This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Flash Player Extraction

0

Hi, I apologize if this has been asked before. I'm using Wireshark to attempt to download the source of a stream on a flash player, but I've been having trouble figuring out where to go from the TCP stream. After capturing packets and following the TCP stream, here is what I got:

GET /z/mp4/vod9/966000/966502.mp4/0_7d43fa406fd425c7_Seg1-Frag3?hdntl=exp=1394780401~acl=%2fz%2fmp4%2fvod9%2f966000%2f966502.mp4%2f*~data=hdntl~hmac=aea1bafcae3f200e7aef29d463fe32325e2d354422f7456436bba763097f25f3&als=9.66,30,8.57,0,635,10044,24.31,1,0,118,f,2.35,249.04,f,s,TVJGVFPHVFST,3.0.3,118&hdcore=3.0.3 HTTP/1.1

Host: vodcdn.mnet.com

User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Referer: http://mwave.interest.me/front/flash/cjem_player_tv.swf?v=9

Cookie: hdntl=exp=1394780401~acl=%2fz%2fmp4%2fvod9%2f966000%2f966502.mp4%2f*~data=hdntl~hmac=aea1bafcae3f200e7aef29d463fe32325e2d354422f7456436bba763097f25f3

Connection: keep-alive

HTTP/1.0 200 OK

Server: AkamaiGHost

Mime-Version: 1.0

Content-Type: video/f4f

Content-Length: 891154

Date: Thu, 13 Mar 2014 07:00:05 GMT

Connection: keep-alive

Set-Cookie: alid=NaJME14M80S87dPjgAIAqQ==; path=/z//mp4/vod9/966000/966502.mp4/; domain=vodcdn.mnet.com

I attempted going to vodcdn.mnet.com/z//mp4/vod9/966000/966502.mp4/ and other combinations, but all give me Access Denied errors.

The video I am attempting to get the URL for can be seen here http://mwave.interest.me/mnettv/videodetail.m?searchVideoDetailVO.clip_id=160106. The video seems to be downloading in fragments, though I’m not sure…

Am I simply not getting the correct URL or is there something else I have to do?

Thanks for any help!

asked 13 Mar ‘14, 00:09

johnnorman929's gravatar image

johnnorman929
11112
accept rate: 0%

attempt to download the source of a stream

what do you mean by that?

(13 Mar ‘14, 06:03) Kurt Knochner ♦

Sorry I wasn’t clear, I’m trying to rip the video that is being shown by the player.

(13 Mar ‘14, 13:41) johnnorman929


One Answer:

0

You can get the manifest out of Wireshark (as an exported HTTP object) and use this process to rip the streams: https://github.com/K-S-V/Scripts/wiki

That process lends itself really well to automation also, if you need to pull a lot of video files.

Edit: Specifically, with those mp4Seg[x]-Frag[xx] files, you should be able to find a .f4m file to accompany it. From that, take the value of the media href attribute (should be a URL) and use it as the 'manifest' input in that linked process.

answered 13 Mar '14, 21:10

Quadratic's gravatar image

Quadratic
1.9k6928
accept rate: 13%

edited 13 Mar '14, 21:13