Extracting Widevine from ChromeOS recovery images

Extracting from stable recovery releases

This is what is implemented currently in InputStream Helper.

1. Download one of the images from https://dl.google.com/dl/edgedl/chromeos/recovery/recovery.json
2. <TBD>

Extracting from development / canary images

Requesting newer development images

The chrome_os_update project was instrumental to understand the official update process for ChromeOS.

You can request newer ChromeOS images from https://tools.google.com/service/update2

Perform the following request:

$ curl -sL -X POST --data @payload.xml https://tools.google.com/service/update2

Using the following payload for canary:

<?xml version="1.0" encoding="UTF-8"?>
<request protocol="3.0" version="ChromeOSUpdateEngine-0.1.0.0" updaterversion="ChromeOSUpdateEngine-0.1.0.0" ismachine="1">
  <os version="Indy" platform="Chrome OS" sp="12739.111.0_armv7l"></os>
  <app appid="{90F229CE-83E2-4FAF-8479-E368A34938B1}" version="12739.111.0" track="canary-channel" lang="en-US" board="elm-signed-mp-v3keys" hardware_class="ELM C2Q-42I-L7G" delta_okay="false" fw_version="" ec_version="">
    <ping active="1" a="-1" r="-1"></ping>
    <updatecheck></updatecheck>
  </app>
</request>

Using the following payload for stable:

<?xml version="1.0" encoding="UTF-8"?>
<request requestid="33041542-1d01-475b-84fd-ccb6e8e4e3cb" sessionid="deea5477-4296-41ed-b627-2dd1063d311a" protocol="3.0" updater="ChromeOSUpdateEngine" updaterversion="0.1.0.0" installsource="ondemandupdate" ismachine="1">
    <os version="Indy" platform="Chrome OS" sp="12499.51.0_x86_64"></os>
    <app appid="{BD7F7139-CC18-49C1-A847-33F155CCBCA8}" version="12499.51.0" track="stable-channel" lang="en-US" board="nocturne-signed-mpkeys" hardware_class="NOCTURNE D5B-A5F-B47-H6A-A5L" delta_okay="false" fw_version="" ec_version="" installdate="4683" >                                                                
        <updatecheck></updatecheck>
    </app>
</request>

You can assemble your own image based on the following information:

• A list of available versions
  • https://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices
  • https://chromiumdash.appspot.com/serving-builds
  • http://omahaproxy.appspot.com/
• A list of appids to use
  • http://cros-omahaproxy.appspot.com/all

Extracting file systems from ChromeOS images

The tools from the official update_engine project were useful to inspect and extract the partitions from ChromeOS update images.

$ ./update_engine/scripts/payload_info.py chromeos_13514.0.0_elm_canary-channel_full_mp-v2.bin-gvtdoyzumi4dly2lmo6xq6lmx2fsb4gm.signed 
Payload version:             2
Manifest length:             56710
Number of partitions:        2
  Number of "root" ops:      996
  Number of "kernel" ops:    8
Timestamp for root:          
Timestamp for kernel:        
Block size:                  4096
Minor version:               0

Extract the root images from the ChromeOS image:

$ ./update_engine/scripts/paycheck.py chromeos_13514.0.0_elm_canary-channel_full_mp-v2.bin-gvtdoyzumi4dly2lmo6xq6lmx2fsb4gm.signed --out_dst_part_paths kernel.img root.img --part_names kernel root

 And there is a libwidevinecdm.so in /opt/google/chrome in the root.img.