关于DMM VR视频下载的讨论

Author: faafbbCreated Oct 23, 2022Updated Sep 1, 2025

看到之前有issue #473 讨论过DMM视频的下载，但是关于VR视频如何下载并没有结论，今天抓包研究了一下，和普通的2D视频流程不太一样环境：windows10，N_m3u8DL-CLI_v3.0.1

前置条件：

下载DMM的windows 端 VR 播放器
下载 fidder，完成相应配置（添加根域名证书、系统代理等）
下载 postman

流程：

打开 fidder
在DMM已购页点击流视频播放，浏览器将会跳转到形如 dmmvrplayerstreaming:digital?product_id={{product_id}}&quality=auto&shop=videoa&parent_product_id={{parent_product_id}}&past_st_flag=0&past_dl_flag=0&quality_groups=high&all_parts=1&part=1 的地址
该地址会唤起 DMM 的 VR 播放器
可在 fidder 中看到获取视频信息的请求

POST https://www.dmm.co.jp/service/digitalapi/-/json/=/method=PcApp/ HTTP/1.1
Host: www.dmm.co.jp
User-Agent: UnityPlayer/2019.2.17f1 (UnityWebRequest/1.0, libcurl/7.52.0-DEV)
Accept: */*
Accept-Encoding: identity
Authorization: Bearer {{ token }}
Content-Type: application/octet-stream
X-Unity-Version: 2019.2.17f1
Content-Length: 513

message=Digital_Api_PlayableProvider.getContentInfo&params={"transfer_type":"stream","quality":"auto","device":"pc_vr","vr_appli_type":"pc","adult_flag":false,"product_id":"{{product_id}}","exploit_id":"{{exploit_id}}","part":"0","shop":"videoa","HTTP_USER_AGENT":"WINDOWSVR_DMMVRPLAY 2.0.5  Intel(R) UHD Graphics 630","is_past":false,"parent_product_id":"{{parent_product_id}}","quality_groups":["high"]}&appid=pc_movievrplayer&authkey=cb0809a54a507acdd880369ea0df939dae4596822fd46fe51616164a2409c030

此时可以关闭VR播放器，打开postman，重放上面的请求
得到返回值

{
    "event": true,
    "data": {
        "cookie": [
            {
                "name": "licenseUID",
                "value": "{{licenseUID}}",
                "expire": 0,
                "path": "/",
                "domain": "dmm.com"
            }
        ],
        "content_id": "{{content_id}}",
        "content_title": "{{content_title}}",
        "content_info": {
            "normal": {
                "redirect": "https://str.dmm.com:443/digital/st1:etmvTFqzN6%2BYjb9582jo7gR7KUPc1p2YtHpxgU6Q1d3J-Rxj0wdtXmqYjilTIDyOYPjysXwfsPOSrFACOubTfsCZ4CKH1THt3GOANei5IBE%3D/2xcmMgca4dTbhr9s3WvW4Zo/-/playlist.m3u8?ld=NE6DLADu3aH%2BKnQLk%2BBCzYGCZBUXD9BU3PQy7k1LGnwDzHUn4mkhD%2BT1%2Bv2bJUBXMdqSdaEO0gluniWZUWMLwN%2BFpWuYc4%2BLg6y4gWYgMaE%3D&luid=cojp",
                "recommended_viewing_type": "3d_horizontal_180",
                "height": 1920,
                "width": 3840
            }
        }
    },
    "exectime": 0.4461,
    "memory": "4,229,576"
}

然后将返回值的 redirect 拼接上 &licenseUID={{licenseUID}}&smartphone_access=1，即 https://str.dmm.com:443/digital/st1:etmvTFqzN6%2BYjb9582jo7gR7KUPc1p2YtHpxgU6Q1d3J-Rxj0wdtXmqYjilTIDyOYPjysXwfsPOSrFACOubTfsCZ4CKH1THt3GOANei5IBE%3D/2xcmMgca4dTbhr9s3WvW4Zo/-/playlist.m3u8?ld=NE6DLADu3aH%2BKnQLk%2BBCzYGCZBUXD9BU3PQy7k1LGnwDzHUn4mkhD%2BT1%2Bv2bJUBXMdqSdaEO0gluniWZUWMLwN%2BFpWuYc4%2BLg6y4gWYgMaE%3D&luid=cojp&licenseUID={{licenseUID}}&smartphone_access=1 填到下载器GUI的M3U8地址即可直接下载

在这里有个疑问，第4步的 request body

message=Digital_Api_PlayableProvider.getContentInfo&params={"transfer_type":"stream","quality":"auto","device":"pc_vr","vr_appli_type":"pc","adult_flag":false,"product_id":"{{product_id}}","exploit_id":"{{exploit_id}}","part":"0","shop":"videoa","HTTP_USER_AGENT":"WINDOWSVR_DMMVRPLAY 2.0.5  Intel(R) UHD Graphics 630","is_past":false,"parent_product_id":"{{parent_product_id}}","quality_groups":["high"]}&appid=pc_movievrplayer&authkey=cb0809a54a507acdd880369ea0df939dae4596822fd46fe51616164a2409c030

其中的 authkey 是如何计算的，如果能解决这个问题应该就能批量爬取视频而不需要每次唤起VR播放器抓包了没学过网络安全相关的知识，只能发现两个简单的特征：

request body 中随意添加其他参数（如 &x=1）并不影响鉴权
参数的位置不影响鉴权

按长度猜测是 SHA256，但是不知道明文是按什么规则拼接的，希望有大神能够破解并告知示例：

message=Digital_Api_PlayableProvider.getContentInfo&params={"transfer_type":"stream","quality":"auto","device":"pc_vr","vr_appli_type":"pc","adult_flag":false,"product_id":"h_1155crvr00100zero","exploit_id":"uid:Y2ETW22TVYvDF1ls","part":"0","shop":"videoa","HTTP_USER_AGENT":"WINDOWSVR_DMMVRPLAY 2.0.5  Intel(R) UHD Graphics 630","is_past":false,"parent_product_id":"h_1155crvr00100zerodl6","quality_groups":["high"]}&appid=pc_movievrplayer&authkey=cb0809a54a507acdd880369ea0df939dae4596822fd46fe51616164a2409c030

Source: nilaoda/N_m3u8DL-CLI

View original on GitHub View discussion on GitHub