Laska

Hey digip, thanks for the link! Seems the authors of this tool were forced to remove rmpte support in their successor flvstreamer. bummer :/ I have a feeling I might just miss some token or SWF player check (like location or size of the SWF) as the handshake with the calculations 'seems' to work already in the old version. but maybe rtmpdump does not recognize all command bytes yet, or Adobe changed something. I'm still trying to understand the source and all possible -options of this tool to rule out I just forgot some parameters in the command line ;) At least I found some (maybe incomplete) documentation and linked it in the first post.

Hey guys, it all started yesterday when I thought it would be no big deal to dl some mp3s from myspace. woah, I was wrong. It seems myspace.com switched to an 'RTMPE' protocol for their mp3 streams. You can use an url catcher or this premade script (http://foxylion.xail.net/myspacedump/) to capture the direct rtmp link let's parse http://www.myspace.com/feverray for a test. the first track 'When I grow up' would be rtmpe://akafms-music02.myspacecdn.com/ondemand/mp3:137/std_3f3e6f2962504f8daebeba6df6b833df now I tried with a tool called rtmpdump 1.6 (sources & binaries here), console output says: rtmpdump.exe -r rtmpe://akafms-music02.myspacecdn.com/ondemand/mp3:137/std_3f3e6f2962504f8daebeba6df6b833df -o "When I Grow Up.flv" DEBUG: Parsing... DEBUG: Parsed protocol: 3 DEBUG: Parsed host : akafms-music02.myspacecdn.com DEBUG: Parsed app : ondemand DEBUG: Parsed playpath: mp3:137/std_3f3e6f2962504f8daebeba6df6b833df DEBUG: Setting buffer time to: 36000000ms Connecting ... DEBUG: Protocol : RTMPE DEBUG: Hostname : akafms-music02.myspacecdn.com DEBUG: Port : 1935 DEBUG: Playpath : mp3:137/std_3f3e6f2962504f8daebeba6df6b833df DEBUG: tcUrl : rtmpe://akafms-music02.myspacecdn.com:1935/ondemand DEBUG: app : ondemand DEBUG: flashVer : LNX 9,0,124,0 DEBUG: live : no DEBUG: timeout : 300 sec DEBUG: Connect, ... connected, handshaking DEBUG: HandShake: Client type: 06 DEBUG: HandShake: DH pubkey position: 1215 DEBUG: HandShake: Client digest offset: 410 DEBUG: HandShake: Initial client digest: BE 6E A7 30 2C F8 D9 74 B3 D2 10 94 56 12 39 9B 79 62 AA 24 EF 91 21 78 6E 53 C8 88 2D FB 0F 4C DEBUG: HandShake: Type Answer : 06 DEBUG: HandShake: Server Uptime : 387834394 DEBUG: HandShake: FMS Version : 3.5.1.1 DEBUG: HandShake: Server DH public key offset: 90 DEBUG: HandShake: Secret key: C5 F3 E5 7A 7C 00 9F 9C BA CA 11 9A 89 67 FD 06 19 B2 D0 E1 1C 2E C4 01 BD 2E 58 F7 51 DD 33 F8 E9 B8 CE F5 D2 80 7B D1 C2 54 42 44 34 18 74 3D DE D8 4A C5 DC 7 4 75 F3 10 BF 21 AB 35 3E BF 56 D0 55 72 C5 26 80 F1 7D 18 99 2C 71 6A 0E 78 06 76 81 41 A7 E1 B2 47 B7 1E 86 54 64 D1 B8 E6 AF 71 28 03 53 9D ED 5A 83 EF D7 2D 2B FE 38 5A 50 7D D5 D6 12 CF EC 75 72 5D 26 4F D5 00 CE 2D BC DEBUG: RC4 Out Key: 54 39 6F C4 B1 2E 4F E0 A0 81 AB 1F 73 E0 82 0E DEBUG: RC4 In Key: 76 7D B7 A2 A7 66 C6 5B 85 33 A1 8F A2 33 F6 B7 DEBUG: HandShake: Client signature digest position: 410 DEBUG: HandShake: Digest key: 46 80 B3 67 87 5C 0B 9D 77 45 A4 51 D8 E7 53 55 B5 8F 7D E0 B5 67 62 09 F6 AD 08 00 83 96 A1 31 DEBUG: HandShake: Signature calculated: 54 F6 29 26 ED 0E 17 13 76 88 5D 57 0E 0F 4D CC E0 74 41 EB 68 1F 65 63 BD 3B 9C CC F0 0D 13 DF DEBUG: HandShake: Server sent signature: 54 F6 29 26 ED 0E 17 13 76 88 5D 57 0E 0F 4D CC E0 74 41 EB 68 1F 65 63 BD 3B 9C CC F0 0D 13 DF DEBUG: HandShake: Genuine Adobe Flash Media Server DEBUG: HandShake: Calculated digest key from secure key and server digest: C8 0F 93 6B 1F BA D6 23 1F C3 29 91 EA B3 B7 4E 43 07 55 B2 0B AE 24 77 E4 9F EA 6A 41 D1 B8 EE DEBUG: HandShake: Client signature calculated: 37 15 50 92 28 C6 80 B1 22 D0 01 78 A2 09 40 1B 15 43 A1 FB 24 C8 B5 DF 5E D1 EA 77 54 3C 0C D0 DEBUG: HandShake: Handshaking finished.... DEBUG: Connect, handshaked Connected... Starting download at 0.000 KB DEBUG: GetNextMediaPacket, received: server BW DEBUG: GetNextMediaPacket, received: client BW DEBUG: HandlePing, received ping. type: 0, len: 6 DEBUG: GetNextMediaPacket, unknown packet type received: 0xf0 ERROR: ReadN, RTMP recv error 10060 ERROR: ReadPacket, failed to read RTMP packet header. type: 5 Closing connection... done! Well, I know next to nothing about network protocols (I'm more into openGL gfx stuff ;)), so I don't quite get what's going on here. I see rtmpdump tries to calculate some kind of fake signature to establish a handshake. But where are these DH and secret keys taken for the calc from? is there more than one RTMPE format? Has anybody any good links to some documentation about RTMPE/RTMPTE? Do I also need some kind of session ID token before the dl starts? Do I need something more from the SWF player which normally hands over the .mp3 link (like some logic check) Can I just override the first unrecognized packet and capture a length of say 4 mb incoming data (if I don't know about how to calculate the filesize) or does 0xf0 mean the connection was terminated? Thanks for any input and help on this! Laska update: for those interested, I finally found some documentation here http://lkcl.net/rtmp/RTMPE.txt

hey Steve8x, great work! (I hope ;) couldn't test this yet because I can't resolve the dl url) I had no idea they use a token. :/ Can someone do me a fav and upload the complete src and binaries on some reliable host, like rapidshare or something? thanks a lot!! Laska _____________ Update: wooooha! downloading hq mp3s from myspace.com turned out to be a massive challenge see http://hak5.org/forums/index.php?showtopic...t=0#entry138228 for more information. If I had know this before I would have done something else, now it's too late ;)