Need help with Gkencode , part of gkplugins.

subixonfire

New member
May 22, 2012
1
0
0
More and more streaming sites (online video databases) that use gkplugins to stream video files started using encrypted links...

example:

webpage :
Code:
http://www.gledajfilm.net/welcome-to-the-jungle-2014/
in page source you can find this:
Code:
<param name="FlashVars" value="plugins=captions,http://www.gledajfilm.net/wp-content/plugins/gkplugins-for-wordpress/player/plugins/proxy.swf&proxy.link=gledaj*df236814880713e784e099b26a27569fb9891e1e1a5a32a56df1a33b5a68373014ed2e4a02be5bdb415663799435e606&captions.file=http://www.gledajfilm.net/prevod/Welcome to the Jungle (2014).srt&logo.file=http://www.gledajfilm.net/logo-player.png&logo.hide=false&logo.position=top-left&logo.margin=10&captions.fontsize=22&captions.back=false&skin=http://www.gledajfilm.net/skins/grol.zip" />
encrypted link:
Code:
df236814880713e784e099b26a27569fb9891e1e1a5a32a56df1a33b5a68373014ed2e4a02be5bdb415663799435e606
decrypted link(used wireshark to capture it):
Code:
http://allmyvideos.net/zwsc13orsu1w

Php code used to encrypt links is available here: https://subversion.assembla.com/svn/ghd/trunk/protected/vendors/libs/Gkencode.php

Now there is some algo, and an unknown key. This key is probably looking something like this "QtnYUeivGXAskmJz218Q".

Now here comes the hard part, is it possible to someway turn around this to get the key when we know encrypted, decrypted link , and this algo???

If that's possible than someone smarter than me can make some decoding code based on this encoding one, we can get the key that is the same for all site content, and use this to make some plugins... :)
 
Last edited:

shani_08

Banned
Nov 25, 2013
112
0
0
Hi,
I have worked on another version of this tool to disassemble the logic, which was easier to find the key as well to recreate a algorithm in python. This one however is little different and much more secure, but i have already done a lot of background work. infact, i am able to run few of the tests, need to make code little better and readable.
This is how it goes: The flash object, after receiving the encrypted FlashVars, downloads another flash component, named as gkplugins_encode.swf. This is the main code which translates the encrypted string to the url that you mentioned. The key is stored in that swf and i believe the security algo the key are both different for every other website.
Anyways, i will clean up the code and upload here, in case anyone interested.
Lastly, getting the encrypted url to normal one like "http://allmyvideos.net/zwsc13orsu1w" doesn't mean it will be start working as more other work would be required but i believe not difficult at all.

-shani

More and more streaming sites (online video databases) that use gkplugins to stream video files started using encrypted links...

example:

webpage :
Code:
http://www.gledajfilm.net/welcome-to-the-jungle-2014/
in page source you can find this:
Code:
<param name="FlashVars" value="plugins=captions,http://www.gledajfilm.net/wp-content/plugins/gkplugins-for-wordpress/player/plugins/proxy.swf&proxy.link=gledaj*df236814880713e784e099b26a27569fb9891e1e1a5a32a56df1a33b5a68373014ed2e4a02be5bdb415663799435e606&captions.file=http://www.gledajfilm.net/prevod/Welcome to the Jungle (2014).srt&logo.file=http://www.gledajfilm.net/logo-player.png&logo.hide=false&logo.position=top-left&logo.margin=10&captions.fontsize=22&captions.back=false&skin=http://www.gledajfilm.net/skins/grol.zip" />
encrypted link:
Code:
df236814880713e784e099b26a27569fb9891e1e1a5a32a56df1a33b5a68373014ed2e4a02be5bdb415663799435e606
decrypted link(used wireshark to capture it):
Code:
http://allmyvideos.net/zwsc13orsu1w

Php code used to encrypt links is available here: https://subversion.assembla.com/svn/ghd/trunk/protected/vendors/libs/Gkencode.php

Now there is some algo, and an unknown key. This key is probably looking something like this "QtnYUeivGXAskmJz218Q".

Now here comes the hard part, is it possible to someway turn around this to get the key when we know encrypted, decrypted link , and this algo???

If that's possible than someone smarter than me can make some decoding code based on this encoding one, we can get the key that is the same for all site content, and use this to make some plugins... :)
 

nothere

Banned
Nov 25, 2012
1,036
0
0
Good work Shani :).
We already have a url resolver for allmyvideos (if it still works?) so it would be just a case of passing the decrypted url to urlresolver.
 

shani_08

Banned
Nov 25, 2013
112
0
0
Success at last!

OK, in that case, here is the code, I have tested 3-4 urls and those worked ok.

copy the decrypter contents from Here

Now, save that file as gledajfilmDecrypter.py

to test this code, in your test client, import the class first, like
Code:
import gledajfilmDecrypter
create an object of the class provided in that code and call the function,
Code:
x = gledajfilmDecrypter.gledajfilmDecrypter(198,128)# create the object

#now call
print x.decrypt('df236814880713e784e099b26a27569f689be53883b2cc6fc841ff5a502c9a80692ca67b51a53e0fcc16345858d2ecf6','O8DwsiRUOEqnkcJxbK3X','ECB').split('\0')[0];
First Param is that encrpted text, no leading gledaj*, second is the Code, which remains constant and third param is also constant, leave it like that.
It should print the uncrypted url. Like is said browsing that url directly wont work as it expecting a Post instead of Get and then you have to so some work to get the correct URL. but if the urlresolver is available then someone should test it there first.


-shani
 

shani_08

Banned
Nov 25, 2013
112
0
0
Urlresolver should be working now

Lastly, since i am a sucker to finish the job, the urlresolver is working if we just change one line of code there.

open the Allmyvideos.py in urlresolver and change following line
Code:
 r = re.search('"file" : "(.+?)"', html)
to
Code:
 r = re.search('"file" : "(http.+?)"', html)
Thats it and it should start playing those unencrypted links.

-Shani
 

shani_08

Banned
Nov 25, 2013
112
0
0
Should be possible but the decode code and logic both are different for each site. I have discovered 3 variations.
Will give it a try later.
 

shani_08

Banned
Nov 25, 2013
112
0
0
But I need to know why you need those? As I am receiving requests from several people to earn money from this release paid android apps etc.
other than addon use in won't entertain the request.
 

shani_08

Banned
Nov 25, 2013
112
0
0
Thanks, i checked and its possible to cracked that site. So complete your Addon up to Play video, categories/settings/video listing etc should be working and search etc as well, only the play wont work as you dont know how to unencrypt, Share that Addon with me, and i will send you the rest of code to unlock and your Addon should be completed. Is it fair?
 

shani_08

Banned
Nov 25, 2013
112
0
0
Well, you said you looking to write an addon, if so, the key will be available to you when you get there.
If you just want want to see how they have encrypt/ decrypt then you have to go through the swf files. For any other reason please state correctly.
If it was difficult I would have failed myself :)
 

acid0

New member
Mar 11, 2014
4
0
0
I guess better to leave desire to write addon because I won't extract the key from a SWF. Thanks for explanation.
 

shani_08

Banned
Nov 25, 2013
112
0
0
I know English is not my first language but I was clear enough to tell you that i will send you the key and the algo once you get to video play part of the Addon.
But anyways, better luck next time, I think you understood the message here.
 

joecowboy

New member
Mar 31, 2014
12
0
0
I was looking at your decrypt code you ported from AS3 to Python very good. I am wondering if you can help me with porting the Key Decrypt function. Why I am asking Stream4k.to uses the same exact Encode.swf as gledajfilm does except for different embed keys. I figured this would make a great addition for a URL resolver for Mov**4k.to since it's now their new solution for the old Stream2k that is gone now.z

I am stuck on porting the code from AS3 to Python do to the goto statements. I can follow them but not real sure about the if (this >= 2) or while (this >= 2) statements. I know it's referring to the function itself as an object.


Example Code to grabe the encoded URL from Stream4k.to:

Code:
	if "Stream4k":
		VideoPage = HTML.ElementFromURL(HostPage).xpath('//div[@class="embed_container"]/script')[0].text.split("('")[1].split("')")[0].decode('base64', 'strict')
		VideoInfo = VideoPage.split('proxy.link=')[1].split('%')[1].split('"')[0]

		x = gledajfilmDecrypter.gledajfilmDecrypter(198,128)# create the object
		#VideoStream = x.decrypt('df236814880713e784e099b26a27569f689be53883b2cc6fc841ff5a502c9a80692ca67b51a53e0fcc16345858d2ecf6','O8DwsiRUOEqnkcJxbK3X','ECB').split('\0')[0]
		VideoStream = x.decrypt(VideoInfo, decryptKey("7195d8f072fabb791dbf3f22ccd946c2d3c8a8812b668392c5b3d286b82e96f2"), "ECB").split('\0')[0]
AS3 Key Decrypt Code:

Code:
        private function _SafeStr_4(_arg_1:Object):Object{
            goto _label_3;
            do  {
                while (_local_5 < _local_3.length) {
                    var _local_6:int = _local_3[_local_5];
                    //unresolved if
                    (_local_6 >> 12);
                    
                _label_1: 
                    _local_4.writeByte(_local_6);
                    _local_5++;
                };
                return ({"v":_local_2.decrypt(_arg_1.v, _local_4.toString(), "ECB").split(String.fromCharCode(0))[0]});
                
            _label_2: 
                var _local_4:ByteArray = new ByteArray();
                var _local_5:int;
            } while (this >= 2);
            
        _label_3: 
            _local_6 = 0;
            var _local_2:Gkencode = new Gkencode(192, 128);
            if (this < 2){
                do  {
                    _local_6 = ((this | ((((_local_6 >> 4) & 15) >> 2) << 2)) | ((_local_6 & 15) >> 2));
                    if (this >= 2) goto _label_1;
                } while (this >= 2);
                this;
            };
            var _local_3:Array = [17536, 16512, 16524, 17420, 17544, 3144, 3204, 17416, 0x4C4C, 3080, 16456, 16460, 18572, 16396, 19468, 0x4400, 19464, 16524, 18508, 17420];
            if (this >= 2) goto _label_2;
            return (this);
        }

Start of AS3 to Python Code:

Code:
def decryptKey(param1):
	_local_2 = gledajfilmDecrypter(198,128)
	_local_3 = [17536, 16512, 16524, 17420, 17544, 3144, 3204, 17416, 0x4C4C, 3080, 16456, 16460, 18572, 16396, 19468, 0x4400, 19464, 16524, 18508, 17420]
	_local_4 = bytearray()
	_local_5 = 0
	_local_6 = 0

	while _local_5 < len(_local_3):
		_local_6 = _local_3[_local_5]
		_local_6 = _local_6 >> 12
		_local_4.extend(bytes(_local_6))
		_local_5 += 1
	reVal = _local_2.decrypt(param1, str(_local_4), "ECB").split('\0')[0]

	return reVal
 
Last edited:

shani_08

Banned
Nov 25, 2013
112
0
0
Give me sometime. Later tonight I will send you the key. Just post the source html section where the flashvars are declared.
 

joecowboy

New member
Mar 31, 2014
12
0
0
Can you also help me also finish porting that AS3 Code? Once you have that code any other website that uses the exact encode.swf be easy to decode the key.

The encode.swf location is:

stream4k.to/player/plugins/2.swf

Example Flash Vars for Stream4k.to:

Code:
<object id="flashplayer" classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" width="100%" height="100%">
									<param name="movie" value="player.swf" />
									<param name="allowFullScreen" value="true" />
									<param name="allowScriptAccess" value="always" />
									<param name="FlashVars" value="plugins=/player/plugins/proxy.swf&proxy.image=0&proxy.reloader=false&proxy.link=linkcdn%2A00eef1e54a4a6e7884ea7e6076c4ce446dfb148b892d6c795a7416f054e972e0d25b9786ee916592a3b67c246f19557a0ddd03fcf86d77fb9732ccaa6fe5238b9ab835c1caca82ab30c371a272eca79f02fda966f67fd0fb132c153d4614d4362ab4f2c37fe02364aef117b3fd805404" />
									<embed name="flashplayer" src="/player/player.swf" FlashVars="plugins=/player/plugins/proxy.swf&proxy.reloader=false&proxy.image=0&screencolor=000000&autostart=false&proxy.link=linkcdn%2A00eef1e54a4a6e7884ea7e6076c4ce446dfb148b892d6c795a7416f054e972e0d25b9786ee916592a3b67c246f19557a0ddd03fcf86d77fb9732ccaa6fe5238b9ab835c1caca82ab30c371a272eca79f02fda966f67fd0fb132c153d4614d4362ab4f2c37fe02364aef117b3fd805404" type="application/x-shockwave-flash" allowfullscreen="true" allowScriptAccess="always" width="100%" height="100%" />
								</object>
 
Last edited:

shani_08

Banned
Nov 25, 2013
112
0
0
For the key, in didn't do that much hassle. I simply debug the swf and ask it to tell me the keys. So it's just not required that hassle. Will look into the code for porting once I get some breather. For time being, I will try and get you the keys later.
 

joecowboy

New member
Mar 31, 2014
12
0
0
Only difference in your python code an the decompiled version of both sites encode.swf is in the function keyExpansions:

_loc3_ = [0]*(self.Nb * (self.Nr + 1)) <==== This line is not in the decompiled versions
while _loc4_ < self.Nk:
if (_loc4_)<len(param1)/4: <====This line is not in the decompiled versions