2017 Live Stream Capture Tech Talk

[FULLMETAL]

Downloaded the m3u8 and the following was listed:

#EXTM3U
#EXT-X-STREAM-INF:BANDWIDTH=2121091,RESOLUTION=896x504,CODECS="m p4a.40.2,avc1.4d001f"
1800K/1800_slide_twv1.m3u8
#EXT-X-STREAM-INF:BANDWIDTH=559938,RESOLUTION=400x224,CODECS="mp 4a.40.2,avc1.42c01e"
450K/450_slide_twv1.m3u8
#EXT-X-STREAM-INF:BANDWIDTH=985571,RESOLUTION=512x288,CODECS="mp 4a.40.2,avc1.42c01e"
800K/800_slide_twv1.m3u8
#EXT-X-STREAM-INF:BANDWIDTH=1425340,RESOLUTION=640x360,CODECS="m p4a.40.2,avc1.4d001f"
1200K/1200_slide_twv1.m3u8
#EXT-X-STREAM-INF:BANDWIDTH=2908735,RESOLUTION=960x540,CODECS="m p4a.40.2,avc1.4d001f"
2500K/2500_slide_twv1.m3u8
#EXT-X-STREAM-INF:BANDWIDTH=4023049,RESOLUTION=1280x720,CODECS=" mp4a.40.2,avc1.640029"
3500K/3500_slide_twv1.m3u8

[TheBang]

Here's as far as I've gotten in decryption. The decryption key (https://media-api.m.lv.twimg.com/pro...ys/id/20307890) is always the same, in hex: 45F859D2B58D3507DEBCF807A6F79D3A. i.e. they are not rotating keys (which is a feature). So, only the initialization vector (IV) is changing, and that's listed in the m3u8.

So, in my example m3u8 above, the IV should be CD08B15FC528B365A6365A74DDD6CC34 for fragment 02/30/03.ts.

It should work if you decrypt with those values, like so:

$ openssl aes-128-cbc -d -K 45f859d2b58d3507debcf807a6f79d3a -iv CD08B15FC528B365A6365A74DDD6CC34 -nosalt -in 03.ts -out 03-dec.ts

But I just get:

bad decrypt
35490:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:/SourceCache/OpenSSL098/OpenSSL098-52.40.1/src/crypto/evp/evp_enc.c:337:

[FULLMETAL]

Downloaded a different m3u8 from the feed in the URL I mentioned above. It looks like the one you posted. Here's a link: https://pastebin.com/mczHJ3W1