KeyDive: Widevine L3 Extractor for Android

KeyDive is a sophisticated Python script designed for precise extraction of Widevine L3 DRM (Digital Rights Management) keys from Android devices. This tool leverages the capabilities of the Widevine CDM (Content Decryption Module) to facilitate the recovery of DRM keys, enabling a deeper understanding and analysis of the Widevine L3 DRM implementation across various Android SDK versions.

Important

Support for OEM API 18+ (SDK > 33) requires the use of functions extracted from Ghidra.

Features

🚀 Seamless Installation via pip
🔄 Automated extraction of Widevine L3 DRM keys
📱 Compatibility with a wide range of Android versions (SDK > 22), ensuring broad applicability
💾 Seamless extraction process, yielding essential DRM components
🌐 Offline extraction mode for environments without internet access
🖥️ Command-line options for flexible usage
🛠️ Support for custom functions extracted from Widevine libraries using Ghidra
❤️ Fully Open-Source! Pull Requests Welcome

Prerequisites

Before you begin, ensure you have the following prerequisites in place:

ADB (Android Debug Bridge): Make sure to install ADB and include it in your system's PATH environment variable for easy command-line access.
Frida-Server: Install frida-server on your target Android device. This requires root access on the device. For installation instructions and downloads, visit the official Frida documentation.

Installation

Follow these steps to set up KeyDive:

Ensure all prerequisites are met (see above).
Install KeyDive from PyPI using Poetry:
```
pip install keydive
```

Usage

Play a DRM-protected video on the target device.
Launch the KeyDive script.
Reload the DRM-protected video on your device.
The script will automatically extract the Widevine L3 keys, saving them as follows:
- client_id.bin - This file contains device identification information.
- private_key.pem - This file contains the RSA private key for decryption.

This sequence ensures that the DRM-protected content is active and ready for key extraction by the time the KeyDive script is initiated, optimizing the extraction process.

Command-Line Options

usage: keydive [-h] [-d <id>] [-v] [-l <dir>] [--delay <delay>] [--version] [-a] [-c <file>] [-w] [-o <dir>] [-f <file>]

Extract Widevine L3 keys from an Android device.

options:
  -h, --help            show this help message and exit

Global options:
  -d <id>, --device <id>
                        Specify the target Android device ID to connect with via ADB.
  -v, --verbose         Enable verbose logging for detailed debug output.
  -l <dir>, --log <dir>
                        Directory to store log files.
  --delay <delay>       Delay (in seconds) between process checks in the watcher.
  --version             Display KeyDive version information.

Cdm options:
  -a, --auto            Automatically open Bitmovin's demo.
  -c <file>, --challenge <file>
                        Path to unencrypted challenge for extracting client ID.
  -w, --wvd             Generate a pywidevine WVD device file.
  -o <dir>, --output <dir>
                        Output directory path for extracted data.
  -f <file>, --functions <file>
                        Path to Ghidra XML functions file.

Advanced Usage

Extracting Functions

For advanced users looking to use custom functions with KeyDive, a comprehensive guide on extracting functions from Widevine libraries using Ghidra is available. Please refer to our Functions Extraction Guide for detailed instructions.

Offline Extraction

KeyDive supports offline extraction mode for situations without internet access. This mode allows you to extract DRM keys directly from your Android device. Ensure all necessary dependencies are installed and follow the detailed Offline Mode Guide for step-by-step instructions.

Obtaining Unencrypted Challenge Data

Note

Usage of unencrypted challenge is not required by default. It is only necessary when the script cannot extract the client id.

To extract the unencrypted challenge data required for KeyDive's advanced features, follow the steps outlined in our Challenge Extraction Guide. This data is crucial for analyzing DRM-protected content and enhancing your DRM key extraction capabilities.

Temporary Disabling L1 for L3 Extraction

Warning

Usage of the module is now deprecated because the deactivation of the library was natively added.

Some manufacturers (e.g., Xiaomi) allow the use of L1 keyboxes even after unlocking the bootloader. In such cases, it's necessary to install a Magisk module called liboemcrypto-disabler to temporarily disable L1, thereby facilitating L3 key extraction.

Disclaimer

KeyDive is intended for educational and research purposes only. The use of this tool in unauthorized testing of protected content is strictly prohibited. Please ensure you have permission before proceeding with DRM key extraction.