Alleycat Player v2e

Install the Local Proxy Server app which is available here. The current version name is "kraker-1c".

CORS Unblocker:  Allow CORS -- Firefox or Chrome-based   CORS Everywhere -- Firefox only

Alleycat Player supports playback of HLS/m3u8 and DASH/mpd videos via these two modules (whitelist accordingly):

cdn.jsdelivr.net/npm/hls.js@0.12.0/dist/hls.min.js
reference.dashif.org/dash.js/v2.9.3/dist/dash.all.min.js

Release notes for v2e (March 7, 2020):

A bunch of the US channels went down. That's 51 channels though 34 of those have a secondary feed. The sites which supply the "ustv.to" links have undergone yet another rebuild. The links are obfuscated now whereas they were in the clear before. That's fixed. Also, the sites have moved over to CloudFlare from Sucuri for the DDOS protection (bot blocker). That's fixed too. At this point, only "ustvgo.tv" appears to be using the bot blocker but that can change at any time. If a blocker is not in place, the sites are accessible with a remote proxy. Don't expect that to last. You should be using the Local Proxy Server.

VidNode has fixed the problem with the m3u8 feeds. Some of the mp4 links are not working but I haven't done more than a few spot checks.

Some of the Canadian channels have been replaced and they all require the local proxy. I don't have a replacement for TV Ontario but TVO Kids still works.

Release notes for v2d (March 3, 2020):

At this point, I need to talk about what I call the "Referer lock". Yes, the word "referer" is misspelled. It is an historical artifact. Simply put, the Referer is the domain (the URL) from which a page or a component was loaded. Elements of a page loaded from different servers are in different domains. This is only important in the case of iframe or script tags because these are active elements while images and text are passive. There are visibility rules which the browser enforces between elements or components in different domains. For example, a video embedded in one of the Alleycat viewers is invisible to Alleycat while the embedded video is blocked from opening windows (popup ads) outside of its "sandbox".

There are security protocols which govern communication between web browsers and web servers but it really consists of little more than a "gentleman's agreement" on the part of the browser that it will implement certain restrictions at the request of the server. Special HTTP headers are used to control this. While the visibility rules enforced by the browser within itself are difficult to overcome without exploiting security weaknesses, it is trivial to break security outside of the browser. This is accomplished with a proxy server. A proxy server sits between the browser and the destination server for the purpose of disguising one from the other and it can manipulate the messages passing back and forth. There are certain advantages to using a remote proxy over a local proxy and vice versa but those details are not important here.

Getting back to the main point, the HTTP Referer header is not accessible to any script running inside of the browser (though access is possible with an extension or add-on). Thus, Alleycat Player cannot pretend to be from "twitter.com" or any other domain in order to bypass security checks on the server. The Referer lock is actually a pretty powerful check on unauthorized access to server content. Though it is a trivial thing to change an HTTP header, it can only be done with a specialized tool. A video which is Referer-locked won't play on SMPlayer though I think there is a way to do this on VLC. Forget about Windows Media Player or any other player which does not specifically support a user-specified Referer. In some cases, the server will accept its own domain as Referer but video players do not take advantage of this. Without the user being able to control the Referer header, such videos are unplayable.

Up to this time, the only videos that I have found to be Referer-locked are some m3u8 live streams and the videos from VidNode (also m3u8). No mp4 videos have been found like this until XHamster went for it. I don't know if this was deliberate. Perhaps somebody flicked a switch at the server without intending to. Or maybe the management decided that too many people were downloading (you can easily find the mp4 links in the HTML source). In any case, if this sort of thing is gonna keep happening, I figure that it's time to give my users a better understanding of what this proxy thing is all about. This is a war that I'm waging with content providers. Hee hee.

• Updated: Fox News occassionally delivers m3u8 instead of mp4.
• Updated: Twitter very rarely gives mp4 instead of m3u8. Strange.
• Updated: GoUnlimited, UniqueStream (reverted to v2a code), XHamster (now requires Local Proxy Server).
• Added MixDrop and StreamVid. Removed ProStream. Interesting thing about MixDrop is that I tried to hack it before but didn't find a way around the link obfuscation. MixDrop has changed its page format so now Alleycat can get the links. There is still an obfuscation in place but I've seen the exact same method before so I know how to hack it.
• Forgot to mention that iHeartRadio was added in v2c. Only podcasts are supported for now. The big names like Rush Limbaugh, Sean Hannity and Dan Bongino are all there.
• I have added active links (shown in red) for all of the Talk Radio stations. These links go to a web site where you can find the station broadcast schedule (though some are less informative than others). Talk Radio is not terribly interesting if you don't know who in hell is talking.
• Some Internet TV channels are down. Not fixing them at this time because they've all been down before. They are: MiX Music, You Too America, CFTO, City TV, TV Ontario, TV Mar, A Spor HD.
• There is an issue with VidNode as I write this. Recently, the site was delivering invalid links for the m3u8 videos but now the links are not found anymore. That's fine as long as there is at least one mp4 link available on the download page (hit DLoad to get the links). Additionally, there is usually a link to an XStream video as well on the VidNode main page so Alleycat will link to this if present. Note that the XStream links are often broken (video removed for DMCA violation). Anyway, that's how it's going to work until VidNode fixes their problem. If the site goes down, there are others waiting to be hacked.

This is a major interface upgrade. In the past, I was (grudgingly) satisfied with the user interface despite the obvious shortcomings. This is and was always a technical endeavour (hacking websites) and not an exercise in web page design. However, I have reached a point where I am pretty pleased with the standing of this project technically so it makes sense to pay closer attention to the user interface.

Two things warranted my attention: compatibility with both standard and wide-screen monitors and the generally inadequate look of the default select boxes, especially in Firefox with its long-standing issue with the double-spacing in dropdown lists. These issues have been fixed for good. The select boxes have been totally replaced using some tricky CSS and some Javascript. The video viewports, which were not zoomable before, will now zoom correctly along with the other interface elements. My original mistake was taking seriously some "expert" design advice. I am not so naive anymore.

For those who might be looking to this project for potential lessons in HTML/CSS and Javascript, I recommend that you study the minimal version of this application (alleycat-player.htm). The current complexity of the code is daunting for beginners. I apologize for the state of the HTML/CSS code but that's not my fault. I'm not the only developer who struggles mightily with this stuff. The specs have grown in complexity over the years and often work against the original intent of the World Wide Web as being primarily text-oriented. In other words, Alleycat Player is pushing the limits. This stuff would actually be better done as a desktop application and not a browser-based one. That said, I can't say that the end result is in any way disappointing (knock on wood).

• CBC News is geo-locked so I added a secondary link which is not. However, the Local Proxy Server is required.
• There has been some churn in the TV channel selection due to the usual problem of links suddenly biting the dust. I hate it but that is life in the fast lane. The sources for many of the US channels are still behind a bot blocker and it looks to be a permanent condition. You are out of luck for those channels without the Local Proxy Server. Most of the secondary channels are, unfortunately, also inaccessible without the proxy.
• The Internet Radio has been expanded to support up to 100 stations. However, if you are expecting me to populate this with new links then you are seriously barking up the wrong tree. I only did this in order to finalize the design. The anonymous user of this anonymous application created by an anonymous developer can very well learn how to add his/her own radio stations (hur hur).

Found two issues with YouTube. First, the signature creation algorithm was failing on some versions of "base.js". This may just be YouTube developers messing around (it has happened before). The second issue is the DASH player failing on some videos. This was fixed by changing the DASH player version from "3.0.1" to "2.9.3". I had to do the same thing previously for the HLS player (reverting from the latest version to version "0.12.0") because the player was failing on some videos sourced from Akamai. This game of whack-a-mole never ends.

I have noticed the occassional livestream YouTube video which does not work because the expected video information is absent. Instead, the YouTube file contains the URLs for both an mpd and an m3u8 file. This issue is fixable but I won't be addressing it until I see indications that it is more common than it currently appears. If you encounter such a video, it may be viewable via an Invidious instance.

A new video resolution indicator has been added to the viewers. This info comes from the video playback element (the video tag). For HLS/DASH playback, the indicator will update when the player switches the quality level. An important fact here is that the resolution info in the video element is never updated. For that reason, updates must be pulled directly from the HLS/DASH video player. In the case of HLS, the resolution info comes from the actual video stream (though I have noticed that it is sometimes wrong). In the case of DASH, the info comes from the manifest (the mpd file), not from the video stream. For this reason, it may not necessarily reflect the true resolution.

• Updated ABC, VidNode, UniqueStream
• StreamLord still does not have a working search feature. It has been replaced with WillTV.
• The sources for many US channels (ustv247.tv, ustvgo.tv, watchnewslive.tv) now have a bot blocker in place. This was true already for the main page links but did not apply to the secondary links which Alleycat is using for the video URL. The code has been updated to bypass the bot blocker but that requires the Local Proxy Server to work.
• The new remote proxy added in v2a (35.210.173.135) is marked with a double asterisk because it can be used to break the region locking on PBS. If this proxy turns out to be stable, I will be looking into it further.

Big update for YouTube. Additional video formats are now available with the DASH player and the Kraker Local Proxy Server (version 1c is required). Now, Kraker is indispensable in this process since there are a number of issues involving not just the usual CORS limitations but also the behaviour of the Google video server. In order to access the video file, DASH needs to employ byte ranges. That would normally be fine BUT when the web browser sends an OPTIONS request to test whether byte ranges are permissible, Google answers NO. Bad Google. Byte ranges work fine but you just don't want to allow it. Alrighty then...Kraker will auto-complete the OPTIONS request and green light it.

The role of the Kraker server goes further than that. It also is responsible for creating the mpd file for the DASH player. It retrieves a blank template from the local disk, merges that with data from Alleycat and then makes the file accessible as a remote resource. The point here is that the video is playable with any video player that supports DASH/mpd playback (like SMPlayer or VLC). The video data is held only in the Kraker memory so it goes away if the proxy is shut down. Also, there is a limit of 16 videos available at one time. Note that VLC displays an incorrect progress bar for live streams while SMPlayer only plays the first few seconds. VOD works fine on both. This has to do with the fact that the DASH specs are a mess and nobody really knows how it is supposed to work. It cost me three days of trial and error to get the native DASH player to work correctly.

For most videos, all of these formats are available: 360/480/720p in both mp4 and webm. The thing here is that the audio and the video are separate files (which is why the DASH player is needed). For mp4, these are the YouTube tag numbers: #140 (audio), #134 (360p), #135 (480p), #136 (720p). For webm: #251 (audio), #243 (360p), #244 (480p); #247 (720p). Higher resolutions may be available for some videos but Alleycat does not access them (at least, not at this point in time). If the DASH formats are not available (rare), Alleycat will revert to the normal formats. Also, the audio and video are both available for download via the DLoad button.

At this point, there is hardly any need for the additional YouTube sources, which are decidedly unreliable at best. Still, they are sometimes useful for bypassing geo-blocks though that doesn't always work. Oh well.

• New brightness controls with a finer adjustment gradient. Also, ability to clear and restore the settings using the Reset button.
• New source for free movies and TV shows: UniqueStream. Note that the site is in a state of flux since I already have had to update the code before this release. I expect additional changes to occur so be prepared for this site to become inaccessible at some point (will fix in the next Alleycat update).
• VidNode updated because the domain name changed to "vidcloud9.com". Still called VidNode though and the site is still accessible as "vidnode.net".

Tips on using Alleycat Player -- these instructions are not meant to be complete. Alleycat Player is primarily designed as a hacking tool. Please experiment to determine the limits and capabilities of the tool.

The original purpose of this tool was to support backdoor access to videos on YouTube for the purpose of downloading or for transferring the URL of a video file to an external viewer for playback. The tool has expanded considerably since the first version and it now supports backdoor access to videos on almost 50 different sites.

There are two ways to play videos embedded in web sites. The first method is to get the ID number of the video if such is available. Enter the ID number in the line below the "Play ID" button and press. The second method is to use the DIG option. In this case, you would copy and paste the URL of a web page in the line beside the "DIG" button and press. For some sites, Alleycat will search the indicated page for the ID number of a video and then apply the ID lookup function. Some sites do not employ video ID numbers so the DIG option is the only way to get the video. Many web sites can be problematic due to small or major differences in page design so this may not always work. Also, sites may sometimes change the page format so that Alleycat can no longer find the video. For this reason, the code is continuously being tested and will be updated accordingly.

A complete URL may be entered as the ID number with the caveat that the ID must be the last part of the URL. If a slash (/) or a dot (.) appears within the last 5 characters (like ".html") then the string will be truncated. A character count is used to separate the ID from the rest of the URL. For YouTube, an ID is always exactly 11 characters. For some sites, there is a small range like from 6 to 8 characters. In the event that a known good ID number is rejected, you can force the ID to be accepted by preceding it with an asterisk (*). This is seldom necessary but might be needed for very old videos.

In many cases, you have the option of choosing the resolution of the video. The format/resolution selection box has an odd appearance due to Alleycat's original purpose of extracting YouTube videos. YouTube, unlike every other video storage site, uses its own special coding system for resolutions and formats (because it has so many). For example, #22 refers to mp4-720p and #43 refers to webm-360p. Note that the webm format is only available on YouTube. The checkbox called "Format" applies to m3u8 playback (not mp4 or mpd). If checked, the video track for the desired resolution will be extracted from the master m3u8. Note that this cannot be done if the master file contains an audio track separate from the video.

The button called DLoad is for m3u8 sites. Both the "No Play" and the "Format" options must be checked. The m3u8 format (similar to m3u used for mp3) consists of multiple segments, each about 10 seconds long. In order to convert to another format like mp4, each of these segments must be downloaded. The DLoad button will open a new window with the list of segments. This has limited functionality. You can change the list format to text by changing the value of the variable called "plain_text" inside the Alleycat Player code. At some point, I'll figure out what more I can do with this.

Viewer modes: Raw / Wrapper / Sandbox

Sandboxing (implemented via the HTML iframe tag) is employed by Alleycat Player to prevent Javascript embeds from opening windows or popups for advertising. Some pirate video download sites are unsafe when used without a good popup blocker. However, if you play the URL inside Alleycat Player, these popups are very effectively blocked. Any URL may be inserted, not just videos. The native viewers are sandboxed by default. However, if you employ a window option to open the URL, you need to indicate that you want the window to be sandboxed. Just check the Sandbox option. If you don't want a sandbox but you want to run a non-video URL then check the Raw option. In the default Wrapper mode, there are three selectable options: Wrapper for playing mp4/ogv/webm videos (or whatever video format your web browser supports), M3U8 for HLS/m3u8 files and DASH for DASH/mpd files.

Web browser compatibility notes

Microsoft Edge has native support for m3u8 and mpd. This does not conflict with Alleycat Player. Videos have a strong tendency to pixelate badly. Google Chrome and Brave also have issues with pixelation but to a much lesser extent. Firefox has no such issue. Opera, Maxthon and Vivaldi were briefly tested. They work but pop-up windows do not size correctly.

If the "Allow Multiple" option is not checked, windows are supposed to get re-used or closed as needed. However, I have found two cases where the web browser incorrectly blocks the window close function in Alleycat Player. Edge does not allow a window opened in Raw mode to be closed. Firefox (on Win10 but not on WinXP) blocks in Raw mode if the window is controlled by an extension (such as for m3u8/mpd playback).

Always keep in mind that browsers contain various "security" features that may interfere with Alleycat Player. Consider that Alleycat is able to extract video links from numerous different sites. Your browser has no idea what is trustworthy and what is not (even though the content is just a video). You may need to battle with the site blockers in the browser itself and in whatever add-ons or extensions you may have. Don't blame Alleycat. Your browser is just trying to "protect" you. Normally, a notice of some sort should appear to warn you about blockage. Sometimes not. If a video does not play, check the settings in your web browser or pop-up blocker. 'Nuff said. It isn't too bad overall.

Addendum: Microsoft Edge is hopelessly broken. Videos play with only sound because Edge does not support the CSS filters used for the brightness control. Also, Edge is not allowing connections to the local host (might be an option somewhere but I can't be bothered to find it). To repair the no-video problem, find and comment out this line of code:

vid.style.filter = "brightness(" + lvl + ") contrast(" + con + ") saturate(" + sat + ")";

Update: CSS filters are now being used for the radio buttons and checkboxes to get rid of the ugly gray background on Chrome-based browsers. This breaks on Edge as well. The offending two lines of code read as follows:

filter: contrast(1.2) brightness(1.4) opacity(85%);

Caveat: My version of Microsoft Edge is out of date since I have Windows 10 updates disabled.

Special Notes

• Alleycat Player must be saved to your local drive. If you run Alleycat from its download site, it can fail in mysterious ways. For one thing, your web browser may block access to HTTP sites (which includes the Local Proxy Server and many Internet TV channels). The other problem is the HTTP header called "Referer" (set by the web browser) which can cause videos on some sites to not play. These sites are affected: BitChute, DailyMotion.
• Internet TV (IPTV) channels are subject to downtime of a few hours or a day or a week or even forever. Many of the channel links offered here can be found via the associated website. If a channel goes down and you want to recover it then search for the website and extract a fresh link from there. Pirate links are, of course, not easily replaced.
• Internet TV channels marked with a double asterisk (**) are only accessible with the Local Proxy Server. Those marked with a single asterisk (*) are playable with a CORS unblocker. The secondary channels (where available) may or may not need a CORS unblocker or the Local Proxy Server.
• Internet TV channels which are streamed via "ustv.to" (formerly "savitar.tv") are only accessible with the Local Proxy Server. This is only for channels within the United States.
• Only two Invidious sites support live streaming: "invidio.us" and "invidious.snopyta.org".
• Vimeo live streaming (m3u8) is supported. Requires the Local Proxy Server or a CORS unblocker.
• Brighteon videos will play with the Local Proxy Server and also with the remote proxies marked with an asterisk.
• InfoWars videos play as m3u8 but the mp4 version is available via the DLoad button.
• The above is also true for VidNode but you need the Local Proxy Server to play m3u8. If you are not using the proxy then Alleycat will play an mp4 if it is available but you still need a CORS unblocker.
• For Twitter short links (like "https://t.co/..."), use DIG to get the tweet.

Sites accessible with a Brightcove DIG:
 - https://www.stuff.co.nz
 - https://www.nzherald.co.nz
 - https://www.miamiherald.com
 - https://time.com
 - https://www.itv.com/goodmorningbritain
 - https://www.thesun.co.uk
 - https://www.channel4.com/news
 - http://webtv.un.org
 - https://www.express.co.uk

Sites accessible with a Podcasts DIG:
 - https://podcasts.apple.com
 - https://itunes.apple.com
 - https://www.stitcher.com
 - https://radiopublic.com
 - https://overcast.fm
 - https://www.podbean.com
 - https://www.spreaker.com

There are three symbols used to indicate the options available for a particular site. [#] means no DIG option because the video ID is always exposed. [?] means that video ID numbers are not available (you have to DIG). [+] means that both ID numbers and the DIG option are supported.

Here is a rundown of each site, the available video formats and the site URL (link will open a new tab or window):

Site List -- Go to Info viewer or News viewer or Movie viewer

? = unknown or auto-select (m3u8/mpd)
* = user selectable (via format box)
! = use the Sandbox option to embed the video.
KRAK = only accessible with the Local Proxy Server (Kraker)
CORS = only accessible with a CORS unblocker (or Kraker)

Movie Sites -- Go to Movie viewer or Info/News

! on a site url = use caution on these sites due to popup ads
! on Proxy or CORS or KRAK = use the Sandbox option to embed the video.

Note that quality level (example: [720]) may not be the same as resolution.

These sites are supported under XStream:

www.fembed.com
streamhoe.online
myvidis.top

These sites are supported under "General DIG":

www.lunchflix.com (GoUnlimited)
watchmoviesfree.org (XStream)
antmovies.tv (XStream) pretty broken right now

Some search sites to get video links from:

ololo.to
crocovid.com
www1.swatchseries.to
www.downloads-anymovies.com
www2.project-free-tv.ag
www.watchepisodes4.com
streamdreams.org
www.primewire.li

If you want to play embedded videos, make sure that you use the proper embed URL.

For example:

Internet TV  --  TV Guide:  ustv247.tv  ustvgo.tv  watchnewslive.tv

In order to facilitate channel surfing, a new feature has been added. Check the option "Allow Multiple" to activate. This will present the stack as buttons displayed on top of the viewer. Along with that are 12 buttons for previously selected channels. The "Copy" button will show and hide the popup. Also, pausing the video (not in full-screen) will show the popup. You can click a blank entry to hide. All viewers have this feature.

Some channels have two stream sources. This is indicated with a plus sign (+) after the channel name. A double plus indicates that the streams are from different local stations. Select "webm" in the format panel to access the secondary channel.

 Bibliography

Internet Radio

You can input your own URL for either an mp4 or an mp3 or whatever your browser supports. To play a YouTube video in audio-only mode, just enter the 11-character video id.

To find some radio station URLs, you can use the AudioRealm DIG tool supplied with the Movie viewer. Also supplied is a stack with links to iHeartRadio and Virtual DJ. These will pop up a window with an embedded web site.

Info + Entertainment  --  Go to News viewer or Site list   |   snap    

+

youtube.com genyoutube.net invidio.us invidious.snopyta.org Youtube DASH

      < >     < >      Reset 

Play URL Copy DIG

Stack 1 Stack 2 Stack 3   BitChute Vimeo InfoWars

News & Propaganda  --  Go to Info viewer or Site list   |   snap    

+

youtube.com genyoutube.net invidio.us invidious.snopyta.org Youtube DASH

      < >     < >      Reset 

Play URL Copy DIG

Stack 1 Stack 2 Stack 3   Fox PBS BBC

FREE Movies & TV  --  Go to Movie Sites or Info/News   |   snap    

+

youtube.com genyoutube.net invidio.us invidious.snopyta.org Youtube DASH

      < >     < >      Reset 

Play URL Copy DIG

Radio Dance   TV US1 TV US2 TV US3   TV UK+ TV Alt   Int'l 1 Int'l 2

Internet Radio