6 ms·

Damn I didn't know Spotify had implemented DRM. Back in the day (7 years ago maybe?) they had a low-level C SDK available for anyone to use, I learned alot abou

by melq 6y ago

Damn I didn't know Spotify had implemented DRM. Back in the day (7 years ago maybe?) they had a low-level C SDK available for anyone to use, I learned alot about data streams and wrote my first ring buffer trying to capture and process the PCM data.

zamadatix 6y ago
It seems like a particularly odd thing to do as well since there has never really been much effort to DRM the audio path end to end. At least in video it takes some special hardware to capture the output and if you don't crack protection at the source bitstream you're either going to have a ridiculously big lossless file or degradation.
- Namidairo 6y ago
  I remember that they'd pack the executable with Themida with the highest possible settings in order to complicate reverse engineering. Not really a huge hurdle nowadays, but they used to have the VM and anti-debug detection ratcheted up all the way and it would trigger when I had IDA open. (I believe it was a findwindow check)
- Macha 6y ago
  I wonder if there'll be a renewed push for this in the next decade. At the moment it's pretty pointless given the widespread continued existence of headphone jacks which have a pretty big analog hole, not to mention the continued existence of stores selling DRM free protests after the backlash in the 00s
  - Wowfunhappy 6y ago
    I mean, it's pretty pointless anyway. How long did HDCP 2 last? A couple years?
  - gizmo686 6y ago
    The analog hole isn't going away. At some point, the audio signal needs to get decrypted before going into the electromagnet that drives speakers. Even if you can somehow protect the electrical and magnetic signals, capturing a high quality audio signal from actual aucistic waves in the air is much simpler to do than capturing a visual signal from the light being emited from a monitor.
kitsunesoba 6y ago
Unfortunately, libspotify was deprecated years ago and was never given a proper replacement, despite promises to do so. Now all they have available are platform-specific SDKs that can control Spotify devices, which are exceptionally awkward on mobile platforms where in order to play anything, the Spotify app has to remain open in the background. It really bummed me out because the potential of a language-agnostic cross-platform library for legally streaming music is huge. It essentially decouples the service from the UI.
- dehrmann 6y ago
  > was never given a proper replacement The eSDK replaces it, but it's basically partners-only.
  - kingosticks 6y ago
    The embedded sdk is a dumbed down library providing playback, control is performed using Spotify's apps (via Spotify Connect). Libspotify provides playback and control i.e. everything needed to implement your own version of Spotify's app (but it predates Spotify Connect so has zero support for it). It's not much of a replacement. And as you say, there is no public access anyway.
- shp0ngle 6y ago
  How do projects like this work? https://github.com/librespot-org/librespot https://github.com/librespot-org/librespot
  - kitsunesoba 6y ago
    As far as I know, librespot is reverse-engineered from libspotify and/or the official Spotify client. As mentioned on their GitHub page: > Using this code to connect to Spotify's API is probably forbidden by them. Use at your own risk.
  - MrGilbert 6y ago
    It's a reverse-engineered version of the "Spotify Connect" protocol. [1] The original name of "librespot" was "spotify-connect", as this fork shows. [1]: https://github.com/Fornoth/spotify-connect/blob/master/README.md https://github.com/Fornoth/spotify-connect/blob/master/READM...

by melq 6y ago

zamadatix 6y ago

It seems like a particularly odd thing to do as well since there has never really been much effort to DRM the audio path end to end. At least in video it takes some special hardware to capture the output and if you don't crack protection at the source bitstream you're either going to have a ridiculously big lossless file or degradation.

Namidairo 6y ago
I remember that they'd pack the executable with Themida with the highest possible settings in order to complicate reverse engineering. Not really a huge hurdle nowadays, but they used to have the VM and anti-debug detection ratcheted up all the way and it would trigger when I had IDA open. (I believe it was a findwindow check)
Macha 6y ago
I wonder if there'll be a renewed push for this in the next decade. At the moment it's pretty pointless given the widespread continued existence of headphone jacks which have a pretty big analog hole, not to mention the continued existence of stores selling DRM free protests after the backlash in the 00s
- Wowfunhappy 6y ago
  I mean, it's pretty pointless anyway. How long did HDCP 2 last? A couple years?
- gizmo686 6y ago
  The analog hole isn't going away. At some point, the audio signal needs to get decrypted before going into the electromagnet that drives speakers. Even if you can somehow protect the electrical and magnetic signals, capturing a high quality audio signal from actual aucistic waves in the air is much simpler to do than capturing a visual signal from the light being emited from a monitor.

kitsunesoba 6y ago

Unfortunately, libspotify was deprecated years ago and was never given a proper replacement, despite promises to do so. Now all they have available are platform-specific SDKs that can control Spotify devices, which are exceptionally awkward on mobile platforms where in order to play anything, the Spotify app has to remain open in the background. It really bummed me out because the potential of a language-agnostic cross-platform library for legally streaming music is huge. It essentially decouples the service from the UI.

dehrmann 6y ago
> was never given a proper replacement The eSDK replaces it, but it's basically partners-only.
- kingosticks 6y ago
  The embedded sdk is a dumbed down library providing playback, control is performed using Spotify's apps (via Spotify Connect). Libspotify provides playback and control i.e. everything needed to implement your own version of Spotify's app (but it predates Spotify Connect so has zero support for it). It's not much of a replacement. And as you say, there is no public access anyway.
shp0ngle 6y ago
How do projects like this work? https://github.com/librespot-org/librespot https://github.com/librespot-org/librespot
- kitsunesoba 6y ago
  As far as I know, librespot is reverse-engineered from libspotify and/or the official Spotify client. As mentioned on their GitHub page: > Using this code to connect to Spotify's API is probably forbidden by them. Use at your own risk.
- MrGilbert 6y ago
  It's a reverse-engineered version of the "Spotify Connect" protocol. [1] The original name of "librespot" was "spotify-connect", as this fork shows. [1]: https://github.com/Fornoth/spotify-connect/blob/master/README.md https://github.com/Fornoth/spotify-connect/blob/master/READM...