ResolveURL icon indicating copy to clipboard operation
ResolveURL copied to clipboard

Published 20 hours ago • verified publisher icon Gujal00

streamrapid.py ?

Open lavara123 opened this issue 3 years ago • 9 comments

They switched to a new method. Base64 style encryption with Ajax

lavara123 avatar Sep 15 '22 15:09 lavara123

They are changing the decrypt key stored in obfuscated javascript every 20 minutes, so can't do anything about it, same as mcloud. Broken for now

Gujal00 avatar Sep 15 '22 23:09 Gujal00

@Gujal00 How did you get that key? can you post the code? maybe i can do something

lavara123 avatar Sep 15 '22 23:09 lavara123

The decrypt key is in https://rabbitstream.net/js/player/prod/e5-player.min.js?v=1663283550 The time stamp changes every 20 minute or so on that url and the key variable name and value changes. On the above timestamp the key is const _0x14f6b5 = '69932eff70fd109a'; sometimes the value is further obfuscated with a function like this, const _0x3fc144 = _0x2f748d(0xc24, '!2Y]') The plugin has been updated to follow the new logic, But it cant get the key everytime due to obfuscation. If the correct key is used then ResolveURL resolves correctly with the new code

SMR Link Tester: Link Resolved: |https://rabbitstream.net/embed-5/fkuRvX6a5GXz?z=|https://b-g-eu-5.feetcdn.com:2223/v2-hls-playback/683398921bf2156da090956a30a14f665b206d0b6d8e5cd027064cc311169cc516edf06b2edc31467cdda904b4f331245b5fb0cbb571c4808804d1878d6a45d8098fe997974feced9806198b5f3835408730f2a1ee8d5f128795bdc89c63a26c44d80924a6134bfbfcada8197e10692fc09742ed80236f31a55b23d0f6cd783d45ed38b6e83a387e4fd05b98b11920dff19e92613979dbcadeeca4ba3ddc2158d9683954aacd2fd1663923d872ce33a8/720/index.m3u8|User-Agent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%3B+rv%3A68.0%29+Gecko%2F20100101+Firefox%2F68.0&Referer=https%3A%2F%2Frabbitstream.net%2F|

Gujal00 avatar Sep 15 '22 23:09 Gujal00

@Gujal00 How can we find this? I'm looking for a const in js code, there is no such phrase.

So do you have a method to scrape the JS code?

lavara123 avatar Sep 17 '22 22:09 lavara123

@lavara123 You can see the key in clear (highlighted in yellow below) in the current JS, probably next time it will be obfuscated https://rabbitstream.net/js/player/prod/e5-player.min.js?v=1663467150 2022-09-18 14_44_58-https___rabbitstream net_js_player_prod_e5-player min js_v=1663467150

Gujal00 avatar Sep 18 '22 02:09 Gujal00

@Gujal00 The link I tested was different. the key obviously does not exist as you show

i test link https://rabbitstream.net/embed-5/xmHgf4E61Gjb?z=

https://rabbitstream.net/js/player/prod/e5-player.min.js?v=1663488750

I think this phrase returns the key 12345

lavara123 avatar Sep 18 '22 09:09 lavara123

@correct, as I mentioned before that sometime it is obfuscated and sometimes it is not

The decrypt key is in https://rabbitstream.net/js/player/prod/e5-player.min.js?v=1663283550 The time stamp changes every 20 minute or so on that url and the key variable name and value changes. On the above timestamp the key is const _0x14f6b5 = '69932eff70fd109a'; sometimes the value is further obfuscated with a function like this, const _0x3fc144 = _0x2f748d(0xc24, '!2Y]') The plugin has been updated to follow the new logic, But it cant get the key everytime due to obfuscation. If the correct key is used then ResolveURL resolves correctly with the new code

Gujal00 avatar Sep 18 '22 21:09 Gujal00

@lavara123 try with https://github.com/Gujal00/ResolveURL/commit/e416e8f0ec6f1ff4b637f5fc8c73776754be1ea3 and report back. It is a hit and miss, but that's the best that can be done for now.

Gujal00 avatar Sep 20 '22 23:09 Gujal00

The key is generated inside a web assembly module disguised as a PNG image in "loading.png". Reverse engineering skills is needed to fix this plugin. For more info check this article https://www.pudn.com/Download/item/id/1711319547629731.html

triorr avatar Apr 26 '24 01:04 triorr

yep, this cannot be done in python and have to rely on an external docker container running node_ts to solve this. Works well with https://github.com/drblgn/rabbit_wasm

Gujal00 avatar Jul 22 '24 06:07 Gujal00