streamrapid.py ?

[lavara123]

streamrapid.py ?

[Gujal00]

They are changing the decrypt key stored in obfuscated javascript every 20 minutes, so can't do anything about it, same as mcloud.
Broken for now

[lavara123]

@Gujal00
How did you get that key? can you post the code? maybe i can do something

[Gujal00]

The decrypt key is in https://rabbitstream.net/js/player/prod/e5-player.min.js?v=1663283550 The time stamp changes every 20 minute or so on that url and the key variable name and value changes.
On the above timestamp the key is
const _0x14f6b5 = '69932eff70fd109a'; sometimes the value is further obfuscated with a function like this, const _0x3fc144 = _0x2f748d(0xc24, '!2Y]')
The plugin has been updated to follow the new logic, But it cant get the key everytime due to obfuscation. If the correct key is used then ResolveURL resolves correctly with the new code

SMR Link Tester: Link Resolved: |https://rabbitstream.net/embed-5/fkuRvX6a5GXz?z=|https://b-g-eu-5.feetcdn.com:2223/v2-hls-playback/683398921bf2156da090956a30a14f665b206d0b6d8e5cd027064cc311169cc516edf06b2edc31467cdda904b4f331245b5fb0cbb571c4808804d1878d6a45d8098fe997974feced9806198b5f3835408730f2a1ee8d5f128795bdc89c63a26c44d80924a6134bfbfcada8197e10692fc09742ed80236f31a55b23d0f6cd783d45ed38b6e83a387e4fd05b98b11920dff19e92613979dbcadeeca4ba3ddc2158d9683954aacd2fd1663923d872ce33a8/720/index.m3u8|User-Agent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%3B+rv%3A68.0%29+Gecko%2F20100101+Firefox%2F68.0&Referer=https%3A%2F%2Frabbitstream.net%2F|

[lavara123]

@Gujal00 How can we find this? I'm looking for a const in js code, there is no such phrase.

So do you have a method to scrape the JS code?

[Gujal00]

@lavara123
You can see the key in clear (highlighted in yellow below) in the current JS, probably next time it will be obfuscated
https://rabbitstream.net/js/player/prod/e5-player.min.js?v=1663467150

[lavara123]

@Gujal00
The link I tested was different. the key obviously does not exist as you show

i test link
https://rabbitstream.net/embed-5/xmHgf4E61Gjb?z=

https://rabbitstream.net/js/player/prod/e5-player.min.js?v=1663488750

I think this phrase returns the key

[Gujal00]

@Correct, as I mentioned before that sometime it is obfuscated and sometimes it is not

The decrypt key is in https://rabbitstream.net/js/player/prod/e5-player.min.js?v=1663283550 The time stamp changes every 20 minute or so on that url and the key variable name and value changes. On the above timestamp the key is const _0x14f6b5 = '69932eff70fd109a'; sometimes the value is further obfuscated with a function like this, const _0x3fc144 = _0x2f748d(0xc24, '!2Y]') The plugin has been updated to follow the new logic, But it cant get the key everytime due to obfuscation. If the correct key is used then ResolveURL resolves correctly with the new code

[Gujal00]

@lavara123 try with e416e8f and report back. It is a hit and miss, but that's the best that can be done for now.

[triorr]

The key is generated inside a web assembly module disguised as a PNG image in "loading.png". Reverse engineering skills is needed to fix this plugin.
For more info check this article https://www.pudn.com/Download/item/id/1711319547629731.html

[Gujal00]

yep, this cannot be done in python and have to rely on an external docker container running node_ts to solve this. Works well with https://github.com/drblgn/rabbit_wasm