STREAMING!!!!!!! *READ*

[arris69]

well..
after decrypt Km with kpriv_rx whitin 200ms one would send the E_kh(E_kh(k_m))=k_m
after generate r_tx the tv doesnt send acknoledge just send the codes to it. difference between normal and hack is in red , so u should use the red ones. the thing is it requires acces on tv to send captured E_kh_km from tv to phone. u see that root acces on tv is required (not the fake-root imho).

what you mean with "red one"??? and what you mean with "fake-root"???

this version can use a simple authentication via phone since it allready connected. so if u have the Ekpub_rx(km) then u can start phone multiview and let wireshark sit in between phone output to wireshark and wireshark to tv. so wireshark sends returncodes instead of phone sending them.

wireshark is desined for caprture data and not for send it...

this way u get data back from tv which holds the masterkey,but it require a samsung tv with a samsung s2 or s3 phone (or one that actually works with multiview/dualview)
another thing :
"Please note that this is not sufficient for decrypting the transmited audio/video content between the two devices. This would require that we know the license constant lc123, which is available only to HDCP licensees."

the goal here is to get the hdcp auth without a phone to let the tv start the streaming, the encryption can be turned then off on tv with a widget/patch/or whatever...

[dajojo]

what you mean with "red one"??? and what you mean with "fake-root"???

the red one referring to writing on the page u showed me. fake-root as in no real root without restriction on my es8000

wireshark is desined for caprture data and not for send it...

it states so on the page so i guess it would need to send that data in order to get the masterkey.

the goal here is to get the hdcp auth without a phone to let the tv start the streaming, the encryption can be turned then off on tv with a widget/patch/or whatever...

oki i got ya.. then why not clone the phone hdcp sequence on pc ? the authenthication on tv concerning acces to tv is not the problem i guess ?
it would need HDCPv2 server on TCP port 9999 on pc and the keys right ?
i use teamview android to show my s3 on the pc and there i start smartview.. works too

[CanTR]

curl52 empty reply from server

[tobarbaro]

Hi,

I was reading all the stuff in this post, I have made an Xcode with GCDAsyncSocket, I did the remote iphone part and everything was ok, register de iphone on TV an controls it, but when I try to StartCloneView the TV always ask me to allow a new Device, I accept on TV and then throws me the InvalidDevice message, I think it has to do with the user agent im sending.

I did not understand the DRM part.

here is the remote Xcode.

Code: Select all

NSString* key = [command.arguments objectAtIndex:0];
    NSString* tvip = [command.arguments objectAtIndex:1];    

    
    NSString *myip = [self getIPAddress]; //Doesn't seem to be really used
    NSString *mymac = [self getMacAddress]; //Used for the access control/validation, but not after that AFAIK
    NSString *appstring = @"iphone..iapp.samsung";//@"iphone.iapp.samsung"; //What the iPhone app reports
    NSString *tvappstring = @"iphone.UN32F4300.iapp.samsung"; //Might need changing to match your TV type (I change it for my TV Model)
    NSString *remotename = [[UIDevice currentDevice] name]; //What gets reported when it asks for permission/also shows in General->Wireless Remote Control menu
    
    
    sckt = [[GCDAsyncSocket alloc] initWithDelegate:self delegateQueue:dispatch_get_main_queue()];
    NSError *err = nil;
    if (![sckt connectToHost:tvip onPort:55000 error:&err]) // Asynchronous!    
    {        
        NSLog(@"NEL: %@", err);
        pluginResult = [CDVPluginResult resultWithStatus:CDVCommandStatus_ERROR messageAsString:@"Lost streaming"];    
        [self.commandDelegate sendPluginResult:pluginResult callbackId:command.callbackId];
        return;
    }
        
    NSString *messagepart1 = [NSString stringWithFormat:@"d\0%@\0%@%@\0%@%@\0%@",
                                [self chr:[[self base64Encode:myip] length]],
                                [self base64Encode:myip],
                                [self chr:[[self base64Encode:mymac] length]],
                                [self base64Encode:mymac],
                                [self chr:[[self base64Encode:remotename] length]],
                                [self base64Encode:remotename]
                             ];
                                 
    NSString *part1 = [NSString stringWithFormat:@"\0%@\0%@%@\0%@",
                        [self chr:[appstring length]],
                        appstring,
                        [self chr:[messagepart1 length]],
                        messagepart1
                      ];     
                      
    [sckt writeData:[part1 dataUsingEncoding:NSASCIIStringEncoding] withTimeout:5 tag:0];
    
    NSString *messagepart2 = @"?\0";
    NSString *part2 = [NSString stringWithFormat:@"\0%@\0%@%@\0%@",
                        [self chr:[appstring length]],
                        appstring,
                        [self chr:[messagepart2 length]],
                        messagepart2
                      ];  
    
    [sckt writeData:[part2 dataUsingEncoding:NSASCIIStringEncoding] withTimeout:5 tag:1];
                        
    NSString *messagepart3 = [NSString stringWithFormat:@"\0\0\0%@\0%@",                                
                                [self chr:[[self base64Encode:key] length]],
                                [self base64Encode:key]
                             ];
    
    NSString *part3 = [NSString stringWithFormat:@"\0%@\0%@%@\0%@",
                        [self chr:[tvappstring length]],
                        tvappstring,
                        [self chr:[messagepart3 length]],
                        messagepart3
                      ];
        
    
    [sckt writeData:[part3 dataUsingEncoding:NSASCIIStringEncoding] withTimeout:5 tag:2];

    NSString *response = [NSString stringWithFormat:@"%@%@%@", part1, part2, part3];              
            
    [sckt disconnectAfterWriting];

//functions
- (NSString *)base64Encode:(NSString *)plainText
{
    NSData *plainTextData = [plainText dataUsingEncoding:NSUTF8StringEncoding];
    NSString *base64String = [plainTextData base64EncodedString];
    return base64String;
}

- (NSString *)chr: (int) asciiCode
{
    return [NSString stringWithFormat:@"%c", asciiCode];
}

and here is the code for the StartCloneView:

Code: Select all

sckt = [[GCDAsyncSocket alloc] initWithDelegate:self delegateQueue:dispatch_get_main_queue()];
    NSError *err = nil;    
    if (![sckt connectToHost:@"192.168.0.5" onPort:7676 error:&err]) // Asynchronous!    
    {        
        NSLog(@"NEL: %@", err);
        pluginResult = [CDVPluginResult resultWithStatus:CDVCommandStatus_ERROR messageAsString:@"Lost streaming"];    
        [self.commandDelegate sendPluginResult:pluginResult callbackId:command.callbackId];
        return;
    }
    NSString *soap = @"\r\n\r\n<s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:StartCloneView xmlns:u=\"urn:samsung.com:service:MainTVAgent2:1\"><ForcedFlag>Normal</ForcedFlag></u:StartCloneView></s:Body></s:Envelope>";
    NSString *headers = @"POST /smp_4_ HTTP/1.0\r\nHOST: 192.168.0.5:7676\r\nCONTENT-LENGT: 273\r\nCONTENT-TYPE: text/xml;charset=\"utf-8\"\r\nUSER-AGENT: DLNADOC/1.50 SEC_HHP_*/1.0\r\nSOAPACTION: \"urn:samsung.com:service:MainTVAgent2:1#StartCloneView\"";
    NSString *request = [NSString stringWithFormat:@"%@%@",headers,soap];
    [sckt writeData:[request dataUsingEncoding:NSASCIIStringEncoding] withTimeout:10 tag:0];
    [sckt readDataWithTimeout:30000 tag:0];
    
    [sckt disconnectAfterReadingAndWriting];

I know im ignoring something, if you see something please help us :O (sorry for my english)