Regression for player 99f55c01

[azihassan]

Verbose logs:

youtube-d https://www.youtube.com/watch\?v\=7JupB4QHyGI --verbose
Verbose mode : true
Handling https://www.youtube.com/watch?v=7JupB4QHyGI
Cache hit (/tmp/7JupB4QHyGI.html), skipping HTML download...
base.js cache hit (/tmp/99f55c01.js), skipping download...
Downloaded video HTML
Attempt to dethrottle : Yes
Why do NES colors look so different in emulators?
Why do NES colors look so different in emulators-7JupB4QHyGI-18.mp4
/home/hassan/code/youtube-d/Why do NES colors look so different in emulators-7JupB4QHyGI-18.mp4
Found n : SzsYpL619T3c7CW0EArK
Failed to find N param challenge name
Failed to solve N parameter, downloads might be rate limited
source/parsers.d:706 immutable(char)[] parsers.ThrottlingAlgorithm.findChallengeName() [0x56300d61735e]
source/parsers.d:747 immutable(char)[] parsers.ThrottlingAlgorithm.solve(immutable(char)[]) [0x56300d617588]
source/parsers.d:163 immutable(char)[] parsers.SimpleYoutubeVideoURLExtractor.getURL(int, bool) [0x56300d615435]
source/app.d:145 void app.handleURL(immutable(char)[], int, helpers.StdoutLogger, bool, bool, bool, bool, bool, bool, bool) [0x56300d589dfd]
source/app.d:100 _Dmain [0x56300d58986a]
Solved n : SzsYpL619T3c7CW0EArK
7JupB4QHyGI.html
Found link : https://rr2---sn-f5o5-jhod.googlevideo.com/videoplayback?expire=1772699920&ei=sOyoaf-GHvfRp-oPx472uQU&ip=105.66.132.116&id=o-AFKa6Jk7OjNiM4ilwsc4qlFQ1ObNghftLqdTe8DejtjP&itag=18&source=youtube&requiressl=yes&xpc=EgVo2aDSNQ%3D%3D&cps=1072&met=1772678320%2C&mh=ip&mm=31%2C29&mn=sn-f5o5-jhod%2Csn-h5q7kne6&ms=au%2Crdu&mv=m&mvi=2&pl=24&rms=au%2Cau&initcwndbps=483750&bui=AVNa5-yfrDFcmCNpqr-ou0W1d0N5JL7nh_oUhW71UdZ9fGozxiP9E0xdSiFAPYRc9wQQcLjQ7H3kaR_R&spc=6dlaFIoZR-mGYTs6xq8jUunSDXi7knRAZYLgv8TLD4-Sp2TE8pIOkjOwJctRIEMTuO3X_Uq2&vprv=1&svpuc=1&mime=video%2Fmp4&ns=pvXg1Atq6NZTON1m_lyOWV8T&rqh=1&gir=yes&clen=18383614&ratebypass=yes&dur=492.263&lmt=1772586157618385&mt=1772677768&fvip=1&fexp=51552689%2C51565115%2C51565681%2C51580968%2C51791334&c=MWEB&sefc=1&txp=3309224&n=SzsYpL619T3c7CW0EArK&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Cxpc%2Cbui%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Crqh%2Cgir%2Cclen%2Cratebypass%2Cdur%2Clmt&sig=AHEqNM4wRgIhAKRqoujfDMb12b-82XO1U4tOGL0fmJW6YqXt0JtYuWlMAiEA_wPgaTAiYpfaXr0lTCSoB7VIWgkvNeKpuLb7DD6H6-4%3D&lsparams=cps%2Cmet%2Cmh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Crms%2Cinitcwndbps&lsig=APaTxxMwRQIhAPM3yRuLfP052fdBL1VcKbiJdr04MkiPJAqRZMtQpx84AiAMTjWQB9ubwnn-1_c1DotWwndxB4h3hoE89D5o7JT8Xw%3D%3D
Downloading https://www.youtube.com/watch?v=7JupB4QHyGI to Why do NES colors look so different in emulators-7JupB4QHyGI-18.mp4
Using RegularDownloader
Downloading from byte 0
Failed with status 403
source/helpers.d:18 ulong helpers.getContentLength(immutable(char)[]) [0x56300d60ffaa]
source/downloaders.d:50 void downloaders.RegularDownloader.download(immutable(char)[], immutable(char)[], immutable(char)[]) [0x56300d60a100]
source/app.d:196 void app.handleURL(immutable(char)[], int, helpers.StdoutLogger, bool, bool, bool, bool, bool, bool, bool) [0x56300d58a20f]
source/app.d:100 _Dmain [0x56300d58986a]
Retry 1 of 2

[azihassan]

Looks like there was a major overhaul in the base.js file. A few candidates:

A search for "n" reveals a call to (new g.eD(D, !0)).get("n") in a function called BRX (regex search: .\.url=...(.\.url)):

BRX=function(D){try{var X=(new g.eD(D,!0)).get("n");if(X){var B=D.match(/\/n\/([^/]+)/);if(B&&B[1]&&B[1]!==X)return D.replace("/n/"+B[1],"/n/"+X)}}catch(C){g.SN(C)}return D};

Beautified as:

BRX = function(D) {
    try {
        var X = (new g.eD(D, !0)).get("n");
        console.log("X = ", X);
        if (X) {
            var B = D.match(/\/n\/([^/]+)/);
            if (B && B[1] && B[1] !== X) return D.replace("/n/" + B[1], "/n/" + X)
        }
    } catch (C) {
        g.SN(C)
    }
    return D
};

(I added the console.log)

With BRX invoked with V.url=BRX(V.url) in qg$:

qg$=function(D,X){if(X&&D.hlsvp)return sG();if(D.hlsFormats){if(X=Co(D.hlsFormats)){for(var B=[],C=g.F(X),V=C.next();!V.done;V=C.next()){V=V.value;V.url&&(V.url=BRX(V.url));var x=void 0;((x=D.Cv)==null?0:x.L)&&B.push(V.itag)}var y;((y=D.Cv)==null?0:y.L)&&B.length>0&&D.s7("hlsfmt",{itags:B.join(".")})}D.JZ=K$A(D.HZ,X);D.JZ&&NRb(D,D.JZ);y=D.clientPlaybackNonce;var l,W,v,f;return Z_$(D.HZ,D.isAd(),X,(f=(l=D.playerResponse)==null?void 0:(W=l.captions)==null?void 0:(v=W.playerCaptionsRenderer)==null?void 0:
v.baseUrl)!=null?f:null,D.M3,y,function(u){return D.publish("ctmp","hlsflt",u)}).then(function(u){for(var h=0,p=[],J=g.F(u),H=J.next();!H.done;H=J.next()){H=H.value;
var b=void 0;p.push((b=H.getInfo())==null?void 0:b.itag);var U=b=void 0;((b=H.getInfo())==null?void 0:(U=b.audio)==null?void 0:U.numChannels)>h&&(h=H.getInfo().audio.numChannels)}h>2&&D.s7("hlschl",{mn:h});var q;((q=D.Cv)==null?0:q.L)&&D.s7("hlsfmtaf",{itags:p.join(".")});var a;if(D.D("html5_enable_vp9_fairplay")&&((a=D.G)==null?0:Q$(a)))for(D.s7("drm",{sbdlfbk:1}),h=g.F(D.oC),p=h.next();!p.done;p=h.next())if(p=p.value,Zm(p)){D.G=p;break}lG(D,u)})}return sG()};

So I thought that BRX takes the video URL, extracts the N param and returns a new URL with the deciphered N param. It doesn't seem to be the case though because BRX runs a search and replace for /n/, and not &n=. Since the URL doesn't have /n/, if fails the if (B &&...) check and ends up returning it as it were.

[azihassan]

I tested this approach on the browser, but with another URL and a different player (6c5cb4f4). I simply took the result of X (logged above) and manually replaced the &n=XXX value of the URL with the value of X and it unblocked the video. Strangely enough, when I tested this very same approach with the URL that youtube-d spits out (when in --output-url mode), it didn't work. Maybe it expired by the time I finished?

I'll try putting it in the code to see if it works. Easier said than done though, the current solve function expects the N param in the argument but the real descrambling function now takes the entire URL.

[azihassan]

Test confirmed with just modifying the modifiedJavascript variable after dumping it to a tmp.js file. The reason it didn't work before was that the video I tested it against was using a different base.js file than the one I was experimenting with

[azihassan]

Now that N param shenanigans are handled, it's time to look into signatureCipher. The current code attempts to find the challenge function by searching for decodeURIComponent(something.s) but there's no direct equivalent in the new players. In player 6c5cb4f4, grepping for .s) reveals some interesting calls to a function called V0:

b=V0(b.url,b.sp,b.s)

url, sp and s are the three parts that are referenced in a typical signatureCipher. Excerpt from dQw4w9WgXcQ:

{"signatureCipher":"s=D%3D6%3D%3DQxB7T%3D0HcDzEY48727NT1_zvKe3Rl7SW7jp6QHU0PXwDQICMv6sm66gRAu3n6x5BQxu-hYhQ4IRZ7LHkcrX5WQOEjWgIQRw4MNqEHn\u0026sp=sig\u0026url=https://rr7---sn-f5o5-jhok.googlevideo.com/videoplayback%3Fexpire%3D1772962167%26ei%3DF-2saZzMHsugp-oPmsbRsQI%26ip%3D105.66.133.63%26id%3Do-AJV1Hzrf6Q2RJJbwNNiGWnnkA1h5TBkASOLV1QLPhHqq%26itag%3D18%26source%3Dyoutube%26requiressl%3Dyes%26xpc%3DEgVo2aDSNQ%253D%253D%26cps%3D1106%26met%3D1772940567%252C%26mh%3D7c%26mm%3D31%252C29%26mn%3Dsn-f5o5-jhok%252Csn-h5q7knes%26ms%3Dau%252Crdu%26mv%3Dm%26mvi%3D7%26pl%3D24%26rms%3Dau%252Cau%26initcwndbps%3D428750%26bui%3DAVNa5-wtBuK36aK2BQTk7sh01Ujd9ccgmcv59Ex0PX4fZnvXtA2pZ9-Yd6mNBMGdkucVe9endPcdLFq4%26spc%3D6dlaFOcajz9Db9RJGEXY8xzDo81abd907HY6lXcGD3sClV_GkRVfwgHCEWUQL_pAbZFQlD1gsNnX0w%26vprv%3D1%26svpuc%3D1%26mime%3Dvideo%252Fmp4%26ns%3DawfYKfrKnL-KdypC3i-MTfAT%26rqh%3D1%26cnr%3D14%26ratebypass%3Dyes%26dur%3D213.089%26lmt%3D1766960953317159%26mt%3D1772940323%26fvip%3D4%26fexp%3D51565116%252C51565682%252C51791334%26c%3DMWEB%26sefc%3D1%26txp%3D5538534%26n%3DpfgQYSVnPLN62xxa%26sparams%3Dexpire%252Cei%252Cip%252Cid%252Citag%252Csource%252Crequiressl%252Cxpc%252Cbui%252Cspc%252Cvprv%252Csvpuc%252Cmime%252Cns%252Crqh%252Ccnr%252Cratebypass%252Cdur%252Clmt%26lsparams%3Dcps%252Cmet%252Cmh%252Cmm%252Cmn%252Cms%252Cmv%252Cmvi%252Cpl%252Crms%252Cinitcwndbps%26lsig%3DAPaTxxMwRQIhAJxAn8d0tGoRa3vcKktBgax6axNit4PAL3tmHRhW4ntiAiA2bLcFyyizhl81KHBscpUuBwAaRD27oz-h9LjCAIiWWA%253D%253D"}

V0 is defined as:

V0=function(r,p,I){p=p===void 0?"":p;I=I===void 0?"":I;r=new g.XW(r,!0);r.set("alr","yes");I&&(I=OD(14,7872,y0(91,2162,I)),r[v[6]](p,du(24,8199,I)));return r}

Here, I references s since it's the third argument. The interesting portions are I=OD(14,7872,y0(91,2162,I)) and du(24,8199,I)

y0 definition:

y0=function(r,p,I,S){var a=p^r;if((r&88)==r){var B=I[v[4]](v[a^1241]),N=0;B[0]||N++;for(var e={};N<B[v[5]];N+=2)B[N]&&Wb(a^1230,a^743,e,B[N],B[N+1]);var C=e}if(!(r-9>>3)){B=a^5802;for(N=[];++B-N[v[5]]-(a^5834);)switch(B){case a^5828:B=a^5813;default:N[v[a^5863]](String[v[a^5861]](B));case a^5812:case a^5813:case a^5770:break;case a^5777:B-=a^5798;case a^5814:case a^5815:continue;case a^5840:B=a^5830;case a^5809:}C=N}(r>>2&15)==4&&(Wb(a^7842,a^15475,I),B=y0(a^7844,a^5773,I[v[a^7906]](v[a^7845])||v[a^
7921])[v[4]](v[a^7874]),C=I[v[a^7905]]===v[a^7926]&&B[v[5]]>1&&!!B[1]);r-9&11||((0,I[new S(v[a^5920])/(a^5256)])((0,I[a^6010])(),I[a^5959],I[a^6008]),(0,I[a^6009])(I[a^5972],I[a^5974]),((0,I[a^6005])(I[a^5959],I[a^5967]),I[6])((0,I[a^5954])(),I[a^5936],I[a^6008]),(0,I[a^6003])((0,I[a^5953])(I[a^5996],I[a^5936]),I[a^5973],(0,I[a^5977])((0,I[a^5977])((0,I[a^5977])((0,I[a^5962])(I[a^6012]),I[a^5953],I[a^6011],I[new S(v[a^6010])/(a^5256)]),I[a^6009],I[a^5920],I[a^5959]),I[a^5962],I[a^5974]),I[a^5936],
I[a^5995]),C=[]);(r|88)==r&&(C=decodeURIComponent(I));return C}

It does some black magic then returns decodeURIComponent on s, which mimics the behavior of the previous players. The bitwise stuff turned out to be a red herring in this case, after evaluating the global var v="call;U... array that is referenced throughout the file, we can evaluate y0 with the parameters above:

y0(91,2162, "D%3D6%3D%3DQxB7T%3D0HcDzEY48727NT1_zvKe3Rl7SW7jp6QHU0PXwDQICMv6sm66gRAu3n6x5BQxu-hYhQ4IRZ7LHkcrX5WQOEjWgIQRw4MNqEHn") == decodeURIComponent('D%3D6%3D%3DQxB7T%3D0HcDzEY48727NT1_zvKe3Rl7SW7jp6QHU0PXwDQICMv6sm66gRAu3n6x5BQxu-hYhQ4IRZ7LHkcrX5WQOEjWgIQRw4MNqEHn')

du definition:

du=function(r,p,I,S,a,B,N,e){var C=p^r;if(!(r+2>>3)){for(var b=I[v[4]](v[C^6611]),J={},W=0;W<b[v[5]];W++)var O=bd(C^6604,C^1666,b,W,J);var X=J}(r-3^9)<r&&(r-2^23)>=r&&(X=S(a,B,N));(r|56)==r&&(X=S(B,N,e));(r+9&40)>=r&&(r+1^24)<r&&(X=encodeURIComponent(I));return X}

du can be evaluated similarly, and it returns the same result as encodeURIComponent(s)

OD definition:

OD=function(r,p,I,S){var a=p^r;if((r+2^24)<r&&(r+9&26)>=r){var B=I[v[4]](v[a^7877]);Ma[v[a^7917]](B,a^7927);Ma[v[a^7832]](B,2);Ma[v[a^7917]](B,a^7878);Ma[v[a^7912]](B,a^7902);Ma[v[a^7917]](B,a^7907);Ma[v[a^7912]](B,6);Ma[v[a^7832]](B,1);Ma[v[a^7912]](B,a^7818);var N=B[v[a^7909]](v[a^7877])}r+2>>4||(I=(I%S[v[5]]+S[v[5]])%S[v[5]],B=S[0],S[0]=S[I],S[I]=B,N=[I]);return N}

OD can't be easily evaluated on the browser console since it references Ma, which itself needs more context. However, we can plug it into the generated tmp.js file which is really just the 6c5cb4f4 player with some stubs and desugaring to make it digestible by duktaped:

//...
weight:0}],w2:[{callback:Sg9,weight:500}]};g.iC("yt.player.Application.create",g.mI.create);g.iC("yt.player.Application.createAlternate",g.mI.create);YmQ(Od(),ect);var Ckh=g.aU("ytcsi.tick");Ckh&&Ckh("pe");descramble=iaU;decryptSig=V0})(_yt_player);

//b is extracted from the signatureCipher JSON field in the HTML of the video
var b = {
    "url": "https://rr7---sn-f5o5-jhok.googlevideo.com/videoplayback%3Fexpire%3D1772962167%26ei%3DF-2saZzMHsugp-oPmsbRsQI%26ip%3D105.66.133.63%26id%3Do-AJV1Hzrf6Q2RJJbwNNiGWnnkA1h5TBkASOLV1QLPhHqq%26itag%3D18%26source%3Dyoutube%26requiressl%3Dyes%26xpc%3DEgVo2aDSNQ%253D%253D%26cps%3D1106%26met%3D1772940567%252C%26mh%3D7c%26mm%3D31%252C29%26mn%3Dsn-f5o5-jhok%252Csn-h5q7knes%26ms%3Dau%252Crdu%26mv%3Dm%26mvi%3D7%26pl%3D24%26rms%3Dau%252Cau%26initcwndbps%3D428750%26bui%3DAVNa5-wtBuK36aK2BQTk7sh01Ujd9ccgmcv59Ex0PX4fZnvXtA2pZ9-Yd6mNBMGdkucVe9endPcdLFq4%26spc%3D6dlaFOcajz9Db9RJGEXY8xzDo81abd907HY6lXcGD3sClV_GkRVfwgHCEWUQL_pAbZFQlD1gsNnX0w%26vprv%3D1%26svpuc%3D1%26mime%3Dvideo%252Fmp4%26ns%3DawfYKfrKnL-KdypC3i-MTfAT%26rqh%3D1%26cnr%3D14%26ratebypass%3Dyes%26dur%3D213.089%26lmt%3D1766960953317159%26mt%3D1772940323%26fvip%3D4%26fexp%3D51565116%252C51565682%252C51791334%26c%3DMWEB%26sefc%3D1%26txp%3D5538534%26n%3DpfgQYSVnPLN62xxa%26sparams%3Dexpire%252Cei%252Cip%252Cid%252Citag%252Csource%252Crequiressl%252Cxpc%252Cbui%252Cspc%252Cvprv%252Csvpuc%252Cmime%252Cns%252Crqh%252Ccnr%252Cratebypass%252Cdur%252Clmt%26lsparams%3Dcps%252Cmet%252Cmh%252Cmm%252Cmn%252Cms%252Cmv%252Cmvi%252Cpl%252Crms%252Cinitcwndbps%26lsig%3DAPaTxxMwRQIhAJxAn8d0tGoRa3vcKktBgax6axNit4PAL3tmHRhW4ntiAiA2bLcFyyizhl81KHBscpUuBwAaRD27oz-h9LjCAIiWWA%253D%253D",
    "sp": "sig",
    "s": "D%3D6%3D%3DQxB7T%3D0HcDzEY48727NT1_zvKe3Rl7SW7jp6QHU0PXwDQICMv6sm66gRAu3n6x5BQxu-hYhQ4IRZ7LHkcrX5WQOEjWgIQRw4MNqEHn"
};
var N = "pfgQYSVnPLN62xxa"; //from b.url after decodeURIComponent-ing it
var sig = decryptSig(b.url, b.sp, b.s);
console.log("sig = ", sig);
var url = decodeURIComponent(b["url"]) + "&" + b["sp"] + "=" + sig.W.sig;
console.log("url after sig decryption = ", url);

var descrambled = descramble('https://www.googlevideo.com/n/' + N + '/videoplayback?n=' + N);
console.log("descrambled = ", descrambled);

var urlAfterDescrambing = url.replace("&n=" + N, "&n=" + descrambled.replace("https://www.googlevideo.com/n/", "").replace("/videoplayback?n=" + N, ""));
console.log("url after descrambling = ", urlAfterDescrambing);

descramble and decryptSig are probes that were placed on iaU and V0 respectively, that's why we had to feed them arguments in the format that those original functions expected. Output:

$ node tmp.js
sig =  {
  U: 'https://rr7---sn-f5o5-jhok.googlevideo.com/videoplayback%3Fexpire%3D1772962167%26ei%3DF-2saZzMHsugp-oPmsbRsQI%26ip%3D105.66.133.63%26id%3Do-AJV1Hzrf6Q2RJJbwNNiGWnnkA1h5TBkASOLV1QLPhHqq%26itag%3D18%26source%3Dyoutube%26requiressl%3Dyes%26xpc%3DEgVo2aDSNQ%253D%253D%26cps%3D1106%26met%3D1772940567%252C%26mh%3D7c%26mm%3D31%252C29%26mn%3Dsn-f5o5-jhok%252Csn-h5q7knes%26ms%3Dau%252Crdu%26mv%3Dm%26mvi%3D7%26pl%3D24%26rms%3Dau%252Cau%26initcwndbps%3D428750%26bui%3DAVNa5-wtBuK36aK2BQTk7sh01Ujd9ccgmcv59Ex0PX4fZnvXtA2pZ9-Yd6mNBMGdkucVe9endPcdLFq4%26spc%3D6dlaFOcajz9Db9RJGEXY8xzDo81abd907HY6lXcGD3sClV_GkRVfwgHCEWUQL_pAbZFQlD1gsNnX0w%26vprv%3D1%26svpuc%3D1%26mime%3Dvideo%252Fmp4%26ns%3DawfYKfrKnL-KdypC3i-MTfAT%26rqh%3D1%26cnr%3D14%26ratebypass%3Dyes%26dur%3D213.089%26lmt%3D1766960953317159%26mt%3D1772940323%26fvip%3D4%26fexp%3D51565116%252C51565682%252C51791334%26c%3DMWEB%26sefc%3D1%26txp%3D5538534%26n%3DpfgQYSVnPLN62xxa%26sparams%3Dexpire%252Cei%252Cip%252Cid%252Citag%252Csource%252Crequiressl%252Cxpc%252Cbui%252Cspc%252Cvprv%252Csvpuc%252Cmime%252Cns%252Crqh%252Ccnr%252Cratebypass%252Cdur%252Clmt%26lsparams%3Dcps%252Cmet%252Cmh%252Cmm%252Cmn%252Cms%252Cmv%252Cmvi%252Cpl%252Crms%252Cinitcwndbps%26lsig%3DAPaTxxMwRQIhAJxAn8d0tGoRa3vcKktBgax6axNit4PAL3tmHRhW4ntiAiA2bLcFyyizhl81KHBscpUuBwAaRD27oz-h9LjCAIiWWA%253D%253D',
  N: true,
  scheme: '',
  path: '',
  Z: '',
  W: {
    alr: 'yes',
    sig: 'AHEqNM4wRQIgWjEOQW5XrckHL7ZRI4QhYh-uxQB5x6n3unRg6Dms6vMCIQDwXP0UHQ6pj7WS7lR3eKvz_1TN72784YEzDcH06T7BxQ%3D%3D'
  },
  url: ''
}
url after sig decryption =  https://rr7---sn-f5o5-jhok.googlevideo.com/videoplayback?expire=1772962167&ei=F-2saZzMHsugp-oPmsbRsQI&ip=105.66.133.63&id=o-AJV1Hzrf6Q2RJJbwNNiGWnnkA1h5TBkASOLV1QLPhHqq&itag=18&source=youtube&requiressl=yes&xpc=EgVo2aDSNQ%3D%3D&cps=1106&met=1772940567%2C&mh=7c&mm=31%2C29&mn=sn-f5o5-jhok%2Csn-h5q7knes&ms=au%2Crdu&mv=m&mvi=7&pl=24&rms=au%2Cau&initcwndbps=428750&bui=AVNa5-wtBuK36aK2BQTk7sh01Ujd9ccgmcv59Ex0PX4fZnvXtA2pZ9-Yd6mNBMGdkucVe9endPcdLFq4&spc=6dlaFOcajz9Db9RJGEXY8xzDo81abd907HY6lXcGD3sClV_GkRVfwgHCEWUQL_pAbZFQlD1gsNnX0w&vprv=1&svpuc=1&mime=video%2Fmp4&ns=awfYKfrKnL-KdypC3i-MTfAT&rqh=1&cnr=14&ratebypass=yes&dur=213.089&lmt=1766960953317159&mt=1772940323&fvip=4&fexp=51565116%2C51565682%2C51791334&c=MWEB&sefc=1&txp=5538534&n=pfgQYSVnPLN62xxa&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Cxpc%2Cbui%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Crqh%2Ccnr%2Cratebypass%2Cdur%2Clmt&lsparams=cps%2Cmet%2Cmh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Crms%2Cinitcwndbps&lsig=APaTxxMwRQIhAJxAn8d0tGoRa3vcKktBgax6axNit4PAL3tmHRhW4ntiAiA2bLcFyyizhl81KHBscpUuBwAaRD27oz-h9LjCAIiWWA%3D%3D&sig=AHEqNM4wRQIgWjEOQW5XrckHL7ZRI4QhYh-uxQB5x6n3unRg6Dms6vMCIQDwXP0UHQ6pj7WS7lR3eKvz_1TN72784YEzDcH06T7BxQ%3D%3D
descrambled =  https://www.googlevideo.com/n/kNfK67CmHYhodg/videoplayback?n=pfgQYSVnPLN62xxa
url after descrambling =  https://rr7---sn-f5o5-jhok.googlevideo.com/videoplayback?expire=1772962167&ei=F-2saZzMHsugp-oPmsbRsQI&ip=105.66.133.63&id=o-AJV1Hzrf6Q2RJJbwNNiGWnnkA1h5TBkASOLV1QLPhHqq&itag=18&source=youtube&requiressl=yes&xpc=EgVo2aDSNQ%3D%3D&cps=1106&met=1772940567%2C&mh=7c&mm=31%2C29&mn=sn-f5o5-jhok%2Csn-h5q7knes&ms=au%2Crdu&mv=m&mvi=7&pl=24&rms=au%2Cau&initcwndbps=428750&bui=AVNa5-wtBuK36aK2BQTk7sh01Ujd9ccgmcv59Ex0PX4fZnvXtA2pZ9-Yd6mNBMGdkucVe9endPcdLFq4&spc=6dlaFOcajz9Db9RJGEXY8xzDo81abd907HY6lXcGD3sClV_GkRVfwgHCEWUQL_pAbZFQlD1gsNnX0w&vprv=1&svpuc=1&mime=video%2Fmp4&ns=awfYKfrKnL-KdypC3i-MTfAT&rqh=1&cnr=14&ratebypass=yes&dur=213.089&lmt=1766960953317159&mt=1772940323&fvip=4&fexp=51565116%2C51565682%2C51791334&c=MWEB&sefc=1&txp=5538534&n=kNfK67CmHYhodg&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Cxpc%2Cbui%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Crqh%2Ccnr%2Cratebypass%2Cdur%2Clmt&lsparams=cps%2Cmet%2Cmh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Crms%2Cinitcwndbps&lsig=APaTxxMwRQIhAJxAn8d0tGoRa3vcKktBgax6axNit4PAL3tmHRhW4ntiAiA2bLcFyyizhl81KHBscpUuBwAaRD27oz-h9LjCAIiWWA%3D%3D&sig=AHEqNM4wRQIgWjEOQW5XrckHL7ZRI4QhYh-uxQB5x6n3unRg6Dms6vMCIQDwXP0UHQ6pj7WS7lR3eKvz_1TN72784YEzDcH06T7BxQ%3D%3D

Output:

Now all that's left is to translate this madness into D

[juedi998]

In the sts=20518 version, the decoding logic of the n algorithm has undergone a fundamental change.
It still keeps the original n=xxxx pattern, but even if you extract and compute the n value from that branch, the video still cannot be played correctly.
This is because the algorithm now actually requires feeding the entire playback chain to compute the correct n value.

Note that the calculation branch used by SABR is not the same as the one used in the regular playback chain. However, both require the full playback chain as input to derive the correct n value.

I have already figured it out. Good luck.

[Nansess]

In the sts=20518 version, the decoding logic of the n algorithm has undergone a fundamental change. It still keeps the original n=xxxx pattern, but even if you extract and compute the n value from that branch, the video still cannot be played correctly. This is because the algorithm now actually requires feeding the entire playback chain to compute the correct n value.

Note that the calculation branch used by SABR is not the same as the one used in the regular playback chain. However, both require the full playback chain as input to derive the correct n value.

I have already figured it out. Good luck.

what's the point of the "I have already figured it out, Good Luck" comment lmao acting like this is rocket science,

LuanRT/YouTube.js#1148

there's already been multiple fixes pushed out