$ show hyugogirubato/KeyDive
KeyDive is a Python-based CLI tool designed for extracting Widevine L3 DRM keys from Android devices. It operates by establishing an ADB connection to a rooted device, injecting a Frida JavaScript script into the Widevine Content Decryption Module (CDM) process, and hooking specific native functions to intercept cryptographic material (client IDs, private keys, keyboxes). The tool supports multiple provisioning methods (Keybox, OTA, OEM Certificate) and exports data in formats compatible with pywidevine (.wvd). It is primarily used for DRM research, security analysis, and educational purposes regarding digital rights management on Android. The architecture consists of a Python core (`keydive.core.Core`) that manages device communication and Frida sessions, a JavaScript injection script (`keydive.js`) that performs the actual memory interception and data extraction, and a suite of modules (`keydive.drm`) for parsing and serializing DRM-specific binary formats like KeyBox and WVD. The tool handles complex C++ memory layouts (std::string, std::vector) across different Android ABIs and SDK versions, demonstrating significant reverse engineering capability.
The LLM identified 3 files worth highlighting for reuse:
Implements a robust parser for the Widevine KeyBox binary format (128 or 132 bytes). It validates magic tags ('kbox', 'LVL1'), computes CRC32 checksums using the MPEG-2 variant, and parses device-specific fields like stable ID and AES keys. This component is self-contained and reusable for any project requiring Widevine KeyBox validation or manipulation.
Provides a lightweight implementation of the WVD (Widevine Device) structure (v2 format) using the `construct` library. It serializes RSA private keys and ClientIdentification protobufs into the binary blob required by tools like pywidevine. The code cleanly separates structure definition from business logic, making it easily extractable for other DRM-related projects.
Contains sophisticated JavaScript functions for reading C++ `std::string` and `std::vector` objects from Android process memory. It handles multiple ABIs (libc++, libstdc++ C++11, libstdc++ COW, android::Vector) to ensure compatibility across different Android versions and manufacturers. This demonstrates non-obvious skill in dynamic instrumentation and reverse engineering, as it correctly interprets memory layouts that vary by compiler and platform.