Analysis of a video website m3u8 non perceptual encryption

Sample address ：aHR0cHM6Ly92LnFxLmNvbS94L2NvdmVyL216YzAwMjAwMXB2eHd6eS9pMDAzM2NncjF2bi5odG1s

After opening the website , Right click on the playback interface , Click on 【 Video information 】

You can see , Here, the encryption type of the video is 【CHACHA】, Follow the original method to find m3u8

Strange , here m3u8 Obviously not. key The logo of , But why does it show DRM Well ？ No matter how much , Try downloading directly .

Sure enough , Whatever you use m3u8 Downloader , After downloading, either the video disappears or an error is reported , It shows that there is encryption , But you can play it on the web , The decryption method must be in the web page .

After preliminary analysis, it is found that , Things are not as simple as they think , The decryption process is put in wasm in , Then follow the previous wasm Experience of relevant articles , To analyze this wasm, The first wasm Download to local , And then convert to .o For documents IDA see

Decryption is one of 【h】 Method , This method is preceded by memory related instructions ,