Can some help me with deciphering the You tube signature for censored videos

Question

For censored videos such as vevo you tube uses signature cipher to decodes its signature. You can refer to this link to understand what im saying.

YouTube signature decipher with an working example for VB.Net

Please open and read the above link to understand the question.

But recently youtube has changed its js file to change its cipher code link-

https://s.ytimg.com/yts/jsbin/player-en_US-vflGaNMBw/base.js

after finding the e.sig i see the nr function

nr=function(a){
  a=a.split("");
  mr.qv(a,69);mr.qv(a,26);mr.NC(a,38);mr.qv(a,8);mr.qv(a,22);mr.y9(a,1);
  return a.join("")

Java script isnt my native language so i cant understand this function.

However i can provide an encrypted and decrypted sigatures from an online youtube video downloader after seing the download link.

encrypted signature

-3E2D315C8113141CBBA08986DC4898B7190B7278.6349B6F283A287624084AF146535A2FEF0596458

decrypted signature

097F54F65B8282E9E1C04DB6235C18C4DF52176B.0341321C5E755A7B7151ADABEDCBC1F5B0592A47

I think you could start by finding more about mr and these two letters functions functions... They all seems to receive the a array, and a int parameter, and must do something with it. try to find these functions in the minified sources... There you may find some clues of what needs to be done, assuming you want to reproduce this on a custom client... Edit: Post the functions here if you need help figuring them out... ;) — joao Beno

joao Beno joao Beno · Accepted Answer · 2016-05-23T16:25:06

So, the function

nr=function(a){
    a=a.split("");
    mr.qv(a,69);mr.qv(a,26);mr.NC(a,38);mr.qv(a,8);mr.qv(a,22);mr.y9(a,1);
    return a.join("")
}

Just explode the a into an array of characters, then there is these functions:

 var mr = {
     qv: function(a, b) {
         var c = a[0];
         a[0] = a[b % a.length];
         a[b] = c
     },
     y9: function(a, b) {
         a.splice(0, b)
     },
     NC: function(a) {
         a.reverse()
     }
 };

qv: It receives the a array, store it's first value on the c var, then set the first value as the modulo of b value and a lenght, then set the b value on the a array as the c value.
y9: It gets the a array and remove b elements starting from 0... Basically remove the first element of the array on your function...
NC: Just revert the a array.

I think you need to track the changes qv do to your string... try and see if you can set a breakpoint in it on Firefox's debugger (I would not thrust Chrome for this matter... :D) and see if it gets your unciphered key in the end, or if there is more code in it...

Can some help me with deciphering the You tube signature for censored videos

1 Answers