[App] Netflix HD for Widevine DRM L1 devices

Rhala

Senior Member
Nov 17, 2011
53
22
0
Aachen
Hey people,

today i wanted to share a post from chenxiaolong, who did some awesome work back at the Galaxy Tab S2 forum. The main problem, was that Netflix didn't want to play HD content on the Galay Tab S2, which was why I researched the requirements of Netflix. They need Widevine L1 implemented on the SoC to allow HD playback. While this is the necessary requirement, Netflix also needs to enable this device in their device list and tell the app it supports Widevine DRM L1. In many cases they don't do that although the device itself would be very capable of displaying HD content. Tried it out on my Galaxy Tab S2 and on the Nexus 5, which both support Widevine DRM L1 and aren't/weren't marked as WV L1 capable. To check DRM capability of your device you can use for example this app https://play.google.com/store/apps/details?id=com.androidfung.drminfo&hl=en
This will not make a non WV L1 capable device run Netflix HD, it will only make the device use the most secure DRM technology!
The whole process doesn't need root, just some tools like apktool, apk-signer and such. Feel free to link the post into your device forum you achieved to get Netflix HD on.

Big Thanks goes out to @chenxiaolong
Link to thread post: http://forum.xda-developers.com/showpost.php?p=65001865&postcount=12
 
Dec 13, 2013
9
14
0
Based on this, I made a script on Ubuntu to patch last version of netflix APK.

It currently works on version up to 5.12.xxx, it doesn't seem to work on more recent versions, we will have probably to wait for a new version of apktool (2.4.0 ?).

First, you need to install some packages

Code:
sudo apt-get install apktool zipalign default-jdk
Then, you have to build you own signature (to do only once)

Code:
keytool -genkeypair -alias androiddebugkey -keypass android -keystore "${HOME}/.netflix.keystore" -storepass android -keyalg RSA -sigalg SHA1withRSA -dname "CN=Android Debug,O=Android,C=US" -validity 9999
Then, download last netflix APK, for instance from apkmirror, and execute this script on downloaded file (for instance "netflixpatch com.netflix.mediaclient_4.16.1.apk" if your script is named "netflixpatch")

Code:
#!/bin/bash

NAME=$(basename "${1}" .apk)
KEYSTORE="${HOME}/.netflix.keystore"
TMPOUT=$(mktemp -d /tmp/tmpdir.netflixpatch.XXXXXXXXXX) || { echo "Failed to create temp file"; exit 1; }
FILEOLD="${TMPOUT}/smali/com/netflix/mediaclient/service/webclient/model/leafs/DeviceConfigData.smali"
FILENEW="${TMPOUT}/smali/com/netflix/mediaclient/service/configuration/DeviceConfiguration.smali"

apktool d -r -f "${1}" -o "${TMPOUT}"

if [ -f "${FILEOLD}" ];then
	echo "Patching method 1"
	sed -i 's/iget-boolean v0, p0, Lcom\/netflix\/mediaclient\/service\/webclient\/model\/leafs\/DeviceConfigData;->enableWidevineL1:Z/const\/4 v0, 0x1/g' "${FILEOLD}"
elif [ -f "${FILENEW}" ];then
	echo "Patching method 2"
	sed -i '/isWidevineL1Enabled/c\    const\/4 v0, 0x1\n    return v0' "${FILENEW}"
else
	echo "File to patch not found !"
	rm -rf "${TMPOUT}"
	exit 1
fi

# /usr/local/bin/apktool b "${TMPOUT}"
apktool b "${TMPOUT}"

jarsigner -keystore "${KEYSTORE}" -storepass android -keypass android -sigalg MD5withRSA -digestalg SHA1 -sigfile CERT -signedjar "${TMPOUT}/dist/${NAME}-patched-signed.apk" "${TMPOUT}/dist/${NAME}.apk" androiddebugkey

zipalign -f 4 "${TMPOUT}/dist/${NAME}-patched-signed.apk" "${NAME}-patched-signed-zipaligned.apk"

rm -rf "${TMPOUT}"
You'll get a "com.netflix.mediaclient_4.16.1-patched-signed-zipaligned.apk" file, which will play HD content if your device has Widevine DRM L1 libraries, even if not whitelisted by Netflix.
 
Last edited:

Neckon

Senior Member
Apr 13, 2011
53
4
28
Dusseldorf
Hi!

Is it possible that this trick doesn't work anymore or doesn't work on all devices? I patched the current Netflix APK (and verified that the changes were made using apktool) but I only get 720p at best. There was also an error message along the lines of "content not allowed in prolog"?

I'm using one of those generic AmLogic S912 boxes ("X92 Smart Box" with the white clock display thing in the front) which supports L3 but neither Netflix nor Prime Video stream 1080p.
 

T0mfield

New member
Jan 3, 2011
2
0
0
Based on this, I made a script on Ubuntu to patch last version of netflix APK.

First, you need to install some packages

Code:
sudo apt-get install apktool zipalign default-jdk
Then, you have to build you own signature (to do only once)

Code:
keytool -genkeypair -alias androiddebugkey -keypass android -keystore "${HOME}/.netflix.keystore" -storepass android -keyalg RSA -sigalg SHA1withRSA -dname "CN=Android Debug,O=Android,C=US" -validity 9999
Then, download last netflix APK, for instance from apkmirror, and execute this script on downloaded file (for instance "netflixpatch com.netflix.mediaclient_4.16.1.apk" if your script is named "netflixpatch")

Code:
#!/bin/bash

NAME=$(basename "${1}" .apk)
KEYSTORE="${HOME}/.netflix.keystore"
TMPOUT=$(mktemp -d /tmp/tmpdir.netflixpatch.XXXXXXXXXX) || { echo "Failed to create temp file"; exit 1; }

apktool d -r -f "${1}" -o "${TMPOUT}"

sed -i 's/iget-boolean v0, p0, Lcom\/netflix\/mediaclient\/service\/webclient\/model\/leafs\/DeviceConfigData;->enableWidevineL1:Z/const\/4 v0, 0x1/g' ${TMPOUT}/smali/com/netflix/mediaclient/service/webclient/model/leafs/DeviceConfigData.smali

apktool b ${TMPOUT}

jarsigner -keystore "${KEYSTORE}" -storepass android -keypass android -sigalg MD5withRSA -digestalg SHA1 -sigfile CERT -signedjar "${TMPOUT}/dist/${NAME}-patched-signed.apk" "${TMPOUT}/dist/${NAME}.apk" androiddebugkey

zipalign -f 4 "${TMPOUT}/dist/${NAME}-patched-signed.apk" "${NAME}-patched-signed-zipaligned.apk"

rm -rf $TMPOUT
You'll get a "com.netflix.mediaclient_4.16.1-patched-signed-zipaligned.apk" file, which will play HD content if your device has Widevine DRM L1 libraries, even if not whitelisted by Netflix.
Im sorry but with these informations I don't know exactly if and how it will work out for my galaxy s5. Can I use a app on my mobile to sign the backuped Netflix app? Or do I need to sign the apk on my PC?
 

zeebee

Senior Member
Aug 29, 2009
68
18
0
Im sorry but with these informations I don't know exactly if and how it will work out for my galaxy s5. Can I use a app on my mobile to sign the backuped Netflix app? Or do I need to sign the apk on my PC?
These are instructions for Linux. What I have done:
1. download Ubuntu from Windows 10 Store
2. open powershell as admin and type:
Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux
3. reboot when prompted
4. open command line and type:
ubuntu
5. create user/password as prompted
6. type:
sudo apt-get upgrade

Then follow the instructions from post #1. I've got my netflix apk from apkmirror: https://www.apkmirror.com/?post_type=app_release&searchtype=apk&s=netflix
You can access the windows filesystem by /mnt/c/

The script worked fine for me with Netflix 5.9.0 build 24858 and my Nexus 10.
 
Dec 13, 2013
9
14
0
The modification was not working anymore on my tablet (Samsung Galaxy Tab A6 SM-T580) giving me an error 0013 and it is now working again, I don't know why (I upgraded firmware to last version T580XXU2BQI9 / T580XEF2BQI9, or maybe Netflix changed something on their servers).

It is tested and working on Netflix apk 5.8.0_build_24642 and 5.9.0_build_24858 with apktool 2.2.1-dirty (Ubuntu 17.04 version), 2.2.3 and 2.3.0
 
Last edited:

vleesevlons

Member
Aug 23, 2015
34
2
0
I edited post https://forum.xda-developers.com/showpost.php?p=72178861&postcount=2, it should now work with old and new version of APK, (tested with version 5.11.1_build_25432)
I'm getting this error:
Code:
sed: can't read /tmp/tmpdir.netflixpatch.1QU3FdHrJ4/smali/com/netflix/mediaclient/service/webclient/model/leafs/DeviceConfigData.smali: No such file or directory
Also, you've changed the keystore value in the script code but not in the signature code.
Also, it didn't work with 5.11.2. Getting an error 5.2. Not sure if it's because it genuinely doesn't work anymore or because I didn't do it correctly on account of the error. Might I add that I'm using a virtual machine, if it makes a difference.
Also, why is there an L before com/?
 
  • Like
Reactions: lasic
Dec 13, 2013
9
14
0
Also, you've changed the keystore value in the script code but not in the signature code.
Also, it didn't work with 5.11.2. Getting an error 5.2. Not sure if it's because it genuinely doesn't work anymore or because I didn't do it correctly on account of the error. Might I add that I'm using a virtual machine, if it makes a difference.
Also, why is there an L before com/?
Thank you, I edited the script to correct keystore path.

The error you were getting was normal, I was trying to patch file for old versions and new versions of netflix apk, I changed the script to prevent the file error message.

I don't know why you've got error 5.2, I had it for some times then it worked again, after uninstalling official apk and reinstalling patched one, maybe something in the cache of the tablet. I tried many version of apktool too, but it doesn't seem related.

For the virtual machine, it shouldn't affect the patching process.

And for the L before com, I don't know, it is smali language, probably to indicate a string value.
 
Last edited:
  • Like
Reactions: vleesevlons

vleesevlons

Member
Aug 23, 2015
34
2
0
Thank you, I edited the script to correct keystore path.

The error you were getting was normal, I was trying to patch file for old versions and new versions of netflix apk, I changed the script to prevent the file error message.

I don't know why you've got error 5.2, I had it for some times then it worked again, after uninstalling official apk and reinstalling patched one, maybe something in the cache of the tablet. I tried many version of apktool too, but it doesn't seem related.

For the virtual machine, it shouldn't affect the patching process.

And for the L before com, I don't know, it is smali language, probably to indicate a string value.
I have a Nexus 5 (2013).
I've installed DRMinfo to confirm that I have WV L1 and it says it does.
I've been experimenting with liboemcrypto.so, i.e. deleting it or renaming it, and that does get rid of the error 5.2.
However, it appears that if the .so file differs from how a liboemcrypto.so should be, then Netflix will not do the DRM check and it will just give you SD quality.
So, I'm at a loss there...

What build worked for you? I've tried 5.11.2 build 25441 and 5.11.1 build 25432
 
Dec 13, 2013
9
14
0
I have a Nexus 5 (2013).
I've installed DRMinfo to confirm that I have WV L1 and it says it does.
I've been experimenting with liboemcrypto.so, i.e. deleting it or renaming it, and that does get rid of the error 5.2.
However, it appears that if the .so file differs from how a liboemcrypto.so should be, then Netflix will not do the DRM check and it will just give you SD quality.
So, I'm at a loss there...

What build worked for you? I've tried 5.11.2 build 25441 and 5.11.1 build 25432
In my understanding, but I'm not sure, if you remove liboemcrypto.so, you lose Widevine level 1, so Netflix won't even try to play HD, so no error 5.2. I tried and got HD by patching 5.11.2_build_25441 and 5.11.1_build_25432.
 

sakej

Senior Member
Jan 24, 2010
112
40
48
Poznań
Thanks for this guide. For me this missed a few instructions, like how to run a script on a file :)
So this are the steps nessesary to compleat this process:
1. Do everything from OP till it says to run a script on a file
2. For ease name your script netflixpatch and file com.netflix.mediaclient_4.16.1.apk
3. Open terminal in a place where you saved netflix app and this script
4. In terminal type: chmod u+x netflixpatch
5. Then run this script on apk by typing in terminal: ./netflixpatch com.netflix.mediaclient_4.16.1.apk (with ./ in front)
6. If all went you will see new file in your directory, thats the modified app

Now. For me, and I had apk v .12.2 build 25768 this trick seems to not work. I still have video looking like 720
Im on OnePlus 5T (capable of widevine lv.1) and stock rom.
Do I have nessesary libery I don't really know yet.
Need to investigate more but at least I have modified apk now so thanks for that :)

EDIT: Thers no liboemcrypto.so in /system/vendor/lib/ so that's probably the issue here ...
 
Last edited:

JMMING Hackers

New member
Feb 5, 2018
4
0
0
anybody knows that this code founds with Android TV netflix apk ?

Based on this, I made a script on Ubuntu to patch last version of netflix APK.

First, you need to install some packages

Code:
sudo apt-get install apktool zipalign default-jdk
Then, you have to build you own signature (to do only once)

Code:
keytool -genkeypair -alias androiddebugkey -keypass android -keystore "${HOME}/.netflix.keystore" -storepass android -keyalg RSA -sigalg SHA1withRSA -dname "CN=Android Debug,O=Android,C=US" -validity 9999
Then, download last netflix APK, for instance from apkmirror, and execute this script on downloaded file (for instance "netflixpatch com.netflix.mediaclient_4.16.1.apk" if your script is named "netflixpatch")

Code:
#!/bin/bash

NAME=$(basename "${1}" .apk)
KEYSTORE="${HOME}/.netflix.keystore"
TMPOUT=$(mktemp -d /tmp/tmpdir.netflixpatch.XXXXXXXXXX) || { echo "Failed to create temp file"; exit 1; }
FILEOLD="${TMPOUT}/smali/com/netflix/mediaclient/service/webclient/model/leafs/DeviceConfigData.smali"
FILENEW="${TMPOUT}/smali/com/netflix/mediaclient/service/configuration/DeviceConfiguration.smali"

apktool d -r -f "${1}" -o "${TMPOUT}"

if [ -f "${FILEOLD}" ];then
	echo "Patching old version"
	sed -i 's/iget-boolean v0, p0, Lcom\/netflix\/mediaclient\/service\/webclient\/model\/leafs\/DeviceConfigData;->enableWidevineL1:Z/const\/4 v0, 0x1/g' "${FILEOLD}"
elif [ -f "${FILENEW}" ];then
	echo "Patching new version"
	sed -i '/isWidevineL1Enabled/c\    const\/4 v0, 0x1\n    return v0' "${FILENEW}"
else
	echo "File to patch not found !"
	rm -rf "${TMPOUT}"
	exit 1
fi

# /usr/local/bin/apktool b "${TMPOUT}"
apktool b "${TMPOUT}"

jarsigner -keystore "${KEYSTORE}" -storepass android -keypass android -sigalg MD5withRSA -digestalg SHA1 -sigfile CERT -signedjar "${TMPOUT}/dist/${NAME}-patched-signed.apk" "${TMPOUT}/dist/${NAME}.apk" androiddebugkey

zipalign -f 4 "${TMPOUT}/dist/${NAME}-patched-signed.apk" "${NAME}-patched-signed-zipaligned.apk"

rm -rf "${TMPOUT}"
You'll get a "com.netflix.mediaclient_4.16.1-patched-signed-zipaligned.apk" file, which will play HD content if your device has Widevine DRM L1 libraries, even if not whitelisted by Netflix.

------------------------------------------
anyone try to apply this patch and upload to mega to try if this patch found in Mi box Tv:confused::confused::confused::confused::confused::confused:
 

JMMING Hackers

New member
Feb 5, 2018
4
0
0
Problems with the script Helpme

[email protected]:/mnt/c/Users/crist/Downloads/netflix# ./net.sh com.netflix.ninja_5.0.4_build_1965.apk
./net.sh: line 2: $'\r': command not found
./net.sh: line 14: syntax error near unexpected token `elif'
'/net.sh: line 14: `elif [ -f "${FILENEW}" ];then


anybody could helme ... I copy this script :
-------------------------------------------------------------
#!/bin/bash

NAME=$(basename "${1}" .apk)
KEYSTORE="${HOME}/.netflix.keystore"
TMPOUT=$(mktemp -d /tmp/tmpdir.netflixpatch.XXXXXXXXXX) || { echo "Failed to create temp file"; exit 1; }
FILEOLD="${TMPOUT}/smali/com/netflix/mediaclient/service/webclient/model/leafs/DeviceConfigData.smali"
FILENEW="${TMPOUT}/smali/com/netflix/mediaclient/service/configuration/DeviceConfiguration.smali"

apktool d -r -f "${1}" -o "${TMPOUT}"

if [ -f "${FILEOLD}" ];then
echo "Patching old version"
sed -i 's/iget-boolean v0, p0, Lcom\/netflix\/mediaclient\/service\/webclient\/model\/leafs\/DeviceConfigData;->enableWidevineL1:Z/const\/4 v0, 0x1/g' "${FILEOLD}"
elif [ -f "${FILENEW}" ];then
echo "Patching new version"
sed -i '/isWidevineL1Enabled/c\ const\/4 v0, 0x1\n return v0' "${FILENEW}"
else
echo "File to patch not found !"
rm -rf "${TMPOUT}"
exit 1
fi

# /usr/local/bin/apktool b "${TMPOUT}"
apktool b "${TMPOUT}"

jarsigner -keystore "${KEYSTORE}" -storepass android -keypass android -sigalg MD5withRSA -digestalg SHA1 -sigfile CERT -signedjar "${TMPOUT}/dist/${NAME}-patched-signed.apk" "${TMPOUT}/dist/${NAME}.apk" androiddebugkey

zipalign -f 4 "${TMPOUT}/dist/${NAME}-patched-signed.apk" "${NAME}-patched-signed-zipaligned.apk"

rm -rf "${TMPOUT}"

-----------------------------------
 

JMMING Hackers

New member
Feb 5, 2018
4
0
0
yes I did that

Friend I Did that. I was copy the script and paste in a white document and save has .sh when I try to execute make me that error . Please help me
 

MagistarNL

New member
Feb 9, 2018
2
0
0
Tried the script. First had to get Ubuntu. So I did:

enable Hyper-V, load Ubuntu 16.4.3-server-x64 (so no GUI) on Generation 1
ran the apt-get install commands provided by OP

Code:
[email protected]:~$ ./netflixpatch com.netflix.mediaclient_5.13.0_build_25824.apk
 03:21:52 up 17 min,  2 users,  load average: 0.05, 0.07, 0.07
USER     TTY      FROM             [email protected]   IDLE   JCPU   PCPU WHAT
sebas    tty1                      03:04   13:17   0.05s  0.05s -bash
sebas    pts/0    192.168.178.72   03:09    0.00s  0.07s  0.00s w
I: Using Apktool 2.0.2-dirty on com.netflix.mediaclient_5.13.0_build_25824.apk
I: Copying raw resources...
I: Baksmaling classes.dex...
I: Baksmaling classes2.dex...
I: Baksmaling classes3.dex...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files...
Patching old version
Script is running BUT I do not see the output created. Old file has an unmodified timestamp. Any thoughts on how to troubleshoot this?
 
Last edited: