KissAnime encryption change

[RexfelisLOC]

Looks like KissAnime has a new decryption function called "ovelWrap". It seems to be encoded as the following:

function ovelWrap(_0x7b4ax13) {
var _0x7b4axe = null;
try {
var _0x7b4ax10 = CryptoJS[_0x59b3[0]][_0x59b3[24]][_0x59b3[23]]({
ciphertext : CryptoJS[_0x59b3[22]][_0x59b3[21]]_0x59b3[20]
}),
_0x7b4ax7 = CryptoJS[_0x59b3[30]][_0x59b3[29]](_0x7b4ax10, key, {
mode : CryptoJS[_0x59b3[26]][_0x59b3[25]],
iv : iv,
padding : CryptoJS[_0x59b3[28]][_0x59b3[27]]
});
return _0x7b4axe = _0x7b4ax7.toString(CryptoJS[_0x59b3[22]].Utf8)
} catch (p) {
alert(p + _0x7b4ax13)
}
}
var bkZ = _0x59b3[31], skH = _0x59b3[32], iv, key;
iv = CryptoJS[_0x59b3[22]][_0x59b3[33]]_0x59b3[20], key = CryptoJS.SHA256(skH)

How do you decode javascript like the above?

[RexfelisLOC]

Found a JS deobfuscator:

function ovelWrap(_0x7b4ax13) {
var _0x7b4axe = null;
try {
var _0x7b4ax10 = CryptoJS['lib']['CipherParams']['create']({
ciphertext: CryptoJS['enc']['Base64']'parse'
}),
_0x7b4ax7 = CryptoJS['AES']['decrypt'](_0x7b4ax10, key, {
mode: CryptoJS['mode']['CBC'],
iv: iv,
padding: CryptoJS['pad']['Pkcs7']
});
return _0x7b4axe = _0x7b4ax7.toString(CryptoJS['enc'].Utf8)
} catch (p) {
alert(p + _0x7b4ax13)
}
}
var bkZ = 'a5e8d2e9c1721ae0e84ad660c472c1f3',
skH = 'nhasasdbasdtene7230asb',
iv, key;
iv = CryptoJS['enc']['Hex']'parse', key = CryptoJS.SHA256(skH)

[L2501]

it same aes as used in their other sites

all you need is to get the key and iv

 var bkZ = 'a5e8d2e9c1721ae0e84ad660c472c1f3',
     skH = 'nhasasdbasdtene7230asb',
     iv, key;
 iv = CryptoJS['enc']['Hex']['parse'](bkZ), key = CryptoJS.SHA256(skH)

key = hashlib.sha256('nhasasdbasdtene7230asb').digest()
iv = 'a5e8d2e9c1721ae0e84ad660c472c1f3'.decode('hex')

crypter = AES.new(key, AES.MODE_CBC, iv)
crypter.decrypt(cypertext.decode('base-64'))

[RexfelisLOC]

Awesome thanks. I was able to replace the token with the skH value and it works.

[Twoure]

Thanks for the info, I'll push a fix when I can.

[Twoure]

Fixed anime. Currently working on cartoon, then will check drama for changes.

[Twoure]

Finished cartoon/drama js decryption. Still need to translate into python, and make dynamic.

[RexfelisLOC]

I'm curious if your library can play videos from the beta server. Here's a video which is only available using Openload or KissAnime's beta server (KissAnime server is not available):

http://kissanime.ru/Anime/Naruto-Shippuuden/Episode-003?id=100312&s=beta

Notice the &s=beta at the end. The code will extract the link, but I cannot play the link in a browser (I do not use Plex).

[Twoure]

Notice the &s=beta at the end. The code will extract the link, but I cannot play the link in a browser (I do not use Plex).

I'm seeing the same thing. I assume its a header dependency issue. Sometimes sites like these expire the video link the instant it's been called, and they normally have some dependency within the requests header. I don't have time right now to look into this any further, but will once I've patched up the channel for the default sites.

[NicholasLAranda]

Thank you for addressing this and implementing a fix.