403 Forbidden #3
Comments
|
Initial playback URL sent by browser:
Raw initial playback URL extracted from HTML:
Differences after we add After adding the |
|
We can't change any of the parameters that are listed in the sparams because then we would also have to change the signature in the sig parameter. |
|
The initial playback sent by browser has the same signature as the one that arrives in HTML so we are sure that the client in no way modifies and can not establish a new signature. So we can't modify the |
|
I also tested it with logged-in account sessions and on some accounts it just works. |
|
Working initial playback extracted from HTML on logged-in session where everything works
|
|
I already tested both formats with webm and mp4. Lottery what link will be returned for what session. Sometimes it works. Normal videos works always. The problem is only with livestreams. I will try to debug on the same html in the code as in the browser and find the cause. Weird as fuck |
|
The difference in requests between software and browser with the same hardcoded HTML: Still doesn't work |
|
I removed |
|
"As this issue seems to be coming from the context of YouTube ReVanced, I'd like to remind that the main purpose of PoToken is to ban unofficial YouTube apps and their users. If you can't play videos in YouTube ReVanced, that means everything works as intended. YouTube ReVanced and ReVanced in general are not supported or endorsed by microG." |
|
https://github.com/unixfox/refresh-botguard-token-youtube i tried: But there is no poToken in response. |
|
"Actual YT web client adds a pot (proof of origin token / poToken) param to the videoplayback query, which is presumably sourced from Google's Botguard. Not much is documented about Botguard, but it seems to essentially be reCAPTCHA sans user input." |
|
I tried with debugger and manually generating a pot token and then pasting it to the software but the effect is still the same. base.js line ~8587 |
|
At worst, it looks like the pot token is being refreshed every few seconds/requests and is also required by the later videoplaybacks not only initial. If it actually uses a botguard underneath, this is the maximum and most annoying protection they could have introduced. |
|
I also tested in puppeter and there, too, after removing |
|
It seems that player on
There is no difference. The effects are the same. |
|
Okay, after numerous tests I am sure that it is not the fault of |
|
The The |
|
After the first few requests If anyone is interested, my version looks like this: At first I totally forgot about this parameter and omitted it, because for somehow 2 years everything worked fine for me with this parameter omitted. And in my case, the difference with the correctly generated parameter and the one that youtube sends was not really important because my goal is to achieve view bots that download the worst possible quality. (Just the first few segments - youtube doesn't expect you to download them nonstop to sustain viewers) |
var playerJsUrlToExtractFunctionCache = make(map[string]string)
var playerJsUrlToExtractFunctionCacheLock = new(sync.Mutex)
func ExtractEncryptFunctionFromBaseJs(playerJsUrl string, baseJs []byte) (string, error) {
playerJsUrlToExtractFunctionCacheLock.Lock()
defer playerJsUrlToExtractFunctionCacheLock.Unlock()
cachedExtractFunction, ok := playerJsUrlToExtractFunctionCache[playerJsUrl]
if ok {
return cachedExtractFunction, nil
}
almostEndPhrase := []byte(`enhanced_except`)
almostEndPhraseIndex := bytes.Index(baseJs, almostEndPhrase)
if almostEndPhraseIndex < 0 {
return "", fmt.Errorf("could not find enhanced except")
}
almostEndPhraseIndex = almostEndPhraseIndex + len(almostEndPhrase)
finalEndMaxIndex := almostEndPhraseIndex + 200
cut := baseJs[almostEndPhraseIndex:finalEndMaxIndex]
endPhrase := []byte(`return b.join("")`)
endPhraseIndex := bytes.Index(cut, endPhrase)
if endPhraseIndex < 0 {
newEndPhrase := []byte(`return Array.prototype.join.call(b,"")`)
newEndPhraseIndex := bytes.Index(cut, newEndPhrase)
if newEndPhraseIndex >= 0 {
log.Printf("new script version detected\n")
newEndPhraseIndex = newEndPhraseIndex + len(newEndPhrase)
endPhraseIndex = newEndPhraseIndex
}
} else {
endPhraseIndex = endPhraseIndex + len(endPhrase)
}
if endPhraseIndex < 0 {
return "", fmt.Errorf("could not find end phrase")
}
endIndex := almostEndPhraseIndex + endPhraseIndex
cutFromEndToStartMax := baseJs[endIndex-5500 : endIndex]
splitFunctionPhrase := []byte(`var b=a.split("")`)
splitFunctionIndex := bytes.Index(cutFromEndToStartMax, splitFunctionPhrase)
if splitFunctionIndex < 0 {
newSplitFunctionPhrase := []byte(`var b=String.prototype.split.call(a,"")`)
newSplitFunctionIndex := bytes.Index(cutFromEndToStartMax, newSplitFunctionPhrase)
if newSplitFunctionIndex >= 0 {
log.Printf("new script version detected\n")
splitFunctionIndex = newSplitFunctionIndex
}
}
if splitFunctionIndex < 0 {
return "", fmt.Errorf("could not find split function")
}
encryptStartIndex := endIndex - 5500 + splitFunctionIndex
encryptEndIndex := endIndex
encryptFunction := baseJs[encryptStartIndex:encryptEndIndex]
ytSigFixContent := fmt.Sprintf("encrypt = function (a) {\n%s\n}", encryptFunction)
playerJsUrlToExtractFunctionCache[playerJsUrl] = ytSigFixContent
log.Printf("new script version in cache for url: %s\n", playerJsUrl)
return ytSigFixContent, nil
}I don't know what these changes are due to. An attempt to fight scrapping bots that download videos to teach AI? or maybe just bumping up the version in some webpack or other vite like shit? |
|
Looks like there exists a working version of |
|
hi qqqqqvb4 did you find what cause error 403 for random people afterall? |
|
Hi all, I'm interested in using this project but I get the following messages, let me know if there is a fix. |
It seems to me that over the past month Youtube has changed something. Both this and my own downloader no longer work. An attempt to download any livestream returns 403. After adding some missing parameters to the query we are able to get the correct status code but then we get this error: cabr.send_sabr_erro�. Any ideas?
The text was updated successfully, but these errors were encountered: