Youku Real Video Address resolution (updated to 2016-2-28)

The algorithm of Youku video has changed several versions since November 2015 24 , and this temporary solution has received a lot of response, thank you very much! Now to this article re-revision, comprehensive and orderly complete crack ideas (including Crack method)!

By the right, this article is only for videos in m3u8 format.

a . Preparatory work

The so-called 工欲善其事 its prerequisite, do a good job in the preparation of the crack will make you more effective.

1. First prepare an HTTP grab kit, recommended on PC Fiddler or Postman,ios recommended surge

2. Prepare an iOS test device (because the Youku video is determined to play with m3u8 in Safari)

two . Grasping the package process

Take Fiddler as an example, first configure Fiddler settings and iOS devices, so that Fiddler can crawl the request data for an iOS device, this step should not be explored by yourself first.

Open Safari, enter the Youku address and enter a video to view the Fiddler window with some important information to focus on:

• Request v. Youku. Com/v_show/id_{vid}. HTML , the cookie information returned is YKSS

• Request play. Youku. Com/play/get. Json?vid={vid}&ct=12 , the cookie information of the request header YKSS and __ysuid, and the security node returned

• Finally, the m3u8 address PL is spelled out . Youku. Com/playlist/m3u8?vid=. . . ., request to get m3u8 's specific video content

The first two steps are to say, but the third part of the m3u8 so a complex string, formatted as HTTP://PL. Youku. Com/playlist/m3u8?vid=xmtqznziwodq3ng==&type=flv&ts=1452839810&keyframe=0&ep= Ciargegox8yb5spyjd8bnc6xjnigxjz3kn7p%2f5gbr8rqkevbzjpcqj21tps%3d&sid=0452839810074 12c2cb59&token=0524&ctype=12&ev=1&oip=2093868719, how did you get it? Looking back at a bunch of JS code you caught, you'll find the essence right here-Http://player. Youku. Com/embed/unifull/unifull_. JS, which is all the Youku real address of the analytic algorithm, the source is very long, if you are interested, you can format the file after reading slowly. The next section is specifically about how the algorithm is in the inside.

three . Real Address algorithm Analysis

In the important information that was noted in the steps in the previous section, get. JSON the Securiy node returned by this interface is very important to the algorithm (in fact, from the name can see its special meaning)

1 . get SID, Token and EP

The security node has two values, one is encryp_string and the other is IP.

In http://player. Youku. Com/embed/unifull/unifull_. JS , you can find YKeverywhere. M3u8src this function, in which two parameters are passed in, one is the vid of the video and the other is the format of the video fragment (e.g. "MP4").

Summarize what this method does (the algorithm needs to calculate 3 values: SID, Token, and EP):

1). encrypt_string Decode64, which is base64 decoding, to get a byte array Decoded_ep

2). Generate a secret key key_a (its value is actually fixed), using this key with Decoded_ep as the RC4 algorithm encryption, get a string temp

3). The result of temp is made up of "xxxx_xxxx", which is a SID, which is a token

4) . Generate a key Key_b (its value is also fixed), using this key with the string {Sid}_{vid}_{token} ASCII byte array whole memory RC4 algorithm encryption, get a string temp2

5). Base64 conversion to TEMP2, and then do URL encode, get EP

At this point SID, Token and EP Get it!

For RC4 plus decryption, refer to Https://zh. Wikipedia. ORG/WIKI/RC4

On the code:

2 . method for generating fixed key key_a and Key_b

If the key key_a and secret key key_b how to get interested, please continue to fineness below the content, not interested can skip this paragraph.

In http://player. Youku. Com/embed/unifull/unifull_. JS , the secret key is generated by method translate (a, b), where A is a combined string and B is a fixed target array.

The function of the translate method is to use the ASCII code of the character to deform, for each character in the combined string, if the lowercase letter A-Z, then take its ASCII code, otherwise its ASCII code +26; Then if you can find the digital in the target array, if you can find it, and the value of the code > 25, then take the code-26, otherwise take the code +97 corresponding to the character; the last group synthesizes a new string of equal numbers, which is the secret key. On the code:

The original strings for two keys were b4eto0b4 and boa4poz1

Target array: [1, 4, 7, 14,, 8, 24, +, 6,, 34, 16, 9, 10, 13, 22, 32, 29, 31, 21 , 18, 3, 2, 23, 25, 27, 11, 20, 5, 15, 12, 0, 33, 26]

(Do not ask me how to know, see JS Source of their own group, are fixed)

3 . Stitching m3u8 Address

The next step is to fill in the values in the format specified by m3u8, in the following format:

HTTP://PL. Youku. com/playlist/m3u8?vid={vid}&type={type}&ts={ts}&keyframe=1&ep ={EP}&sid={sid}&token={token}&ctype=12&ev=1&oip={OIP }

There are other variables in this string that need to be filled in, where

Type refers to the format of the video fragment in the content of m3u8, the value of SD (FLV, 3PGPHD), HD (MP4, FLVHD), ultra-clear (HD2), 1080P (HD3)

TS refers to the Unix timestamp of the current time (accurate to seconds)

OIP refers to IP in the security node

When the combination is complete, ask for the m3u8 address, and you will get a series of video clips.

4 . precautions

The algorithm logic is clear, also need to have the note point, once ignored will result in the final even if the m3u8 address is spelled out, the video content is not requested.

Review the 3 steps in section Two, with a note on each step:

The first step, request v. Youku. Com/v_show/id_{vid}. HTML , the return value will have a cookie named YKSS, which is important and cannot be lost.

A second step, request get. JSON, the first step of the COOKIE:YKSS also to send, and also to add a cookie,__ysuid= called __ysuidgetpvid (6), the algorithm see the previous update record; Referer to fill in the URL address of the video, absolutely cannot be lost, otherwise even get. JSON can return the data normally, but also can get security node, but spell out m3u8 no matter how you request can not get video content, remember Referer don't lose!

The third step, the request m3u8 address, for the time being no longer need to Bogwang as R cookie, but with youku urine sex, is not allowed to add later.

If you have any questions, please leave a message. (The following are some of the previous change records that have been voided)

————————————————————————————————————————————————————————————————

11-30 Update:

Today, another problem has been found, here to add. get. JSON when this interface returns, response with a cookie, if you provide the Web API yourself, this cookie will also be returned to the app, otherwise the application will not be able to get the full video content even if the m3u8 address is spelled out.

————————————————————————————————————————————————————————————————

12-8 Update:

Thanks to @kkia found that

Request Http://play. Youku. Com/play/get. Json?vid={vid}&ct=12 This API, HTTP requests need to take referer:{url},url as a page link to the video you need to get, otherwise there will be a non-master request error.

In addition, the cookie check mechanism is started again.

Therefore, if you encapsulate the Web API, it is recommended that each request, the contents of the m3u8 file download, build and store the temporary m3u8 file, and then return this file link to the client, and then periodically to clean up the temporary files .

————————————————————————————————————————————————————————————————

12-29 Update:

Thanks to @kkia, Name=r's cookie acquisition pathway has changed again, and the steps are updated as follows:

1. through the full video address URL (http://v. Youku. Com/v_show/id_{vid}. HTML) to get a bunch of cookies, only extract the ykss=132b825604a2f7516fd91fc0; path=/; domain=. Youku. com This cookie

2. Request get. JSON with the above named Ykss cookie, plus referer= video URL, the request results will appear in the name of a cookie named R

3. Last request m3u8 address with the cookie,referer= video URL named R, you can get the results.

————————————————————————————————————————————————————————————————

12-30 Update:

Youku daily Die, and updated the cookie algorithm, it seems that this is a protracted war, we do a good job of psychological preparation, I believe so toss everyone understand the importance of the cookie named R.

It is now possible to obtain a cookie named R:

Request get directly. JSON this API, the head needs to have the following format information:

Cookie: __ysuid={16-length-string};

referer:http://v. Youku. Com/v_show/id_{vid}. Html

One of the __YSUID algorithms is as follows (thanks @kkia)

The __YSUID consists of a 13-bit long Unix timestamp with a 3-bit long random string.

In fact, you can request success as long as the cookie contains r in the Request m3u8 link (no matter what the value is, at least at this stage).

Youku Real Video Address resolution (updated to 2016-2-28)