From b308669221ff0ad7cd75604c91d517af033932c8 Mon Sep 17 00:00:00 2001
From: kenzuya <kenzuya@gmail.com>
Date: Tue, 17 Mar 2026 14:04:36 +0700
Subject: [PATCH] Update Netflix

---
 ...sense_vidaa_tv_14.0.0_92747e74_7110_l1.wvd | Bin 0 -> 2966 bytes
 unshackle/services/Netflix/MSL/__init__.py    | 243 ++++++++++--------
 unshackle/services/Netflix/__init__.py        |   1 +
 unshackle/services/Netflix/config.yaml        |   2 +-
 unshackle/unshackle.yaml                      |   2 +-
 5 files changed, 137 insertions(+), 111 deletions(-)
 create mode 100644 unshackle/WVDs/hisense_vidaa_tv_14.0.0_92747e74_7110_l1.wvd

diff --git a/unshackle/WVDs/hisense_vidaa_tv_14.0.0_92747e74_7110_l1.wvd b/unshackle/WVDs/hisense_vidaa_tv_14.0.0_92747e74_7110_l1.wvd
new file mode 100644
index 0000000000000000000000000000000000000000..978734ffa96859b05eb747a51cd095dd8fa90f8d
GIT binary patch
literal 2966
zcmeH|`8ONr9>$Z{gQ2k|(>98Zpa>$iQj}VY*!LibiiT(iHHrqci>0a>TbHPPZ9Ay6
zmR9Xsr$dNZrmhynP)m*Cnmf~T?zw-%{pEY!^L@^F-simMIiJ_n#S{br0=UbO@!XG&
z51@D;5b#-F;yih9gnB8?vAsI~LQcXhSmYy!hxJ%V5R@G&%JoH$RxG6Rc9EL+z~)V6
z2VhJ{E`HdGAr~s0C21t4?pnXG*+PFsw0-nzu`CS=7)xs5cE^fMqqFaNAX0Lyv01xw
z?$eh%<xFkHcdo!p`VgqxHcWZCr*$p$btrdxUDf4m3OZ7ak(M9sd9RzZ@l|94>IAT2
zI262X>rfM%&sFF2?VhoU%|9`h7X9^L@L{r#E9V;A*M3+%sc>jxM&-o-W>4(7M`uup
z@qi@?E0$kVy85S?nQ;4bie_6Ovx?4DGa%h+{?pSg&5n>|uH~_9ypld_gz&Ng8pB3+
zg1CSH;PFcUR7mB#&qap?%eb33JAu`McU&9hQK80wW*h0n4|uEd(%M>++K>?Ch|~=K
zMlRBnzFWBF{T18|`=g#O|MIX7t%lK*M|Rh#d%u*~X6Z!T8!ca*QOr|?DD39u6}^;W
z=rMka)8JL{(s{By`SDpaufhfH4slG3J$<V0Tg>*rP-EM;eezYO<?%-o@6R6Q1}!Ir
zF=hgPPM65Ux>dhDk8fG36+B_bYL<15ETB`gUNkia>PZ}0y-@(HaOxXp7e=#FQD=T|
z(ukJC2<vO{h)TJd3Vxgx`w+--Wa|-r6nq5Y8by{$0L)i<h4$J#mOp8CMYve}$pf$1
zZ-G1~EP-e=z+utblcWrUWSA(}-m8B;S?w1H2h8^X>T{+B_x4>dvg%umr9tM_@L@^O
z3+5fg&()rS=_QMdyk=}iWxpxuR$;-cKGSQ_J<7Wv+d^8Fc72eY4*WW0SoC~n(WPSC
zG@E}B$$LrLF8siGH&vtXx^y`w%upq>dx-chUSNJx?XL{0i6za4Mo`_uLiijtZ)U>a
zt&B#bVVPwrf=_PDwc**ajACR{+u*wyP_&IR;xOo3$ywE!_Tg^ZFzx!n8eO(*<`3Qa
z$OeTQh4-ZlswXzHGGs6|=n+`lD6%pLpEO&`pCa|JeX})6QKVY<)9<1Zna})n4Er1p
z{#eLN9-9*RD?`OX+e8k}?e|}=(xaFC-pJm4PWKKK?~9A}DA)kA?7O$d9f0<va&gX4
z%Pu)SU{e&oPOo&b`6d=UF_&uk`aFNua?#T}BaZeHbju6SbbqL5Cw#C<>h@LOPHEM{
zwDQMSM#n~zD{VLXhkE<x?nCYvc~;C{-?H=RRsSU4E0G1F-84bXM<ErrXOQ{M0N+c>
zd_|G-d-eM1a3eQ)9?vE9qE}7UUc<TxVzNgrQu5pHoP{*ln^e|V8XCUd+CyLS9h_q=
znfc$`?dV0O_bu_W*oK8-baQ^r%ad!G>BwByb-v;r_T(I;e?-n|U7*}U=*rQr!4OR+
zibZM7E6xRh;|Rf1Ci2E!<H}|&I#VHv`&@;cZ2j@MGkhWlInzgusv^}--!8}3lQzxw
zBI)m&igI4@UP!}~_~;O~XLYJ94}_^8LXPY+CFyNjBlwn|dPjIp53eR8)Q71!fg-ee
zw>{ZkMzyCQ-h&XSTCFX*i68d+Q>+TMC9Wo7><*?FP~HW8Af!SNyu!r~f{1>ym25~T
zRZgj?dKt6Md)Gv|i!(9AD@z9<<ALD+qwG7%5O1{ggd&M}LIg2{po$|0TL2xZfc!vF
z0E`CYX3@1xRD;@U<jBLhsA45^jJ3+SMo;r=srL@icYxX-$AuWm$OHss%SXPUL!kvD
zYycR+!Kc|!=h5q!^}>p|-?fQ5vBrc)YAy|PoBi_Hki!z-#IB%5Wb9E&9jz-0$n7~D
z)@!6zcB(8{$;mIA*(v_4`LxfB3AZ6i`>va;jP{(@*N#n@DIN<c{L$w!w&PC|Xsck2
z+&l$bPSvgk6mk=!MJCtH8Q=f5z<8yTZL9S%xi*5`OB$?XiC0%gpYL6V04j_>^_|-;
zy@)2VED!NlzUqfAmjyumGkYWHi&gIVPcsBg&-AMy#b9fZDmdx&q_i=9#gk2;p8Fbq
z@QwPp4f&ggbXW9L4e0(<^)oYsO<kYQ+41Om3{Py3Gmp46b=n)^;CXOGE%3`ig!|lp
zw-RqaUD26pfdR)2-`Y2(4{-8z!q~>j+q1E(q722oi%ci=;><T94W}6bFqg8AB4_9j
zOYf?r`%juVqjqg0{Vy6thMNi{b7%Fv&I;Y@5}ORj4~SX2Me?g!bt%=l%UirZU-as%
zP@88SRM$qT7WR|}Tn9StzUTw~h<t}%>uRt|SfeLJO*7I@QnovJ{=4%7<d|6Zr^TDT
zCqAI8OO6B+TErw|CHi1l1&(d<e5EBHFLv7IHM89ljtrQ5)9Yzjw2<H(@uq3%RU=z1
ztnLsGkg~Xjk=LtE?uov{bN9BD)}}XaoaNJaOb6Z8>BGC(WHiC<$x`X-f)osrPS?$V
zaX!~ee$Ltg^p_`iMc4lE`p5LEEGb+Avti|+zHxZBMz;3n5-?AJI^cz5j4U#?mahRw
z)2vwLpS;vXn|U^)PYh;dYSI)tw0fLUHL_P=8>+%+!??AHBB#jM`~0*!ltb4HxKq%W
z0fr?OxNnDW*)yZA*Kr@Jc>M74oz%3twTb2el`M+VKDc6*V)mc!`?&Lvn_O;_eQ5E=
zzrnF~Pjngij!P$J%fdHqU<B~~CmrU{`)e1NAXm`PQr&MaItar=+>gwJ;LBqdHws5@
z!Nt~;t}XtFXT3=&F6(PqVH=Z!qMZv@E{QN5dRm3W)lK+RY?~`Po3l!FR_^oO<3v|?
z$DA6M`iQi=Hy~F(*((Q~{DwQfxwQ99fx~xOMV8^|wYr_)MU}I7Rd+2;+A!d8e@>Ux
zp0oBREmF4;o-h>ifIV~4V#jMpDy*){ETiCZ<Td8=)f=?3<ZII{M#ULPB?8aj?l%&r
zJuJA)@92lBlf5TTG$2lzG9uG0Y{kesD6Fw76_Iw>c)GN;9H{l4Y=u09dT3BXid&OE
zH|ud_`<fixsFCTr<(zOYRY59y_okh}17C#A?Xz2}Eav1|P}1<H(t!Y<FAYh#vH3C!
zC5y%{y~1~Vg7(kQ1m4TWq?cLmwJXc(Lpyu%)<cSA##iqSB`FQ?<f*pytLG<2*Bxn{
z)j!4Mh~VD9=LbjqD<LriCIuEc=1r(yNE9~2FPH$~vmk~MLc$0zNiaB=j3<!(Uh}(H
zni?Bpom^lt;1hlnTp%%=fD5Nm2!G3hew1K>pFdG0Lfh}yQt&U5;r`M1FFTr|jnOC_
zm^4@@ltRW+apC`KY7YkcQ;8%zmKYL1hM4@5LGAmcYTqsN(5gta%MQj`I@W4PbycK>
zD(ZNm^r&G3iW-GLBKU<7RIU=D!eFPt;@^Ra#o>do5d=yYksJcyRY$2JRgti>U^tl&
zjKxu+Lc__}FanNBA%;g`L;b>WfmjkDf<S_RG&M9Nk0A_{;YJ7}fjV49Kns99&<)_r
F^=}?CSrz~Q

literal 0
HcmV?d00001

diff --git a/unshackle/services/Netflix/MSL/__init__.py b/unshackle/services/Netflix/MSL/__init__.py
index 3b65d4d..2d74657 100644
--- a/unshackle/services/Netflix/MSL/__init__.py
+++ b/unshackle/services/Netflix/MSL/__init__.py
@@ -10,7 +10,7 @@ import time
 import zlib
 from datetime import datetime
 from io import BytesIO
-from typing import Optional, Any
+from typing import Any, Optional
 
 import jsonpickle
 import requests
@@ -19,15 +19,18 @@ from Cryptodome.Hash import HMAC, SHA256
 from Cryptodome.PublicKey import RSA
 from Cryptodome.Random import get_random_bytes
 from Cryptodome.Util import Padding
+from pywidevine import PSSH, Cdm, Key
 
 from unshackle.core.cacher import Cacher
 
 from .MSLKeys import MSLKeys
-from .schemes import EntityAuthenticationSchemes  # noqa: F401
-from .schemes import KeyExchangeSchemes
+from .schemes import (
+    EntityAuthenticationSchemes,  # noqa: F401
+    KeyExchangeSchemes,
+)
 from .schemes.EntityAuthentication import EntityAuthentication
 from .schemes.KeyExchangeRequest import KeyExchangeRequest
-from pywidevine import Cdm, PSSH, Key
+
 
 class MSL:
     log = logging.getLogger("MSL")
@@ -41,7 +44,16 @@ class MSL:
         self.message_id = message_id
 
     @classmethod
-    def handshake(cls, scheme: KeyExchangeSchemes, session: requests.Session, endpoint: str, sender: str, cache: Cacher, cdm: Optional[Cdm] = None, config: Any = None):
+    def handshake(
+        cls,
+        scheme: KeyExchangeSchemes,
+        session: requests.Session,
+        endpoint: str,
+        sender: str,
+        cache: Cacher,
+        cdm: Optional[Cdm] = None,
+        config: Any = None,
+    ):
         cache = cache.get(sender)
         message_id = random.randint(0, pow(2, 52))
         msl_keys = MSL.load_cache_data(cache)
@@ -53,20 +65,18 @@ class MSL:
             if scheme != KeyExchangeSchemes.Widevine:
                 msl_keys.rsa = RSA.generate(2048)
 
-
             if scheme == KeyExchangeSchemes.Widevine:
                 if not cdm:
-                    raise Exception('Key exchange scheme Widevine but CDM instance is None.')
-                
+                    raise Exception("Key exchange scheme Widevine but CDM instance is None.")
+
                 session_id = cdm.open()
                 msl_keys.cdm_session = session_id
                 cdm.set_service_certificate(session_id, config["certificate"])
                 challenge = cdm.get_license_challenge(
-                    session_id=session_id,
-                    pssh=PSSH("AAAANHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAABQIARIQAAAAAAPSZ0kAAAAAAAAAAA=="),
-                    license_type="OFFLINE",
-                    privacy_mode=True,
-
+                    session_id,
+                    PSSH("AAAANHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAABQIARIQAAAAAAPSZ0kAAAAAAAAAAA=="),
+                    "OFFLINE",
+                    True,
                 )
                 keyrequestdata = KeyExchangeRequest.Widevine(challenge)
                 entityauthdata = EntityAuthentication.Unauthenticated(sender)
@@ -76,47 +86,48 @@ class MSL:
                 keyrequestdata = KeyExchangeRequest.AsymmetricWrapped(
                     keypairid="superKeyPair",
                     mechanism="JWK_RSA",
-                    publickey=msl_keys.rsa.publickey().exportKey(format="DER")
+                    publickey=msl_keys.rsa.publickey().exportKey(format="DER"),
                 )
 
-            data = jsonpickle.encode({
-                "entityauthdata": entityauthdata,
-                "headerdata": base64.b64encode(MSL.generate_msg_header(
-                    message_id=message_id,
-                    sender=sender,
-                    is_handshake=True,
-                    keyrequestdata=keyrequestdata
-                ).encode("utf-8")).decode("utf-8"),
-                "signature": ""
-            }, unpicklable=False)
-            data += json.dumps({
-                "payload": base64.b64encode(json.dumps({
-                    "messageid": message_id,
-                    "data": "",
-                    "sequencenumber": 1,
-                    "endofmsg": True
-                }).encode("utf-8")).decode("utf-8"),
-                "signature": ""
-            })
+            data = jsonpickle.encode(
+                {
+                    "entityauthdata": entityauthdata,
+                    "headerdata": base64.b64encode(
+                        MSL.generate_msg_header(
+                            message_id=message_id, sender=sender, is_handshake=True, keyrequestdata=keyrequestdata
+                        ).encode("utf-8")
+                    ).decode("utf-8"),
+                    "signature": "",
+                },
+                unpicklable=False,
+            )
+            data += json.dumps(
+                {
+                    "payload": base64.b64encode(
+                        json.dumps({"messageid": message_id, "data": "", "sequencenumber": 1, "endofmsg": True}).encode(
+                            "utf-8"
+                        )
+                    ).decode("utf-8"),
+                    "signature": "",
+                }
+            )
 
             try:
-                r = session.post(
-                    url=endpoint,
-                    data=data
-                )
+                r = session.post(url=endpoint, data=data)
             except requests.HTTPError as e:
                 raise Exception(f"- Key exchange failed, response data is unexpected: {e.response.text}")
 
             key_exchange = r.json()  # expecting no payloads, so this is fine
             if "errordata" in key_exchange:
-                raise Exception("- Key exchange failed: " + json.loads(base64.b64decode(
-                    key_exchange["errordata"]
-                ).decode())["errormsg"])
+                raise Exception(
+                    "- Key exchange failed: "
+                    + json.loads(base64.b64decode(key_exchange["errordata"]).decode())["errormsg"]
+                )
 
             # parse the crypto keys
-            key_response_data = json.JSONDecoder().decode(base64.b64decode(
-                key_exchange["headerdata"]
-            ).decode("utf-8"))["keyresponsedata"]
+            key_response_data = json.JSONDecoder().decode(base64.b64decode(key_exchange["headerdata"]).decode("utf-8"))[
+                "keyresponsedata"
+            ]
 
             if key_response_data["scheme"] != str(scheme):
                 raise Exception("- Key exchange scheme mismatch occurred")
@@ -133,42 +144,36 @@ class MSL:
                 encryption_key = MSL.get_widevine_key(
                     kid=base64.b64decode(key_data["encryptionkeyid"]),
                     keys=keys,
-                    permissions=["allow_encrypt", "allow_decrypt"]
+                    permissions=["allow_encrypt", "allow_decrypt"],
                 )
                 msl_keys.encryption = encryption_key
                 cls.log.debug(f"Encryption key: {encryption_key}")
                 sign = MSL.get_widevine_key(
                     kid=base64.b64decode(key_data["hmackeyid"]),
                     keys=keys,
-                    permissions=["allow_sign", "allow_signature_verify"]
+                    permissions=["allow_sign", "allow_signature_verify"],
                 )
                 cls.log.debug(f"Sign key: {sign}")
                 msl_keys.sign = sign
-            
+
             elif scheme == KeyExchangeSchemes.AsymmetricWrapped:
                 cipher_rsa = PKCS1_OAEP.new(msl_keys.rsa)
                 msl_keys.encryption = MSL.base64key_decode(
-                    json.JSONDecoder().decode(cipher_rsa.decrypt(
-                        base64.b64decode(key_data["encryptionkey"])
-                    ).decode("utf-8"))["k"]
+                    json.JSONDecoder().decode(
+                        cipher_rsa.decrypt(base64.b64decode(key_data["encryptionkey"])).decode("utf-8")
+                    )["k"]
                 )
                 msl_keys.sign = MSL.base64key_decode(
-                    json.JSONDecoder().decode(cipher_rsa.decrypt(
-                        base64.b64decode(key_data["hmackey"])
-                    ).decode("utf-8"))["k"]
+                    json.JSONDecoder().decode(
+                        cipher_rsa.decrypt(base64.b64decode(key_data["hmackey"])).decode("utf-8")
+                    )["k"]
                 )
-            
+
             msl_keys.mastertoken = key_response_data["mastertoken"]
 
             MSL.cache_keys(msl_keys, cache)
             cls.log.info("MSL handshake successful")
-        return cls(
-            session=session,
-            endpoint=endpoint,
-            sender=sender,
-            keys=msl_keys,
-            message_id=message_id
-        )
+        return cls(session=session, endpoint=endpoint, sender=sender, keys=msl_keys, message_id=message_id)
 
     @staticmethod
     def load_cache_data(cacher: Cacher):
@@ -184,9 +189,24 @@ class MSL:
             # to an RsaKey :)
             msl_keys.rsa = RSA.importKey(msl_keys.rsa)
         # If it's expired or close to, return None as it's unusable
-        if msl_keys.mastertoken and ((datetime.utcfromtimestamp(int(json.JSONDecoder().decode(
-                base64.b64decode(msl_keys.mastertoken["tokendata"]).decode("utf-8")
-        )["expiration"])) - datetime.now()).total_seconds() / 60 / 60) < 10:
+        if (
+            msl_keys.mastertoken
+            and (
+                (
+                    datetime.utcfromtimestamp(
+                        int(
+                            json.JSONDecoder().decode(
+                                base64.b64decode(msl_keys.mastertoken["tokendata"]).decode("utf-8")
+                            )["expiration"]
+                        )
+                    )
+                    - datetime.now()
+                ).total_seconds()
+                / 60
+                / 60
+            )
+            < 10
+        ):
             return None
         return msl_keys
 
@@ -204,8 +224,9 @@ class MSL:
             msl_keys.rsa = RSA.importKey(msl_keys.rsa)
 
     @staticmethod
-    def generate_msg_header(message_id, sender, is_handshake, userauthdata=None, keyrequestdata=None,
-                            compression="GZIP"):
+    def generate_msg_header(
+        message_id, sender, is_handshake, userauthdata=None, keyrequestdata=None, compression="GZIP"
+    ):
         """
         The MSL header carries all MSL data used for entity and user authentication, message encryption
         and verification, and service tokens. Portions of the MSL header are encrypted.
@@ -228,7 +249,7 @@ class MSL:
             "capabilities": {
                 "compressionalgos": [compression] if compression else [],
                 "languages": ["en-US"],  # bcp-47
-                "encoderformats": ["JSON"]
+                "encoderformats": ["JSON"],
             },
             "timestamp": int(time.time()),
             # undocumented or unused:
@@ -272,33 +293,42 @@ class MSL:
 
     def create_message(self, application_data, userauthdata=None):
         self.message_id += 1  # new message must ue a new message id
-        headerdata = self.encrypt(self.generate_msg_header(
-            message_id=self.message_id,
-            sender=self.sender,
-            is_handshake=False,
-            userauthdata=userauthdata
-        ))
+        headerdata = self.encrypt(
+            self.generate_msg_header(
+                message_id=self.message_id, sender=self.sender, is_handshake=False, userauthdata=userauthdata
+            )
+        )
 
-        header = json.dumps({
-            "headerdata": base64.b64encode(headerdata.encode("utf-8")).decode("utf-8"),
-            "signature": self.sign(headerdata).decode("utf-8"),
-            "mastertoken": self.keys.mastertoken
-        })
+        header = json.dumps(
+            {
+                "headerdata": base64.b64encode(headerdata.encode("utf-8")).decode("utf-8"),
+                "signature": self.sign(headerdata).decode("utf-8"),
+                "mastertoken": self.keys.mastertoken,
+            }
+        )
 
-        payload_chunks = [self.encrypt(json.dumps({
-            "messageid": self.message_id,
-            "data": self.gzip_compress(json.dumps(application_data).encode("utf-8")).decode("utf-8"),
-            "compressionalgo": "GZIP",
-            "sequencenumber": 1,  # todo ; use sequence_number from master token instead?
-            "endofmsg": True
-        }))]
+        payload_chunks = [
+            self.encrypt(
+                json.dumps(
+                    {
+                        "messageid": self.message_id,
+                        "data": self.gzip_compress(json.dumps(application_data).encode("utf-8")).decode("utf-8"),
+                        "compressionalgo": "GZIP",
+                        "sequencenumber": 1,  # todo ; use sequence_number from master token instead?
+                        "endofmsg": True,
+                    }
+                )
+            )
+        ]
 
         message = header
         for payload_chunk in payload_chunks:
-            message += json.dumps({
-                "payload": base64.b64encode(payload_chunk.encode("utf-8")).decode("utf-8"),
-                "signature": self.sign(payload_chunk).decode("utf-8")
-            })
+            message += json.dumps(
+                {
+                    "payload": base64.b64encode(payload_chunk.encode("utf-8")).decode("utf-8"),
+                    "signature": self.sign(payload_chunk).decode("utf-8"),
+                }
+            )
 
         return message
 
@@ -316,9 +346,7 @@ class MSL:
             payload_chunk = json.loads(base64.b64decode(payload_chunk["payload"]).decode("utf-8"))
             # decrypt the payload
             payload_decrypted = AES.new(
-                key=self.keys.encryption,
-                mode=AES.MODE_CBC,
-                iv=base64.b64decode(payload_chunk["iv"])
+                key=self.keys.encryption, mode=AES.MODE_CBC, iv=base64.b64decode(payload_chunk["iv"])
             ).decrypt(base64.b64decode(payload_chunk["ciphertext"]))
             payload_decrypted = Padding.unpad(payload_decrypted, 16)
             payload_decrypted = json.loads(payload_decrypted.decode("utf-8"))
@@ -335,9 +363,9 @@ class MSL:
             error_detail = re.sub(r" \(E3-[^)]+\)", "", error.get("detail", ""))
 
             if error_display:
-               self.log.critical(f"- {error_display}")
+                self.log.critical(f"- {error_display}")
             if error_detail:
-               self.log.critical(f"- {error_detail}")
+                self.log.critical(f"- {error_detail}")
 
             if not (error_display or error_detail):
                 self.log.critical(f"- {error}")
@@ -391,22 +419,19 @@ class MSL:
         :return: Serialized JSON String of the encryption Envelope
         """
         iv = get_random_bytes(16)
-        return json.dumps({
-            "ciphertext": base64.b64encode(
-                AES.new(
-                    self.keys.encryption,
-                    AES.MODE_CBC,
-                    iv
-                ).encrypt(
-                    Padding.pad(plaintext.encode("utf-8"), 16)
-                )
-            ).decode("utf-8"),
-            "keyid": "{}_{}".format(self.sender, json.loads(
-                base64.b64decode(self.keys.mastertoken["tokendata"]).decode("utf-8")
-            )["sequencenumber"]),
-            "sha256": "AA==",
-            "iv": base64.b64encode(iv).decode("utf-8")
-        })
+        return json.dumps(
+            {
+                "ciphertext": base64.b64encode(
+                    AES.new(self.keys.encryption, AES.MODE_CBC, iv).encrypt(Padding.pad(plaintext.encode("utf-8"), 16))
+                ).decode("utf-8"),
+                "keyid": "{}_{}".format(
+                    self.sender,
+                    json.loads(base64.b64decode(self.keys.mastertoken["tokendata"]).decode("utf-8"))["sequencenumber"],
+                ),
+                "sha256": "AA==",
+                "iv": base64.b64encode(iv).decode("utf-8"),
+            }
+        )
 
     def sign(self, text):
         """
diff --git a/unshackle/services/Netflix/__init__.py b/unshackle/services/Netflix/__init__.py
index 1c55f70..265b27b 100644
--- a/unshackle/services/Netflix/__init__.py
+++ b/unshackle/services/Netflix/__init__.py
@@ -567,6 +567,7 @@ class Netflix(Service):
             self.log.debug(f"Android sign-in header keys: {list(header_data.keys())}")
             sign_in_value = self.extract_android_sign_in_value(payload_data)
             error_code = self.extract_android_sign_in_error_code(sign_in_value)
+            self.log.fatal(f"Android sign-in failed: {header_data}")
             if error_code:
                 raise click.ClickException(f"Android sign-in failed: {error_code}")
             raise click.ClickException("Android sign-in did not return a useridtoken.")
diff --git a/unshackle/services/Netflix/config.yaml b/unshackle/services/Netflix/config.yaml
index 2802567..498ae54 100644
--- a/unshackle/services/Netflix/config.yaml
+++ b/unshackle/services/Netflix/config.yaml
@@ -19,7 +19,7 @@ playready_kdekdh:
 esn_map:
   # key map of CDM WVD `SystemID = 'ESN you want to use for that CDM WVD'`
   8159: "NFANDROID1-PRV-P-GOOGLEPIXEL"
-  8131: "HISETVK84500000000000000000000000007401422"
+  12603: "HISETVK84500000000000000000000000007401422"
   22589: "NFANDROID1-PRV-P-SAMSUNG-SM-G975F-22589-RYFPGCV4K7QNZJFT5EK3YZ25TYOC1B1MSFEXR4L8JM99YOFXKZLFLOBTATE2AA2UJ"
   22590: "NFANDROID1-PXA-P-L3-XIAOMM2102J20SG-22590-020NTB086HJPGG70MDDMR0306MR0NNO5G3DJGFCKS9HJF58ER9QA21VFG4I0246JRN6TF16L9I627EPK708SH42UUMG1ASFVG20F3"
   12063: "NFANDROID1-PRV-P-SHENZHENKTC-49B1U-12063-2PAENERYJWY35H7F24163TMUCBBA4VRHQ2XZX4OBU4MUTKYFW50BMFBVGTUMN6IM0"
diff --git a/unshackle/unshackle.yaml b/unshackle/unshackle.yaml
index 553173a..c05560a 100644
--- a/unshackle/unshackle.yaml
+++ b/unshackle/unshackle.yaml
@@ -70,7 +70,7 @@ remote_cdm:
     security_level: 3
     type: "decrypt_labs"
     host: https://keyxtractor.decryptlabs.com
-    secret: 7547150416_41da0a32d6237d83_KeyXtractor_api_ext
+    secret: 919240143_41d9c3fac9a5f82e_KeyXtractor_ultimate
   - name: "android"
     device_name: andorid
     device_type: ANDROID