Install the Local Proxy Server app which is available here. The current version name is "kraker-1c".
CORS Unblocker:
Alleycat Player supports playback of HLS/m3u8 and DASH/mpd videos via these two modules (whitelist accordingly):
reference.dashif.org/dash.js/v2.9.3/dist/dash.all.min.js
Release notes for v2f (March 11, 2020):
The fixes made in v2e are holding up but now Youtube has an issue. More whack-a-mole. Never before have I had to deal with so much breakage in such rapid succession. Something changed with Youtube regarding signed videos. The signature creation algorithm broke, meaning that some videos stopped working. They won't play in embedded mode either and this has broken GenYoutube. For some reason, the same videos will play embedded on Hooktube. Da fuck? Invidious is not affected and I will explain what is happening. There are up to 5 remote-access steps involved in establishing a connection to a signed video. For example:
Step 1:
Step 2:
Step 3:
Step 4:
Step 5:
Step 2 is only needed if step 1 fails. If a video is signed then step 3 is needed to determine the URL from which the signature algorithm may be obtained. This is where it breaks. Currently, Youtube is delivering a URL that looks like this:
The next step is to load the file pointed to by the URL and search through it to collect the bits of the signature creation algorithm which is then executed in a Javascript eval statement. The above URL delivers a signature algorithm alright but it does not work. The Google server rejects the video URL composed with this algorithm. Step 4 is the fix for this issue. The correct signature algorithm is extracted in step 5.
Now, there is a problem with loading the URL shown in step 4. The size is over 400K while the URL in step 3 is less than 20K. That is why step 4 was not part of the original process. Invidious uses step 4, not step 3, and that is why it has not been broken by this Youtube change. In order to avoid unnecessary Internet access, Alleycat saves the results from steps 4 and 5 so you are not likely to see these more than once. Youtube cycles the signature creation algorithm once a day though I have seen it occassionally happen several times in a short period.
Additionally, GenYoutube has now been dropped from the list of Youtube sources and not just because of this recent change. The method for obtaining playable video links from GenYoutube has changed. It can be hacked but I'm not gonna bother. The site has never been a reliable source anyway. Previously, "y2meta.net" changed over to "cnclips.net" and I had that working but the site is now pretty broken so it has been dropped. We are now left with just two Invidious instances as backup sources for Youtube. Oh well.
Release notes for v2e (March 7, 2020):
A bunch of the US channels went down. That's 51 channels though 34 of those have a secondary feed. The sites which supply the "ustv.to" links have undergone yet another rebuild. The links are obfuscated now whereas they were in the clear before. That's fixed. Also, the sites have moved over to CloudFlare from Sucuri for the DDOS protection (bot blocker). That's fixed too. At this point, only "ustvgo.tv" appears to be using the bot blocker but that can change at any time. If a blocker is not in place, the sites are accessible with a remote proxy. Don't expect that to last. You should be using the Local Proxy Server.
VidNode has fixed the problem with the m3u8 feeds. Some of the mp4 links are not working but I haven't done more than a few spot checks.
Some of the Canadian channels have been replaced and they all require the local proxy. I don't have a replacement for TV Ontario but TVO Kids still works.
Release notes for v2d (March 3, 2020):
At this point, I need to talk about what I call the "Referer lock". Yes, the word "referer" is misspelled. It is an historical artifact. Simply put, the Referer is the domain (the URL) from which a page or a component was loaded. Elements of a page loaded from different servers are in different domains. This is only important in the case of iframe or script tags because these are active elements while images and text are passive. There are visibility rules which the browser enforces between elements or components in different domains. For example, a video embedded in one of the Alleycat viewers is invisible to Alleycat while the embedded video is blocked from opening windows (popup ads) outside of its "sandbox".
There are security protocols which govern communication between web browsers and web servers but it really consists of little more than a "gentleman's agreement" on the part of the browser that it will implement certain restrictions at the request of the server. Special HTTP headers are used to control this. While the visibility rules enforced by the browser within itself are difficult to overcome without exploiting security weaknesses, it is trivial to break security outside of the browser. This is accomplished with a proxy server. A proxy server sits between the browser and the destination server for the purpose of disguising one from the other and it can manipulate the messages passing back and forth. There are certain advantages to using a remote proxy over a local proxy and vice versa but those details are not important here.
Getting back to the main point, the HTTP Referer header is not accessible to any script running inside of the browser (though access is possible with an extension or add-on). Thus, Alleycat Player cannot pretend to be from "twitter.com" or any other domain in order to bypass security checks on the server. The Referer lock is actually a pretty powerful check on unauthorized access to server content. Though it is a trivial thing to change an HTTP header, it can only be done with a specialized tool. A video which is Referer-locked won't play on SMPlayer though I think there is a way to do this on VLC. Forget about Windows Media Player or any other player which does not specifically support a user-specified Referer. In some cases, the server will accept its own domain as Referer but video players do not take advantage of this. Without the user being able to control the Referer header, such videos are unplayable.
Up to this time, the only videos that I have found to be Referer-locked are some m3u8 live streams and the videos from VidNode (also m3u8). No mp4 videos have been found like this until XHamster went for it. I don't know if this was deliberate. Perhaps somebody flicked a switch at the server without intending to. Or maybe the management decided that too many people were downloading (you can easily find the mp4 links in the HTML source). In any case, if this sort of thing is gonna keep happening, I figure that it's time to give my users a better understanding of what this proxy thing is all about. This is a war that I'm waging with content providers. Hee hee.
This is a major interface upgrade. In the past, I was (grudgingly) satisfied with the user interface despite the obvious shortcomings. This is and was always a technical endeavour (hacking websites) and not an exercise in web page design. However, I have reached a point where I am pretty pleased with the standing of this project technically so it makes sense to pay closer attention to the user interface.
Two things warranted my attention: compatibility with both standard and wide-screen monitors and the generally inadequate look of the default select boxes, especially in Firefox with its long-standing issue with the double-spacing in dropdown lists. These issues have been fixed for good. The select boxes have been totally replaced using some tricky CSS and some Javascript. The video viewports, which were not zoomable before, will now zoom correctly along with the other interface elements. My original mistake was taking seriously some "expert" design advice. I am not so naive anymore.
For those who might be looking to this project for potential lessons in HTML/CSS and Javascript, I recommend that you study the minimal version of this application (alleycat-player.htm). The current complexity of the code is daunting for beginners. I apologize for the state of the HTML/CSS code but that's not my fault. I'm not the only developer who struggles mightily with this stuff. The specs have grown in complexity over the years and often work against the original intent of the World Wide Web as being primarily text-oriented. In other words, Alleycat Player is pushing the limits. This stuff would actually be better done as a desktop application and not a browser-based one. That said, I can't say that the end result is in any way disappointing (knock on wood).
Found two issues with YouTube. First, the signature creation algorithm was failing on some versions of "base.js". This may just be YouTube developers messing around (it has happened before). The second issue is the DASH player failing on some videos. This was fixed by changing the DASH player version from "3.0.1" to "2.9.3". I had to do the same thing previously for the HLS player (reverting from the latest version to version "0.12.0") because the player was failing on some videos sourced from Akamai. This game of whack-a-mole never ends.
I have noticed the occassional livestream YouTube video which does not work because the expected video information is absent. Instead, the YouTube file contains the URLs for both an mpd and an m3u8 file. This issue is fixable but I won't be addressing it until I see indications that it is more common than it currently appears. If you encounter such a video, it may be viewable via an Invidious instance.
A new video resolution indicator has been added to the viewers. This info comes from the video playback element (the video tag). For HLS/DASH playback, the indicator will update when the player switches the quality level. An important fact here is that the resolution info in the video element is never updated. For that reason, updates must be pulled directly from the HLS/DASH video player. In the case of HLS, the resolution info comes from the actual video stream (though I have noticed that it is sometimes wrong). In the case of DASH, the info comes from the manifest (the mpd file), not from the video stream. For this reason, it may not necessarily reflect the true resolution.
Big update for YouTube. Additional video formats are now available with the DASH player and the Kraker Local Proxy Server (version 1c is required). Now, Kraker is indispensable in this process since there are a number of issues involving not just the usual CORS limitations but also the behaviour of the Google video server. In order to access the video file, DASH needs to employ byte ranges. That would normally be fine BUT when the web browser sends an OPTIONS request to test whether byte ranges are permissible, Google answers NO. Bad Google. Byte ranges work fine but you just don't want to allow it. Alrighty then...Kraker will auto-complete the OPTIONS request and green light it.
The role of the Kraker server goes further than that. It also is responsible for creating the mpd file for the DASH player. It retrieves a blank template from the local disk, merges that with data from Alleycat and then makes the file accessible as a remote resource. The point here is that the video is playable with any video player that supports DASH/mpd playback (like SMPlayer or VLC). The video data is held only in the Kraker memory so it goes away if the proxy is shut down. Also, there is a limit of 16 videos available at one time. Note that VLC displays an incorrect progress bar for live streams while SMPlayer only plays the first few seconds. VOD works fine on both. This has to do with the fact that the DASH specs are a mess and nobody really knows how it is supposed to work. It cost me three days of trial and error to get the native DASH player to work correctly.
For most videos, all of these formats are available: 360/480/720p in both mp4 and webm. The thing here is that the audio and the video are separate files (which is why the DASH player is needed). For mp4, these are the YouTube tag numbers: #140 (audio), #134 (360p), #135 (480p), #136 (720p). For webm: #251 (audio), #243 (360p), #244 (480p); #247 (720p). Higher resolutions may be available for some videos but Alleycat does not access them (at least, not at this point in time). If the DASH formats are not available (rare), Alleycat will revert to the normal formats. Also, the audio and video are both available for download via the DLoad button.
At this point, there is hardly any need for the additional YouTube sources, which are decidedly unreliable at best. Still, they are sometimes useful for bypassing geo-blocks though that doesn't always work. Oh well.
Tips on using Alleycat Player -- these instructions are not meant to be complete. Alleycat Player is primarily designed as a hacking tool. Please experiment to determine the limits and capabilities of the tool.
The original purpose of this tool was to support backdoor access to videos on YouTube for the purpose of downloading or for transferring the URL of a video file to an external viewer for playback. The tool has expanded considerably since the first version and it now supports backdoor access to videos on almost 50 different sites.
There are two ways to play videos embedded in web sites. The first method is to get the ID number of the video if such is available. Enter the ID number in the line below the "Play ID" button and press. The second method is to use the DIG option. In this case, you would copy and paste the URL of a web page in the line beside the "DIG" button and press. For some sites, Alleycat will search the indicated page for the ID number of a video and then apply the ID lookup function. Some sites do not employ video ID numbers so the DIG option is the only way to get the video. Many web sites can be problematic due to small or major differences in page design so this may not always work. Also, sites may sometimes change the page format so that Alleycat can no longer find the video. For this reason, the code is continuously being tested and will be updated accordingly.
A complete URL may be entered as the ID number with the caveat that the ID must be the last part of the URL. If a slash (/) or a dot (.) appears within the last 5 characters (like ".html") then the string will be truncated. A character count is used to separate the ID from the rest of the URL. For YouTube, an ID is always exactly 11 characters. For some sites, there is a small range like from 6 to 8 characters. In the event that a known good ID number is rejected, you can force the ID to be accepted by preceding it with an asterisk (*). This is seldom necessary but might be needed for very old videos.
In many cases, you have the option of choosing the resolution of the video. The format/resolution selection box has an odd appearance due to Alleycat's original purpose of extracting YouTube videos. YouTube, unlike every other video storage site, uses its own special coding system for resolutions and formats (because it has so many). For example, #22 refers to mp4-720p and #43 refers to webm-360p. Note that the webm format is only available on YouTube. The checkbox called "Format" applies to m3u8 playback (not mp4 or mpd). If checked, the video track for the desired resolution will be extracted from the master m3u8. Note that this cannot be done if the master file contains an audio track separate from the video.
The button called DLoad is for m3u8 sites. Both the "No Play" and the "Format" options must be checked. The m3u8 format (similar to m3u used for mp3) consists of multiple segments, each about 10 seconds long. In order to convert to another format like mp4, each of these segments must be downloaded. The DLoad button will open a new window with the list of segments. This has limited functionality. You can change the list format to text by changing the value of the variable called "plain_text" inside the Alleycat Player code. At some point, I'll figure out what more I can do with this.
Viewer modes: Raw / Wrapper / Sandbox
Sandboxing (implemented via the HTML iframe tag) is employed by Alleycat Player to prevent Javascript embeds from opening windows or popups for advertising. Some pirate video download sites are unsafe when used without a good popup blocker. However, if you play the URL inside Alleycat Player, these popups are very effectively blocked. Any URL may be inserted, not just videos. The native viewers are sandboxed by default. However, if you employ a window option to open the URL, you need to indicate that you want the window to be sandboxed. Just check the Sandbox option. If you don't want a sandbox but you want to run a non-video URL then check the Raw option. In the default Wrapper mode, there are three selectable options: Wrapper for playing mp4/ogv/webm videos (or whatever video format your web browser supports), M3U8 for HLS/m3u8 files and DASH for DASH/mpd files.
Web browser compatibility notes
Microsoft Edge has native support for m3u8 and mpd. This does not conflict with Alleycat Player. Videos have a strong tendency to pixelate badly. Google Chrome and Brave also have issues with pixelation but to a much lesser extent. Firefox has no such issue. Opera, Maxthon and Vivaldi were briefly tested. They work but pop-up windows do not size correctly.
If the "Allow Multiple" option is not checked, windows are supposed to get re-used or closed as needed. However, I have found two cases where the web browser incorrectly blocks the window close function in Alleycat Player. Edge does not allow a window opened in Raw mode to be closed. Firefox (on Win10 but not on WinXP) blocks in Raw mode if the window is controlled by an extension (such as for m3u8/mpd playback).
Always keep in mind that browsers contain various "security" features that may interfere with Alleycat Player. Consider that Alleycat is able to extract video links from numerous different sites. Your browser has no idea what is trustworthy and what is not (even though the content is just a video). You may need to battle with the site blockers in the browser itself and in whatever add-ons or extensions you may have. Don't blame Alleycat. Your browser is just trying to "protect" you. Normally, a notice of some sort should appear to warn you about blockage. Sometimes not. If a video does not play, check the settings in your web browser or pop-up blocker. 'Nuff said. It isn't too bad overall.
Addendum: Microsoft Edge is hopelessly broken. Videos play with only sound because Edge does not support the CSS filters used for the brightness control. Also, Edge is not allowing connections to the local host (might be an option somewhere but I can't be bothered to find it). To repair the no-video problem, find and comment out this line of code:
vid.style.filter = "brightness(" + lvl + ") contrast(" + con + ") saturate(" + sat + ")";
Update: CSS filters are now being used for the radio buttons and checkboxes to get rid of the ugly gray background on Chrome-based browsers. This breaks on Edge as well. The offending two lines of code read as follows:
filter: contrast(1.2) brightness(1.4) opacity(85%);
Caveat: My version of Microsoft Edge is out of date since I have Windows 10 updates disabled.
Sites accessible with a Brightcove DIG:
- https://www.stuff.co.nz
- https://www.nzherald.co.nz
- https://www.miamiherald.com
- https://time.com
- https://www.itv.com/goodmorningbritain
- https://www.thesun.co.uk
- https://www.channel4.com/news
- http://webtv.un.org
- https://www.express.co.uk
Sites accessible with a Podcasts DIG:
- https://podcasts.apple.com
- https://itunes.apple.com
- https://www.stitcher.com
- https://radiopublic.com
- https://overcast.fm
- https://www.podbean.com
- https://www.spreaker.com
There are three symbols used to indicate the options available for a particular site. [#] means no DIG option because the video ID is always exposed. [?] means that video ID numbers are not available (you have to DIG). [+] means that both ID numbers and the DIG option are supported.
Here is a rundown of each site, the available video formats and the site URL (link will open a new tab or window):
| YouTube | mp4/webm | * | [#] Proxy! | www.youtube.com | www.genyoutube.net |
| --- | [#] No Proxy | invidio.us | invidious.snopyta.org | ||
| BitChute | mp4 | varies | [#] Proxy | www.bitchute.com | |
| Vimeo | mp4 | * | [#] Proxy | vimeo.com | |
| InfoWars | m3u8/mp4 | ? | [+] No Proxy | www.infowars.com | summit.news |
| 153News | mp4 | * | [#] Proxy | 153news.net | |
| LiveLeak | mp4 | * | [#] No Proxy | www.liveleak.com | |
| Brighteon | m3u8 | ? | [+] KRAK! | www.brighteon.com | www.naturalnews.com |
| DailyMotion | m3u8 | * | [#] CORS! | www.dailymotion.com | |
| PragerU | mp4 | * | [?] Proxy | www.prageru.com | |
| TEDTalks | mp4 | * | [?] Proxy | www.ted.com | |
| Nat. Film Board | m3u8 | * | [+] No Proxy | www.nfb.ca | |
| m3u8 | varies | [+] KRAK | twitter.com | threadreaderapp.com | |
| mp4 | varies | [?] Proxy | www.facebook.com | www.instagram.com | |
| SoundCloud | mp3 | [+] Proxy | soundcloud.com | ||
| iHeartRadio | mp3 | [#] No Proxy | www.iheart.com/podcast | ||
| Fox | mp4/m3u8 | 432p | [+] Proxy (DIG) | www.foxnews.com | www.foxbusiness.com |
| ABC | mp4 | 360p | [+] Proxy | abcnews.go.com | |
| CBS | m3u8 | * | [?] Proxy | www.cbsnews.com | |
| CNBC | mp4 | * | [+] Proxy (DIG) | www.cnbc.com | |
| CNN | mp4/m3u8 | * | [?] No Proxy | www.cnn.com | edition.cnn.com |
| C-SPAN | m3u8 | * | [?] Proxy | www.c-span.org | |
| MS/NBC | mp4 | * | [+] Proxy | www.msnbc.com | www.nbcnews.com |
| PBS | m3u8 | * | [+] Proxy | www.pbs.org | |
| CBC | mp4 | * | [+] Proxy (DIG) | www.cbc.ca | |
| CTV | mpd | ? | [+] Proxy (DIG) | www.ctvnews.ca | |
| Global | mp4 | 540p | [+] Proxy | globalnews.ca | |
| TVO | mp4 | 360p | [+] Proxy (DIG) | www.tvo.org | |
| BBC | mpd | ? | [+] Proxy | www.bbc.com | www.bbc.co.uk/sounds |
| Press TV | m3u8 | * | [?] Proxy | www.presstv.com | presstvdoc.com (mp4) |
| Al Jazeera | mp4 | * | [+] Proxy (DIG) | www.aljazeera.com | |
| Bloomberg | mp4 | * | [+] KRAK | www.bloomberg.com |
? = unknown or auto-select (m3u8/mpd)
* = user selectable (via format box)
! = use the Sandbox option to embed the video.
KRAK = only accessible with the Local Proxy Server (Kraker)
CORS = only accessible with a CORS unblocker (or Kraker)
| TubiTV | m3u8 | * | [+] CORS | tubitv.com | |
| VidNode | m3u8/mp4 | * | [+] KRAK! | vidcloud9.com ! | vidnode.net ! |
| 123Movies | mp4 | * | [?] Proxy | w2.d123movies.com ! | 0123moviesback.com ! |
| UniqueStream | mp4 | * | [?] KRAK | uniquestream.net | |
| WillTV | mp4 | ? | [#] Proxy | willtv.net | |
| XHamster | mp4/webm | * | [#] KRAK! | xhamster.com | |
| ClipWatching | mp4 | ? | [#] Proxy! | clipwatching.com ! | |
| CloudVideo | m3u8 | * | [#] CORS! | cloudvideo.tv ! | |
| GoUnlimited | mp4 | ? | [#] Proxy! | gounlimited.to ! | |
| MixDrop | mp4 | ? | [#] CORS! | mixdrop.co ! | |
| StreamVid | m3u8 | ? | [#] KRAK! | streamvid.co ! | |
| UpStream | m3u8/mp4 | ? | [#] Proxy! | upstream.to ! | |
| VideoBin | mp4 | ? | [#] Proxy! | videobin.co ! | |
| VidLox | mp4 | ? | [#] Proxy! | vidlox.me ! | |
| Vidoza | mp4 | ? | [#] CORS! | vidoza.net ! | |
| XStream | mp4 | * | [#] CORS! | xstreamcdn.com ! | www.fembed.com ! |
| AudioRealm | mp3 | [+] Proxy | audiorealm.com |
! on a site url = use caution on these sites due to popup ads
! on Proxy or CORS or KRAK = use the Sandbox option to embed the video.
Note that quality level (example: [720]) may not be the same as resolution.
These sites are supported under XStream:
www.fembed.com
streamhoe.online
myvidis.top
These sites are supported under "General DIG":
www.lunchflix.com (GoUnlimited)
watchmoviesfree.org (XStream)
antmovies.tv (XStream)
Some search sites to get video links from:
ololo.to
crocovid.com
www1.swatchseries.to
www.downloads-anymovies.com
www2.project-free-tv.ag
www.watchepisodes4.com
streamdreams.org
www.primewire.li
If you want to play embedded videos, make sure that you use the proper embed URL.
For example:
| Page: https://openload.co/f/{vid-id} | Embed: https://openload.co/embed/{vid-id} |
| Page: https://streamango.com/f/{vid-id} | Embed: https://streamango.com/embed/{vid-id} |
| Page: https://xstreamcdn.com/f/{vid-id} | Embed: https://xstreamcdn.com/v/{vid-id} |
In order to facilitate channel surfing, a new feature has been added. Check the option "Allow Multiple" to activate. This will present the stack as buttons displayed on top of the viewer. Along with that are 12 buttons for previously selected channels. The "Copy" button will show and hide the popup. Also, pausing the video (not in full-screen) will show the popup. You can click a blank entry to hide. All viewers have this feature.
Some channels have two stream sources. This is indicated with a plus sign (+) after the channel name. A double plus indicates that the streams are from different local stations. Select "webm" in the format panel to access the secondary channel.
|
http://ustv247.tv http://ustvgo.tv http://watchnewslive.tv http://www.giniko.com http://tvtolive.com https://github.com/exodiver/IPTV https://publicdomainradio.blogspot.com/p/blog-page.html |
https://www.rt.com/on-air https://www.presstv.com https://www.aljazeera.com/live https://www.trtworld.com https://www.france24.com https://www3.nhk.or.jp http://ntv.ca/web-tv |
https://yournewsnet.com https://www.newsmaxtv.com https://freespeech.org https://www.redbull.com http://tbd.com |
https://www.nasa.gov/nasalive https://www.c-span.org http://www.cpac.ca http://webtv.un.org |
You can input your own URL for either an mp4 or an mp3 or whatever your browser supports. To play a YouTube video in audio-only mode, just enter the 11-character video id.
To find some radio station URLs, you can use the AudioRealm DIG tool supplied with the Movie viewer. Also supplied is a stack with links to iHeartRadio and Virtual DJ. These will pop up a window with an embedded web site.
|
Format (m3u8) Use Proxy
Allow Multiple No Play Raw Sandbox |
No Video |
|
Format (m3u8) Use Proxy
Allow Multiple No Play Raw Sandbox |
No Video |
|
Format (m3u8) Use Proxy
Allow Multiple No Play Raw Sandbox |
No Video |
| Talk Radio | Cool Music | Funky Music | Just Garbage | More Garbage |
|---|---|---|---|---|
| Fox News Talk
Talk Radio UK Conservative Radio Republic Broadcasting American Family Radio Good Talk Radio InfoWars Radio The Blaze Radio Red State Talk The Fringe FM Truth Frequency Radio Dark Matter Digital Devil's Advocates Radio Voice America BBS Talk Radio 1 BBS Talk Radio 2 |
Star FM Rock Classics
Rock Radio Beograd Lynx Classic Rock Jam FM Radio Gem Radio New Wave Retro Hits Dance Wave Salsa Mexico Hot Mix Dance Lounge Radio 1Mix Radio Trance Starlite Radio |
Virtual DJ: ClubZone
Virtual DJ: TheGrind Virtual DJ: Hypnotica Virtual DJ: PowerBase Radio Free Americana Smooth Jazz Expressions Venice Classic Radio Italia Tropicalisma FM Rockabilly Radio Dandelion Radio Entranced FM Spexx FM |
BBC Radio 1
BBC Radio 1-Extra BBC Radio 2 BBC Radio 3 BBC Radio 4 BBC Radio 4-Extra BBC Radio 5-Live BBC Radio 6-Music Nashville FM Country Power Station Hot Mix Hip-hop Wu World Radio |
Radio El Dorado
COOL fahrenheit Asia Dream Radio Streaming Sound Tracks Radio Africa Online Radio Mi Amigo Int'l Nagaswara FM BeMyRadio Schlager iRie Rockers Tune Disney Radio SRC FM Rahva Radio |