Clear to encrypted SL3000 patch

demo/main.js

@@ -28,9 +28,37 @@ if (demoConfig) {
 
 const hlsjsDefaults = {
   debug: true,
-  enableWorker: true,
+  enableWorker: false,
   lowLatencyMode: true,
   backBufferLength: 60 * 1.5,
+  emeEnabled: true,
+  drmSystems: {
+    "com.microsoft.playready": {
+      licenseUrl: "https://shield-drm.imggaming.com/api/v2/license"
+    }
+  },
+  drmSystemOptions: {
+    "videoRobustness": "3000",
+    "audioRobustness": "3000"
+  },
+  licenseXhrSetup: async function(xhr) {
+    const res = await fetch("https://shield-api.imggaming.com/admin/v1/ovp/dice/client/dce.sandbox/action/sign_test_content_token", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        ttl_seconds: 300,
+        claims: {
+        eid: "786df1e4-9a75-4052-8625-204ba23b2bae",
+        aid: "00000000-0000-0000-0000-000000000000",
+        did: "00000000-0000-0000-0000-000000000000",
+        def: "uhd2"
+        }
+      })
+    });
+    const { token } = await res.json();
+    xhr.setRequestHeader("Authorization", "Bearer " + token);
+    xhr.setRequestHeader("X-DRM-INFO", btoa(JSON.stringify({ system: "com.microsoft.playready" })));
+  }
 };
 
 let enableStreaming = getDemoConfigPropOrDefault('enableStreaming', true);

src/controller/base-stream-controller.ts

@@ -646,6 +646,7 @@
         return data;
       })
       .then((data: FragLoadedData) => {
+        console.log('$$$ _loadInitSegment - loaded init segment, checking if decryption is needed', data);
         const { hls } = this;
         const { frag, payload } = data;
         const decryptData = frag.decryptdata;
@@ -689,9 +690,11 @@
                 },
               });
               data.payload = decryptedData;
+              console.log('$$$ _loadInitSegment - calling this.completeInitSegmentLoad with decrypted data', data);
               return this.completeInitSegmentLoad(data);
             });
         }
+        console.log('$$$ _loadInitSegment - calling this.completeInitSegmentLoad with non-decrypted data', data);
         return this.completeInitSegmentLoad(data);
       })
       .catch((reason) => {

src/controller/eme-controller.ts

@@ -138,7 +138,12 @@ class EMEController extends Logger implements ComponentAPI {
 
   private getLicenseServerUrl(keySystem: KeySystems): string | undefined {
     const { drmSystems, widevineLicenseUrl } = this.config;
-    const keySystemConfiguration = drmSystems?.[keySystem];
+    // const keySystemConfiguration = drmSystems?.[keySystem];
+    const keySystemConfiguration =
+       drmSystems?.[keySystem] ??
+        (keySystem === KeySystems.PLAYREADY_RECOMMENDATION
+          ? drmSystems?.[KeySystems.PLAYREADY]
+          : undefined);
 
     if (keySystemConfiguration) {
       return keySystemConfiguration.licenseUrl;
@@ -162,8 +167,12 @@ class EMEController extends Logger implements ComponentAPI {
 
   private getServerCertificateUrl(keySystem: KeySystems): string | void {
     const { drmSystems } = this.config;
-    const keySystemConfiguration = drmSystems?.[keySystem];
-
+    // const keySystemConfiguration = drmSystems?.[keySystem];
+    const keySystemConfiguration =
+       drmSystems?.[keySystem] ??
+        (keySystem === KeySystems.PLAYREADY_RECOMMENDATION
+          ? drmSystems?.[KeySystems.PLAYREADY]
+          : undefined);
     if (keySystemConfiguration) {
       return keySystemConfiguration.serverCertificateUrl;
     } else {
@@ -439,7 +448,13 @@ class EMEController extends Logger implements ComponentAPI {
       .filter(
         (value) => !!value && keySystemsInConfig.indexOf(value) !== -1,
       ) as any as KeySystems[];
-
+    // Chrome on Windows registers PlayReady as the recommendation variant.
+    // When the standard key system is in the attempt list, add the recommendation
+    // variant as an immediate fallback so attemptKeySystemAccess tries it next.
+    // if (keySystemsToAttempt.indexOf(KeySystems.PLAYREADY) !== -1) {
+    //   const idx = keySystemsToAttempt.indexOf(KeySystems.PLAYREADY);
+    //   keySystemsToAttempt.splice(idx + 1, 0, KeySystems.PLAYREADY_RECOMMENDATION);
+    // }
     return this.selectKeySystem(keySystemsToAttempt);
   }
 
@@ -570,7 +585,7 @@ class EMEController extends Logger implements ComponentAPI {
       const keySystemsToAttempt = keySystem
         ? [keySystem]
         : getKeySystemsForConfig(this.config);
-      return this.attemptKeySystemAccess(keySystemsToAttempt);
+      return this.getKeySystemSelectionPromise(keySystemsToAttempt);
     }
     return mediaKeySessionContext;
   }
@@ -593,6 +608,15 @@ class EMEController extends Logger implements ComponentAPI {
         })}`,
       );
     }
+    // Add recommendation variant as fallback if base PlayReady is in the list
+    const playreadyIdx = keySystemsToAttempt.indexOf(KeySystems.PLAYREADY);
+    if (
+      playreadyIdx !== -1 &&
+      keySystemsToAttempt.indexOf(KeySystems.PLAYREADY_RECOMMENDATION) === -1
+    ) {
+      keySystemsToAttempt = keySystemsToAttempt.slice();
+      keySystemsToAttempt.splice(playreadyIdx + 1, 0, KeySystems.PLAYREADY_RECOMMENDATION);
+    }
     return this.attemptKeySystemAccess(keySystemsToAttempt);
   }
 
@@ -1332,7 +1356,7 @@ class EMEController extends Logger implements ComponentAPI {
 
       this.setupLicenseXHR(xhr, url, keySessionContext, licenseChallenge)
         .then(({ xhr, licenseChallenge }) => {
-          if (keySessionContext.keySystem == KeySystems.PLAYREADY) {
+          if (keySessionContext.keySystem == KeySystems.PLAYREADY || keySessionContext.keySystem == KeySystems.PLAYREADY_RECOMMENDATION) {
             licenseChallenge = this.unpackPlayReadyKeyMessage(
               xhr,
               licenseChallenge,

src/demux/transmuxer-interface.ts

@@ -198,8 +198,34 @@
     chunkMeta.transmuxing.start = self.performance.now();
     const { instanceNo, transmuxer } = this;
     const timeOffset = part ? part.start : frag.start;
+    console.log('$$$ TransmuxerInterface push', {
+      id: this.id,
+      sn: chunkMeta.sn,
+      part: chunkMeta.part,
+      level: chunkMeta.level,
+      timeOffset,
+      accurateTimeOffset,
+    });
     // TODO: push "clear-lead" decrypt data for unencrypted fragments in streams with encrypted ones
-    const decryptdata = frag.decryptdata;
+    // const decryptdata = frag.decryptdata;
+
+    // For clear-lead segments (frag.decryptdata is null), still pass the PlayReady
+    // key from the first encrypted fragment so generateInitSegment can call
+    // fakeEncryption and mark the SourceBuffer pipeline as encrypted from the start.
+    // PlayReady LevelKey.key is null so transmuxer.push won't attempt AES decryption
+    // on the clear segment data — only the init segment processing is affected.
+    let decryptdata = frag.decryptdata;
+    if (decryptdata == null) {
+      const levelDetails = this.hls.levels[frag.level]?.details;
+      const encryptedFrag = levelDetails?.encryptedFragments?.[0];
+      if (encryptedFrag?.levelkeys) {
+        decryptdata =
+          Object.values(encryptedFrag.levelkeys).find(
+            (k) => k?.isCommonEncryption,
+          ) ?? null;
+      }
+    }
+
     const lastFrag = this.frag;
 
     const discontinuity = !(lastFrag && frag.cc === lastFrag.cc);

src/loader/fragment.ts

@@ -283,6 +283,10 @@ export class Fragment extends BaseSegment {
     return this._decryptdata;
   }
 
+  set decryptdata(value: LevelKey | null) {
+    this._decryptdata = value;
+  }
+
   get end(): number {
     return this.start + this.duration;
   }

src/remux/mp4-remuxer.ts

@@ -133,6 +133,7 @@
   }
 
   resetInitSegment() {
+    console.log('$$$ MP4Remuxer - resetInitSegment called with audioCodec');
     this.log('ISGenerated flag reset');
     this.ISGenerated = false;
     this.videoTrackConfig = undefined;

src/remux/passthrough-remuxer.ts

@@ -5,8 +5,8 @@
 import { ElementaryStreamTypes } from '../loader/fragment';
 import { getCodecCompatibleName } from '../utils/codecs';
 import { type ILogger, Logger } from '../utils/logger';
-import { patchEncyptionData } from '../utils/mp4-tools';
-import { getSampleData, parseInitSegment } from '../utils/mp4-tools';
+import { fakeEncryption, patchEncyptionData } from '../utils/mp4-tools';
+import { findBox, getSampleData, parseInitSegment, patchTencIsProtected } from '../utils/mp4-tools';
 import type { HlsConfig } from '../config';
 import type { HlsEventEmitter } from '../events';
 import type { DecryptData } from '../loader/level-key';
@@ -29,6 +29,7 @@
 
 class PassThroughRemuxer extends Logger implements Remuxer {
   private emitInitSegment: boolean = false;
+  private encryptedInitPatched = false;
   private audioCodec?: string;
   private videoCodec?: string;
   private initData?: InitData;
@@ -73,10 +74,13 @@
     videoCodec: string | undefined,
     decryptdata: DecryptData | null,
   ) {
+    console.log('$$$ PassThroughRemuxer - resetInitSegment called with audioCodec', audioCodec, 'videoCodec', videoCodec, 'decryptdata', JSON.stringify(decryptdata));
     this.audioCodec = audioCodec;
     this.videoCodec = videoCodec;
+    // if (decryptdata) decryptdata.keyFormat = "com.microsoft.playready.recommendation";
     this.generateInitSegment(initSegment, decryptdata);
     this.emitInitSegment = true;
+    this.encryptedInitPatched = false;
   }
 
   private generateInitSegment(
@@ -89,11 +93,14 @@
       this.initData = undefined;
       return;
     }
-    const { audio, video } = (this.initData = parseInitSegment(initSegment));
-
     if (decryptdata) {
-      patchEncyptionData(initSegment, decryptdata);
+      const { audio, video } = parseInitSegment(initSegment);
+      if (!audio?.encrypted && !video?.encrypted) {
+        initSegment = fakeEncryption(initSegment);
+      }
+      initSegment = patchEncyptionData(initSegment, decryptdata) ?? initSegment;
     } else {
+      const { audio, video } = parseInitSegment(initSegment);
       const eitherTrack = audio || video;
       if (eitherTrack?.encrypted) {
         this.warn(
@@ -102,6 +109,8 @@
       }
     }
 
+    const { audio, video } = (this.initData = parseInitSegment(initSegment));
+
     // Get codec from initSegment
     if (audio) {
       audioCodec = getParsedTrackCodec(
@@ -179,6 +188,23 @@
     // The binary segment data is added to the videoTrack in the mp4demuxer. We don't check to see if the data is only
     // audio or video (or both); adding it to video was an arbitrary choice.
     const data = videoTrack.samples;
+
+    if (!this.encryptedInitPatched && findBox(data, ['moof', 'traf', 'senc']).length > 0) {
+      this.encryptedInitPatched = true;
+      if (this.initTracks) {
+        const seen = new Set<Uint8Array>();
+        // eslint-disable-next-line no-for-of-loops/no-for-of-loops
+        for (const track of Object.values(this.initTracks)) {
+          if (track?.initSegment && !seen.has(track.initSegment)) {
+            seen.add(track.initSegment);
+            patchTencIsProtected(track.initSegment as Uint8Array<ArrayBuffer>, true);
+          }
+        }
+        this.emitInitSegment = true;
+      }
+    }
+
+
     if (!data.length) {
       return result;
     }

src/utils/mediakeys-helper.ts

@@ -10,6 +10,7 @@ export const enum KeySystems {
   CLEARKEY = 'org.w3.clearkey',
   FAIRPLAY = 'com.apple.fps',
   PLAYREADY = 'com.microsoft.playready',
+  PLAYREADY_RECOMMENDATION = 'com.microsoft.playready.recommendation',
   WIDEVINE = 'com.widevine.alpha',
 }
 
@@ -67,7 +68,8 @@ export function keySystemDomainToKeySystemFormat(
     case KeySystems.FAIRPLAY:
       return KeySystemFormats.FAIRPLAY;
     case KeySystems.PLAYREADY:
-      return KeySystemFormats.PLAYREADY;
+    case KeySystems.PLAYREADY_RECOMMENDATION:
+        return KeySystemFormats.PLAYREADY;
     case KeySystems.WIDEVINE:
       return KeySystemFormats.WIDEVINE;
     case KeySystems.CLEARKEY:
@@ -122,6 +124,7 @@ export function getSupportedMediaKeySystemConfigurations(
       break;
     case KeySystems.WIDEVINE:
     case KeySystems.PLAYREADY:
+    case KeySystems.PLAYREADY_RECOMMENDATION:
       initDataTypes = ['cenc'];
       break;
     case KeySystems.CLEARKEY:
@@ -152,12 +155,12 @@ function createMediaKeySystemConfigurations(
       drmSystemOptions.sessionType || 'temporary',
     ],
     audioCapabilities: audioCodecs.map((codec) => ({
-      contentType: `audio/mp4; codecs=${codec}`,
+      contentType: `audio/mp4; codecs="${codec}"`,
       robustness: drmSystemOptions.audioRobustness || '',
       encryptionScheme: drmSystemOptions.audioEncryptionScheme || null,
     })),
     videoCapabilities: videoCodecs.map((codec) => ({
-      contentType: `video/mp4; codecs=${codec}`,
+      contentType: `video/mp4; codecs="${codec}"`,
       robustness: drmSystemOptions.videoRobustness || '',
       encryptionScheme: drmSystemOptions.videoEncryptionScheme || null,
     })),