[yeahme49]

@thantthet
Wow, it works! Amazing stuff!

i would love if you could document how you found it in-case they change it in the future
There are also a few other services (nowtv, skygo uk) that use the same auth, but different key.
So if you can find the keys relatively easy, it would open up them to have add-ons too

Any chance you've been working on a Peacock addon? Love all your other addons, would love to see a Peacock one too.

[matthuisman]

Finally think I cracked the authentication stuff yesterday. Wow - it was tricky.

Ended up they use their own custom cert that is sent from client requests for certain domains. If the cert isn't there, you get error. This is why the proxied requests would fail.

The cert is hidden and mixed up in code. So couldn't reverse it that way.

However, been getting used to Frida which let's you hook into functions. Managed to hook into the function that uses the cert and then printed the cert out to console. Then into python and success!

So, should be now possible for addon.
Early next week I'll try authenticating playback on some content and see what sort of resolution we can get with L3 and L1 widevine.

On another note, all I have is a free login.
If someone has a paid sub, that will help me develop the live channels sports etc.
If can help, pm me here

[spiffyname]

@matthuisman, do you accept tips? It sounds like this was a ton of work. I took a crack at it but was almost instantly lost. I for one would really benefit from this add-on so I'd like to support you in some way if possible. Thank you for all you've done so far on this and all the other add-ons you've made and helped make. I'm really impressed.

[QianyuLi]

Glad to hear this cool news.

@spiffyname
https://www.matthuisman.nz/donate
https://github.com/sponsors/matthuisman
https://www.patreon.com/join/matthuisman

[barney63]

@matthuisman

Will this addon work with a free sub or will it be pay or both?  Thanks

[matthuisman]

both, but youd need a paid sub to access any of the paid content

[barney63]

@matthuisman

Good, that's what I was hoping, do you think there will be a way to have the free content standout or be separated some way.

[matthuisman]

dont know. i havnt looked into the layout stuff at all yet.
hopefully it can just not show the paid content for free sub

[RedPenguin]

I don’t have a paid account myself, but any help that is needed I can try. Like if a tester is needed for example.

I know this service for some reason is extremely complicated compared to other similar services.

For some reason they make watching their free content harder than many of the big time paid only providers.

[etmisterio]

@matthuisman 
Sorry to bother you, but you are the only one that I can get help from.
You still get the x-sky-signature from this data? Or it changed? I wanted to know from what request its from so I could generate my own signatures.

python:


data = {

    'method': 'GET',

    'url': '/mytv/continuewatching',

    'response_code': '',

    'app_id': 'NBCU-ANDROID-v3',

    'version': '1.0',

    'params_md5': 'd410761c1e765123d77869967943877e',

    'timestamp': '1624262240',

    'payload_md5': 'd41d8cd98f00b204e9800998ecf8427e',

}

[RedPenguin]

I know this won't help out entirely but I just wanted to alert just in case.

I noticed from doing Frida myself, the key is still the same.

So at least we know that they aren't changing the key constantly, so that at least won't be a major issue with the addon.

[NoTanFightFan]

Just wondering if there are any 2022 updates on this? Thank you.

[RedPenguin]

I'm actually wondering this myself.

[jarda189]

will anyone help me?

$UserToken = "insert yours";
$hmac_key = "JuLQgyFz9n89D9pxcN6ZWZXKWfgj2PNBUb32zybj";
$method = "POST";
$url = '/video/playouts/vod';
$time = time();
$NBCU = 'NBCU-ANDROID-v3';
$sky_headers = "{'X-SkyOTT-Agent': 'nbcuott.tablet.android', 'X-SkyOTT-Provider': 'NBCU', 'X-SkyOTT-Territory': 'US', 'X-SkyOTT-PinOverride': 'false', 'X-SkyOTT-UserToken': '".$UserToken."'}";
$body = '{"device":{"capabilities":[{"protection":"WIDEVINE","container":"ISOBMFF","transport":"DASH","acodec":"AAC","vcodec":"H264"},{"protection":"NONE","container":"ISOBMFF","transport":"DASH","acodec":"AAC","vcodec":"H264"}],"maxVideoFormat":"HD","model":"PC","hdcpEnabled":true},"client":{"thirdParties":["FREEWHEEL","YOSPACE"]},"contentId":"GMO_00000000349178_01","providerVariantId":"1c8810f1-d0fb-3338-a39d-cc1f579186e1","parentalControlPin":null}';
function calculate_sky_header_md5($sky_headers) {    
    if(strlen($sky_headers) > 0 ) {                
        $headers = explode(",", str_replace(["{","}","'"],["","",""],$sky_headers));
        foreach($headers as $header) {
            $header = explode(":",$header);            
            $h[] = strtolower(str_replace(" ","",$header[0])).":".$header[1];
        }        
        return md5(implode("\n",$h)."\n");        
    } else {
        return "{}";
    }
   
}

$data = strtoupper($method."\n").$url."\n"."\n".$NBCU."\n1.0\n".calculate_sky_header_md5($sky_headers)."\n".$time."\n".md5($body)."\n";
$hash = base64_encode(hash_hmac("sha1", $data, $hmac_key, $raw_output=TRUE));
      $ch = curl_init();
      curl_setopt($ch, CURLOPT_URL, "https://ovp.peacocktv.com/video/playouts/vod");
      curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
      curl_setopt($ch, CURLOPT_POST, 1);      
      curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
      curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
      curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 0);
      curl_setopt($ch, CURLOPT_TIMEOUT, 30);  
      curl_setopt($ch, CURLOPT_VERBOSE, 1);
      $headers = array();      
      $headers[] = 'x-skyott-agent: nbcuott.tablet.android';    
      $headers[] = 'x-skyott-provider: NBCU';
      $headers[] = 'x-skyott-territory: US';
      $headers[] = 'x-skyott-pinoverride: false';
      $headers[] = 'x-SkyOTT-UserToken: '.$UserToken;
      $headers[] = 'x-sky-signature: SkyOTT client="'.$NBCU.'",signature="'.$hash.'",timestamp="'.$time.'",version="1.0"';
      $headers[] = 'x-skyott-pinoverride: false';
      $headers[] = 'Content-Type: application/vnd.playvod.v1+json';
      curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
      $item = json_decode(curl_exec($ch),true);
      print_r($item);

[Wagg]

FYI - Block This! will successfully block all ads on the official Peacock Android TV and Fire TV app.