Eclipse Community

Duke wrote: ↑30 Mar 2025, 19:35 You can do it yourself by using policies:
https://support.mozilla.org/en-US/kb/customizing-firefox-using-policiesjson

Here is an example of policies.json file which disables Studies, Pocket, Telemetry, Feedback and Firefox accounts:

Code: Select all

{
	"policies": {
		"DisableFirefoxStudies": true,
		"DisablePocket": true,
		"DisableTelemetry": true,
		"DisableFeedbackCommands": true,
		"DisableFirefoxAccounts": true,
    }
}

You can check the active policies in about:policies

This extension can also help you to create this policies.json file:
https://addons.mozilla.org/en-US/firefox/addon/enterprise-policy-generator/

I have customized both r3dfox and Firefox now using this policies.json file as you told me.
Thank you for that.

Is there anything you could do on your side as developers to improve privacy by programming r3dfox?

On your website you state in r3dfox features: "Less telemetry than regular Firefox":
https://eclipse.cx/projects/r3dfox

Could you elaborate on that?
What data does r3dfox collect?
Does Mozilla collect data from r3dfox usage?

PantelicGR wrote: ↑31 Mar 2025, 20:36 On your website you state in r3dfox features: "Less telemetry than regular Firefox":
https://eclipse.cx/projects/r3dfox

Could you elaborate on that?
What data does r3dfox collect?
Does Mozilla collect data from r3dfox usage?

I think only K4sum1 can answer that.

PantelicGR wrote: ↑31 Mar 2025, 20:36 Is there anything you could do on your side as developers to improve privacy by programming r3dfox?

On your website you state in r3dfox features: "Less telemetry than regular Firefox":
https://eclipse.cx/projects/r3dfox

Could you elaborate on that?
What data does r3dfox collect?
Does Mozilla collect data from r3dfox usage?

I try my best to remove telemetry, however it's not perfect. It still makes outgoing connections to Mozilla, and I'm not sure for what. I don't know what it collects. However I can tell you it is less than normal Firefox.

I can't get netflix to work in r3dfox in Windows 7 (64bit). Recent versions of widevine (4.10.2830.0 and 4.10.2891.0) use windows 8 only APIs and thus just crash. And older versions are depracated and thus blocked by netflix. (As well as https://bitmovin.com/demos/drm/ for instance) Firefox supposedly supports Microsoft Playready, as an alternative DRM solution, since version 132. But it doesn't seem to work for me in r3dfox (Neither on netflix or https://reference.dashif.org/dash.js/v4.4.0/samples/drm/playready.html for instance).

I imagine wrapping Widevines API calls vxkex style could make it work.
Or ideally if it's possible to get playready support working that would be great.

If you have any other sugestions for how I can make netflix work again under Windows 7, I would appreciate it

Well, this isn't something that I'd know. r3dfox is compiled without eme or DRM, and if I did compile with DRM it would be very limited without an expensive license that I'll never have enough money to get if I even wanted to. Maybe I could look into Playready, but I wouldn't be surprised if it's some 10+ thing.

At this point you might as well just pirate the shit. If they don't support you, don't support them.

EME and DRM both seem to be present and work just fine on r3dfox though. As far as I can tell it's literally only the widevine .dll that's broken
(And until a couple of days ago the old version still worked just fine. I imagine they timed it so that it was depracated the moment offical support ended for Firefox 115ESR, which came with the old verion of Widevine.)

I have no idea about Playready and how that works however.

Looking at the API hooks. As far as I can tell, there's only 2 API calls (both to kernel32.dll) that break in newer version widevinecdm.dll:
GetProcessMitigationPolicy
and
SetThreadInformation

Both of which are covered by vxkex.
Is it possible to enalbe vxkex for a .dll? It looks like it should be a relatively easy fix for someone who knows what they are doing.

herowoac wrote: ↑03 Apr 2025, 20:11 Is it possible to enalbe vxkex for a .dll? It looks like it should be a relatively easy fix for someone who knows what they are doing.

I believe you'd have to figure out which process is loading the DLL and enable VxKex for that. Unfortunately, it might well be a protected process that loads it, thus you might not be able to use VxKex with it. (Although I don't know, and it's very possible that it's some part of r3dfox/firefox that would load it normally)

herowoac wrote: ↑03 Apr 2025, 18:27 EME and DRM both seem to be present and work just fine on r3dfox though.

No, they don't work.
On https://bitmovin.com/demos/drm/ no DRM and no EME are detected with R3dfox 135.0.1, even tough I have added the Widevine folder to my profile and the correct keys and values to about:config, while it's working fine with Firefox 115.22 ESR on the same Windows 8.1 machine.

K4sum1 said it:

K4sum1 wrote: ↑03 Apr 2025, 18:20 r3dfox is compiled without eme or DRM

Again: It works just fine for me. I could probably work out the settings to make it work for you,
but on windows 7 it won't work anyway, because widevine will crash
(And if you use an older version that doesn't crash, then it will fail to acquire a license since the older version is deprecated and thus blacklisted)

I did try enabling vxkex for r3dfox by the way, to see if that would help with widevine. It didn't. It made everything worse. With vxkex enabled playing video didn't work at all, on any website. And widevine didn't work any better.

OK, it works for you with R3dfox 134.0.3 and it works for me with R3dfox 132. But not with R3dfox 135.0.1.
So I guess it has been removed in between, as K4sum1 said.

I didn't see any mention of EME being removed between version 134 and 135,
in the changelogs or in the message here.

Either way, this is just a pointless sidetrack. If it was recently removed that change can be reverted, if that is decided.
The main issue is the same: widvine no longer works on windows 7 (because it relys on a couple of windows 8 or later specific APIs).
And playready doesn't seem to be working at all.
If we want people to be able to watch their streaming services on windows 7, then fixing that would help a lot.
You can always argue people shouldn't be using streaming services, but that's beside the point.

Honestly though it would probably be easier to just pirate the things you wanna watch. DRM is always hell.

I've managed to make it working with R3dfox 135.0.1 and I got the same results as yours. I've missed one config key, my mistake.
Anyway, the DLL is provided by Google so I'm quite sure they won't fix it for Windows 7.

Yeah I don't expect google will fix the widevine .dll for windows 7. They caused the whole issue by depracating the previous version that worked just fine on windows 7 about a week ago.

But again: The windows 8 APIs the new widevine dll uses are in vxkex. So there is an opensource implementation for those APIs that work in windows 7. I don't have the skills to put the pieces together to make it work. But I would love if someone did, and I will gladly help with testing etc.
Likewise I would gladly help out with testing etc. for any other solutions, like getting playready to work in r3dfox in windows 7 for instance. Whatever that involves. I don't understand the firefox sources anywhere near well enough to have a real idea what it would take to make that work.

herowoac wrote: ↑06 Apr 2025, 19:42 But again: The windows 8 APIs the new widevine dll uses are in vxkex. So there is an opensource implementation for those APIs that work in windows 7. I don't have the skills to put the pieces together to make it work. But I would love if someone did, and I will gladly help with testing etc.

If someone is going to do this (i don't have time rn), probably the best strategy would be to write a DLL to patch widevine's IAT in memory during loading to point to implementations of those functions in the custom DLL.

BTW, any chance for a R3dfox v137 anytime soon ?

I'm distracted with other projects, so it might be a while.

R3dfox 136.0.4 and and 128.9.0 ESR released!
https://github.com/Eclipse-Community/r3dfox/releases

Thanks!

teknixstuff wrote: ↑06 Apr 2025, 20:08 If someone is going to do this (i don't have time rn), probably the best strategy would be to write a DLL to patch widevine's IAT in memory during loading to point to implementations of those functions in the custom DLL.

I have a .dll covering the missing APIs under Windows 7. (kernel64.dll built from sources at https://github.com/Blaukovitch/API-MS-WIN_XP)
But I have no idea how to patch the IAT in memory. Any help would be welcome.

@herowoac

Since r3dfox can't be made VMP-compliant (Verified-Media-Path, aka Widevine security level 2 (L2)), whether you patch redfox in memory under Win<8 or patch the actual widevinecdm.dll itself will have the same net effect: the prominent encrypted services that mandate VMP won't "work" in r3dfox, period; these include Netflix, AmazonPrimeVideo, CBS.com, Paramount+, Disney+, Spotify, Tidal and most of the commercial/paid for ones... The same is true for r3dfox+Widevine on Win8+, where the CDM is natively supported...

If your goal is to use such services under Win7, then FxESR-115.xx.x will be (quasi) the only solution until it expires next October; this is because Mozilla can afford to pay Google a hefty price (in the order of several USD1,000s) to have Firefox's "firefox.exe", "plugin-container.exe" and "xul.dll" files VMP-signed...

If, OTOH, your goal is to make "plain" encrypted services work, i.e. the ones that only require Widevine security level 3 (L3), then you can just HexEdit/patch the actual widevinecdm.dll file; the file's digital signature will become invalidated, sure, but this is only relevant in the context of L2, not L3...

My legacy OS is Windows Vista SP2 32-bit with all MS updates till EoS, plus several important WS2008SP2 updates manually installed; browser used is r3dfox-136.0.4.win32.portable; I have been successful in restoring EME/Widevine support in the browser by manually adding a group of about:config prefs, which then resulted in r3dfox downloading Widevine-v4.10.2891.0 inside my r3dfox portable profile; I then "borrowed" the "solution" and some extra wrapper DLL files from the Supermium project; the Sm "solutions" took care of the missing API calls (there are 4 under Vista SP2, 2 under Win7 SP1), so the WV CDM can be now properly loaded when called by the browser:





Of course, things would've been more straightforward if K4sum1 had agreed to compile the browser with the " --enable-eme=widevine,playready" buildconfig option (one wouldn't have to manually add the required prefs), however I'm still heavily indebted to him for his browser offering ; yes, no sandbox for me here still, but, alas, c'est la vie ...

Kindest regards .

I was told that Widevine L3 is effectively useless, and well I'd rather be able to say r3dfox has no closed source components rather than have useless DRM included.

If I get around to Plasmafox though I can try enabling eme there to see what happens, or making alternative eme test builds.

GoodConcscience wrote: ↑21 Apr 2025, 21:00 If your goal is to use such services under Win7, then FxESR-115.xx.x will be (quasi) the only solution until it expires next October; this is because Mozilla can afford to pay Google a hefty price (in the order of several USD1,000s) to have Firefox's "firefox.exe", "plugin-container.exe" and "xul.dll" files VMP-signed...

Wouldn't it be possible to redirect/hook whatever functions the widevine CDM uses to validate the signatures to always treat them as valid and/or allow using a self-signed cert for them? This is something I'd have expected them to prevent, but considering they have low enough protection that you can patch the CDM file on disk without it becoming entirely useless, it's possible they've not put much effort in here too.

For what it's worth:
https://github.com/DevLARLEY/WidevineProxy2

Duke wrote: ↑22 Apr 2025, 14:20 For what it's worth:
https://github.com/DevLARLEY/WidevineProxy2

Can confirm this works just fine in r3dfox.
At least with the bitmovin DRM tester.

teknixstuff wrote: ↑22 Apr 2025, 08:23 Wouldn't it be possible to redirect/hook whatever functions the widevine CDM uses to validate the signatures to always treat them as valid and/or allow using a self-signed cert for them? This is something I'd have expected them to prevent, but considering they have low enough protection that you can patch the CDM file on disk without it becoming entirely useless, it's possible they've not put much effort in here too.

The plug-in Duke linked does something similar, but with a device key dumped from a real device (usually an android phone) not a self-signed cert.
Since the device you are playing on isn't the same as the device in the key, you can't play the video directly in the browser though.

herowoac wrote: ↑23 Apr 2025, 16:05 The plug-in Duke linked does something similar, but with a device key dumped from a real device (usually an android phone) not a self-signed cert.
Since the device you are playing on isn't the same as the device in the key, you can't play the video directly in the browser though.

No, it's not similar. My suggestion was to patch your existing Widevine CDM DLL so that it would believe that you were using normal firefox and an unpatched copy of the CDM (perhaps drop a copy of those files somewhere and make it verify against them instead of the real ones?), thus permitting L2 or L1 playback. The method his plugin uses is by having the keys from a device already extracted and just decrypting with those.

herowoac wrote: ↑23 Apr 2025, 15:58

Duke wrote: ↑22 Apr 2025, 14:20 For what it's worth:
https://github.com/DevLARLEY/WidevineProxy2

Can confirm this works just fine in r3dfox.
At least with the bitmovin DRM tester.

This works rather seemlessly and quite easily in Ungoogled Chromium v134 with the bitmovin DRM tester.
But does not work for NETFLIX. At least not in Ungoogled Chromium.
It will prevent Netflix's "pardon the interuption" failure message that is normally displayed in any non-Widevine'd browser.
But the extension does not get the "key" and so the Netflix content will not play.
Just results in a red swirling "page loading" graphic.

The-10-Pen wrote: ↑23 Apr 2025, 21:41 This works rather seemlessly and quite easily in Ungoogled Chromium v134 with the bitmovin DRM tester.
But does not work for NETFLIX. At least not in Ungoogled Chromium.
It will prevent Netflix's "pardon the interuption" failure message that is normally displayed in any non-Widevine'd browser.
But the extension does not get the "key" and so the Netflix content will not play.
Just results in a red swirling "page loading" graphic.

I'm watching Netflix through an emulator, so I'm not going to try this with netflix.
But it works well for me for other streaming services, using the plugin in r3dfox. (and not just bitmovin' DRM tester)