0

This is a subtitle file encoded by xml, is there any way to decode this xml file to srt?

Subtitle link xml

3
  • Any background info on the file? Where's it from? Commented Oct 21, 2023 at 10:58
  • it comes from here, i want to download this subtitle file is there any way to decode it gohitv.com/series/vi-vn/… Commented Oct 21, 2023 at 13:30
  • Can you create a script that only decodes the xml file. Commented Feb 18 at 9:26

1 Answer 1

6

It's AES encrypted, but fortunately it's pretty trivial to see what's going on in the JavaScript file responsible for decoding (https://www.gohitv.com/series/js/hiplayer.min.js) by using browser debugging tools.

Here's a code snippet for decoding that I've tidied up based on the JS file above:

(function() {
    const key = CryptoJS.enc.Utf8.parse("52e3d76bf3115bbd");
    const vector = CryptoJS.enc.Utf8.parse("62543816fdce10e7");

    // First <con> element from XML file
    const encoded = "XSTDxIM1NI+9kYheVJG7ywPKAmg7YNtRKmvhLt6R5umov1aFpyEXrZopsQiHBBBfjrr052rcchm8JBlxY8c47mwz8hUw72VjmqQEna3GHRI=";
    const decoded = CryptoJS.AES.decrypt(encoded, key, {
        iv: vector,
        mode: CryptoJS.mode.CBC,
        padding: CryptoJS.pad.Pkcs7,
    }).toString(CryptoJS.enc.Utf8);

    return decoded; // TÊN NGƯỜI, TỔ CHỨC, TÌNH TIẾT TRONG PHIM\NKHÔNG CÓ THẬT.
})();

You will need CryptoJS: https://cryptojs.gitbook.io/


Edit: I've wrapped this all up in a Python script which you can find here.

In terms of reverse engineering the process, this is how the decrypting happens:

  1. Find the episode ID (search the page source for eid="...")
  2. GET request to https://api.gohitv.com/s1/w/series/api/episode/detail with eid param and did param (random 24 char ID)
  3. The response includes a timestamp and encrypted base64 data. To decrypt the data:
    1. Create MD5 hash #1 of did (from step 2) + the timestamp
    2. Create MD5 hash of hash #1 + Wcb26arWkvkcAZc378eR (a hardcoded key in the site's JavaScript)
    3. Use the first 16 bytes of hash #2 as the AES key and the last 16 bytes as the vector
  4. GET request to https://api.gohitv.com/s1/w/series/api/series/rslv with the following params:
    • eid - episode ID
    • scid - source ID (from step 3)
    • sid - series ID (from step 3)
    • sq - seems to always be 1
    • sign - MD5 hash of: query string of above values + bywebabcd1234 (another hardcoded key)
  5. Find subtitle data in response (includes download URL + key)
  6. Decrypt the subtitle contents using the key as outlined in step 3.3
5
  • Sorry I haven't come back here in a few months, thank you for helping me, but there is one thing I can ask you, where did you find the key and vector? Can this be earned on the app? Commented Jan 2 at 18:04
  • @ĐứcNguyễn take a look at the GET requests to api.gohitv.com. Each request has a did header (which is a random 24 char string) and returns a timestamp along with encrypted base64 data. Calculate md5(md5(did + timestamp) + "Wcb26arWkvkcAZc378eR") - first 16 bytes is the key, last 16 bytes is the vector. The Wcb2 ... value is a hardcoded AES key on the page. Commented Jan 4 at 17:16
  • Hello, I just now have time to revisit this article. Can other urls be downloaded? Can other episodes be watched on the mobile app? Can I get subs, for example: gohitv.com/series/vi-vn/love-is-for-suckers/… Commented Jan 17 at 10:25
  • I got the error Failed to establish a new connection: [WinError 10061] No connection could be made because the target machine actively refused it. How can I use it? Thank you for your help Commented Jan 17 at 11:25
  • I don't know about the mobile app as I only tried with the free links; you might be able to include your session token/login details in the requests. Your error sounds like it could just be your firewall. I suggest opening an issue on the GitHub page if you have any issues with the script - as far as reverse engineering goes, this has been solved and the question should be marked as completed. Commented Jan 17 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.