# KeyDive pulls Widevine L3 key material off a rooted Android device with Frida > KeyDive is a Python tool that extracts Widevine L3 DRM components from an Android device, saving the client id and the RSA private key and optionally exporting a pywidevine WVD file. It needs ADB, a rooted device running frida-server, and, on recent Android versions, either a recent enough frida-server or functions you extracted yourself with Ghidra. **hyugogirubato/KeyDive** — Extract Widevine L3 keys from Android devices effortlessly, spanning multiple Android versions for DRM research and education. - Repository: https://github.com/hyugogirubato/KeyDive - Website: https://pypi.org/project/keydive/ - Stars: 1,103 · Forks: 166 - Language: Python - License: MIT - Published: 2026-10-19 · Updated: 2026-10-19 · Language: en - Canonical page: https://hysenlabs.com/projects/hyugogirubato-keydive ## The tool extracts device key material, it does not decrypt anything KeyDive is described as a Python tool for extracting Widevine L3 DRM keys from Android devices, for DRM research, education and analysis. The word that matters in that description is device. Everything the tool produces comes from the phone it is pointed at. The outputs listed in the README are client_id.bin, which is device identification data, and private_key.pem, an RSA private key. On top of that, the tool can export the result in pywidevine's .wvd format, and it can export a Widevine keybox if the device has one. The keybox is the hardware backed form of the same material, and the option exists because on some devices the keybox is the more interesting artefact. That framing separates this from a content decryption pipeline. The tool is not in the business of fetching or unlocking streams. It recovers the provisioning material, and a researcher can then take that material and a separately captured challenge to their own analysis setup. The project is explicit about the ground rules. The disclaimer says the tool is intended for educational and research purposes only, that the use of this tool in unauthorised testing of protected content is strictly prohibited, and that you should ensure you have permission before proceeding with DRM key extraction. That is the project's own statement, and anyone running it against a device they do not control or have permission for is outside what the author describes. The repository is small and conventional: a keydive/ package directory, a docs/ directory, a CHANGELOG.md, a DEVELOPERS.md, a LICENSE and a pyproject.toml. The package is on PyPI as keydive, and the licence is MIT. ## Frida on the device, ADB on the host, Python 3.8 or newer The prerequisites section lists three things, and the middle one is the real constraint. The first is ADB, the Android Debug Bridge, which has to be installed and on the system's PATH for command line access. The second is frida-server, installed on the target Android device, and the README is explicit that this requires root access on the device, pointing at the official Frida documentation for downloads and instructions. The third is Python 3.8 or newer, which matches the requires-python constraint of greater than or equal to 3.8 and less than 4.0 in the project metadata. Root is not an inconvenience here, it is a design requirement. Everything the tool does depends on attaching to the Widevine CDM inside the media process on the device, and that attachment is what frida-server provides. The Python side is a client that drives that session and does the cryptography afterwards. The project metadata also shows what is doing the work. The dependencies include frida, cryptography, construct and protobuf for parsing the binary structures, crccheck, asn1crypto and Unidecode for handling the certificate and identifier data, requests for the network side, rich-argparse for the command line help, and xmltodict for the Ghidra symbol files. There is also a development group, with frida-tools in it, and the version in the project file is 3.0.6, matching the newest release tag from 2026-04-28. ## One command drives the whole extraction Installation is a single pip line, since the package is published on PyPI. ```bash pip install keydive ``` The usage section then describes a single command that starts the whole flow. ```bash keydive -kw -a player ``` The script installs and launches the Kaltura DRM test app if it is not already installed. The user then works inside the app: provision Widevine if the device is not provisioned, refresh to intercept the keybox or private key, and run a DRM playback test to extract the challenge. KeyDive captures the keys as it goes and writes client_id.bin and private_key.pem. The README explains why the app sequence matters. The tip below the steps says the sequence ensures that the DRM-protected content is active and ready for key extraction by the time the KeyDive script is initiated, optimising the extraction process. In other words, the tool is driving a real playback path rather than asking the device for a key in the abstract, which is what makes the captured material match what the device would actually use. The -a or --auto flag selects that playback test, with the types given as "web" or "player", and -w asks for the pywidevine compatible WVD export while -k asks for the keybox export. ## The advanced flags exist for devices where the automatic path fails The command line options are grouped in the help output into global options, CDM extraction and advanced options, and the advanced group is where the compatibility story is. The first and most important constraint is stated at the top of the README. For dynamic key extraction on devices with Android SDK greater than 33, which is OEM API 18 and later, a minimum frida-server 16.6.0 is required. Otherwise, pre-extracted functions from Ghidra are necessary. That is the fallback the --symbols option serves, and it points at a file, a path to a Ghidra-generated XML symbol file for function mapping. The advanced usage section explains the same idea in prose: custom functions extracted from Widevine libraries with Ghidra can be provided to KeyDive to improve compatibility on some devices, with the details in the functions extraction guide in the docs directory. The other advanced options handle cases where the standard capture fails. --challenge takes protobuf challenge files captured via MITM proxy, which is the route described in the challenge extraction guide, and the README explains it is for when client ID extraction fails. --rsa-key takes RSA private keys in PEM or DER format for client ID decryption, and --aes-key takes AES keys in hex, base64 or file form for decrypting keybox data. --unencrypt forces the license challenge to keep client ID data unencrypted, and it carries a caution that this can cause repetitive crashes or instability in the Widevine library on certain devices. Three switches turn behaviour off: --no-detect disables automatic detection of the OEM private key function, --no-disabler disables the liboemcrypto-disabler module that patches memory protection, and --no-stop means the tool does not stop once the minimum CDM data is intercepted. The README notes that the advanced options are primarily intended for debugging and development purposes, and that regular users do not need to use them. ## The L1 keybox problem on some manufacturers, and the Magisk module that answered it There is one chapter of the README that is a small case study in how DRM implementations diverge between vendors, and it is worth reading even if you never touch the tool. Some manufacturers, with Xiaomi given as the example, allow the use of L1 keyboxes even after unlocking the bootloader. In such cases it is necessary to install a Magisk module called liboemcrypto-disabler to temporarily disable L1, which facilitates L3 key extraction. The status of that module has changed, and the README says so at the top of the section: the usage of the module is now deprecated because the deactivation of the library was natively added. So a workaround that was needed at one point became unnecessary when the underlying library gained the capability itself, which is also why --no-disabler exists as a switch. The offline mode is the other workflow that stands out. KeyDive supports offline extraction workflows suitable for restricted environments, with a dedicated offline mode guide in the docs directory, and offline extraction is listed among the features. For an environment where a network MITM proxy is not an option, the challenge has to be brought in from outside, and the --challenge option is how it gets there. The features list rounds this out with automated extraction supporting SDK greater than 21, export of extracted keys and device credentials in multiple formats, and support for injecting custom Widevine functions extracted from Ghidra XML files. ## MIT licensed, versioned on PyPI, and explicit about who it is for The project is MIT licensed, as the pyproject file records and the LICENSE file holds, and the package classifiers describe it as a production stable library with a cryptography security topic and a video multimedia topic, which is an accurate summary of what it does. The release history is short and regular: v3.0.6 on 2026-04-28, v3.0.5 on 2025-07-09 and v3.0.4 on 2025-07-05. The last push to the repository was on 2026-06-14, so the code is moving, and the CHANGELOG.md is the place to see what changed between versions. The final thing to weigh is the project's own framing, which the README repeats in more than one place. It is a research and education tool, it requires a device you have root on, it tells you to make sure you have permission, and it prohibits unauthorised testing of protected content. Those constraints are not incidental, they are the difference between a research instrument and a piracy tool, and the second reading of this project is not one the author supports. Practically, the decision comes down to whether you own the device and are authorised to analyse it. If you are, the extraction is a documented, scripted process with a test app and a defined output format. If you are not, no option in the help text changes that. ## Conclusion KeyDive fits a DRM researcher who owns or is authorised to test a device and needs the device's own Widevine provisioning material for analysis. It is the wrong tool for anyone without root, and it does not decrypt content for you, it only recovers the keys and identifiers the device uses. Verify first that your device and Android version are covered by the frida-server requirement in the README, and that you have permission, because the project states that unauthorised testing of protected content is prohibited. ## FAQ ### What does KeyDive do? KeyDive extracts Widevine L3 DRM components from an Android device, saving client_id.bin with the device identification data and private_key.pem with the RSA private key, and it can export the result in pywidevine's WVD format or extract a Widevine keybox. ### What do I need before running KeyDive? ADB installed and on the PATH, frida-server installed on the target device, which requires root on that device, and Python 3.8 or newer. For devices on Android SDK greater than 33 the README requires a minimum frida-server 16.6.0, or pre-extracted functions from Ghidra. ### How do I install and run KeyDive? Install it with pip install keydive, then run keydive -kw -a player. The script installs and launches the Kaltura DRM test app, and you then provision Widevine if needed, refresh to intercept the keybox or private key, and run a DRM playback test to extract the challenge. ### What is the liboemcrypto-disabler Magisk module for? Some manufacturers, Xiaomi for example, allow L1 keyboxes to be used even after unlocking the bootloader, and the module temporarily disables L1 to allow L3 key extraction. The README now marks its use as deprecated, because the library natively added the deactivation. ### Is using KeyDive on a device you do not own allowed? The README states that the tool is for educational and research purposes only, that the use of it in unauthorised testing of protected content is strictly prohibited, and that you should ensure you have permission before proceeding with DRM key extraction. ## Sources - [hyugogirubato/KeyDive on GitHub](https://github.com/hyugogirubato/KeyDive) - [License: MIT](https://github.com/hyugogirubato/KeyDive/blob/main/LICENSE) - [Project website](https://pypi.org/project/keydive/) - [README](https://github.com/hyugogirubato/KeyDive/blob/main/README.md) - [Releases](https://github.com/hyugogirubato/KeyDive/releases) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/hyugogirubato-keydive