mkb79
Atmos Download (Future Feature Request… if possible)
So it would be awesome to enable the Audible Dolby Atmos option for downloading I'm not sure if something would need to be added to the api or even what codec format they are using but it seems it can be downloaded in the iOS app and some select android devices.
Digging around the api found this in /1.0/library/B0C66LN3JW but it showed the standard stereo available_codecs
"asset_details": [ "is_spatial": true,"name": "Dolby"]
This is all new to me and I'm not even sure what I'm looking for.
I'm absolutely low on time this week. But you can try out yourself if you can download and decrypt the atmos audio.
You have to make a POST request to https://api.audible.de/1.0/content/B004UVB7KC/licenserequest. B004UVB7KC must be replaced with your ASIN.
The body for the request above is
{
"use_adaptive_bit_rate" : true,
"supported_media_features" : {
"codecs" : [
"mp4a.40.2",
"mp4a.40.42",
"ec+3"
],
"drm_types" : [
"Mpeg",
"Hls",
"HlsCmaf",
"FairPlay"
]
},
"response_groups" : "content_reference,chapter_info,last_position_heard,pdf_url,certificate",
"consumption_type" : "Streaming",
"spatial" : true
}
I does not know why the iOS Audible app makes a Streaming request but it download and saves the audio file.
Edit: The iOS Audible app makes a download request. It looks so
{
"quality" : "High",
"response_groups" : "chapter_info,content_reference,last_position_heard,pdf_url",
"consumption_type" : "Download",
"supported_media_features" : {
"codecs" : [
"mp4a.40.2",
"mp4a.40.42",
"ec+3"
],
"drm_types" : [
"Mpeg",
"Adrm",
"FairPlay"
]
},
"spatial" : true
}
Edit:
In both cases a m3u8 playlist file is provided for downloading using the FairPlay format. After that, the client made a request to https://api.audible.de/1.0/content/B004UVB7KC/drmlicense with a licenseChallenge body to receive the license. I does not know how to decrypt FairPlay DRM.
Well it was worth a shot, and thank you all your time you put into it. I wasn't expecting a response other than yeah that would be neat and maybe marked as a future option once it was figured out in like 6 months or more.
Looks like I'll have to do some research now I know what direction to go in, when I get some free time.
Thank you.
Audible for Android also supports Dolby Atmos. Does it also download a FairPlay format? Because to the best of my knowledge FairPlay is only available on Apple devices so it may be using another (weaker?) DRM.
@devnoname120
The iOS and Android Audible apps are requesting the same API to make a license request. Therefore, you just have to find out which request body the Android app uses.
For iOS this body is sent:
{
"quality" : "High",
"response_groups" : "chapter_info,content_reference,last_position_heard,pdf_url",
"consumption_type" : "Download",
"supported_media_features" : {
"codecs" : [
"mp4a.40.2",
"mp4a.40.42",
"ec+3"
],
"drm_types" : [
"Mpeg",
"Adrm",
"FairPlay"
]
},
"spatial" : true
}
I do not have an Android device to decrypt the HTTPS traffic sent from the Audible app to the API. So you can using the script below to play around to make a licenserequest and test some codecs and drm_types and check which response the API will give:
import json
from audible import Authenticator, Client
auth_file_path = "..." # FILL OUT
asin = "..." # FILL OUT
auth = Authenticator.from_file(auth_file_path)
with Client(auth) as client:
body = {
"quality": "High",
"response_groups": "chapter_info,content_reference,last_position_heard,pdf_url",
"consumption_type": "Download",
"supported_media_features":
{
"codecs": [
"mp4a.40.2",
"mp4a.40.42",
"ec+3"
],
"drm_types": [
"Mpeg",
"Adrm",
"FairPlay"
]
},
"spatial": True
}
lr = client.post(
f"content/{asin}/licenserequest",
body=body,
)
print(json.dumps(lr, indent=4))
Known drm_types are Mpeg, PlayReady, Hls, Dash, FairPlay, Widevine, HlsCmaf, Adrm. And known codecs are ec+3, ac-4, mp4a.40.42, mp4a.40.2. Maybe these helps a little bit?!
If you remove FairPlay from supported drm_types it will download the book in AAXC (Adrm mode)! I does not know if it using Dolby Atmos. But it uses the mp4a.40.2 codec in booth cases. Tried it with asin 3844535306 and german marketplace .
Edit: Oh it seams these audiobook is not available in Dolby Atmos.
Edit:
Tried it again with an Atmos title. It will only download with ec+3 and only as FairPlay protected title. Maybe you have more luck.
@mkb79 I can't test right now. Did you try with ac-4 and WideVine? This seems to me to be the combo that will most likely work for Android content.
I've tried it with the codecs ec+3 and ac-4. Drm_types where set to Mpeg, PlayReady, Hls, Dash, Widevine, HlsCmaf, Adrm (only removing FairPlay). This will give me a HTTP 404 error with the message: Unable to retrieve asset details from Sable(AssetInfos), for marketplaceId:AN7V1F1VY261K, asin:B0BGYDYQ38, acr:null, skuLite:OR_ORIG_002267, version:LATEST, aaaClientId:ApolloEnv:AudibleApiExternalRouterService/EU/Prod. Maybe B0BGYDYQ38 is not available on Android devices in Dolby Atmos or they are using some other codecs/drm_types there.
I've documented some new API endpoints related to the FairPlay DRM.
Steps to download Dolby Atmos titles:
- The client makes a licenserequest.
- It receives the response containing a URI to a m3u8 file
- The client makes multiple GET requests to this URI with the
User-Agent:AppleCoreMedia/1.0.0.20G75 (iPhone; U; CPU OS 16_6 like Mac OS X; de_de)and receives content from type `application/vnd.apple.mpegurl - Client requests the FairPlay certificate.
- Client makes a GET request to dpm.demdex.net and receives JSON content (Edit: these step may be not iOS App related)
- Client make a POST request to drmlicense endpoint
- The client request build a new URI from the URI from 2 and the filename taken from the m3u8 file and receives the
audio/mp4file.
Edit: I can’t replay step 6 currently. I does not know how to build the license challenge. If I follow the other steps from above, leaving step 6 out, I receive a 403 status error. So step 6 must be the import part. Maybe the challenge is build using the cert from point 4 and other things?
@devnoname120 I’ve found out how I can extract the uri from the m3u8 file and download the Dolby Atmos mp4 file. Now I've to find out how to decrypt these file.
@mkb79 What's the output of file dolby_atmos_file.mp4?
Note: step 5 is probably irrelevant as dpm.demdex.net is an endpoint used by Adobe Experience Platform Identity Service.
The m3u8 playlist contains the mp4 file location. With these information you can build the correct URI to the mp4 file. These file must be downloaded using a special Range header specify the byte range like bytes=0-1368458706 for asin B0BGYDYQ38. These audiobook has a size of 1368458706 bytes. If you forgot the Range header I've got an 403 error. So this header is mandatory.
After downloading you have a mp4 file which is encrypted via SAMPLE-AES. Now you need the key for decryption.
Here is the full licenserequest JSON body definition on Android:
{
"supported_media_features" : {
"drm_types": [
"adrm",
"hls",
"play_ready",
"mpeg",
"dash",
"widevine"
],
"codecs": [
"mp4a.40.2", // AAC_LC
"mp4a.40.42", // XHE_AAC
"ec+3", // EC_PLUS_3
"ac-4", // AC_4
],
"chapter_titles_type": "flat/tree",
},
"spatial" : true, // true/false,
"consumption_type" : "streaming/download",
"rights_validation": "ownership/radio/aycl",
"quality" : "low/normal/high/extreme",
"version": "[version]",
"acr": "CR![id_of_28_characters]", // Some kind of id for license?
"use_adaptive_bit_rate": true, // true/false
"playback_start_ms": 123,
"playback_end_ms": 456,
"response_groups" : "content_reference,chapter_info,pdf_url,last_position_heard,ad_insertion",
"file_version": "[version]"
}
Not sure whether it differs from the one you see on iOS or not. Just posting this for my future reference I'll dig more into the Atmos stuff on Android.
Thank you very much. That seams a licenserequest for streaming purposes. use_adaptive_bit_rate is typically for streaming requests. acr is the amazon content reference. This value is unique for each book/asin/codec?/version combination.
Important for me is the response for a download license request for an Dolby Atmos book.
Unfortunately I don't have an Android device that supports Dolby Atmos… Neither do I own a Dolby Atmos book.
@mkb79 Can you retry with this user agent?
Audible, Android, 3.58.0, samsung, SM-S906B, g0sxeea, 13, 1.0, WIFI
This corresponds to a Samsung Galaxy S22 (it has native Dolby Atmos support).
I cobbled up this user agent by looking at how the Audible app constructs it and filling it with the information I was able to find on the internet. I'm not 100% sure I didn't make any mistakes while building it though.
@devnoname120 Specifying an User-Agent makes no different.
But I'm checked the downloaded book B0BGYDYQ38 with MediaInfo
General
Complete name : audio.mp4
Format : MPEG-4
Format profile : Base Media / Version 1
Codec ID : mp41 (iso8/isom/mp41/dash/cmfc)
File size : 1.27 GiB
Duration : 3 h 57 min
Overall bit rate mode : Constant
Overall bit rate : 769 kb/s
Encoded date : 2023-03-22 12:22:54 UTC
Tagged date : 2023-03-22 12:22:54 UTC
Audio
ID : 1
Format : E-AC-3
Format/Info : Enhanced AC-3
Commercial name : Dolby Digital Plus
Codec ID : enca / ec-3
Duration : 3 h 57 min
Bit rate mode : Constant
Channel(s) : 6 channels
Channel layout : L R C LFE Ls Rs
Sampling rate : 48.0 kHz
Compression mode : Lossy
Service kind : Complete Main
Encoded date : 2023-03-22 12:22:54 UTC
Tagged date : 2023-03-22 12:22:54 UTC
Encryption : Encrypted
So downloading Dolby Atmos titles is no problem. But decrypting FPS is the next step. I know how I can receive the FairPlay cert. The drmlicense request will then receive the license which can be used for decryption.
@mkb79 I'm not familiar with FairPlay but it's a tough nut to crack. I'll try to trick the Audible app into thinking that my phone supports Dolby Atmos and dump the resulting HTTP requests. That will be for another time though!
For my future reference here is the list of available Dolby Atmos audiobooks: https://www.audible.com/public-collections/1998b1ba-07e8-470f-8581-f97365772fe0
@devnoname120 @mkb79
Widevine is only available on android devices. For you to be able to request Widevine DRM, your audible client must be registered as an android device. Currently, audible-cli only registers as an iPhone. To register as an Android device, use the following registration body:
Android Registration Body
Change the registration body to the following:body = {
"requested_token_type": [
"bearer",
"mac_dms",
"website_cookies",
"store_authentication_cookie",
],
"cookies": {"website_cookies": [], "domain": f".amazon.{domain}"},
"registration_data": {
"domain": "DeviceLegacy",
"app_version": "141028",
"device_serial": serial,
"device_type": "A10KISP2GWF0E4",
"device_name": (
"%FIRST_NAME%%FIRST_NAME_POSSESSIVE_STRING%%DUPE_"
"STRATEGY_1ST%Audible for Android"
),
"os_version": "google/sdk_gphone64_x86_64/emu64xa:14/UPB5.230623.003/10615560:userdebug/dev-keys",
"software_version": "130050002",
"device_model": "sdk_gphone64_x86_64",
"app_name": "com.audible.application",
},
"auth_data": {
"use_global_authentication": "true",
"client_id": build_client_id(serial),
"authorization_code": authorization_code,
"code_verifier": code_verifier.decode(),
"code_algorithm": "SHA-256",
"client_domain": "DeviceLegacy",
},
"requested_extensions": ["device_info", "customer_info"],
}
I don't own an android Device that supports Dolby Atmos, but I was able to modify the Audible apk to allow downloading Atmos files. You can download it here.
Steps to download Dolby Atmos titles using Zero-G as an example:
-
The client makes a licenserequest. a. Request URL:
https://api.audible.com/1.0/content/B07K4VYQ5X/licenserequestb. Request Body{ "supported_media_features": { "drm_types": [ "Widevine", "Adrm", "Mpeg" ], "codecs": [ "mp4a.40.2", "mp4a.40.42", "ec+3", "ac-4" ], "chapter_titles_type": "Tree" }, "spatial": true, "consumption_type": "Download", "quality": "High", "response_groups": "content_reference,chapter_info,pdf_url,ad_insertion" } -
It receives the response containing a URI to a Dash MPD file
Example MPD File
Zero-G MPD File<?xml version='1.0' encoding='utf-8'?> <MPD minBufferTime='PT20S' type='static' mediaPresentationDuration='PT4H8M52.693S' profiles='urn:mpeg:dash:profile:isoff-main:2011' xmlns='urn:mpeg:dash:schema:mpd:2011' xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance' xsi:schemaLocation='urn:mpeg:DASH:schema:MPD:2011 http://standards.iso.org/ittf/PubliclyAvailableStandards/MPEG-DASH_schema_files/DASH-MPD.xsd'> <Period id='0' duration='PT4H8M52.693S'> <AdaptationSet id='0' contentType='audio' lang='und' subsegmentAlignment='true'> <ContentProtection xmlns:cenc='urn:mpeg:cenc:2013' cenc:default_KID='27bde860-e27a-902c-9fda-9aa043c4fc11' schemeIdUri='urn:mpeg:dash:mp4protection:2011' value='cenc'/> <ContentProtection xmlns:cenc='urn:mpeg:cenc:2013' schemeIdUri='urn:uuid:edef8ba9-79d6-4ace-a3c8-27dcd51d21ed'> <cenc:pssh> AAAAsXBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAAJESECe96GDiepAsn9qaoEPE/BESEFvn1UjnJquHS2LOtGVV88cSEBwnhnUCfvJndrBf6z7afIsaB0F1ZGlibGUiUGNpZDoNCko3M29ZT0o2a0N5ZjJwcWdROFQ4RVE9PSxXK2ZWU09jbXE0ZExZczYwWlZYenh3PT0sSENlR2RRSis4bWQyc0YvclB0cDhpdz09 </cenc:pssh> </ContentProtection> <ContentProtection xmlns:cenc='urn:mpeg:cenc:2013' schemeIdUri='urn:uuid:9a04f079-9840-4286-ab92-e65be0885f95'> <cenc:pssh> AAAAVHBzc2gBAAAAmgTweZhAQoarkuZb4IhflQAAAAMnvehg4nqQLJ/amqBDxPwRW+fVSOcmq4dLYs60ZVXzxxwnhnUCfvJndrBf6z7afIsAAAAA </cenc:pssh> </ContentProtection> <Representation id='0' mimeType='audio/mp4' codecs='ac-4.02.02.00' bandwidth='324598' audioSamplingRate='48000'> <AudioChannelConfiguration schemeIdUri='urn:mpeg:mpegB:cicp:ChannelConfiguration' value='2'/> <SupplementalProperty schemeIdUri='tag:dolby.com,2016:dash:virtualized_content:2016' value='1'/> <BaseURL>../../../../base/or_orig_000434/47096871/cenc/g1/or_orig_000434_48_320-ac4.mp4?ss_sec=20&use_token_based_signing=true</BaseURL> <SegmentBase timescale='48000' indexRange='1118-10281' indexRangeExact='true'> <Initialization range='0-1117'/> </SegmentBase> </Representation> </AdaptationSet> </Period> </MPD> -
Client makes a GET request for the first
Initializationbytes of the file. (Found in the MPD file. Value isrange='0-1117'in the example.) These bytes are the mp4 file'sftypandmoovboxes. -
Client make a POST request to drmlicense endpoint Body:
{ "consumption_type": "Download", "drm_type": "Widevine", "licenseChallenge": "..." }licenseChallengeis the Base64 encoded bytes returned from ExoMediaDrm.KeyRequest.getData() -
Client downloads the rest of the mp4 file.
I don't have any widevine experience, but a good place to start reverse engineering Audible's implementation is in com.audible.widevinecdm.WidevineL3CdmFactory.
@Mbucari
Thank you very much for sharing your findings. Since I don't have an Android device, I unfortunately couldn't find out the exact registration body. This will help a lot.
Now we have two possible approaches (Widevine or FairPlay) to decrypt Atmos titles. Maybe some of them is successful.
Hey @Mbucari and thank you for the payloads. I didn't update you guys in this thread but in the meantime I did a pretty thorough reverse engineering of the Audible Android app. I was also able to defeat the Amazon MAP certificate pinning and insert my own mitmproxy CA inside their hardcoded base64 + gzipped BKS bundle of certificates.
I updated my local fork of audible-cli in order to support Android auth, but (at least on my side) they use a different format of certificates (not PEM) for payload signatures and I haven't fixed that part entirely yet. I additionally dumped a L3 Widevine CDM so I should be ready to decrypt the actual resulting Dolby Atmos payload — unless there are more protections on top of Widevine.
I wanted to do a PR or at least a complete PoC before updating you, but to avoid duplicate work it I could maybe release my findings before doing a PoC when I get the chance to. On Oct 16, 2023, 23:52 +0200, mkb79 @.***>, wrote:
@Mbucari Thank you very much for sharing your findings. Since I don't have an Android device, I unfortunately couldn't find out the exact registration body. This will help a lot. Now we have two possible approaches (Widevine or FairPlay) to decrypt Atmos titles. Maybe some of them is successful. — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.***>
Hey @Mbucari and thank you for the payloads.
You're welcome @devnoname120. FYI, my patched apk removed cert pinning so you can use Http Toolkit to get all https traffic.
I updated my local fork of audible-cli in order to support Android auth, but (at least on my side) they use a different format of certificates (not PEM) for payload signatures and I haven't fixed that part entirely yet.
I forgot to mention this. On Android the private key is formatted like so (Asn.1 values)
PrivateKeyInfo SEQUENCE (3 elem)
version Version INTEGER 0
privateKeyAlgorithm AlgorithmIdentifier SEQUENCE (2 elem)
algorithm OBJECT IDENTIFIER 1.2.840.113549.1.1.1 rsaEncryption (PKCS #1)
parameters ANY NULL
privateKey PrivateKey OCTET STRING
SEQUENCE (9 elem)
INTEGER 0
INTEGER (RSA Modulus)
INTEGER (RSA Public Exponent)
INTEGER (RSA D)
INTEGER (RSA P)
INTEGER (RSA Q)
INTEGER (RSA DP)
INTEGER (RSA DQ)
INTEGER (RSA InverseQ)
The PrivateKey octet string is equivalent to the PEM delivered by iPhone registration.
I additionally dumped a L3 Widevine CDM so I should be ready to decrypt the actual resulting Dolby Atmos payload — unless there are more protections on top of Widevine. I wanted to do a PR or at least a complete PoC before updating you, but to avoid duplicate work it I could maybe release my findings before doing a PoC when I get the chance to.
At the moment I have no idea what any of that means, but it sounds very impressive! Do you have some links to widevine documentation that could help explain this? My searches only yielded high-level info which seems pretty useless for reversing.
@devnoname120 I really wish I could be more helpful with the encryption key, but I don't have python code for it.
You can use this JavaScript parser to decode the base64 and get the integer values: https://lapo.it/asn1js/
And you can see my c# Asn.1 decoder here: https://github.com/rmcrackan/AudibleApi/blob/a630d6f04b2840d68b532a782eab3f46ec14aac0/AudibleApi/Cryptography/PrivateKey.cs#L54C1-L54C1
Quick update: I made good progress. I have a PoC that authenticates, gets the Atmos content license object, extracts the pssh from the MPD, sets up a new Widevine L3 session with my dumped CDM keys, gets a new challenge from the CDM, and sends a Widevine L3 license request to Audible with that challenge.
Currently Audible refuses to grant my L3 license request. I double-checked my license request and it looks correct — I think that the CDM keys that I extracted are just not approved by Audible. Next step is getting my hand on a rooted physical Android physical in order to extract new Widevine CDM keys and move on to the next step.
@devnoname120 I have a couple of old android devices that I could root and, with your instruction, dump CDM keys. Hell, I'd be willing to gift one of them to you if you'd like.
Can you explain what these keys are? If you dumped a working CDM and we use them in our audible decryptors, won't they just be revoked? And when they revoked, would we have to buy a new device to get a new, valid CDM?
@Mbucari That would be great, thanks! Getting my hand on CDM keys would be enough. These keys would only be for my personal use. In order to get the keys you would need to follow these instructions: https://github.com/lollolong/dumper
Can you explain what these keys are?
They are used to simulate a Widevine L3 device. From that simulated device we create a challenge that is sent to Audible's server, which in turn returns personalized decryption keys that the simulator deciphers and then returns back to us. I'm not in my sharpest mental state right now so I hope it makes sense.
If you dumped a working CDM and we use them in our audible decryptors, won't they just be revoked? And when they revoked, would we have to buy a new device to get a new, valid CDM?
You're right, if we included dumped keys they would be banned pretty fast. Users would have to dump their own keys or use a Widevine proxy service such as https://getwvkeys.cc/ or one based on pywidevine's remote CDM feature. I don't know any good proxies yet
Do you have any updates on the Widevine CDM dumps? 🙏
Not yet, sorry. Thanks for the reminder. I'll get to it this week.
@devnoname120 I sent you a CDM dump. I tried using to get the decryption keys, but I got the following response from Audible:
{
"message": "Widevine license denied due to: UNTRUSTED_DEVICE_CERTIFICATE",
"reason": "UntrustedDeviceCertificate"
}
I got that CDM from the web browser at bitmovin. I got another CDM from audible.com in the web browser, and that one also resulted in an UNTRUSTED_DEVICE_CERTIFICATE error. I tried using the dumper to get a CDM from the Audible app, but it only found the "device_info" and not the "private_key", so I couldn't dump it.
@Mbucari I have the exact same error when using the CDM that you sent me.
Interestingly when I use the CDM that I dumped from the Android emulator, Audible returns a 500 HTTP status code and the following response:
{"message":"There was an internal server error."}
I didn't try with a Chrome CDM though.
Can you give us the output of the following steps?
- Install the DRM Info app, open it, and take a screenshot.
- Install the liboemcryptodisabler Magisk module and reboot. This forces the use of Widevine L3 rather than Widevine L1. Take another screenshot from the DRM info app.
- Use the dumper again on the Audible app and report back. Send me by email the
device_client_id_bloband/ordevice_private_key.
I wonder if Audible only accepts devices that actually support Dolby Atmos when requesting ec+3.
Edit: Maybe Audible actually requires Widevine L1 for Dolby Atmos audiobooks.