Wireshark - Getting *.flv video url of youtube - youtube

I'm trying to get the url of the *.flv from any youtube video. I used wireshark to analyize the traffic. I have also an addon for firefox which downloads the videos from youtube. It has a feature where I can see the direct url to the *.flv video.
So far I got this :
http://r1---sn-i5onxoxu-i5hl.c.youtube.com (it's the host) This matches to what the downloaders url is.
followed by
"videoplayback?" and then some video specific stuff I guess. And that's exactly what I cannot figure out. The downloader starts with the host, followed by this and then some other stuff.
What I did was capturing the packages. Then I searched in http requests for "/videoplayback?...". I just added it to the host but it doesn't work.
Can someone help me? What do I have to put after the host? And where do I find it?

This is what I figured out so far.
I watched the same video Wireshark - Using Dumpcap to capture to disk by Mike Pennacchi.
After capturing the packets and saving the file, apply the following display filter:
http.request.full_uri contains "range"
There are 3 packets displayed in my file:
735
2708
4615
Select the first packet, go to Packet details and expand Hypertext Transfer Protocol.
Right-click on Full request URI [truncated]: and select Copy -> Value and paste the url in a text file.
Copy also the url's (see Note) from the other packets and you get a list similar to this one:
http://r2---sn-5hn7zn7k.c.youtube.com/videoplayback?algorithm=throttle-factor&burst=40&cp=U0hWR1FUTl9GT0NONl9JTlJBOlBwSjNTRTA0azVw&cpn=B84QkSbXB7EAaDfs&expire=1372190015&factor=1.25&fexp=935500%2C910100%2C929227%2C916613%2C921047%2C928201%2C901208%2C929123%2C929915%2C929906%2C929907%2C929125%2C925714%2C929917%2C929919%2C931202%2C912512%2C912515%2C912521%2C906838%2C904488%2C906840%2C931910%2C931913%2C932227%2C904830%2C919373%2C933701%2C904122%2C900816%2C926403%2C909421%2C912711%2C935102&id=6ca6b1fa4c861ff9&ip=my ip address&ipbits=8&itag=34&keepalive=yes&key=yt1&ms=au&mt=1372168727&mv=m&newshard=yes&range=13-1781759&ratebypass=yes&signature=D8D28CBCD4AAC5F46901397219F62CB04D3C6290.114129F2F93249AC4D88DF184C7D47C9929B3232&source=youtube&sparams=algorithm%2Cburst%2Ccp%2Cfactor%2Cid%2Cip%2Cipbits%2Citag%2Csource%2Cupn%2Cexpire&sver=3&upn=9RmkbstttTM
http://r2---sn-5hn7zn7k.c.youtube.com/videoplayback?algorithm=throttle-factor&burst=40&cp=U0hWR1FUTl9GT0NONl9JTlJBOlBwSjNTRTA0azVw&cpn=B84QkSbXB7EAaDfs&expire=1372190015&factor=1.25&fexp=935500%2C910100%2C929227%2C916613%2C921047%2C928201%2C901208%2C929123%2C929915%2C929906%2C929907%2C929125%2C925714%2C929917%2C929919%2C931202%2C912512%2C912515%2C912521%2C906838%2C904488%2C906840%2C931910%2C931913%2C932227%2C904830%2C919373%2C933701%2C904122%2C900816%2C926403%2C909421%2C912711%2C935102&id=6ca6b1fa4c861ff9&ip=my ip address&ipbits=8&itag=34&keepalive=yes&key=yt1&ms=au&mt=1372168727&mv=m&newshard=yes&range=1781760-3563519&ratebypass=yes&signature=D8D28CBCD4AAC5F46901397219F62CB04D3C6290.114129F2F93249AC4D88DF184C7D47C9929B3232&source=youtube&sparams=algorithm%2Cburst%2Ccp%2Cfactor%2Cid%2Cip%2Cipbits%2Citag%2Csource%2Cupn%2Cexpire&sver=3&upn=9RmkbstttTM
http://r2---sn-5hn7zn7k.c.youtube.com/videoplayback?algorithm=throttle-factor&burst=40&cp=U0hWR1FUTl9GT0NONl9JTlJBOlBwSjNTRTA0azVw&cpn=B84QkSbXB7EAaDfs&expire=1372190015&factor=1.25&fexp=935500%2C910100%2C929227%2C916613%2C921047%2C928201%2C901208%2C929123%2C929915%2C929906%2C929907%2C929125%2C925714%2C929917%2C929919%2C931202%2C912512%2C912515%2C912521%2C906838%2C904488%2C906840%2C931910%2C931913%2C932227%2C904830%2C919373%2C933701%2C904122%2C900816%2C926403%2C909421%2C912711%2C935102&id=6ca6b1fa4c861ff9&ip=my ip address&ipbits=8&itag=34&keepalive=yes&key=yt1&ms=au&mt=1372168727&mv=m&newshard=yes&range=3563520-5347327&ratebypass=yes&signature=D8D28CBCD4AAC5F46901397219F62CB04D3C6290.114129F2F93249AC4D88DF184C7D47C9929B3232&source=youtube&sparams=algorithm%2Cburst%2Ccp%2Cfactor%2Cid%2Cip%2Cipbits%2Citag%2Csource%2Cupn%2Cexpire&sver=3&upn=9RmkbstttTM
Check the range; it is in these long url's:
range=13-1781759
range=1781760-3563519
range=3563520-5347327
Copy the first url and paste it in your browser.
Now you can download and save the first fileas videoplayback_Pennacchi01.
Repeat the steps for parts 2 and 3.
There are a couple of steps to go, before you can play the file.
Open the file videoplayback_Pennacchi01 in a hex editor.
The file starts with:
12 00 03 4B 00 00 00 00 00 00 00 02 00 0A 6F 6E ...K..........on
Prepend the the FLV header:
46 4C 56 01 05 00 00 00 09 00 00 00 00 FLV..........
Now the file looks like:
46 4C 56 01 05 00 00 00 09 00 00 00 00 12 00 03 FLV.............
4B 00 00 00 00 00 00 00 02 00 0A 6F 6E 4D 65 74 K..........onMet
Move you cursor to the end of file 01.
Open files 02 and 03 and copy and paste the content of the files into file 01.
Now you are ready to play the video.
Note 1
These links expire after some time: expire=1372190015
Convert Unix timestamp to Readable Date/time: Tue, 25 Jun 2013 19:53:35 GMT
You can also reconstruct the FLV file from the capture file.
Go to File -> Export Objects -> HTTP
look for Content Type video/x-flv.
Select the first one, hit Save As ans save the file.
Save also the other 2 parts.
Merge the files in order and prepend the FLV header.
Note 2
It used to be very easy. Apply display filter (http.request.method == "GET") and grab the URL from GET request containing /get_video?video.... But things have changed...

Related

How to interpret DROP elements from dragging a file attachment off Outlook Online?

When I drag a file attachment from Outlook Online (Web, rendered in Firefox) to my app, I receive the following drop elements:
But how do I get the attachment contents (the raw bytes of the attachment) from these? None of the elements are big enough to contain the 250K file that is attached, and the IStream content consists just of these 16 bytes:
00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00
My suspicion is that it is this IStream that I must use to stream the bytes from the browser to my application, but I can't fathom how to convert these bytes to a stream in my Delphi application.
Edit: JSON from application/x-moz-custom-clipdata:
{
"itemType":"attachment",
"attachmentFile":{
"attachmentItemId":"AAM...BASE64...H6M=",
"name":"<FileName>.pdf",
"size":254330,
"fileType":5,
"type":"ItemIdAttachment:#Exchange",
"ContentType":"application/pdf"
}
}
Use TOleStream from Vcl.AxCtrls to convert from IStream to TStream and read the bytes.
you must user Graph API to get attachemen file

Ruby: writing binary string (7zip) to file. file gets corrupted

We're building an application on Ruby on Rails 4 and it's going really fluently, except for this pain-giving issue
In our application we get a Multipart Response from a SOAP request. This response comes from an external party and sends us a 7zip compressed file. The response has 2 parts, where the second contains a application/octet-stream.
The parts are of the Mail:part type.
When I save the contents of 'part.body.decoded' to a file, I can't open the file with 7zip, because it says the file is damaged.
When I open the generated file in the hex-editor the first lines seem ok.
p part.body.decoded.encoding.name # gives => "ASCII-8BIT"
File.open("file.7z", "wb") do |f|
f.write(part.body.decoded)
end
Here are the first HEX lines.
37 7A BC AF 27 1C 00 03 EF F2 1B 17 EA FA 03 00
00 00 00 00 68 00 00 00 00 00 00 00 BD D9 66 08
00 1E 10 88 27 43 3B A7 F5 C7 75 19 5D F6 A6 E0
As a test I created a 7z file myself and read it in a string and wrote it back to a file. This works and gives me a valid 7zip.
Any ideas on how to tackle this?
Update: when I put the contents of part.body.decoded in a string
str = part.body.decoded #and put the string
p str # I get the string as below (I've deleted the middle section of the string because it has to many characters to post it here)
"7z\xBC\xAF'\x1C\x00\x03\xFCpd\x01\xEA\xFA\x03\x00\x00\x00\x00\x00h\x00\x00\x00\x00\x00\x00\x006E\x91\x1F\x00\x1E\x10\x88'C;\xA7\xF5\xC7u\x19]\xF6\xA6\xE0\xACC\xD9\xA4\xA0:,4\xE9\xA1\xAD%\x05\\a\xFBq\xA4Z\xEC7\xCC\x8C\x91\xBC?\x80H)\xFBa\xB8\xB8u\xBE\xB2\x1C|`\xA7P|\xC3\xA9\x82\xB3\r\n\xA2\x15\xA2\xDAn\xBB\xB9
Solved :-) The Savon 2 Soap Gem depends on the Mail Gem (max. version 2.5). In the Mail gem there is a bug, which touches the raw binary reponse (it ads line-ends). I've forked the Mail gem and made adaptions (to be found in the higher version of Mail (which Savon doesn't use)) and added 'my' Mail gem to my gemfile.
Thnx to all commenters for their tips!

Send CAN Message

I'm trying to use my smartphone to move my cars windows up and down. I recorded the CAN traffic two times by using AT MA. First time I just turned the ignition on. The second time I pushed the buttons for the electric windows.
I guess the PIDs for the window are the ones which didn’t occur in my first log file…
Now I want to try this by sending the bytes back but how can this be done with the ELM 327?
This is a message I received:
400 23 00 00 00 00 00 00 00
I already tried to set the header by doing:
AT SH 400
And then I wrote the remaining bytes to the stream:
23 00 00 00 00 00 00 00
But this seems not to be the cheat…
Cheers,
Stefan

4 byte checksum, sum32 algorithm for Epson printers

I'm programming a low level communication with an Epson tm-t88iv thermal printer on a Linux device, which receives only hexadecimal packages. I have read the manual trying to understand how the checksum is built but i can't manage to recreate it.
the manual says that the checksum are 4 bytes representing the 2 bytes sum of all the data in the package sent.
I have currently four working examples I found by listening to a port on a windows computer with a different program. the last 4 hexadecimals are the checksum (03 marks the end of the data and is included in the checksum calculation, according to the manual).
02 AC 00 01 1C 00 00 03 30 30 43 45
02 AC 00 00 1C 80 80 1C 00 00 1C 00 00 1C 03 30 32 32 31
02 AD 07 01 1C 00 00 1C 31 30 03 30 31 35 33
02 AD 00 00 1C 80 80 1C 00 00 1C 00 00 1C 03 30 32 32 32
I have read somewhere that there is a sum32 algorithm but i can't find any example of it or how to program it.
Wow, this is a bad algorithm! If someone else finds himself trying to understand Epson's terrible low-level communication manual, this is how the check-sum is done:
The checksum base is 30 30 30 30
Sum in hexadecimals all of the data package (for example, 02+89+00+00+1C+80+80+1C+00+01+1C+09+0C+1C+03 = 214)
Then separate the result digit by digit, if its a letter add 1 to the value (for example B2 would be 2|1|4).
sum it to the checksum base number by number starting from right to left (this would be a checksum of 30 32 31 34).
Note: It works perfectly, but for some reason the examples I posted above don't seem to match so much. They are all the printers response, but slightly after it got a hardware problem and had to be reformatted by technical support, so maybe it got fixed.
I hope it helps somebody somewhere.

Delphi 7 turn off creation of DDP files

How do you turn off the feature or stop the creation of all the .ddp files for your Delphi 7 forms? I read something about removing the designdgm60.bpl, but is that the only way? It seems that there was another way I can't remember any longer.
Update: I tried renaming the designdgm70.bpl and that just creates a ton of program errors.
Also, I'm using Delphi 7.2 on one computer and there is no design tab I can see unless its covered by something in CnWizards. 7.2 definitely creates the ddp files though.
DDP files are for Delphi diagrams (DDP stands for Delphi Diagram Portfolio) in Delphi 6-7. Delphi 5 used the DTI extension for this.
DDP files can have meaningful information. They don't get compiled into .DCU/.EXE./... as they are for documentation purposes only.
Did you create diagrams of components on your form/datamodule? I used to do that (to explain structure to co-workers) so I was actually really happy with the DDP files.
Before deleting them, inspect them to see if they contain documentation you want to keep.
You can safely delete them if they are 51 bytes long and the TDUMP of it looks like this:
000000: 07 18 44 45 4C 50 48 49 2E 44 49 41 47 52 41 4D ..DELPHI.DIAGRAM
000010: 2E 50 4F 52 54 46 4F 4C 49 4F 0F 00 00 E0 40 02 .PORTFOLIO....#.
000020: 01 09 06 09 55 6E 74 69 74 6C 65 64 31 06 00 02 ....Untitled1...
000030: 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
I suppose that it's impossible to turn off .ddp creation in IDE by built-in methods, but DDevExtensions tool includes this option (File Cleaner)
You can install DDevExtensions which is free.
There is an option which you can check that automatically deletes .ddp files.

Resources