How to dump CDM key pair from AVD

Requirement

• PC with Android Studio + Android SDK + Python 3 installed

Guide

1. Create Android 13.0(Google APIs) AVD

   Do not select Google play

2. Download latest frida server

   Frida

   There are many links, but select "frida-server-xx.x.x-android-x86_64.xz".

   

3. Extract frida-server's archive

   

4. Rename the file "frida-server-xx.x.x-android-x86_64" to "frida-server".

   

5. Download or clone Keydive onto your PC.

   Keydive

6. Run following commands on your terminal

   adb root
   adb push frida-server /data/local/tmp
   adb shell "chmod +x /data/local/tmp/frida-server"
   adb shell "/data/local/tmp/frida-server -D &"
   python keydive.py
   

   

7. Play any Widevine-protected video on AVD

   • Bitmovin Demo
   • Dash.js Demo

   *) It does not matter even if Chrome is black outed at this time. CDM will be dumped when either URL is typed in the URL bar.

8. At device/xxxxxx/private_keys/xxxxxx/xxxxxxx directory, you will find dumped CDM key pair.