'p] [AVC HIGH].mkv')
+			else:
+				VideoOutputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p] [AVC HIGH].mkv'
+
+		elif os.path.isfile(self.CurrentName + ' [' + self.CurrentHeigh + 'p] [CBR].mp4'):
+			VideoInputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p] [CBR].mp4'
+			if self.Type == "show":
+				VideoOutputName = os.path.join(self.SeasonFolder, self.CurrentName + ' [' + self.CurrentHeigh + 'p] [CBR].mkv')
+			else:
+				VideoOutputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p] [CBR].mkv'
+		
+		elif os.path.isfile(self.CurrentName + ' [' + self.CurrentHeigh + 'p].mp4'):
+			VideoInputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p].mp4'
+			if self.Type == "show":
+				VideoOutputName = os.path.join(self.SeasonFolder, self.CurrentName + ' [' + self.CurrentHeigh + 'p].mkv')
+			else:
+				VideoOutputName = self.CurrentName + ' [' + self.CurrentHeigh + 'p].mkv'
+		else:
+			VideoInputNoExist = True
+
+		if VideoInputNoExist == False:
+			AudioExtensionsList=[
+									".ac3",
+									".mka",
+									".eac3",
+									".m4a",
+									".dts",
+									".mp3",
+									".aac"
+								]
+			
+			SubsExtensionsList= [
+									".srt",
+									".ass",
+								]
+
+			if lang == "English":
+				language_tag = "English"
+			
+			if language_tag == "English":
+				subs_forced = 'Forced'
+				subs_sdh = 'SDH'
+				#["en", "en", "eng", "English", "yes", "yes"]
+				#[audio_language, subs_language, language_id, language_name, audio_default, subs_default]
+				LanguageList = [
+									["es-la", "es-la", "spa", "Spanish", "yes", "no"],
+									["es", "es", "spa", "Castilian", "no", "no"],
+                                                                        ["en", "en", "eng", "English", "no", "no"],
+									["pt-BR", "pt-BR", "por", "Brazilian Portuguese", "no", "no"],
+									["cat", "cat", "cat", "Catalan", "no", "no"],
+									["eu", "eu", "baq", "Basque", "no", "no"],
+									["fr", "fr", "fre", "French", "no", "no"],
+									["fr-bg", "fr-bg", "fre", "French (Belgium)", "no", "no"],
+									["fr-lu", "fr-lu", "fre", "French (Luxembourg)", "no", "no"],
+									["fr-ca", "fr-ca", "fre", "French (Canada)", "no", "no"],
+									["de", "de", "ger", "German", "no", "no"],
+									["it", "it", "ita", "Italian", "no", "no"],
+									["pl", "pl", "pol", "Polish", "no", "no"],
+									["tr", "tr", "tur", "Turkish", "no", "no"],
+									["hy", "hy", "arm", "Armenian", "no", "no"],
+									["sv", "sv", "swe", "Swedish", "no", "no"],
+									["da", "da", "dan", "Danish", "no", "no"],
+									["fi", "fi", "fin", "Finnish", "no", "no"],
+									["nl", "nl", "dut", "Dutch", "no", "no"],
+									["nl-be", "nl-be", "dut", "Flemish", "no", "no"],
+									["no", "no", "nor", "Norwegian", "no", "no"],
+									["lv", "lv", "lav", "Latvian", "no", "no"],
+									["is", "is", "ice", "Icelandic", "no", "no"],
+									["ru", "ru", "rus", "Russian", "no", "no"],
+									["uk", "uk", "ukr", "Ukrainian", "no", "no"],
+									["hu", "hu", "hun", "Hungarian", "no", "no"],
+									["bg", "bg", "bul", "Bulgarian", "no", "no"],
+									["hr", "hr", "hrv", "Croatian", "no", "no"],
+									["lt", "lt", "lit", "Lithuanian", "no", "no"],
+									["et", "et", "est", "Estonian", "no", "no"],
+									["el", "el", "gre", "Greek", "no", "no"],
+									["he", "he", "heb", "Hebrew", "no", "no"],
+									["ar", "ar", "ara", "Arabic", "no", "no"],
+									["fa", "fa", "per", "Persian", "no", "no"],
+									["ro", "ro", "rum", "Romanian", "no", "no"],
+									["sr", "sr", "srp", "Serbian", "no", "no"],
+									["cs", "cs", "cze", "Czech", "no", "no"],
+									["sk", "sk", "slo", "Slovak", "no", "no"],
+									["sl", "sl", "slv", "Slovenian", "no", "no"],
+									["sq", "sq", "alb", "Albanian", "no", "no"],
+									["bs", "bs", "bos", "Bosnian", "no", "no"],
+									["mk", "mk", "mac", "Macedonian", "no", "no"],
+									["hi", "hi", "hin", "Hindi", "no", "no"],
+									["bn", "bn", "ben", "Bengali", "no", "no"],
+									["ur", "ur", "urd", "Urdu", "no", "no"],
+									["pa", "pa", "pan", "Punjabi", "no", "no"],
+									["ta", "ta", "tam", "Tamil", "no", "no"],
+									["te", "te", "tel", "Telugu", "no", "no"],
+									["mr", "mr", "mar", "Marathi", "no", "no"],
+									["kn", "kn", "kan", "Kannada (India)", "no", "no"],
+									["gu", "gu", "guj", "Gujarati", "no", "no"],
+									["ml", "ml", "mal", "Malayalam", "no", "no"],
+									["si", "si", "sin", "Sinhala", "no", "no"],
+									["as", "as", "asm", "Assamese", "no", "no"],
+									["mni", "mni", "mni", "Manipuri", "no", "no"],
+									["tl", "tl", "tgl", "Tagalog", "no", "no"],
+									["id", "id", "ind", "Indonesian", "no", "no"],
+									["ms", "ms", "may", "Malay", "no", "no"],
+									["fil", "fil", "fil", "Filipino", "no", "no"],
+									["vi", "vi", "vie", "Vietnamese", "no", "no"],
+									["th", "th", "tha", "Thai", "no", "no"],
+									["km", "km", "khm", "Khmer", "no", "no"],
+									["ko", "ko", "kor", "Korean", "no", "no"],
+									["zh", "zh", "chi", "Mandarin", "no", "no"],
+									["yue", "yue", "chi", "Cantonese", "no", "no"],
+									["zh-hans", "zh-hans", "chi", "Chinese (Simplified)", "no", "no"],
+									["zh-hant", "zh-hant", "chi", "Chinese (Traditional)", "no", "no"],
+									["zh-hk", "zh-hk", "chi", "Chinese (Simplified)", "no", "no"],
+									["zh-tw", "zh-tw", "chi", "Chinese (Traditional)", "no", "no"],
+									["zh-sg", "zh-sg", "chi", "Chinese (Singapore)", "no", "no"],
+									["ja", "ja", "jpn", "Japanese", "no", "no"],
+									["tlh", "tlh", "tlh", "Klingon", "no", "no"],
+									["zxx", "zxx", "zxx", "No Dialogue", "no", "no"]
+								]
+
+			ALLAUDIOS = []
+			default_active_audio = False
+			for audio_language, subs_language, language_id, language_name, audio_default, subs_default in LanguageList:
+				for AudioExtension in AudioExtensionsList:
+					if os.path.isfile(self.CurrentName + ' (' + audio_language + ')' + AudioExtension):
+						if default_active_audio == True: audio_default = "no"
+						ALLAUDIOS = ALLAUDIOS + ['--language', '0:' + audio_language, '--track-name', '0:' + language_name, '--default-track', '0:' + audio_default, '(', self.CurrentName + ' (' + audio_language + ')' + AudioExtension, ')']
+						if audio_default == "yes": default_active_audio = True
+
+			for audio_language, subs_language, language_id, language_name, audio_default, subs_default in LanguageList:
+				for AudioExtension in AudioExtensionsList:
+					if os.path.isfile(self.CurrentName + ' (' + audio_language + '-ad)' + AudioExtension):
+						if default_active_audio == True: audio_default = "no"
+						ALLAUDIOS = ALLAUDIOS + ['--language', '0:' + audio_language, '--track-name', '0:' + language_name + ' (Audio Description)', '--default-track', '0:no', '(', self.CurrentName + ' (' + audio_language + '-ad)' + AudioExtension, ')']
+						if audio_default == "yes": default_active_audio = True
+
+			OnlyOneLanguage = False
+			if len(ALLAUDIOS) == 9:
+				OnlyOneLanguage = True
+			
+			elif len(ALLAUDIOS) == 18:
+				if ALLAUDIOS[1] == ALLAUDIOS[10]:
+					if '-ad' in ALLAUDIOS[7] or '-ad' in ALLAUDIOS[16]:
+						OnlyOneLanguage = True
+			else:
+				OnlyOneLanguage = False
+
+
+			ALLSUBS = []
+			default_active_subs = False
+			for audio_language, subs_language, language_id, language_name, audio_default, subs_default in LanguageList:
+				for SubsExtension in SubsExtensionsList:
+					if os.path.isfile(self.CurrentName + ' (' + subs_language + '-forced)' + SubsExtension):
+						if subs_default == "yes": default_active_subs = True
+						ALLSUBS = ALLSUBS + ['--language', '0:' + language_id, '--track-name', '0:' + subs_forced, '--forced-track', '0:yes', '--default-track', '0:' + subs_default, '--compression', '0:none', '(', self.CurrentName + ' (' + subs_language + '-forced)' + SubsExtension, ')']
+					
+					if OnlyOneLanguage == True:
+						if default_active_subs == True: subs_default = "no"
+						if os.path.isfile(self.CurrentName + ' (' + subs_language + ')' + SubsExtension):
+							ALLSUBS = ALLSUBS + ['--language', '0:' + language_id, '--forced-track', '0:no', '--default-track', '0:' + subs_default, '--compression', '0:none', '(', self.CurrentName + ' (' + subs_language + ')' + SubsExtension, ')']
+					
+					else:
+						if os.path.isfile(self.CurrentName + ' (' + subs_language + ')' + SubsExtension):
+							ALLSUBS = ALLSUBS + ['--language', '0:' + language_id, '--forced-track', '0:no', '--default-track', '0:no', '--compression', '0:none', '(', self.CurrentName + ' (' + subs_language + ')' + SubsExtension, ')']
+
+					if os.path.isfile(self.CurrentName + ' (' + subs_language + '-sdh)' + SubsExtension):
+						ALLSUBS = ALLSUBS + ['--language', '0:' + language_id, '--track-name', '0:' + subs_sdh, '--forced-track', '0:no', '--default-track', '0:no', '--compression', '0:none', '(', self.CurrentName + ' (' + subs_language + '-sdh)' + SubsExtension, ')']
+
+			#(Chapters)
+			if os.path.isfile(self.CurrentName+' Chapters.txt'):
+				CHAPTERS=['--chapter-charset', 'UTF-8', '--chapters', self.CurrentName + ' Chapters.txt']
+			else:
+				CHAPTERS=[]
+
+
+			mkvmerge_command_video = [self.mkvmergeexe,
+									'-q',
+									'--output',
+									VideoOutputName,
+									'--language',
+									'0:und',
+									'--default-track',
+									'0:yes',
+									'(',
+									VideoInputName,
+									')']
+			
+
+
+			mkvmerge_command = mkvmerge_command_video + ALLAUDIOS + ALLSUBS + CHAPTERS
+			mkvmerge_process = subprocess.run(mkvmerge_command)