TubeReplacer

I did a bunch of things, none of which felt that interesting to make a log for, so here’s one big one.

• The quality selector now works
• You can now toggle video stats (logging in history) on or off.
• Some error handling and trimming stuff to save on ram

Did a small hack to add the tweak’s version to the crash reports

So this one is small, but I’ve done an optimzation for the process of getting that little thumbnail. The older youtube clients did indivisual, very small requests for the specific channel, incl the thumbnail. I already have this data with the video requests, and getting the channel data is rather wasteful of the network and slow. I’ve replaced it with just using the avatar from the feed. Speeds things up a decent chunk!

Some minor sabr tweaks, and also a fix to the channel id failing to load for certain feeds

I made some of the settings work, and also made it hide the comments count which I don’t have a way of getting a precise number right now. Ignore the playback error.

i did a bunch of misc fixes which aren’t interesting.

• iOS 5 preference fix
• some reloading of video changes with SABR
• cleanup of a bunch of things
• a fix to the item count (cuz 32bit limit aaaaaaa)
• memory things
• some crash bugs with SABR

A bunch of signin fixes, I fixed the channel id finder failing for different accounts, and I fixed an issue where one of the requests I did on 2.0.0 is synchronous and would not let the app start until it completed.

2.0.0 support! and actually 1.4.0 support this time (oops, i think i clicked the wrong version…). I really hacked my way to 2.0.0 support, as it adds all the stream data to a protobuf container thingy which is never actually generated as protobuf. The protobuf also isn’t a normal function, and I couldn’t figure out how to recreate it, not that it would really work if it does do some protobuf shenanigans.

So I did what probably every programmer does, hack it in poorly. When it
starts trying to play the video, after the protobuf section, and where i still have access to the legacy GData streams, and I just shove it in there, and it manages to work! Also had to do some extra things to include valid authentication to the SABR stuff so it can play private videos and such. But now 2.0.0 works!

I managed to get 1.4.0 support working! They started kinda doing what I implemented myself…. which causes issues, but it works! 2.0.0 is going to be hard tho…

Managed to get videos to count towards your history! Also some kinda boring optimization things (start parsing even while we are still downloading, because net neutrality doesn’t exist for some reason, and someone got 22 seconds for a 2mb file)

i managed to get private videos to work, however they still don’t show up in the “Uploads” tab.

A bunch of smaller bugfixes, and now it runs on iOS 5. There was some small differences since polyfils, and it doesn’t work with a proxy on (since it proxies localhost). The left device is iOS 5.

I spent a bit of time fixing up the settings menu to properly have the HD options. Unsure how much of this is going to stay like this, but right now both of the HQ ones work, the 360p (Android) plays with SABR for a bit, then it stops as we don’t have proper attestation (our POTokens only work on web based clients). Probably going to have to forbid using sabr on ANDROID. Unsure yet about Android VR or visionOS. They both need a visitorData, which I still have to get. VisionOS has the nice perk of giving a completely unprotected HLS stream, which this can use. Android VR is traditionally unprotected, but I think they kinda ruined that.

I also did a tiny bit of work to get closed captions working, which is basically prefixing https://www.youtube.com to the URL if it begins with a slash

I fixed the support in 1.0.0-1.3.0, 1.4.0 and above, they started changing a bunch of player things which I still have to figure out….

I managed to fix most of the RAM issues, excluding the one inside the youtube app which my stuff amplifies. I’ve done some stuff to allow you to change apps, lock the phone, etc, and have the stream recover. It’s not perfect, but it works well enough.

It kinda somewhat maybe works! you can make it through a video, however scrubbing thru the video takes forever (some request never finishes), and theres some random stutter in the video. RAM usage is still a problem, and private videos don’t play. To get here, I did things how the HTTP server wanted so other requests can come in while i’m waiting for a segment, and allows this to play fully, however I do still need to fix the buffering issues.

Shockingly, now that I have most of the TS stuff already in place for video, audio is shockingly painless! It was only just like the previous thing, and ADTS headers, https://wiki.multimedia.cx/index.php/ADTS. Time to try it on device!

OK, so this was quite annoying, It was really hard to find any docs on how esds is decoded, but I got there in the end, these are some of the parts I need to make the ADTS header (https://wiki.multimedia.cx/index.php/ADTS). The decoder is quite bad, and just ignores some cases, but hopefully it will work :)

Figuring out why the player view was never getting freed was taking too long, so uhh audio! yes! I have managed to grab the header out of the app after having to patch wayyy too many bugs with the header parsing, some of which could crash the app if your network is bad. Tiem to parse dis audio header!

I managed to make the buffering system a little more robust, it can complete a video & even seek if your careful to let it play out. I also fixed some of the memory leaks, you can get much farther, but it does still only climbs, at the end of this 25 minute video it got up to 189mbs of ram used, which means we basically leaked 100mb of ram. This is quite unacceptable still, and I get to do more of figuring out why, yay!

srry for audio, i am in a discord call, but i managed to get more than like 20 seconds to work, however it currently gobbles RAM, and has wayyyy too many crash bugs. I fixed a bunch of the crash bugs, and broken stream bugs, but there’s still some crashing, esp. on video end.

IT PLAYS!!!!!!!!!!!!!!!!!!!!!! YES!!!!!!!!!!!!!! that took wayyy too much debugging (and i also used ai assistance to tell why it wouldn’t play). I got it first working with VLC & other media players, but the iOS 6 player was especially stubborn. It only plays a couple seconds since I only do one request, but it plays. Did i mention it plays? I might try forcing it to use 1080p since 144p is a little… lacking in quality and SABR is defaulting to it, i guess i’ll figure that out later.

Unsure how much of a win this is, but at least FFplay can play the video! However, VLC, built in media players on windows, and more importantly, the video player within iOS 6 cannot play it :( I’ve forced it to use 144p for a while now for a small file size, but it should be able to go quite up in size. Bigger issue is getting it to play, however I think I will wait on that, and work on having it serve the files on the phone so I can debug this a bit easier, and have the player actually like play the files without my syslog stuff. Hopefully I can get the video to play tho :)

Quite boring when all that exists in these devlogs is random hex eh? Hopefully this should be the last hex blob before actually getting some kinda of video to play! (maybe, miiiight have to do one more as I hook the TS file up with the HTTP server). I managed to packetize the data into PES packets. The next thing for video (no audio) should be packing it all up in one nice TS file. And then if we get lucky, we will get like 4 seconds of a video :D, maybe even up to like 10 since then the buffer runs out, and second requests to SABR aren’t implemented yet.

I now grab h264 samples, and convert them into annex b samples. I think the next part might be actually building the TS file! wow! This means creating packets of the data, and then making packets out of those packets (why…)

I decided compiling FFmpeg was going to take forever, uhh doesn’t really give good stardance hours, and this is does more stardance hours ig… I did tfdt, tfhd, and trun parsing. I think this is all the parsing I need to do on the video side and the fragment size… i hope. Here’s a screenshot of me just printing the sample size to syslog.

I did some extra work trying to parse MP4, but like… this is going to be a lot of effort to do, and just for the video, not even looking at audio yet. For this reason, I would like to bundle parts off FFMPeg with it, but compiling it is being terrible… I got arm64 after a while, but armv7 just does not want to go :(

POTokens actually work! current protection status being 1 means the session is approved and good to continue throughout the entire stream! I basically implemented the PR at https://github.com/LuanRT/BgUtils/pull/44, and did some user agent fixes… and my fuckup mis-spelling something I literally said in comments I might of 😭 . And now I get SPS of 1! :D :D :D It only took… like 3 months…. for potokens… 😔

I also figured out that Web offers an HLS stream if you specify an iOS useragent… uhhhhh i pretend not to see (for now), I’m sunk cost right now, and such. I wanna commit video container crimes!

Actually doing something with the media data we get from SABR now. I have decided that probably the best way to implement this is to convert it into an HLS stream. I came to this decision after fully looking at what SABR outputs, a fragmented MP4 intended for DASH, which the phone cannot play. However, SABR splits up the files based on the header first, then a bunch of fMP4 fragments. With a lot of work, I should be able to manually change the container from fMP4, to MPEG-TS, the format used by HLS, and have it streamed. It does have some hickups, changing stream to a lower or higher quality while streaming would likely be difficult (more concerning with it being a server adaptive bit rate system). Also MPEG-TS looks kinda… janky? This may also bring me some trouble if I chose to add Opus audio, since much of the audio streams are Opus based.

Anyways, I now parse the first MP4 stream we get per format (audio & video), specifically the initialization section, and create an HLS manifest out of it! My next step is probably to have the phone itself host an HTTP server to grab the stream from, as it only supports getting videos from URLs. Audio is also in MP4 format, so this should work for it too :D

Working on some SABR parsing stuff, I got StreamProtectionStatus & NextRequestPolicy, along with the extraction stuff to get the segment from SABR. Doing this kinda of debugging on airplane wifi is rather hard, as the response is quite big, containing video segments.

OK, a couple fun things. I finally got an output from SABR yay! The bug was really stupid, and it took me wayyy to long to figure out. I get the ustreamerconfig as base64, HOWEVER, this isn’t standard base64, it’s URL safe base64… for some reason. To send it in SABR, I have to turn it into bytes, specifically an NSData. These old iOS versions don’t have a standard base64 library, so I import one. The base64 library does not accept the - & _ type, and instead of like throwing any sort of error or even a log, it just… ignores them! So the error was actually accurate, it was a malformed config, specifically ustreamer config.

I also did some stuff on POTokens. It appears that youtube did an update, and the POToken engine does more checks to see if it’s on youtube.com, or something like that. It seems it now specifically refuses POTokens were minted on not youtube.com, and only for the video id case, and only sometimes, specifically if fexp in the URL is 51973818, if it’s 51973819 it works. Also for some reason on my end using the visitorData works, which it doesn’t for other people in the youtube.js discord. Oh I should mention it also affects the library BgUtils, which my thing (and yt-dlp, and literally everything) is based on/uses. For now, i’m going to ignore the POToken issue, since I’m honestly not that great at debugging the youtube’s JS (i spent like a couple hours trying, if you search for function Vr in the base.js you’ll find something in the POToken minter as of right now). However according to Luan (the author of the BgUtils thingy), nothing changed in the player code, so idk, Idk how I could really debug the potoken engine.

Oh also, something… interesting, someone else in the BgUtils discord decided to uhh fork my thing and using the power of AI, implement POToken gen using QuickJS. I initally tried this for POToken gen but got stuck with me missing polyfills. I’m considering taking parts of the forked code (specifically the polyfills), and some of my older QuickJS code and having two POToken systems you can switch between in case one breaks (ES6 issues for example), but idk if I should.

I guess for now, I get to go actually write an implementation reading SABR data/UMP now. Maybe i’ll be doing this on a plane again :D (return flight)

I’ve been doing a lot of work on getting SABR playback working. I think i’ve got sending “preferred” audio & video formats, client info stuff and probably some other things too. Currently the only response I have is sabr.malformed_config (2c1d0a15 73616272 2e6d616c 666f726d 65645f63 6f6e6669 6710021a 022006). Most of these 7h 30m were done on the ground, but i’m working on this at 37 000ft in the air. Had to do some hacks & scripting to get this to connect to the internet, which needs you to watch an ad every 30 minutes.

I did a bunch of integration stuff, and cleanup, but now it plays 360p from the mweb client! I had to add an extra way to decipher n/sig to it (since youtube is yes), but it seems decently reliable, execpt for me not having POToken generation checks to see if it’s ready. Hopefully shouldn’t be too hard :)

iOS 5 now works with the botguard stuff! It was pretty simple, I just had it load the cloudflare version of polyfill.io and copied the JS it gave (since it’s based on UA)

I did some minor optimization of the POToken stuff, so it doesn’t block the main (UI) thread for too long, turning 2478.5ms -> 8.8ms by adding a 0 second settimeout when starting the botguard VM.

I also went to go check on iOS 5. When there, I noticed my analytics temp file was failing to write, meaning it sent a “installed” event every launch. This is well… bad. It means my analytics are bad yay! I added a small check to see if I can actually write this file before sending it off, i’ll diagnose it later.

And finally, I DID IT!!!!!!!!!!!!!!! YESS!!!!! This URL was generated on the phone, from a URL from the mobile client, meaning I can now get signed in videos. This was months and have ruined the speed of startup… BUT IT WORKS!!!!!

I also have to actually make it like use the n/sig function, and do other tweaks since I used a proxy to manually implant the URL. It also means I can finally start making a SABR client inside this. I am very happy 😭

YESSS I HAVE A N/SIG SOLVED WITH JS CHALLENGE. I am yet to test if it’s valid though, here’s hoping lol.

In an effort to keep it on device, I tried switching to tree-sitter. I got it all compiled for iOS, and I did get it to just parse the javascript on device! However, it took 40 seconds to parse. Along with this, RAM usage went from 58MB -> 220MB. The 3GS (one of the current targets) only has 256MB, and if I ever even try on the 3G, that only has 128MBs of ram. This is very bad.

As much as it pains me, I think the best solution would likely be to have a server pick out the n/sig function, and have the device pull a json file or something which has the functions it needs. Kinda does ruin the “no server is involved” stuff with this, but that kinda does seem like the sacrifice I have to make unfortunately. Sadge :(

So I decided to look at n/sig, as that’s what I need next. N/Sig is basically two steps

1. Find the function for n/sig
2. Run that function.

The n/sig function is located somewhere in https://www.youtube.com/s/player/882a803a/player_es6.vflset/en_US/base.js (the link changes as new players come out, so it’s dynamic). If you look at it for a bit, you may notice it’s quite big. 2.4mb. Every other tool puts it into something called meryiah, a JS parser. https://meriyah.github.io/meriyah/. If you try to put that script into that site, you will notice the output is extremely long. It’s long enough that you cannot select all of it. It’s also long enough to cause memory exhaustion. This is a problem. I cannot run this on my device without causing an out of memory crash. I’m unsure right now how I should get around this, but we will see

I also did some integrating the POToken stuff with the rest of that app, but that was relatively minor execpt for the bad memory management I do biting me in the ass. I think this may have also destroyed launch preformance, but i guess we have to see.

I quickly did coldstart token generation. This is intended for when the POToken engine is starting up/unavailable. It’s used to allow for instant playback on actual youtube, and here too I hope. There’s a few things I need to do to make sure this works alright. Right now, if there’s no network on startup, the engine will just be perpetually broken, and that’s not great, so I need to handle that, along with actually integrating it with the rest of the tweak.

i did it! i now have a POToken on device. God that took far too long lol. Now I actually have to like… use them. im going to bed.

Probably had some other things, but I got the botguard response in the youtube app instead of the YT Capture app. This was shockingly annoying, since idk why, but the GTMHTTPFetcher just… doesn’t work on the youtube app? Since at least for now this is iOS 5+, I just switched to an equivalent function in the NS stuff.
Right now this does botguard responses only, but I need POToken generation, so here I go i guess…..

(isn’t this just riveting?)

I decided that QuickJS was just not working out, and decided to switch over to a hidden webview. I had a few hiccups due to the fact that it’s an ancient webview, and thus missing functions like await, async, and Symbol. The latter was required by the botguard’s iframe, which caused issues trying to polyfill it, but I got there in the end. And now I have a fresh botguard token! Now it’s time for POTokens, and then the needed tokens for uploading videos!

I fixed an issue where videos with a view count over the 32bit integer limit (2.14B) go into the negatives. This was relatively annoying since the issue was the app turning the int64 into an int when passing it to a function to display the video, meaning I had to RE & recreate the functions for displaying video info three times! (1.2.1 & 1.3.0 had different versions for iPad, and 2.0.0)

Also did a small fix to the dislikes where viewing a video where more dislikes than likes (baby shark) would make the likes & dislikes 50/50.

Took a break from PO stuff still, but now you can select a specific channel, though i’ve hidden my other one bcuz privacy.

Since I keep seeing crash reports from people not reading “Known Issues”, i’ve added one for this, and iPad on iOS 9 incompatibilities. Hopefully I will stop seeing all this :)

I am taking a break from POToken for now, since they are legitimately hell, and it’s kinda gotten in a state where too much is broken and I must do a patch to fix these issues. I’ve managed to fix most of the issues which include

• Sentence based instead of word based captions not being handled
• “Viewer Discretion” videos not playing due to some missing flags
• RYTDL now uses ratio stuff with the from youtube like count instead of relying on just sometimes broken data from RYTDL
• Homepage length being broken
• Playlist content (trending, categories, playlists (duh), favourites, watch later) no longer appearing
• Removing the now broken “Adaptive” option (rip)

I’m getting somewhere but it’s still quite wrong. I managed to “pass” initalization, but generating a botguard response is just flat out broken. This should look very different. I changed out some bits on how setTimeout & setInterval to get it to initalize, but I don’t know if something there is wrong or what is happening :(

Sooo uhh suffering :D I do not know everything in this 2h 26m, but I spent a bunch of time rewriting some of my requesting stuff to have auth for challenges, and debugging why the challenge response I got was junk. Turns out, I’m bad at javascript and didn’t properly await -_-. Now I can actually get a completed challenge! but only currently in the browser… Time to try it on device!