KissNetwork.bundle icon indicating copy to clipboard operation
KissNetwork.bundle copied to clipboard

KissAnime encryption change

Open RexfelisLOC opened this issue 9 years ago • 82 comments

Looks like KissAnime has a new decryption function called "ovelWrap". It seems to be encoded as the following:

function ovelWrap(_0x7b4ax13) { var _0x7b4axe = null; try { var _0x7b4ax10 = CryptoJS[_0x59b3[0]][_0x59b3[24]][_0x59b3[23]]({ ciphertext : CryptoJS[_0x59b3[22]][_0x59b3[21]]_0x59b3[20] }), _0x7b4ax7 = CryptoJS[_0x59b3[30]][_0x59b3[29]](_0x7b4ax10, key, { mode : CryptoJS[_0x59b3[26]][_0x59b3[25]], iv : iv, padding : CryptoJS[_0x59b3[28]][_0x59b3[27]] }); return _0x7b4axe = _0x7b4ax7.toString(CryptoJS[_0x59b3[22]].Utf8) } catch (p) { alert(p + _0x7b4ax13) } } var bkZ = _0x59b3[31], skH = _0x59b3[32], iv, key; iv = CryptoJS[_0x59b3[22]][_0x59b3[33]]_0x59b3[20], key = CryptoJS.SHA256(skH)

How do you decode javascript like the above?

RexfelisLOC avatar Mar 15 '17 16:03 RexfelisLOC

Found a JS deobfuscator:

function ovelWrap(_0x7b4ax13) { var _0x7b4axe = null; try { var _0x7b4ax10 = CryptoJS['lib']['CipherParams']['create']({ ciphertext: CryptoJS['enc']['Base64']'parse' }), _0x7b4ax7 = CryptoJS['AES']['decrypt'](_0x7b4ax10, key, { mode: CryptoJS['mode']['CBC'], iv: iv, padding: CryptoJS['pad']['Pkcs7'] }); return _0x7b4axe = _0x7b4ax7.toString(CryptoJS['enc'].Utf8) } catch (p) { alert(p + _0x7b4ax13) } } var bkZ = 'a5e8d2e9c1721ae0e84ad660c472c1f3', skH = 'nhasasdbasdtene7230asb', iv, key; iv = CryptoJS['enc']['Hex']'parse', key = CryptoJS.SHA256(skH)

RexfelisLOC avatar Mar 15 '17 18:03 RexfelisLOC

it same aes as used in their other sites

all you need is to get the key and iv


 var bkZ = 'a5e8d2e9c1721ae0e84ad660c472c1f3',
     skH = 'nhasasdbasdtene7230asb',
     iv, key;
 iv = CryptoJS['enc']['Hex']['parse'](bkZ), key = CryptoJS.SHA256(skH)

key = hashlib.sha256('nhasasdbasdtene7230asb').digest() iv = 'a5e8d2e9c1721ae0e84ad660c472c1f3'.decode('hex')

crypter = AES.new(key, AES.MODE_CBC, iv) crypter.decrypt(cypertext.decode('base-64'))

L2501 avatar Mar 15 '17 18:03 L2501

Awesome thanks. I was able to replace the token with the skH value and it works.

RexfelisLOC avatar Mar 15 '17 19:03 RexfelisLOC

Thanks for the info, I'll push a fix when I can.

Twoure avatar Mar 15 '17 22:03 Twoure

Fixed anime. Currently working on cartoon, then will check drama for changes.

Twoure avatar Mar 16 '17 00:03 Twoure

Finished cartoon/drama js decryption. Still need to translate into python, and make dynamic.

Twoure avatar Mar 16 '17 04:03 Twoure

I'm curious if your library can play videos from the beta server. Here's a video which is only available using Openload or KissAnime's beta server (KissAnime server is not available):

http://kissanime.ru/Anime/Naruto-Shippuuden/Episode-003?id=100312&s=beta

Notice the &s=beta at the end. The code will extract the link, but I cannot play the link in a browser (I do not use Plex).

RexfelisLOC avatar Mar 16 '17 12:03 RexfelisLOC

Notice the &s=beta at the end. The code will extract the link, but I cannot play the link in a browser (I do not use Plex).

I'm seeing the same thing. I assume its a header dependency issue. Sometimes sites like these expire the video link the instant it's been called, and they normally have some dependency within the requests header. I don't have time right now to look into this any further, but will once I've patched up the channel for the default sites.

Twoure avatar Mar 16 '17 22:03 Twoure

Thank you for addressing this and implementing a fix.

NicholasLAranda avatar Mar 18 '17 02:03 NicholasLAranda

Fixed anime in https://github.com/Twoure/KissNetwork.bundle/commit/3a15779747bd338a634f5a5211a9f087e01bee1f (aka dev branch). The values are hard-coded for now, but will need to be generated later (so this patch may break in a day or two). Still looking into a good way to do this. Moving on to cartoon/drama section for now.

Twoure avatar Mar 18 '17 03:03 Twoure

Thanks @GreyAsteroid for bringing the manga section to my attention. I'll add this to my list of things to do. Seems the encryption is a similar style as the other sites.

Twoure avatar Mar 19 '17 06:03 Twoure

Fixed anime, cartoon, Asian dramas. Still working out some of the bugs, but have the ground work done. Will also take time to fix the manga section after finalizing the video sections.

Twoure avatar Mar 19 '17 06:03 Twoure

Any ETA when 1.3.0 releases with channel fixes? All weekend we've wants to watch some animated cartoons but since it changed, we're limited to Netflix, my small home server & the poor quality of SS-Plex & PrimeWire with their mass of dead links.

NicholasLAranda avatar Mar 19 '17 21:03 NicholasLAranda

@RypeDub420 said: Any ETA when 1.3.0 releases with channel fixes?

Hopefully early this week.

All weekend we've wants to watch some animated cartoons

In the meantime, tryout 9anime.bundle dev branch. If you have the ssl cert issue and can't navigate the channel, then try enabling the SSL/TLS Fix within the channel's preferences.

Please keep 9anime.bundle comments to it's support thread [REL] 9anime and issues to https://github.com/Twoure/9anime.bundle/issues.

Twoure avatar Mar 20 '17 02:03 Twoure

Okay Twoure thanks for referencing. Will wait on next build. Appreciate your work in keeping your plugin up-to-date sir!

IJ08 avatar Mar 20 '17 22:03 IJ08

Hey just wanted to show my appreciation for your effort. Ditched cable a year back and this particular plugin has been absolutely awesome for entertaining my 4 year old. So nice to be able to hit shuffle and let the TV just play. I'm trying to become more involved with Plex and will hopefully learn how to help fix, maintain or create my own plugin. For now I am patiently waiting for your updates as they come through.

frankr2994 avatar Mar 20 '17 23:03 frankr2994

Ditto from the guy above me. Am willing to do python coding for free anime :-).

MisterVulcan avatar Mar 21 '17 00:03 MisterVulcan

Fixed default videos in https://github.com/Twoure/KissNetwork.bundle/compare/eda694b...bbd22af available from the current dev branch. Moving on to manga section for now, then will revisit the new beta video host.

Twoure avatar Mar 21 '17 00:03 Twoure

I also wanted to show my appreciation. Thanks for doing all this!

bearsnacks avatar Mar 21 '17 14:03 bearsnacks

Hi Twoure, i would like to use your Code for the Kodi Kissasian Addon. After changing the Code to work with Kodis python, i've got a problem with the get_rks() function. I changed it like this:

cl = list() bl = list() key = "" code = "" ra = re.findall(r'<script type="text/javascript">(.?)</script',page, re.DOTALL) #html = HTML.ElementFromString(page) for node in ra : #html.xpath('//script[@type="text/javascript"]'):
r = re.search(r'var\s
?(_[^=]+)=$kissenc',node) if r: key = r.group(1) cl.append('var %s = "%s"; ' %(key, rks_init)) continue r2 = re.search(r'($kissenc[^(]+(%s))' %key, node) if key else None if r2: continue r3 = re.search(r'(%s)' %key,node) if key else None if r3: for i, n in enumerate(node.strip().split(';')): n = n.strip() if re.search(r'(%s)' %key,n): r4 = re.search(r'\s([^(=]+)(',n) if r4: n = "function %s(a, b) {return a + 'bl_key' + b};" %r4.group(1) + n cl.append(n.lstrip('} \n') + ';') elif (i == 0): r3 = re.search(r'var\s*?(_[^=]+)=["'["']]',n) if r3: bl = [ b64decode(s.strip().decode('unicode_escape')) for s in r3.group(2).split(',') ] code = ''.join(cl + [' %s' %key]) if cl else '' code = code.replace('bl_key', (bl[0] if bl else '$')) if code: return js2py.eval_js(code) return False

Unfortunatly the execution of js2py.eval_js(code) fails. The variable "code" looks for example like this: var _duMLg = "Agxck2w4kG82A5tho"; var t = _duMLg;function x352(a, b) {return a + '$' + b};_duMLg = x352('5', _x1);_duMLg += t;_duMLg += '10'; _duMLg

Could you see a mistake or give a hint?

Prometheusx-git avatar Mar 21 '17 18:03 Prometheusx-git

FYI, KissCartoon is returning a "http://kisscartoon.se/Play?" for video links. Not sure if you are handling this, but if you try to play the link, KissCartoon will return "Please do not do that!"

RexfelisLOC avatar Mar 21 '17 22:03 RexfelisLOC

@Prometheusx-git and @RexfelisLOC, thanks for the heads up.

Twoure avatar Mar 21 '17 22:03 Twoure

@Prometheusx-git The code changes per user (I'm guessing based on IP and other params). https://www.reddit.com/r/KissAnime/comments/60fbp0/the_state_of_kissanime_kodi_addons_and_how/

So it seems my code above isn't going to work for the page your getting. I've not seen the code change on my end for almost two days now. I'll have to wait and see what it changes to.

Twoure avatar Mar 22 '17 00:03 Twoure

@RexfelisLOC said: FYI, KissCartoon is returning a "http://kisscartoon.se/Play?" for video links. Not sure if you are handling this, but if you try to play the link, KissCartoon will return "Please do not do that!"

Patch for cartoon play urls in https://github.com/Twoure/KissNetwork.bundle/compare/bbd22af...06b16b4 Also testing different openload url handler.

Twoure avatar Mar 22 '17 03:03 Twoure

In the meantime, tryout 9anime.bundle dev branch. If you have the ssl cert issue and can't navigate the channel, then try enabling the SSL/TLS Fix within the channel's preferences. Please keep 9anime.bundle comments to it's support thread [REL] 9anime and issues to https://github.com/Twoure/9anime.bundle/issues.

I'm waiting for KissCartoon :'(

NicholasLAranda avatar Mar 22 '17 23:03 NicholasLAranda

@Twoure said: Fixed anime, cartoon, Asian dramas. Still working out some of the bugs, but have the ground work done. Will also take time to fix the manga section after finalizing the video sections.

I'm just trying dev for Asian dramas, video still not working :(

yastri avatar Mar 23 '17 08:03 yastri

@yastri That's because of this https://www.reddit.com/r/KissAnime/comments/60fbp0/the_state_of_kissanime_kodi_addons_and_how/

Yolley avatar Mar 23 '17 08:03 Yolley

It is probably related to this announcement on the KissAnime website:

RemoveYourMedia is taking down almost all our videos with DMCA reports. We don't have any way to prevent this so... if you could not load the videos on KissAnime, please use other anime sites in the mean time (GoGoAnime, 9Anime...). There are a lot of good anime sites out there and DMCA could not take them all down.

I imagine that they are making changes to their encryption protocols to combat the RYM DMCA requests, which then breaks code here.

The cynical side of me thinks that it is also possible that RYM is using this or a similar tool to do all of the hard decryption work for them...

mapestree avatar Mar 23 '17 22:03 mapestree

the 9anime plex channel is having errors playing videos now, could be related to ^

Looks like its going to be a while to fix all of these issues.

IJ08 avatar Mar 23 '17 22:03 IJ08

OMG WTF IS JSFUCK xD

Anyways, I hope this gets fully implemented soon. I am sorry for all of the work you have to do as a developer.

NicholasLAranda avatar Mar 24 '17 06:03 NicholasLAranda