I have a player that plays encrypted video files and works like this:

  1. I open an encrypted video file with it
  2. it decrypts the video file and writes it to its memory
  3. and plays the file from the memory after that

and I want to copy the decrypted video file from memory and play it with a usual video player like VLC so I tried to create its memory dump with task manager and hoped to find out the video file there. Sadly I don't know enough to find a video file in a large chunk of bits from memory. I tried to find mp4 patterns in a hex editor (I guessed it might be mp4 because of the unencrypted sample files that they provide before purchase and many mp4 occurrences in the memory dump) and tried every solution that I find online but nothing worked for me so I hoped someone here maybe has an idea and willing to help me how to make it done.

I upload its memory dump here (after opening a short encrypted video with it) and this is the original encrypted video and this is the player and these two are the prerequisites before installing the player: this and this (the last one is the K-Lite Codec Pack)

This player doesn't provide any information about the video, but from their unencrypted sample files, it might be 1280x720 and the duration of video file that is inside the memory dump and original encrypted file, is 13 minutes and 26 seconds.

After loading the video, the disk activity of the process (player) tends to zero (even if I seek to middle or end), and I found a direct ratio between the encrypted video file size and the amount of memory that player occupies, that's why I think video file might be in the memory dump. I just don't know if it is encrypted or not, if not how to find and extract it, if yes how to analyze and find out about its encryption method and hopefully find out a way to decrypt it.

This video is encrypted by a commercial software named Balas Soft Lock (https://www.copyprotection.net/balas-soft-lock.aspx) and the main reason I want to unlock it is that their player doesn't provide the features that I need (for example keyboard shortcut and fast forward).

This question is a clone from StackOverflow and still is active.

Any insight is appreciated, Thanks :)

  • Its highly likely that the video is never completed decrypted but rather in parts as and when required. You can try to find which codec is responsible for demuxing the video stream and explore it further for better insights.
    – 0xec
    Jul 10 '19 at 10:08
  • thanks, @0xec is there any way that I can be sure about it? and how can find out about the codec that is responsible for demuxing the video?
    – Arash
    Jul 10 '19 at 12:27
  • Check the list of loaded DLLs in the process and compare it with the codecs the installed in the system. www.nirsoft.net/utils/installed_codec.html
    – 0xec
    Jul 10 '19 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.