Google Video hacking

I decided to look into Google Video a bit, now that they are selling stuff.

First things first, I looked into how the Google Video Player works for free files. (I’m a cheapskate.) It’s Google Engineering at it’s finest; the simplest thing that will work, and no simpler. When you click to see a movie in the Google Video Player, you download a tiny text file (with file extension GVP). That causes the Google Video Player to launch. It reads the file and starts to download the video via HTTP, just like the Flash player is doing in the web browser. The GVP file is just a text file, so you can open it and find the URL. If you fetch the URL yourself with wget (i.e. no cookies, no javascript, etc) you get a big binary stream. The content-type claims that it is “video/x-msvideo”, but it does not play in Windows Media Player.

I took a look at the header of the file, and the first four bytes are “RIFF”. Using File::Format::RIFF , I took a look inside the file and found that it starts with a LIST of type “goog”, which has inside it a chunk of type “GDAT” that is 32 bytes long. AVICodec is willing to overlook this extra data, but Windows Media Player and WinAmp don’t. Later, I’ll try to remove the Google extensions to the AVI file and see if I can get WinAmp to play it. Here’s what AVICodec sees inside the AVI file:

File  :  9.91 MB (9.91 MB),  duration: 0:02:34,  type: AVI,  1 audio stream(s),  quality: 46 %
Video :  7.56 MB,  411 Kbps,  30.0 fps,  480*360 (4:3),  divx = OpenDivx v4,    Supported
Audio :  2.34 MB,  128 Kbps,  44100 Hz,  2 channels,  0x55 = MPEG Layer-3,    Supported

So, there’s nothing fancy about the data; it’s Divx video and MP3 audio. There’s just a litte extra data in there gumming up the works.

When I went to buy my first video, I checked out the terms of service. They are located here. The interesting thing, which you can tell from the way the TOS are worded, is that you are signing up for a generalized payment processing system, not for a video purchase system. That’s a big deal, and an under-reported one. Some bloggers discovered the Google Purchases system in October, but no one in the press is talking about it right now.

The TOS says that I’ll be doing business with Google Payment Corp, a wholly owned subsidiary or Google. The other surprising thing is that it clearly says that GPC will not charge a service fee. As a video publisher, I know that if I choose to have Google collect fees for me, they reserve the right to take a portion of the fees, so it’s not like they are running Google Purchases for free or anything.

When you go to confirm the purchase, here are the final three reminders you get:

  • Requires Internet connection to watch
  • Requires Windows 2000 or XP
  • All sales final

There is also a small note saying, “Google processes video sales but is not the seller.”

Once the purchase is completed, you download a GVP file, just like with the free movies. It is formatted precisely the same. And fetching the video content outside of the Google Video Player also works fine. So that’s one interesting bit: the copy-protected files travel over vanilla HTTP, no cookies required. If you know the URL for a file someone purchased, you can download it. Playing it is a different matter, of course.

I took a look at the header of the copy-protected file while it was downloading. It has the same format, with the LIST of type “goog” and a chunk named GDAT. But there’s two extra chunks named “DRMI” and “drmh”. After that the AVI file seems to be about the same, but the chunks of video and audio are undoubtedly encrypted.

When you go to play the copy protected file, it works just like iTunes. The file indicates that it is copy protected, and the viewer talks to Google via SSL. I presume it submits your username, password, and the video id, and in return gets a key to decrypt it. If you try to play the file without a network connection, it fails, even after I’d watched it once, which means they chose not to use a key caching file, like Apple’s iTunes did. Good thing too, because that’s the feature that made it possible to break iTunes’ DRM system.

Google Video Player said, “checking for updates”, and then downloaded a decoder of some sort. Due to operator error, I didn’t manage to capture that in Ethereal, so I’ll have to try again sometime to make that happen. Finally the video played. The framerate and colors were very disappointing, bordering on unwatchable. It might be better once the entire file has loaded, but once Google Video Player got a good long ways ahead of the paused video, it stopped downloading.

All in all, an interesting way to spent $1.99, but not something I’d ever do again probably.

Update: When you strip out the “goog” list from the front of a GVI file, you get a valid AVI that will play in Windows Media Player and WinAmp. The following script, called gvi2avi will convert a GVI to an AVI:

#!/usr/bin/perl -w

use File::Format::RIFF;

my ( $riff1 ) = File::Format::RIFF->read( *STDIN );
$riff1->write( *STDOUT );

An unmodified GVI file (i.e. with the “goog” list intact) will play correctly in VLC.

Leave a Reply