Reverse Engineering: Youtube & h.264 for the masses

So a client asked me if he could get a youtube video in their new iPhone app. I replied it should be possbile ... Hence this post

Like any sensible mac user i signed up to the youtube beta as soon as i heard about it. My beloved 2007 macbook is starting to show it's age, and while it can handle 1080p videos without melting (it's sweats a fair bit!), flash videos truly bring it to its knees.

So first thing i did was select a random youtube video, this one happened to be a short about the upcoming indian premier league (i personally hate cricket, but anyways...).

I was immediately disheartened, it wasn't going to be as easy as simply reformatting the link ...


This format is new and exclusive to the HTML 5 beta, from my research the h.264 content delivered to the iphone has a different format, and is served from a different domain.

Domains/SubDomains
Also a quick glance shows that a different series of subdomains are used, and while i haven't tested, i'm guessing these are a series of load balance servers, so there is no guarantee that the video will be on the same server.

Signature(s)
Even more bad news the signature param appears to change on every request, suggesting that it's generated for each session. I tested this, my using the same account to watch the same video, but once in safari and once in chrome, checking the signatures each time.

Signature A
25BF3979A2386835A59AE3DA23076950B6323FB1.670A622C94E87A9192D1CD62885B2589D6EC9A1F


Signature B
B2F0121150A88F697711D19D2F1F8B18EBFC3058.9FE89BCC68B319D255A83A613C84A2040CAF3B2B


Beyond the signature nothing else seems to change. My guess is that youtube will have to open this up when they start to provide video embed tags instead or in addition to the standard object/embed mashup.
Retardation, tells me those are 2 SHA1 hashes separated by a dot, the age old question is whats the plain text?

Conclusion
I'm not kevin Mitnick (Holla at me Kevin ;) ). My minimal security knowledge tells me that the plain text includes a variable that is changing. My assumption is that it user session key, but with no know access to it. (Unless the people aka google are dumb uninformed, which is highly unlikely i assume they encrypt their session cookie).

So for now the h.264 videos are safe :(

I need to try this

We called it the Rubber Duck method of debugging. It goes like this:

1) Beg, borrow, steal, buy, fabricate or otherwise obtain a rubber duck
(bathtub variety)
2) Place rubber duck on desk and inform it you are just going to go over
some code with it, if that's all right.
3) Explain to the duck what you code is supposed to do, and then go into
detail and explain things line by line
4) At some point you will tell the duck what you are doing next and then
realise that that is not in fact what you are actually doing. The duck
will sit there serenely, happy in the knowledge that it has helped you
on your way.

Works every time. Actually, if you don't have a rubber duck you could at
a pinch ask a fellow programmer or engineer to sit in.

Andy

Andrew Errington src

Backrow, Thats a big ass framework

Some months a ago i spoke about front row. First, the plan was to reverse engineering it, then it was building a plugin for it. Well, it hasn't exactly had my complete attention, however it did drift back into my mind today.

The main sticking point for me has been the lack of documenation, however this should be expected considering that we're talking about a unsupported framework, from one of the most secretive corporate entities in existance.

So in my quest to write for leopard front row, i decided that a nice class diagram would come in handy, easy right...

Well this is what it looks like, after exploring appoximately 30-40% of the 500+ classes!

However i've learnt alot about naming conventions and framework layout. The most striking thing is the level of depth. For example there are classes for everything under the sun, like the Entry of IPv6 addresses. Stuff i personally would have overlooked. I guess thats why i get the semi-big bucks.

Needless to say the folks at apple know how to design a framework, and have done a great job in the absence of namespaces, to provide rigid catagorization of classes.

Class names are nice and logical, for example any class ending with 'layer', is most likely a subclass of BRRenderLayer, eg. BRListLayer or BRTextMenuLayer.

The experience has also made me feel like i've been using the framework, rather than an outsider, looking in. So hopefully in the coming days i can actually leverage this thing to do something other than allow me navigate tv series from the comfort of my bed.

Quote of the Day

"It's a pitty they made so much fuss about gay cowboys, it's actually a decent film"

I happen to think brokeback mountain is a half decent flick

Quick and Dirty Leopard Dock Image replacement script

This one is for all the dock hackers out there. I'm gonna try and roll this into a application during my lectures today ^_^

Cut and paste the script into a text editor of your choice, and save it as "dockSwitcher.sh"

To use this save your new dock images on the desktop and then run the script. Beware i haven't tested as i A. Use the non-glass dock, and B. didn't have time. So use with caution.


#!/bin/bash
## Quick and dirty Dock Image Replacement script
## Jonathan Dalrymple
## November 6, 2007

##Root Checking
## Thanks to
## http://blog.mecworks.com/articles/2006/02/23/bash-scripting-tip-running-a-script-as-root/
CMDLN_ARGS="$@" # Command line arguments for this script
export CMDLN_ARGS

# Run this script as root if not already.
chk_root () {

if [ ! $( id -u ) -eq 0 ]; then
echo "Please enter root's password."
exec su -c "${0} ${CMDLN_ARGS}" # Call this prog as root
exit ${?} # sice we're 'execing' above, we wont reach this exit
# unless something goes wrong.
fi

}

# Check if user is root
chk_root

##Back up dock
cp /System/Library/CoreServices/Dock.app ~/Dock.backup.app

##Remove the old files
rm /System/Library/CoreServices/Dock.app/Contents/Resources/scurve-l.png

rm /System/Library/CoreServices/Dock.app/Contents/Resources/scurve-m.png

rm /System/Library/CoreServices/Dock.app/Contents/Resources/scurve-sm.png

rm /System/Library/CoreServices/Dock.app/Contents/Resources/scurve-xl.png

##Put in the new files
mv ~/Desktop/scurve-l.png /System/Library/CoreServices/Dock.app/Contents/Resources/

mv ~/Desktop/scurve-m.png /System/Library/CoreServices/Dock.app/Contents/Resources/

mv ~/Desktop/scurve-sm.png /System/Library/CoreServices/Dock.app/Contents/Resources/

mv ~/Desktop/scurve-xl.png /System/Library/CoreServices/Dock.app/Contents/Resources/

##Remove dock images from desktop
rm ~/Desktop/scurve-l.png

rm ~/Desktop/scurve-m.png

rm ~/Desktop/scurve-sm.png

rm ~/Desktop/scurve-xl.png

##
killall Dock




Leopard Hacking : Front Row

Thanks to my coffee, i can't seem to sleep. So to pass the time i decided to do some more work on a new brain wave i just had this evening.

It centers around front row. Well actually it had nothing to do with front row, however building on top of front row makes more sense, than starting out from scratch.

Now as you may or may not know, like most of the cool gui stuff on osx front row is a closed environment. Which means it's hacking time. Something i always wanted to play with is a decompiler. Now i'm no Dmitry Grinberg, so assembly doesn't wash with me. Instead i found this little gem.

After a a brief compile it gave me this wonderful output



struct _NSZone;

/*
* File: Movies
* Arch: Intel 80x86 (i386)
*/

@protocol BRMenuListItemProvider
- (long)itemCount;
- (float)heightForRow:(long)fp8;
- (BOOL)rowSelectable:(long)fp8;
- (id)titleForRow:(long)fp8;
- (id)itemForRow:(long)fp8;
@end

@protocol NSObject
- (BOOL)isEqual:(id)fp8;
- (unsigned int)hash;
- (Class)superclass;
- (Class)class;
- (id)self;
- (struct _NSZone *)zone;
- (id)performSelector:(SEL)fp8;
- (id)performSelector:(SEL)fp8 withObject:(id)fp12;
- (id)performSelector:(SEL)fp8 withObject:(id)fp12 withObject:(id)fp16;
- (BOOL)isProxy;
- (BOOL)isKindOfClass:(Class)fp8;
- (BOOL)isMemberOfClass:(Class)fp8;
- (BOOL)conformsToProtocol:(id)fp8;
- (BOOL)respondsToSelector:(SEL)fp8;
- (id)retain;
- (oneway void)release;
- (id)autorelease;
- (unsigned int)retainCount;
- (id)description;
@end

@interface RUIMoviesAppliance : BRAppliance
{
}

+ (id)moduleKey;
- (id)init;
- (void)dealloc;
- (id)moduleIconName;
- (float)moduleIconReflectionOffset;
- (id)moduleName;
- (id)moduleKey;
- (id)applianceController;

@end

@interface RUIMoviesApplianceController : BRMediaMenuController
{
NSArray *_headerRows;
NSMutableArray *_titlesWithUnplayedContent;
RUIMovieFolderCollection *_movieFolderCollection;
BRMovieTrailersProvider *_trailersProvider;
unsigned int _hasLocalMovies:1;
unsigned int _movieTrailersPreviewRequested:1;
unsigned int _movieTrailersSelected:1;
BRDataStore *_dataStore;
Class _msClass;
}

- (id)init;
- (void)dealloc;
- (id)musicStoreBaseType;
- (BOOL)menuDisplaysLeftIcon;
- (void)networkStatusChanged:(id)fp8;
- (BOOL)isVolatile;
- (id)loadModelData;
- (void)refreshControllerForModelUpdate;
- (BOOL)shouldRefreshForUpdateToObject:(id)fp8;
- (long)defaultIndex;
- (void)itemSelected:(long)fp8;
- (void)wasExhumedByPoppingController:(id)fp8;
- (void)wasPushed;
- (void)willBePopped;
- (void)wasPopped;
- (id)previewControlForItem:(long)fp8;
- (BOOL)brEventAction:(id)fp8;

@end

@interface RUIMoviesApplianceController (AsyncNotifications)
- (void)_movieTrailersLoaded:(id)fp8;
- (void)_swapNewController:(id)fp8;
@end

@interface RUIMoviesApplianceController (DataSourceAccess)
- (id)_movieTrailers:(id *)fp8;
@end

@interface RUIMoviesApplianceController (MediaParadeBuilders)
- (id)_moviesFolderParade;
- (id)_movieTrailersParade;
- (id)_stingrayMediaPreview;
@end

@interface RUIMoviesApplianceController (MovieLoading)
- (void)_cacheUnplayedTitles;
- (BOOL)_hasUnplayedMovies;
@end

@interface RUIMoviesApplianceController (MovieSelection)
- (id)_movieSelectedAtIndex:(long)fp8;
@end

@interface RUIMoviesApplianceController (MenuBuilding)
- (id)_buildMovieTrailersMenu;
- (id)_movieTrailersController:(id)fp8;
- (id)_buildMyMoviesMenu;
- (id)_stingrayFrontPageController;
- (id)_headerRows;
@end

@interface RUIMoviesApplianceController (DataProviders)
- (id)itemForRow:(long)fp8;
- (long)itemCount;
- (id)titleForRow:(long)fp8;
- (float)heightForRow:(long)fp8;
- (BOOL)rowSelectable:(long)fp8;
@end

@interface RUISDMovieTrailersController : RUIMovieTrailersController
{
}

- (id)initWithTrailers:(id)fp8;
- (id)previewControlForItem:(long)fp8;
- (id)titleForRow:(long)fp8;
- (long)defaultIndex;
- (id)itemForRow:(long)fp8;
- (long)itemCount;
- (void)itemSelected:(long)fp8;

@end

@interface RUIMovieTrailersController : BRMediaMenuController
{
NSArray *_trailers;
}

- (id)initWithTrailers:(id)fp8;
- (void)dealloc;
- (BOOL)isNetworkDependent;
- (void)itemSelected:(long)fp8;
- (long)itemCount;
- (id)itemForRow:(long)fp8;
- (id)titleForRow:(long)fp8;
- (float)heightForRow:(long)fp8;
- (BOOL)rowSelectable:(long)fp8;
- (id)previewControlForItem:(long)fp8;

@end

@interface RUISDMovieTrailersController (Private)
- (id)_HDMovieTrailers:(id *)fp8;
@end

@interface RUIMovieTrailersController (Private)
- (id)_movieTrailersTitle;
@end

@interface RUIMovieDirectoryController : BRMediaMenuController
{
RUIMovieFolderCollection *_collection;
NSString *_path;
}

- (id)initWithMovieFolderCollection:(id)fp8;
- (void)dealloc;
- (id)moviesForParade;
- (void)itemSelected:(long)fp8;
- (id)previewControlForItem:(long)fp8;
- (id)mediaPreviewMissingMediaType;
- (BOOL)mediaPreviewShouldShowMetadata;
- (BOOL)mediaPreviewShouldShowMetadataImmediately;
- (long)itemCount;
- (id)itemForRow:(long)fp8;
- (id)titleForRow:(long)fp8;
- (float)heightForRow:(long)fp8;
- (BOOL)rowSelectable:(long)fp8;

@end

@interface RUIMovieFolderAsset : BRBaseMediaAsset
{
NSString *_displayName;
NSURL *_mediaURL;
NSString *_folderPath;
BRImage *_posterImage;
BOOL _requestedImage;
}

+ (id)assetForName:(id)fp8 folderPath:(id)fp12 andMediaURL:(id)fp16;
- (void)dealloc;
- (void)setDisplayName:(id)fp8;
- (void)setMediaURL:(id)fp8;
- (void)setMovieFolderPath:(id)fp8;
- (id)assetID;
- (id)title;
- (id)mediaURL;
- (BOOL)hasCoverArt;
- (id)coverArt;
- (id)dateAcquired;
- (id)mediaType;

@end

@interface RUIMovieFolderAsset (ArtLoading)
- (void)_loadImage:(id)fp8;
- (void)_imageLoaded:(id)fp8;
@end

@interface RUIMovieFolderCollection : BRBaseMediaCollection
{
RUIMovieFolderCollection *_parent;
NSString *_displayName;
NSString *_folderPath;
NSArray *_childCollections;
NSArray *_childAssets;
}

+ (id)collectionForName:(id)fp8 folderPath:(id)fp12 andParent:(id)fp16;
- (void)dealloc;
- (void)setParent:(id)fp8;
- (void)setDisplayName:(id)fp8;
- (void)setMovieFolderPath:(id)fp8;
- (id)childCollections;
- (id)parentCollection;
- (id)collectionType;
- (id)collectionID;
- (int)count;
- (id)mediaAssets;
- (id)title;
- (id)titleForSorting;
- (BOOL)hasCoverArt;
- (id)coverArt;
- (BOOL)isLocal;

@end

@interface RUIMovieFolderCollection (Private)
- (void)_generateCollectionChildren;
@end

@interface BRMediaCollectionType (FolderCollectionExtension)
+ (id)folderCollection;
@end

What you see here is the headers/interface & protocol files for all the different classes located within Front rows movies appliance.

If you want to see your own front row app, it's located @ /system/library/coreservices/front row.app

Now i had heard that some good folks over at Awkward TV forums have hacked appliances for the Apple TV which is basically what the new front row on leopard is, however these don't seem to work 'out of the box', and apparently Apple updated this version before the roll out.

Coupled with all the above, i have reason to believe that the new appliances are digitally signed by [chinese] ni cai, Apple.

By reasoning for this, is a did a hex dump (using 0xED) of the appliance executables, and found the following string(s) @ 135535

"Apple Certification Authority1301U*Apple Code Signing Certification Authority"

Now just after typing the above sentence, it dawned on me that this might be for the transactions with the ITMS, for movie trailers, however i checked the settings appliance and found the same thing.

Also i tried deleting the various applications from a running front row, and it handles them gracefully, and also doesn't mind having new ones dropped in. I tried droping in the rss apple tv plugin, however it didn't like it very much.

I'm a programmer, not a hacker so this is about the limit of my skill, especially if it envolves digitally signed apps. I can barely deal with the symbian signed apps, never mind about these ones. If got some ideas or feel like getting dirty and dodging some DMCA takedown notices let me know.

UPDATE

i found this URL above the previous string, http://www.apple.com/appleca/

turns out that the certificate may be freely available, which might make life a tad bit easier.

PS. to any one wanting to warn me for breaking the law, i'm not a US resident ^_^