[GH-ISSUE #23] remove shannon approach #16

Closed
opened 2026-02-28 14:24:42 +03:00 by kerem · 8 comments
Owner

Originally created by @3052 on GitHub (Mar 1, 2024).
Original GitHub issue: https://github.com/devgianlu/go-librespot/issues/23

neither the current web client or android client use the shannon code any more:

https://github.com/devgianlu/go-librespot/blob/master/ap/shannon.go

web client uses websocket, and Android uses normal HTTP

Originally created by @3052 on GitHub (Mar 1, 2024). Original GitHub issue: https://github.com/devgianlu/go-librespot/issues/23 neither the current web client or android client use the shannon code any more: https://github.com/devgianlu/go-librespot/blob/master/ap/shannon.go web client uses websocket, and Android uses normal HTTP
kerem closed this issue 2026-02-28 14:24:43 +03:00
Author
Owner

@devgianlu commented on GitHub (Mar 1, 2024):

The Shannon code is there purely to support the retrieval of decryption keys for audio streams. Using the new playplay protocol is an open problem because of reverse engineering and aggressiveness of Spotify to cease and desist everything that uses it.

<!-- gh-comment-id:1972677735 --> @devgianlu commented on GitHub (Mar 1, 2024): The Shannon code is there purely to support the retrieval of decryption keys for audio streams. Using the new playplay protocol is an open problem because of reverse engineering and aggressiveness of Spotify to cease and desist everything that uses it.
Author
Owner

@3052 commented on GitHub (Mar 1, 2024):

the web client doesn't use playplay, it uses Widevine L3:

https://guc3-spclient.spotify.com/widevine-license/v1/audio/license

which has been publicly reversed (by me) for nearly two years now

https://github.com/glomatico/spotify-aac-downloader/blob/main/spotify_aac_downloader/downloader.py

<!-- gh-comment-id:1973086038 --> @3052 commented on GitHub (Mar 1, 2024): the web client doesn't use playplay, it uses Widevine L3: https://guc3-spclient.spotify.com/widevine-license/v1/audio/license which has been publicly reversed (by me) for nearly two years now https://github.com/glomatico/spotify-aac-downloader/blob/main/spotify_aac_downloader/downloader.py
Author
Owner

@devgianlu commented on GitHub (Mar 3, 2024):

Oh nice, that would work, but I don't really see the benefit of doing it since the current implementation works file for now. If they ever shut it down or we are forced to move out of it to implement some new fancy features, then we might consider other opportunities, such as Widevine (or playplay).

<!-- gh-comment-id:1975278401 --> @devgianlu commented on GitHub (Mar 3, 2024): Oh nice, that would work, but I don't really see the benefit of doing it since the current implementation works file for now. If they ever shut it down or we are forced to move out of it to implement some new fancy features, then we might consider other opportunities, such as Widevine (or playplay).
Author
Owner

@3052 commented on GitHub (Mar 12, 2024):

actually, it seems for the web client widevine only works for these:

MP4_256_DUAL
MP4_128_DUAL
MP4_256
MP4_128

while these are protected with something else:

OGG_VORBIS_320
OGG_VORBIS_160
OGG_VORBIS_96
AAC_24

has anyone researched this? I am not even sure if you can change the format with the web client, maybe with a premium account? hm checking more, it seems yes:

https://open.spotify.com/premium

<!-- gh-comment-id:1989731663 --> @3052 commented on GitHub (Mar 12, 2024): actually, it seems for the web client widevine only works for these: MP4_256_DUAL MP4_128_DUAL MP4_256 MP4_128 while these are protected with something else: OGG_VORBIS_320 OGG_VORBIS_160 OGG_VORBIS_96 AAC_24 has anyone researched this? I am not even sure if you can change the format with the web client, maybe with a premium account? hm checking more, it seems yes: https://open.spotify.com/premium
Author
Owner

@devgianlu commented on GitHub (Mar 12, 2024):

go-librespot supports OGG_VORBIS only for now. I am not an audiophile or nowhere near an audio expert, but it seems OGG provides the best quality so far.

<!-- gh-comment-id:1991066831 --> @devgianlu commented on GitHub (Mar 12, 2024): go-librespot supports OGG_VORBIS only for now. I am not an audiophile or nowhere near an audio expert, but it seems OGG provides the best quality so far.
Author
Owner

@devgianlu commented on GitHub (Oct 20, 2024):

Posting this here for future reference: https://github.com/es3n1n/re-unplayplay

<!-- gh-comment-id:2425045584 --> @devgianlu commented on GitHub (Oct 20, 2024): Posting this here for future reference: https://github.com/es3n1n/re-unplayplay
Author
Owner

@3052 commented on GitHub (Oct 20, 2024):

to add some context, the above is a de-compilation into C code, and is highly obfuscated:

https://github.com/es3n1n/re-unplayplay/blob/master/src/lib/reversals/decrypt_key.cpp

<!-- gh-comment-id:2425058706 --> @3052 commented on GitHub (Oct 20, 2024): to add some context, the above is a de-compilation into C code, and is highly obfuscated: https://github.com/es3n1n/re-unplayplay/blob/master/src/lib/reversals/decrypt_key.cpp
Author
Owner

@devgianlu commented on GitHub (Nov 16, 2024):

By following threads around the topic of playplay it seems very not trivial to have it working without Spotify interfering. It looks to me like there is additional work required to have a proper solution that does not require hardcoding tokens.

Additionally, tackling the original topic: the AP is still required for exchanging OAuth2 credentials for stored credentials to be used with Login5.

Closing this as the scope is too broad. If the two things mentioned above change in the future it may be worth going down this path.

<!-- gh-comment-id:2480536680 --> @devgianlu commented on GitHub (Nov 16, 2024): By following threads around the topic of playplay it seems very not trivial to have it working without Spotify interfering. It looks to me like there is additional work required to have a proper solution that does not require hardcoding tokens. Additionally, tackling the original topic: the AP is still required for exchanging OAuth2 credentials for stored credentials to be used with Login5. Closing this as the scope is too broad. If the two things mentioned above change in the future it may be worth going down this path.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/go-librespot#16
No description provided.