Myspace plugin - help needed - Printable Version +- Kodi Community Forum (https://forum.kodi.tv) +-- Forum: Development (https://forum.kodi.tv/forumdisplay.php?fid=32) +--- Forum: Add-ons (https://forum.kodi.tv/forumdisplay.php?fid=26) +--- Thread: Myspace plugin - help needed (/showthread.php?tid=28588) |
Myspace plugin - help needed - Unbehagen - 2007-09-18 Hey, I'm planning to write a plugin for myspace so you can listen to bands before going to concerts etc. Does anyone have a flash decompiler handy and could help me to circumvent their weird mp3 url hiding/obfuscation? I'd be happy to do the python coding and I would really appreciate your help with this! - Unbehagen - 2007-09-18 Maybe this helps? I'm scared of AJAX. http://www.myspace-mp3-downloader.com/src_files/bandmp3.js http://www.myspace-mp3-downloader.com/ - Asteron - 2007-09-18 There is nothing special about AJAX... its just an HTTP get that gives you back an XML file. It looks like that gets parsed and "purl" points to the mp3... still there are several stages in this thing... it'd be good to step through it a bit in a debugger. Actually that purl has to be unencrypted in some weird thing... Code: function decodeUrl(bandid, songid, token, durl) { wtf is "rijndaelDecrypt"? - Unbehagen - 2007-09-18 Asteron Wrote:wtf is "rijndaelDecrypt"?This is actually AES. - Unbehagen - 2007-09-18 I just sniffed some packets. Looks like they're really desperately trying to hide this URL. Now that's what I call link protection. damn it. This ajax thing is even worse. It doesn't contact myspace directly, but through some proxy php script. I'm not sure if we should use that.. Here is a CSV with the GET request, but without the responses (was too lazy to pick them all out): Code: "53", "5.054162", "192.168.1.129", "216.178.38.121", "HTTP", "GET /prostituiertengang HTTP/1.1" - Unbehagen - 2007-09-18 This is also interesting: http://64.233.183.104/search?q=cache:tCpFeecf8AwJ:aniscartujo.es/myspacemp3.htm+myspace+mp3+rijndael&hl=de&ct=clnk&cd=13&gl=de - Unbehagen - 2007-09-18 Okay, so here is how it works: 1. get http://myspace.com/[friendname] 2. extract numeric friend_id from html 3. get the song list: http://mediaservices.myspace.com/services/media/musicplayerxml.ashx?b=[friendid] 4. curl=song url, token=token, encrypted with Rijndael 5. Download URL will be: [songurl]?bandid=[bandid]&songid=[songid]&token=1[decrypted token]&p=[song url on base64] This seems to be only valid for a minute or so, then the token gets deleted I guess. Man, that's really creepy. - Unbehagen - 2007-09-18 We can use this for rijndael: http://www.postneo.com/2005/03/31/more-python-for-series-60-crypto-rijndael and use the key from: http://www.myspace-mp3-downloader.com/src_files/bandmp3.js , search for "var key=" I already spent some hours fiddling around with this. I would be amazed and really appreciate it if somebody could write the routine to extract the friend_id from the myspace html! Anyone? - mortael - 2007-09-18 Unbehagen Wrote:if somebody could write the routine to extract the friend_id from the myspace html! Anyone? you mean something like this: 2 rather easy ways to get to the FriendID make a HEAD request for the myspace.com/[friendname] page, and grab from the response-header this line: Set-Cookie: g23=[friendid]; path=/ or retrieve the whole html-page and search for it using some regex: Code: result = re.search(r'"DisplayFriendId":(\d+)', htmlpage) good luck! - Unbehagen - 2007-09-18 Thanks for your help, mortael. Here's what I have yet, it runs on a pc, no xbmc yet: Code: import urllib http://jclement.ca/software/pyrijndael/pyrijndael-v1_4.tar.gz http://www.postneo.com/2005/03/31/more-python-for-series-60-crypto-rijndael They both give errors or complain about wrong block sizes. I figured out that the Rijndael-"CBC"-Encryption is used, but I could not find any library for that. All help is appreciated. - Nuka1195 - 2007-09-18 http://fernyb.net/myspace/api/ - SleepyP - 2007-10-07 I always knew MySpace had some weird methods used for the inner workings, but GOD DAMN thats crazy! - Unbehagen - 2007-10-08 SleepyP Wrote:I always knew MySpace had some weird methods used for the inner workings, but GOD DAMN thats crazy!Yep I think it's because they want to create a shop later (or do they already have one?) for selling mp3s. But they don't actually seem to use their weird security token stuff; i commented out everything regarding that. Did anybody experience any difficulties with this plugin other than no title showing up for some artists (This is because of malformed XML or weird carachters. I currently don't have a solution for that.) ? Please report any problems playing MP3s here so I can fix that. |