KWTX-DT1

[bugdaboss]

Channel ID

KWTXDT1.us

Stream URL (optional)

No response

Notes (optional)

Stream 1:
https://dai2-playlistserver.aws.syncbak.com/cpl/13353657/dai2v5/1/7b2264657669636554797065223a2242726f77736572222c22616b616d61694d7670644b6579223a6e756c6c7d/master.m3u8?access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjIwMTYwNDAxIn0.eyJkZXZpY2VUeXBlIjoiQnJvd3NlciIsInNpZCI6MzIzLCJjaWQiOjExMzI0LCJtaWQiOjEzMzUzNjU3LCJtayI6bnVsbCwib29tIjpmYWxzZSwiaXAiOiIxMjkuMjIyLjc3LjI0MyIsInVpcCI6IjEyOS4yMjIuNzcuMjQzIiwiZG1hIjo2MjMsInNzaWQiOiI1NDE1OTMyYTlmNmI0YTlkYTkzNDRmMWFkNzcyYjkzNiIsInNuIjoiV2ViIGE5YWYwM2U3OWYgKCBudWxsICkiLCJ1aWQiOm51bGwsImFwc3QiOm51bGwsInNiZXAiOmZhbHNlLCJjc2IiOmZhbHNlLCJtZDUiOiI2YTI4YzI2M2VjMmQxYTk0MzdkYzlmMjBjNjk5MGU1NCIsImlhdCI6MTY4MjQwNDcyNCwiZXhwIjoxNjgyNDA1MDI0LCJhdWQiOiJodHRwczovL3BsYXlsaXN0c2VydmVyLmF3cy5zeW5jYmFrLmNvbSIsImlzcyI6IlN5bmNiYWsgR3JhcGhRTCBBUEkiLCJzdWIiOiJpSGowYXFPNWtQQy1VNlpzZWttd2N0dDNDRkFiZU5tX0h2RlJkenhhVFBDMVh6amlvQSJ9.aFtB3rMewQC7mUfzo6p83VGDU7zN8Z2du4STKNHrYaQ

Stream 2:

https://dai2-playlistserver.aws.syncbak.com/cpl/13729466/dai2v5/1/7b2264657669636554797065223a2242726f77736572222c22616b616d61694d7670644b6579223a6e756c6c7d/master.m3u8?access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjIwMTYwNDAxIn0.eyJkZXZpY2VUeXBlIjoiQnJvd3NlciIsInNpZCI6MzIzLCJjaWQiOjExOTI5LCJtaWQiOjEzNzI5NDY2LCJtayI6bnVsbCwib29tIjp0cnVlLCJpcCI6IjEyOS4yMjIuNzcuMjQzIiwidWlwIjoiMTI5LjIyMi43Ny4yNDMiLCJkbWEiOjYyMywic3NpZCI6ImUxYTQ1MzA1MzFkYzQ4NzY5ZjdlNzExY2E3NjZmODRiIiwic24iOiJXZWIgYTlhZjAzZTc5ZiAoIG51bGwgKSIsInVpZCI6bnVsbCwiYXBzdCI6bnVsbCwic2JlcCI6ZmFsc2UsImNzYiI6ZmFsc2UsIm1kNSI6IjU5Y2ViNzgxM2EyMjdkNjQ4NWI3NDFlYzcxYzUzM2M3IiwiaWF0IjoxNjgyNDA1MTQ3LCJleHAiOjE2ODI0MDU0NDcsImF1ZCI6Imh0dHBzOi8vcGxheWxpc3RzZXJ2ZXIuYXdzLnN5bmNiYWsuY29tIiwiaXNzIjoiU3luY2JhayBHcmFwaFFMIEFQSSIsInN1YiI6ImlIajBhcU81a1BDLVU2WnNla213Y3R0M0NGQWJlTm1fSHZGUmR6eGFUUEMxWHpqaW9BIn0.fg7270zTOPbz_0nHXBzq8Oyjt4O38RJofeCi-MdG65E

Please confirm the following

• I have read Contributing Guide

[azgaresncf]

both streams have "forbidden" response

[bugdaboss]

im really not sure, i ran it through the thing the guide says and it worked fine, odd

https://streamtest.in/logs/https-dai2-playlistserver-aws-syncbak-com-cpl-13353657-dai2v5-1-7b2264657669636554797065223a2242726f77736572222c22616b616d6169-f6b32288-df96-48ad-b6ef-4bb0f36d8f8c
https://streamtest.in/logs/https-dai2-playlistserver-aws-syncbak-com-cpl-13353657-dai2v5-1-7b2264657669636554797065223a2242726f77736572222c22616b616d6169

https://streamtest.in/logs/https-dai2-playlistserver-aws-syncbak-com-cpl-13729466-dai2v5-1-7b2264657669636554797065223a2242726f77736572222c22616b616d6169-e292d428-2d21-4620-badd-e64b61b1c458
https://streamtest.in/logs/https-dai2-playlistserver-aws-syncbak-com-cpl-13729466-dai2v5-1-7b2264657669636554797065223a2242726f77736572222c22616b616d6169-5481c34a-a9fd-4a59-9ce3-b917c0a949f5

[bugdaboss]

both streams have "forbidden" response

if you can figure it out heres the link to the site: https://www.kwtx.com/livestream/

[azgaresncf]

it is really odd, i've ran it through VLC and it dosen't work at all

[azgaresncf]

both streams have "forbidden" response

if you can figure it out heres the link to the site: https://www.kwtx.com/livestream/

i think i will check this, thank you

[bugdaboss]

it is really odd, i've ran it through VLC and it dosen't work at all

i tried vlc like 4 times, worked just find so werid

[azgaresncf]

with the response of the GraphQL API, we can see that streams have access_token

it is so weird though

[bugdaboss]

doesnt want to work for me either now for some reason

[azgaresncf]

streams have referrer headers on their request

[azgaresncf]

i will just test something, wait a sec

[bugdaboss]

alright, keep me posted. super intrested now. seems super strange to me

[bugdaboss]

im new to this so bare with me

[bugdaboss]

did you ever find anything?

[azgaresncf]

i think i will find something, i just have no time rn

[azgaresncf]

streams are encrypted with an aes key

[azgaresncf]

i think i will add it through my repo so you can see it with vlc or kodi, it is just gonna be a little bit tough

[bugdaboss]

let me know whenever you do

[azgaresncf]

don't worry :)
it will be an URL like this: https://raw.githubusercontent.com/azgaresncf/strm2hls/main/streams/KWTXDT1.m3u8

[bugdaboss]

kk how long do you think it will be?

[azgaresncf]

kk how long do you think it will be?

i don't know it all (because I don't have too much time to do this for some reasons), but i think it will be pretty easy to add it

[azgaresncf]

@bugdaboss is it the stream not 24/7?

[bugdaboss]

i do not think so, KWTX LIVE EVENTS i believe is not and only shows their "news at **" broadcasts on it

[bugdaboss]

KWTXtra is, they play 'local news live' on it, and maybe the "news at **" broadcasts too but im not sure about the last part

[bugdaboss]

KWTXtra, plays local news live, then does this programs. the live events stream will not do programs.

[PopeyeTheSai10r]

streams are encrypted with an aes key

I think you should be looking at the media.m3u8

[PopeyeTheSai10r]

This one is working for now. Not sure how much longer.

https://dai2-playlistserver.aws.syncbak.com/media.m3u8?bitrate=3659760&session=a11ebd08251541568a8cf3ab46fa2ca0

[azgaresncf]

master.m3u8 redirect to media.m3u8

[azgaresncf]

the stream is now completely black

[azgaresncf]

what is that stream URL?
https://live-247.clevr.me/rm247/ngrp:rm247_all/master.m3u8
(it is just a weather media...)

[JakeStorm-Dev]

Just a few notes to add in trying to figure out how Gray Television functions:

1. M3U8 Link Breakdown

ABC - WLOX MS
------------------------------------------------------------------------------
Full Link = https://dai2-playlistserver.aws.syncbak.com/cpl/18548900/dai2v5/1/7b2264657669636554797065223a382c22616b616d61694d7670644b6579223a6e756c6c7d/master.m3u8?access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjIwMTYwNDAxIn0.eyJkZXZpY2VUeXBlIjo4LCJzaWQiOjc1OCwiY2lkIjoxNzI2NywibWlkIjoxODU0ODkwMCwibWsiOm51bGwsIm9vbSI6dHJ1ZSwiaXAiOiIxMDcuMTQ2LjU2LjEyMCIsInVpcCI6IjEwNy4xNDYuNTYuMTIwIiwiZG1hIjo1MzQsInNzaWQiOiJhZDY4ZGI3ZDI5ODk0MWRiODAxN2JhNzM2OGEzNWZlZCIsInNuIjoiV2ViIDA0MDYwODQxYTQgKCBudWxsICkiLCJ1aWQiOm51bGwsImFwc3QiOm51bGwsInNiZXAiOmZhbHNlLCJjc2IiOmZhbHNlLCJtZDUiOiIzNzVhMGFhZGFmMmFhZjM4ODAxNDAzYmRkMDVkNjg0YyIsImlhdCI6MTcxMjkwMjU4MywiZXhwIjoxNzEyOTAyODgzLCJhdWQiOiJodHRwczovL3BsYXlsaXN0c2VydmVyLmF3cy5zeW5jYmFrLmNvbSIsImlzcyI6IlN5bmNiYWsgR3JhcGhRTCBBUEkiLCJzdWIiOiJlaFVnMUc1NnlEakNVaEo2bkl5X240aWVMV2c5Wk85aUM4SVJ5b3pCZlZoNW5CVEtLSCJ9.riNB9jL_gdNffq4VE9rd7YSxznSAX1dJc7F75aDG7v4
------------------------------------------------------------------------------
Server = https://dai2-playlistserver.aws.syncbak.com
------------------------------------------------------------------------------
Server Storage Location = /cpl/18548900/dai2v5/1/
------------------------------------------------------------------------------
Customer ID = /7b2264657669636554797065223a382c22616b616d61694d7670644b6579223a6e756c6c7d/
------------------------------------------------------------------------------
M3U8 = /master.m3u8
------------------------------------------------------------------------------
Syncbak API Token = eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjIwMTYwNDAxIn0.eyJkZXZpY2VUeXBlIjo4LCJzaWQiOjc1OCwiY2lkIjoxNzI2NywibWlkIjoxODU0ODkwMCwibWsiOm51bGwsIm9vbSI6dHJ1ZSwiaXAiOiIxMDcuMTQ2LjU2LjEyMCIsInVpcCI6IjEwNy4xNDYuNTYuMTIwIiwiZG1hIjo1MzQsInNzaWQiOiJhZDY4ZGI3ZDI5ODk0MWRiODAxN2JhNzM2OGEzNWZlZCIsInNuIjoiV2ViIDA0MDYwODQxYTQgKCBudWxsICkiLCJ1aWQiOm51bGwsImFwc3QiOm51bGwsInNiZXAiOmZhbHNlLCJjc2IiOmZhbHNlLCJtZDUiOiIzNzVhMGFhZGFmMmFhZjM4ODAxNDAzYmRkMDVkNjg0YyIsImlhdCI6MTcxMjkwMjU4MywiZXhwIjoxNzEyOTAyODgzLCJhdWQiOiJodHRwczovL3BsYXlsaXN0c2VydmVyLmF3cy5zeW5jYmFrLmNvbSIsImlzcyI6IlN5bmNiYWsgR3JhcGhRTCBBUEkiLCJzdWIiOiJlaFVnMUc1NnlEakNVaEo2bkl5X240aWVMV2c5Wk85aUM4SVJ5b3pCZlZoNW5CVEtLSCJ9
------------------------------------------------------------------------------
Encryption Variable = .riNB9jL_gdNffq4VE9rd7YSxznSAX1dJc7F75aDG7v4
------------------------------------------------------------------------------

Note in the above example, the API token is present but appended with an encryption variable. The mystery is in how the encryption variable is generated and inserted.

2. Sessions and Encryption

Under most circumstances, if the video plays in the browser, it can play in external players such as VLC. The issue is determining the proper M3U8 file. In most cases these days, providers are using some form of basic defeat to achieve this. Companies such as Gray Television utilize scripts to insert encryption into the links while others redirect to server-side pregenerated encrypted links, while others still use sessioning with cookies to protect the link. Some even use a combination of these. There is no one size fits all solution to pulling the M3U8's. The thing to remember is that Sessioning, usually with masked blob files, will not generate a permanent link. Instead the session is time based and/or limited to single use session keys. So it's important to know that pulling the live stream's session is quite pointless toward determining a permanent link. As suck you have to look before the blob file, not after:

In this example the blob shows as :

------------------------------------------------------------------------------
blob:https://www.wlox.com/3107614f-1841-423b-b316-06f31bb6b22d
------------------------------------------------------------------------------

The link itself is not a valid link and only being handled within the browser session. Note that the aeskey encryption occurs AFTER the master and primary media m3u8's.

In this example the aeskey shows as :

------------------------------------------------------------------------------ 
https://dai2-playlistserver.aws.syncbak.com/aeskey?data=beee05b7e0ae3dab4e64047e5587c315a4115f064f918c025837b1f127feacd9
------------------------------------------------------------------------------

So again, you'll want to focus on links prior to encryption as your player is not set to directly decrypt. In the case of VLC, it can only handle decryption on a case to case basis or with use of a plugin. But this is not ideal as the channels themselves are not uniform with the same encryption key. That said, we then only need focus on the first m3u8 generated (master.m3u8) and the redirection to the ts stream m3u8 (media.m3u8). Remember to always look above the blobs for the m3u8's as they are not script processed to further defeat or obscure or add further injections.

3. The Encryption Variable Conundrum

In the above example, the API token is appended with an encryption variable. This variable is single use and changes with each refresh of the page. Note a quick way to drill drown to the correct m3u8 is to refresh (reload) your browser page and see what changes. If something changes, it is by definition a variable. The key to getting a working m3u8 is to have no variables (else you will have to update that variable every time you want to watch. While that can be achieved with scripts, the ideal solution is direct access to the source. Once you start adding in scripts to defeat their protections, you may be running afoul of anti-paracy laws. But do note that simple refresh scripts do not violate any laws, after all, they are providing all the information and no actual hacking has taken place.

Anyway, the issue here in this example is that the API key is being appended with an encryption variable (everything after the period in the master.m3u8 link). This appears to be added in via scripting. Scrolling up a bit in the developer network tab reveals the point in which the API token is appended:

------------------------------------------------------------------------------
https://www.wlox.com/pf/api/v3/content/fetch/syncbak-get-tokens?query={"deviceId":"EwMLOyxsacYTLU9XDahqlUwsJSheG2SBzNhIStZZxrPEt3UEld","queryString":"{\"query\":\"+query+GrayWebAppsDefaultData+($expirationSeconds:+Int,+$vodCount:+Int){+liveChannels+{+id+title+description+callsign+listImages+{+type+url+size+}+posterImages+{+type+url+size+}+isNew+type+status+onNow+{+id+title+description+episodeTitle+tvRating+startTime+endTime+duration+isLooped+isOffAir+airDate}+onNext+{+id+title+description+episodeTitle+tvRating+startTime+endTime+duration+isLooped+isOffAir+airDate}+isNielsenEnabled+isClosedCaptionEnabled+location+networkAffiliation+taxonomy+{+facet+terms+}+}+firstLiveChannel:+liveChannels(first:1)+{+id+title+description+callsign+listImages+{+type+url+size+}+posterImages+{+type+url+size+}+isNew+type+status+onNow+{+id+title+description+episodeTitle+tvRating+startTime+endTime+duration+isLooped+isOffAir+airDate}+onNext+{+id+title+description+episodeTitle+tvRating+startTime+endTime+duration+isLooped+isOffAir+airDate}+isNielsenEnabled+isClosedCaptionEnabled+location+networkAffiliation+taxonomy+{+facet+terms+}+streamUrl(expiresIn:+$expirationSeconds)+}+videoOnDemand+(first:+$vodCount){+id+title+description+duration+airDate+listImages+{+type+url+size+}+posterImages+{+type+url+size+}+}+}\",\"variables\":{\"expirationSeconds\":300,\"vodCount\":12}}"}&_website=wlox
------------------------------------------------------------------------------

By viewing the Payload, Preview, and Response tabs, we can note the following:

------------------------------------------------------------------------------
{,…}
apiToken
: 
"eyJhbGciOiJIUzI1NiIsImtpZCI6IjA0MDYwODQxYTQ0NDQ3ZWVhZGFmZDgyYmI2OWQwMGQ0IiwidHlwIjoiSldUIn0.eyJhcHBOYW1lIjoiV0xPWCBMb2NhbCBOZXdzIiwiYXBwUGxhdGZvcm0iOiJ3ZWIiLCJhdWQiOiJodHRwczovL3N5bmNiYWstYXBpLmF3cy5zeW5jYmFrLmNvbSIsImJ1bmRsZUlkIjoiZGV2IiwiZGV2aWNlSWQiOiJFd01MT3l4c2FjWVRMVTlYRGFocWxVd3NKU2hlRzJTQnpOaElTdFpaeHJQRXQzVUVsZCIsImRldmljZVR5cGUiOjgsImV4cCI6MTcxMzkwMTU1MywiaWF0IjoxNzEzODE1MTUzfQ.Wx8sotZZMgkD2Nk2HqTrhazrB0qz1SRphUz_sTrfWK0"
deviceId
: 
"EwMLOyxsacYTLU9XDahqlUwsJSheG2SBzNhIStZZxrPEt3UEld"
query
: 
"{\"query\":\" query GrayWebAppsDefaultData ($expirationSeconds: Int, $vodCount: Int){ liveChannels { id title description callsign listImages { type url size } posterImages { type url size } isNew type status onNow { id title description episodeTitle tvRating startTime endTime duration isLooped isOffAir airDate} onNext { id title description episodeTitle tvRating startTime endTime duration isLooped isOffAir airDate} isNielsenEnabled isClosedCaptionEnabled location networkAffiliation taxonomy { facet terms } } firstLiveChannel: liveChannels(first:1) { id title description callsign listImages { type url size } posterImages { type url size } isNew type status onNow { id title description episodeTitle tvRating startTime endTime duration isLooped isOffAir airDate} onNext { id title description episodeTitle tvRating startTime endTime duration isLooped isOffAir airDate} isNielsenEnabled isClosedCaptionEnabled location networkAffiliation taxonomy { facet terms } streamUrl(expiresIn: $expirationSeconds) } videoOnDemand (first: $vodCount){ id title description duration airDate listImages { type url size } posterImages { type url size } } }\",\"variables\":{\"expirationSeconds\":300,\"vodCount\":12}}"
querySignatureToken
: 
"eyJhbGciOiJIUzI1NiIsImtpZCI6IjA0MDYwODQxYTQ0NDQ3ZWVhZGFmZDgyYmI2OWQwMGQ0IiwidHlwIjoiSldUIn0.eyJhcHBOYW1lIjoiV0xPWCBMb2NhbCBOZXdzIiwiYXBwUGxhdGZvcm0iOiJ3ZWIiLCJhdWQiOiJodHRwczovL3N5bmNiYWstYXBpLmF3cy5zeW5jYmFrLmNvbSIsImJ1bmRsZUlkIjoiZGV2IiwiZGV2aWNlSWQiOiJFd01MT3l4c2FjWVRMVTlYRGFocWxVd3NKU2hlRzJTQnpOaElTdFpaeHJQRXQzVUVsZCIsImRldmljZVR5cGUiOjgsImV4cCI6MTcxMzkwMTU1MywiaWF0IjoxNzEzODE1MTUzLCJoYXNoIjoiZTEyNzBiZWY0MDdmYTBjOGE1NzIzNGMwZjliNGFmY2QifQ.EtoVMu2P6vI5Q_IG04YdMiOxZlgjbmSpJSeZsKNxyic"
_id
: 
"c032f8748ec66ab4a3391f3922a83151ac81b39815054137c82896b55b1e9559"
------------------------------------------------------------------------------

Note that it is at this moment that the API token is apended with the Encryption variable, particularly noted is that it is timed for expiration. This is why the links don't last and why it becomes headache worthy to figure out. The conundrum comes in the approach. How to append the API token ao that it registers and pulls correctly. For that we need some experimentation:

Base link + API Token (without appending the encryption):

------------------------------------------------------------------------------
https://dai2-playlistserver.aws.syncbak.com/cpl/18548900/dai2v5/1/7b2264657669636554797065223a382c22616b616d61694d7670644b6579223a6e756c6c7d/master.m3u8?access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjIwMTYwNDAxIn0.eyJkZXZpY2VUeXBlIjo4LCJzaWQiOjc1OCwiY2lkIjoxNzI2NywibWlkIjoxODU0ODkwMCwibWsiOm51bGwsIm9vbSI6dHJ1ZSwiaXAiOiIxMDcuMTQ2LjU2LjEyMCIsInVpcCI6IjEwNy4xNDYuNTYuMTIwIiwiZG1hIjo1MzQsInNzaWQiOiJhZDY4ZGI3ZDI5ODk0MWRiODAxN2JhNzM2OGEzNWZlZCIsInNuIjoiV2ViIDA0MDYwODQxYTQgKCBudWxsICkiLCJ1aWQiOm51bGwsImFwc3QiOm51bGwsInNiZXAiOmZhbHNlLCJjc2IiOmZhbHNlLCJtZDUiOiIzNzVhMGFhZGFmMmFhZjM4ODAxNDAzYmRkMDVkNjg0YyIsImlhdCI6MTcxMjkwMjU4MywiZXhwIjoxNzEyOTAyODgzLCJhdWQiOiJodHRwczovL3BsYXlsaXN0c2VydmVyLmF3cy5zeW5jYmFrLmNvbSIsImlzcyI6IlN5bmNiYWsgR3JhcGhRTCBBUEkiLCJzdWIiOiJlaFVnMUc1NnlEakNVaEo2bkl5X240aWVMV2c5Wk85aUM4SVJ5b3pCZlZoNW5CVEtLSCJ9
------------------------------------------------------------------------------
&querySignatureToken
------------------------------------------------------------------------------

To get URL we will need to be able to call the append ourselves in the link. While this can be done using a Reg Expression scrape (perhaps on a cron job), it's hardly conducive to directing the traffic to where we want it to go. In theory, we should be able to have their system generate the data as normal but for the purposes of appending or rewriting the URL into a direct connection.

That's where I will leave off for today. Will continue the experiments. If anyone else is reading this and has additional input or has solved the issue with a direct link to the m3u8 in the above example, please feel free to chime in.