Flash Player Extraction

Question

Hi, I apologize if this has been asked before. I'm using Wireshark to attempt to download the source of a stream on a flash player, but I've been having trouble figuring out where to go from the TCP stream. After capturing packets and following the TCP stream, here is what I got:

GET /z/mp4/vod9/966000/966502.mp4/0_7d43fa406fd425c7_Seg1-Frag3?hdntl=exp=1394780401~acl=%2fz%2fmp4%2fvod9%2f966000%2f966502.mp4%2f*~data=hdntl~hmac=aea1bafcae3f200e7aef29d463fe32325e2d354422f7456436bba763097f25f3&als=9.66,30,8.57,0,635,10044,24.31,1,0,118,f,2.35,249.04,f,s,TVJGVFPHVFST,3.0.3,118&hdcore=3.0.3 HTTP/1.1
Host: vodcdn.mnet.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://mwave.interest.me/front/flash/cjem_player_tv.swf?v=9
Cookie: hdntl=exp=1394780401~acl=%2fz%2fmp4%2fvod9%2f966000%2f966502.mp4%2f*~data=hdntl~hmac=aea1bafcae3f200e7aef29d463fe32325e2d354422f7456436bba763097f25f3
Connection: keep-alive
HTTP/1.0 200 OK
Server: AkamaiGHost
Mime-Version: 1.0
Content-Type: video/f4f
Content-Length: 891154
Date: Thu, 13 Mar 2014 07:00:05 GMT
Connection: keep-alive
Set-Cookie: alid=NaJME14M80S87dPjgAIAqQ==; path=/z//mp4/vod9/966000/966502.mp4/; domain=vodcdn.mnet.com

I attempted going to vodcdn.mnet.com/z//mp4/vod9/966000/966502.mp4/ and other combinations, but all give me Access Denied errors.

The video I am attempting to get the URL for can be seen here http://mwave.interest.me/mnettv/videodetail.m?searchVideoDetailVO.clip_id=160106. The video seems to be downloading in fragments, though I’m not sure…

Am I simply not getting the correct URL or is there something else I have to do?

Thanks for any help!

Answer 1

You can get the manifest out of Wireshark (as an exported HTTP object) and use this process to rip the streams: https://github.com/K-S-V/Scripts/wiki

That process lends itself really well to automation also, if you need to pull a lot of video files.

Edit: Specifically, with those mp4Seg[x]-Frag[xx] files, you should be able to find a .f4m file to accompany it. From that, take the value of the media href attribute (should be a URL) and use it as the 'manifest' input in that linked process.