Reverse Engineering CapCut's Encrypted Video Cache (BDVE Type 1) and Building an Open-Source Solver

Описание и применение

Инструмент CapCut Cache Recover позволяет расшифровать защищённые видео‑кэши CapCut, используя схему BDVE Type 1, и получать без потерь MP4‑файлы за доли секунды.

Задача

CapCut and JianYing video editors store draft video cache files that are encrypted with a proprietary BDVE Type 1 scheme, making them unreadable by standard players and FFmpeg.

Результат

The tool decrypts BDVE Type 1 encrypted CapCut cache files in under 0.3 seconds, achieving >100 MB/s throughput and producing lossless MP4 files identical to CapCut’s rendered output.

Рабочий процесс

• Inspect file header to discover XOR mask 0x3B and recover ftyp box
• Parse BDVE trailer to obtain step, length, key via SHA‑256 digest
• Locate plaintext sample table boxes (stsz, stsc, stco/co64) to find NAL unit offsets
• Apply modulo arithmetic to narrow step and length candidates
• Verify candidate parameters against trailer digest
• Decrypt encrypted slices by XORing bytes where pos % step < length
• Trim 68‑byte BDVE trailer
• Write clean MP4 file

Доказательства

Only to be greeted by this demuxer error: [mov,mp4-m4a-3gp-3g2-mj2 @ 0x7fa2b00] moov atom not found Invalid data found when processing input

Источник

The XOR mask is clearly 0x3B! Decrypting the first 8 bytes reveals the standard ftyp header.

Источник

Throughput exceeds 100 MB/s on standard hardware. A 500 MB video decrypts in ~4 seconds.

Источник