Many TV channels allow you to stream their shows from a flash plugin on their website. How cool wouldn’t it be if you were able to download these streams to a file on your computer, or even show the streams in your favorite movie player, like mplayer? Let me tell you one thing. This is indeed possible.
How?
In order for the flash plugin to show the streams on your computer, they need to be freely available on the interwebz. If we use a protocol analyser like Wireshark to dig into the information sent between the flash plugin that runs in your browser, and the server that provides the video streams, we often see that it is transmitted using the Real Time Messaging Protocol (RTMP). If you happen to use a GNU/Linux based operating system, you’re in luck. There exists a toolkit called ‘rtmpdump’ that allows you to interact with a server offering RTMP streams. All you need to display these streams on your computer, are a few parameters that are exchanged between the aforementioned flash plugin and the RTMP server.
Example? Pretty please!?!
I will now show you an example of how this is done by grabbing an episode of the Norwegian TV show “Robinson-ekspedisjonen” that runs on TV3. This is the Norwegian version of Survivor. These episodes are freely available on http://tv3play.no if you want to display them in your browser. If you are like me, and you’d like a local copy on your computer, follow these steps:
1. Navigate to the URL where the first episode of Season 11 is located (http://www.tv3play.no/play/252950/)
2. Fire up a terminal and enter the following command (and yes, regular expressions are awesome!):
ngrep -W byline | grep -Pio '(swfUrl\.{2}M\K.*?(?=\.{2}tc))|(pageUrl\.{2}"\K.*(?=\.{3}))|(tcUrl\.{3 }\K.*?(?=\.{2}))|(resetting \K.*?(?=\.{3}))'
3. Start the show in your browser. A commercial should now appear (that you should really watch in return of downloading the stream ;-)), and wait for the output that appears in the terminal. It should be something like:
1.http://flvplayer.viastream.viasat.tv/play/swf/player110516.s.wf?rnd=1318382997
2.rtmp://mtgfs.fplive.net/mtg
3.flash/norway/tv3/robinson2011/robinsonekspedisjonen_sd_1101-flash_500
4. Here follows a short description of the above output.
1. This is the URL of the flash plugin that runs in your browser. Since we are parsing raw network data, an extra “.” has been added in between the “swf” extension. This can safely be removed. The corresponding switch in rtmpdump is “-W”
2. This is the location where you access streams on the RTMP server. The corresponding switch in rtmpdump is “-r”.
3. Finally, this is the path to the TV show on the RTMP server. The corresponding switch in rtmpdump is “–playpath”.
5. We can now feed these variables to rtmpdump, and do whatever we want with the captured stream. Here are two examples:
Download:
rtmpdump -r "rtmp://mtgfs.fplive.net/mtg" --swfVfy --swfUrl "http://flvplayer.viastream.viasat.tv/play/swf/player110516.swf?rnd=1318382997" --playpath "flash/norway/tv3/robinson2011/robinsonekspedisjonen_sd_1101-flash_500" -o output.flv
Show in mplayer:
rtmpdump -r "rtmp://mtgfs.fplive.net:1935/mtg" -W "http://flvplayer.viastream.viasat.tv/play/swf/player110516.swf?rnd=1318382997" --playpath "flash/norway/tv3/dagens_mann/sesong_1/dagens_mann_101-flash_500" -live | mplayer -
6. Side note. If you want to watch/download the stream in higher quality, replace “flash_500” with “flash_900” in the playpath.
Is this legal?
The way I see it, we are not doing anything illegal here, as the video streams are made available from the publisher.
Sure, they are hidden such that “Average Joe” will have difficulties downloading them. Also, we do perform a neat hack when we extract the required variables from the network packet stream using a regular expression, but we still need to watch the commercial (or at least wait for it to finish) in order to get these variables.
As long as I (or you) keep the downloaded streams for yourself, and don’t distribute them directly, you are operating within any legal boundaries, at least if you live in Norway.