AES encryption, HLS stream. What syntax?

Hi guys, I was on Livestreamer but somebody suggested me to try streamlink so here I am!

Sorry for my profane language but I'm no programmer.

I'm trying to download a .m3u8 stream. I'm subscribed to the service offering that stream but I wouldn't know what command to write to pass my key.
Actual website is hidden for privacy reasons.

Right now I write
streamlink "hls://https://fakelinkto.m3u8" best -o video.ts

But I receive
Failed to create decryptor: unable to open URL: https://fakelinktokey.php (403 Client error forbidden)

Would anybody point me in the right direction?
Many thanks

[skulblakka]

--http-cookie, --http-header or --http-query-param might help solving your issue.

Hey @skulblakka could you be so kind to write me an example with my syntax in the windows command prompt? Should I add those strings at the end like this:
streamlink "hls://https://fakelinkto.m3u8" best -o video.ts --http-cookie

[gravyboat]

There's a command line usage example in the docs.

[flijloku]

@rodolfofanti You can find many examples if use the search: https://github.com/chrippa/livestreamer/issues?utf8=%E2%9C%93&q=--http-cookie

Ok, thank you guys. After a quick glance at the docs I wrote this command:
streamlink "hls://https://site.m3u8" best -o video.ts --http-cookie KEY=0xb87f84a4ced179cfc020624ade3d7f71

I got the key from the m3u8 manifesto, I'll paste the first few lines:
#EXTM3U #EXT-X-VERSION:3 #EXT-X-MEDIA-SEQUENCE:0 #EXT-X-ALLOW-CACHE:YES #EXT-X-TARGETDURATION:13 #EXT-X-KEY:METHOD=AES-128,URI="https://site/key.php",IV=0xb87f84a4ced179cfc020624ade3d7f71

But there's probably something wrong in the syntax since it still telling me "failed to create decryptor"

[flijloku]

As I understand you may be required developer tools in the browser or programs such as Wireshark to form a correct command.

[skulblakka]

streamlink "hls://https://site.m3u8" best -o video.ts --http-cookie KEY=0xb87f84a4ced179cfc020624ade3d7f71

Correct my if I'm wrong, but unless the key is actually named "KEY" you have to find the correct name for the value.

[beardypig]

@rodolfofanti you need to find the authentication cookie for the site, which you can probably find using the developer tools in your browser (as @flijloku mentioned). The cookie is needed to authenticate you so you can get the key, and you set it with --http-cookie option. The 0xb87f84a4ced179cfc020624ade3d7f71 you had before is some extra data needed for AES (the Initialization vector, IV).

Hey @beardypig I got all the details from the Chrome console and I also found a similar case to mine in another post where a user suggested this command which I tried:

streamlink --http-header "Cookie=CloudFront-Signature=JGMFS1pfIWiwG58vKIf0WECwmsLJHRKvN3hSGpTikipKaEhmKpkzv0l9cc4YMgZL~JPc4mptxri30KCgt~tBytDWv4a74IyR5Gj6f42ZsXBjaF3ENpOnqFrEchL8m5sH4~j2NMpFEANVciLu01vdnLWcUurpy8IVnMO3LuhwlCVjc8drl12AnvFOg5QYXd93jgPydQzy4wAXTeQfE3mChbTlQ1Hl87N9CHas7l-gKqNs5gGy1L8SDpLhQUc-pWGayOGowokO1Ky29yuB--w4wYP08r5vYvaZJM05I5tvSrQQvNtcT0PUo64KZy5FGwGKI0c4SzaB5mIKd7L2uzVOzA__;CloudFront-Policy=CiAgICAgICAgICAgIHsgCiAgICAgICAgICAgICAgICJTdGF0ZW1lbnQiOiBbCiAgICAgICAgICAgICAgICAgIHsgCiAgICAgICAgICAgICAgICAgICAgICJSZXNvdXJjZSI6Imh0dHBzOi8vZDh1MzFpeWNlOXhpYy5jbG91ZGZyb250Lm5ldC8zNi8xLyoiLAogICAgICAgICAgICAgICAgICAgICAiQ29uZGl0aW9uIjp7CiAgICAgICAgICAgICAgICAgICAgICAgICJEYXRlR3JlYXRlclRoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTQ4MzM5NDM1Nn0sCiAgICAgICAgICAgICAgICAgICAgICAgICJEYXRlTGVzc1RoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTQ4MzQ4MDc1Nn0KICAgICAgICAgICAgICAgICAgICAgfSAKICAgICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICBdIAogICAgICAgICAgICB9CiAgICAgICAg;CloudFront-Key-Pair-Id=APKAJHWRPDT6BGTTH7LA" "hlsvariant://https://link.m3u8" best -o video.ts

Still I receive same error: 403 Forbidden for URL.
Any clue? Maybe am I typing something wrong?
thanks

[beardypig]

It's hard to say, there might be other cookies, or something else. Would be easier to tell with the actual URL :-)

@beardypig This is one of the URLs

https://d8u31iyce9xic.cloudfront.net/36/1/part1.m3u8?Policy=CiAgICAgICAgICAgIHsgCiAgICAgICAgICAgICAgICJTdGF0ZW1lbnQiOiBbCiAgICAgICAgICAgICAgICAgIHsgCiAgICAgICAgICAgICAgICAgICAgICJSZXNvdXJjZSI6Imh0dHBzOi8vZDh1MzFpeWNlOXhpYy5jbG91ZGZyb250Lm5ldC8zNi8xLyoiLAogICAgICAgICAgICAgICAgICAgICAiQ29uZGl0aW9uIjp7CiAgICAgICAgICAgICAgICAgICAgICAgICJEYXRlR3JlYXRlclRoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTQ4MzUyMTA5N30sCiAgICAgICAgICAgICAgICAgICAgICAgICJEYXRlTGVzc1RoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTQ4MzYwNzQ5N30KICAgICAgICAgICAgICAgICAgICAgfSAKICAgICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICBdIAogICAgICAgICAgICB9CiAgICAgICAg&Signature=LhjQreNWqs0X1r80Lh5sX3upR9H3926JL7F45O~t1QQ31gJlaEGy-~wqhzjVNX-emU~pVurwnLw3FDuxGq6m5GgJD7BPa3tPkaPgS~BpOrlZakgSDj~mTLhC8nEtN4OEdwVUpuGKoNJDu2qYtMOD2rokNbHNvDn3rBu0~WM4ErbDQ2UMZmKvW7lPBYGUUSFLTB285acro84~tisTcRCHV8BVBG8aP~FhyJ5-o4qio7iSZfnTPDOO1c60X6NN8QiX2QaWAa9lL-vORA8NpFTBji0QLVEJlwcP9PCv1TMCyOwxNIiknSj0NBgeIMmiCANAV~H6zhCG08ClIZTTg2JhVA__&Key-Pair-Id=APKAJHWRPDT6BGTTH7LA

[beardypig]

Cool. I think you'll need the cookies from the main site (after you have logged in) rather than cloudfront, as the key is hosted on the main site. I cannot test it as I don't have an account :)

Thanks @beardypig . Now pardon my illiteracy but could you suggest me how to retrieve that? So do you think that those values aren't the actual keys?

[beardypig]

You should be able to retrieve it using your browsers developer tools or a debugging proxy like mitmproxy, Charles, or fiddler. I mainly use Chrome developer tools, you can find the cookies in a couple of places under the dev tools: under Network, you can select a request (you should be able to see a request to key.php and in the Headers tab you'll see Request Headers including the Cookie header, which you'll need to copy and include with --http-cookie. For example, if the Requests Headers lists something lke

Cookie: secret=dfghjk4567yhjkdwqd; something=else

then you need to run streamlink with the --http-cookie "secret=dfghjk4567yhjkdwqd; something=else" argument :)