[Samsung Galaxy Tab S3 Themes, Apps, and Mods] esgie:
I wanted to ask you for help in getting Netflix running in HD/HDR on tampered Tab S3 (as well as Google Movies, player.pl and other media streaming services using Widevine L1).

I have analyzed the problem in details and I am convinced that it is possible. Unfortunately, I have stuck in my testing due to the problem described below. Maybe anyone has an idea how to solve it...

L1 Widevine DRM is hardware-based device-specific media encryption engine which - in short - allows you to play HD movies along with all the fancy stuff like HDR and surround. L1 engine requires a factory-provisioning certificate which should be placed in

/data/mediadrm/IDM1013/L1/cert.bin

The point is that the certificate is part of stock ROM and it is being flashed via Odin from the image of stock, encrypted /data partition (if you extract an Odin image, it is a userdata.img file). The firmware image is the only source of that file; in particular, it cannot be generated in any other way, using any algorithm. It has to be provided through the factory firmware.

We want to read the contents of the cert file - i'll explain why in a second. Unfortunately:

- userdata.img is encrypted and cannot be mounted/dumped with any external tool; so we cannot get the file straight from the image;

- after flashing stock rom the /data partition cannot be mounted with TWRP (Samsung-crypto still not supported...) thus the file cannot be accessed via recovery;

- after booting stock ROM, the encrypted /data is mounted and the file is there. However, I still cannot get the copy of the file via shell/adb due to lack of privileges for unrooted user!

- the /data encryption on Samsung devices depends on boot image integrity. Thus rooting the device - which in fact require boot image tampering in order to install SuperSu or Magisk - will result in system not booting and an error in decrypting the /data partition. Cert file still cannot be accessed.

- to run the [rooted] system using the tampered boot image, it is required to format the /data and disable the encryption first. After that the device will boot and will be rooted - but /data/mediadrm/IDM1013/L1/cert.bin will not exist, as we have just formatted whole /data partition!

- to restore the file, one has to flash the full stock ROM, along with encrypted /data, in Odin again - but this will re-enable the encryption and the whole story begins again...

On rooted device, Netflix (and other such apps) checks if liboemcrypto.so exist in the system (it is a library responsible for that L1 DRM support). If yes, it assumes that L1 DRM is available so it tries to decrypt streams in HD, but fails - because there is no /data/mediadrm/IDM1013/L1/cert.bin file, which is required for decryption (you can easily confirm my theory via logcat). This is why the workaround for running Netflix on rooted devices is to delete that liboemcrypto.so library - however, it will disable whole L1 decryption engine. After that, Netflix will proceed to run in L3 mode, which doesn't require factory provisioning; unfortunately, L3 mode is much worse and it does not support anything but SD. That is why deleting liboemcrypto let you run Netflix app at all - but that is also the reason of the low video quality.

If L1/cert.bin does exist, liboemcrypto - at least in theory - shouldn't fail, L1 shall work and HD content shall be possible to be played. So, the aim is to backup the file /data/mediadrm/IDM1013/L1/cert.bin from the encrypted /data that comes along with the stock ROM and restore it after rooting and formatting /data. I haven't found a way to do it, though.

That is why I wanted to ask you guys if you have any idea how to get the /data/mediadrm/IDM1013/L1/cert.bin file from the stock unrooted ROM - as copying it back to the device after rooting it might be the ultimate solution for all that no-HD no-HDR no-anything Netlfix issues, which we all are looking for I guess.

So my question is: is anyone aware of an exploit (like dirtycow), trick or any other method which will be compatibile with stock Samsung ROM and will allow me to dump the contents of that file without root?

Or anyone knows an alternate method of reading the contents of Samsung-encrypted /data partition (in order to read the file)?

PS: don't mistake L1/cert.bin with L3/cert.bin. The latter one is for SD playback and even if deleted, it is being automatically generated on every boot and can be accessed after rooting.