KeyDive is a Python-based CLI tool designed for extracting Widevine L3 DRM keys from Android devices. It operates by establishing an ADB connection to a rooted device, injecting a Frida JavaScript script into the Widevine Content Decryption Module (CDM) process, and hooking specific native functions to intercept cryptographic material (client IDs, private keys, keyboxes). The tool supports multiple provisioning methods (Keybox, OTA, OEM Certificate) and exports data in formats compatible with pywidevine (.wvd). It is primarily used for DRM research, security analysis, and educational purposes regarding digital rights management on Android. The architecture consists of a Python core (`keydive.core.Core`) that manages device communication and Frida sessions, a JavaScript injection script (`keydive.js`) that performs the actual memory interception and data extraction, and a suite of modules (`keydive.drm`) for parsing and serializing DRM-specific binary formats like KeyBox and WVD. The tool handles complex C++ memory layouts (std::string, std::vector) across different Android ABIs and SDK versions, demonstrating significant reverse engineering capability.