Secure path for audio streams

[CastagnaIT]

@kodiai the secure path (SSD_SECURE_PATH) support for Widevine CDM its currently not implemented, but supported by CDM module.

Please suggest a guidance and possible code changes to implement it

To consider that more likely its needed to implement something similar to kodi::addon::CInstanceVideoCodec interface but for audio packages (for inputstream add-ons)
this should be done on the main project: https://github.com/xbmc/xbmc
where there is the inputstream add-on interface

Chromium CDM audio decoder source:
https://github.com/nomiscientist/chromium/blob/1a2ceef04f4a1efdecd858d4bce0c6135b13d9b2/media/cdm/cdm_adapter.cc#L794

[CastagnaIT]

@kodiai please read the message above and provide an answer

[kodiai]

kodiai response

Based on the current codebase, here's what's needed to implement secure path (SSD_SECURE_PATH) support for audio streams with Widevine CDM:

Current State

The secure path infrastructure is already present and working for video streams (src/Session.cpp:226, src/decrypters/DrmEngine.cpp:511-531). However, audio streams are currently disabled when SSD_SECURE_PATH is enabled, as shown in src/Session.cpp:224-234:

if (!session->drm->IsSecureDecoderAudioSupported() &&
    adp->GetStreamType() == StreamType::AUDIO &&
    caps.flags & DRM::DecrypterCapabilites::SSD_SECURE_PATH)
{
  LOG::Log(LOGWARNING, "Disabled stream repr ID \"%s\", AdpSet ID \"%s\", "
           "Secure path decoder on audio stream is not supported", ...);
  repr->isPlayable = false;
}

The IsSecureDecoderAudioSupported() method in src/decrypters/widevine/WVDecrypter.h:58 currently returns false (except on WebOS where it returns true).

Implementation Requirements

To enable secure path for audio, you'll need changes in both this repository and the main Kodi project:

(1) In inputstream.adaptive (this repository):

Step 1: Enable audio decoder support in the Widevine decrypter

• Update src/decrypters/widevine/WVDecrypter.h:58 to return true for IsSecureDecoderAudioSupported()
• This will allow audio streams to be marked as playable when SSD_SECURE_PATH is enabled

Step 2: Ensure CDM initialization supports audio

• The CDM module (lib/cdm/cdm/media/cdm/api/content_decryption_module.h) already has InitializeAudioDecoder() (lines 822, 1048, 1274) and DecryptAndDecodeSamples() (lines 883, 1109, 1335) methods
• Verify the Widevine CDM implementation calls these correctly for audio streams

Step 3: Set appropriate crypto session features

• The code at src/decrypters/DrmEngine.cpp:514-522 only enables INPUTSTREAM_FEATURE_DECODE for SSD_SECURE_PATH when both SSD_SECURE_PATH and SSD_SUPPORTS_DECODING are set
• For audio, you may need to handle this differently or ensure audio capabilities are properly reported

(2) In main Kodi project (xbmc/xbmc):

You'll need an audio equivalent of CInstanceVideoCodec for the inputstream add-on interface. Currently:

• Video has: CInstanceVideoCodec interface with decrypt/decode support via the VideoCodecAdaptive class (src/main.h:72, src/main.cpp:517)
• Audio needs: Similar interface for audio packets, likely named something like CInstanceAudioCodec

This new interface should:

• Accept encrypted audio packets
• Call the CDM's DecryptAndDecodeSamples() method
• Return decoded audio frames to Kodi's audio pipeline
• Handle the crypto session similar to how video does (src/decrypters/DrmEngine.cpp:507-535)

Key Architecture Point

The pattern is already established for video in src/decrypters/DrmEngine.cpp:524-531:

if (caps.flags & DRM::DecrypterCapabilites::SSD_SECURE_PATH &&
    caps.flags & DRM::DecrypterCapabilites::SSD_SECURE_DECODER)
{
  // Enable the ISA VideoCodecAdaptive decoder
  cryptoSession.SetFlags(STREAM_CRYPTO_FLAG_SECURE_DECODER);
}

You'll need to extend this to support audio streams with a new audio codec instance type in the Kodi inputstream API.

Next Steps

(1) Design the audio codec interface in the main Kodi inputstream API
(2) Implement the audio decrypter/decoder handling similar to CVideoCodecAdaptive (src/main.cpp:517-599)
(3) Enable IsSecureDecoderAudioSupported() once the infrastructure is ready
(4) Test with content that requires secure audio decoding

The CDM module already supports this capability (lib/cdm/cdm/media/cdm/api/content_decryption_module.h:208-237, 822-824, 883-884), so the main work is creating the plumbing between inputstream.adaptive and Kodi's audio pipeline.

[CastagnaIT]

@kodiai can you provide code changes diff to implement step 1, for the main project https://github.com/xbmc/xbmc/?

[kodiai]

kodiai response

Here are the code changes needed for the main Kodi project (xbmc/xbmc) to implement Step 1 - adding the secure audio decoder interface:

Required Changes to xbmc/xbmc

(1) Add Audio Codec Instance Type

File: xbmc/addons/kodi-dev-kit/include/kodi/AddonBase.h

@@ -140,6 +140,7 @@
 #define ADDON_INSTANCE_IMAGEDECODER "kodi.imagedecoder"
 #define ADDON_INSTANCE_INPUTSTREAM "kodi.inputstream"
 #define ADDON_INSTANCE_VIDEOCODEC "kodi.videocodec"
+#define ADDON_INSTANCE_AUDIOCODEC "kodi.audiocodec"
 #define ADDON_INSTANCE_GAME "kodi.game"
 #define ADDON_INSTANCE_SCREENSAVER "kodi.screensaver"
 #define ADDON_INSTANCE_VISUALIZATION "kodi.visualization"

(2) Create Audio Codec Interface Header

New file: xbmc/addons/kodi-dev-kit/include/kodi/addon-instance/AudioCodec.h

/*
 *  Copyright (C) 2005-2026 Team Kodi
 *  https://kodi.tv
 *
 *  SPDX-License-Identifier: GPL-2.0-or-later
 *  See LICENSE.md for more information.
 */

#pragma once

#include "../AddonBase.h"
#include "../c-api/addon-instance/audiocodec.h"

#ifdef __cplusplus

namespace kodi
{
namespace addon
{

class CInstanceAudioCodec : public IAddonInstance
{
public:
  explicit CInstanceAudioCodec(const kodi::addon::IInstanceInfo& instance)
    : IAddonInstance(ADDON_INSTANCE_AUDIOCODEC, instance)
  {
    if (CPrivateBase::m_interface->globalSingleInstance != nullptr)
      throw std::logic_error("kodi::addon::CInstanceAudioCodec: Creation of multiple together with single instance way is not allowed!");

    SetAddonStruct(instance);
  }

  ~CInstanceAudioCodec() override = default;

  virtual bool Open(const kodi::addon::AudioCodecInitdata& initData) { return false; }
  virtual bool Reconfigure(const kodi::addon::AudioCodecInitdata& initData) { return false; }
  virtual bool AddData(const DEMUX_PACKET& packet) { return false; }
  virtual AUDIOCODEC_RETVAL GetFrame(AUDIOCODEC_FRAME& frame) { return AUDIOCODEC_RETVAL::VC_ERROR; }
  virtual const char* GetName() { return ""; }
  virtual void Reset() {}

private:
  void SetAddonStruct(const kodi::addon::IInstanceInfo& instance)
  {
    instance.functions->audiocodec = new AddonInstance_AudioCodec();
    instance.functions->audiocodec->toAddon = new AddonToKodiFuncTable_AudioCodec();
    instance.functions->audiocodec->toKodi = new KodiToAddonFuncTable_AudioCodec();

    instance.functions->audiocodec->toKodi->addonInstance = this;
    instance.functions->audiocodec->toKodi->open = ADDON_Open;
    instance.functions->audiocodec->toKodi->reconfigure = ADDON_Reconfigure;
    instance.functions->audiocodec->toKodi->add_data = ADDON_AddData;
    instance.functions->audiocodec->toKodi->get_frame = ADDON_GetFrame;
    instance.functions->audiocodec->toKodi->get_name = ADDON_GetName;
    instance.functions->audiocodec->toKodi->reset = ADDON_Reset;
  }

  inline static bool ADDON_Open(const AddonInstance_AudioCodec* instance,
                                 const AUDIOCODEC_INITDATA* initData)
  {
    CInstanceAudioCodec* thisClass =
        static_cast<CInstanceAudioCodec*>(instance->toKodi->addonInstance);
    thisClass->m_instanceData = instance;

    kodi::addon::AudioCodecInitdata data(initData);
    return thisClass->Open(data);
  }

  inline static bool ADDON_Reconfigure(const AddonInstance_AudioCodec* instance,
                                        const AUDIOCODEC_INITDATA* initData)
  {
    kodi::addon::AudioCodecInitdata data(initData);
    return static_cast<CInstanceAudioCodec*>(instance->toKodi->addonInstance)
        ->Reconfigure(data);
  }

  inline static bool ADDON_AddData(const AddonInstance_AudioCodec* instance,
                                    const DEMUX_PACKET* packet)
  {
    return static_cast<CInstanceAudioCodec*>(instance->toKodi->addonInstance)
        ->AddData(*packet);
  }

  inline static AUDIOCODEC_RETVAL ADDON_GetFrame(const AddonInstance_AudioCodec* instance,
                                                  AUDIOCODEC_FRAME* frame)
  {
    return static_cast<CInstanceAudioCodec*>(instance->toKodi->addonInstance)->GetFrame(*frame);
  }

  inline static const char* ADDON_GetName(const AddonInstance_AudioCodec* instance)
  {
    return static_cast<CInstanceAudioCodec*>(instance->toKodi->addonInstance)->GetName();
  }

  inline static void ADDON_Reset(const AddonInstance_AudioCodec* instance)
  {
    static_cast<CInstanceAudioCodec*>(instance->toKodi->addonInstance)->Reset();
  }

  const AddonInstance_AudioCodec* m_instanceData;
};

class AudioCodecInitdata
{
public:
  explicit AudioCodecInitdata(const AUDIOCODEC_INITDATA* data) : m_data(data) {}

  STREAMCODEC_PROFILE codecProfile() const { return m_data->codecProfile; }
  const uint8_t* extraData() const { return m_data->extraData; }
  unsigned int extraDataSize() const { return m_data->extraDataSize; }
  unsigned int sampleRate() const { return m_data->sampleRate; }
  unsigned int channels() const { return m_data->channels; }
  unsigned int bitsPerSample() const { return m_data->bitsPerSample; }
  unsigned int blockAlign() const { return m_data->blockAlign; }
  const char* cryptoSession() const { return m_data->cryptoSession; }

private:
  const AUDIOCODEC_INITDATA* m_data;
};

} // namespace addon
} // namespace kodi

#endif /* __cplusplus */

(3) Create C API Header

New file: xbmc/addons/kodi-dev-kit/include/kodi/c-api/addon-instance/audiocodec.h

/*
 *  Copyright (C) 2005-2026 Team Kodi
 *  https://kodi.tv
 *
 *  SPDX-License-Identifier: GPL-2.0-or-later
 *  See LICENSE.md for more information.
 */

#ifndef C_API_ADDONINSTANCE_AUDIOCODEC_H
#define C_API_ADDONINSTANCE_AUDIOCODEC_H

#include "../addon_base.h"

#ifdef __cplusplus
extern "C"
{
#endif

  typedef enum AUDIOCODEC_RETVAL
  {
    VC_NONE = 0,
    VC_ERROR = -1,
    VC_BUFFER = 1,
    VC_PICTURE = 2,
    VC_EOF = 3,
  } AUDIOCODEC_RETVAL;

  typedef struct AUDIOCODEC_FORMAT
  {
    enum AVSampleFormat format;
    unsigned int channels;
    unsigned int sampleRate;
    uint64_t channelLayout;
    unsigned int frameSize;
  } AUDIOCODEC_FORMAT;

  typedef struct AUDIOCODEC_FRAME
  {
    uint8_t** data;
    int* linesize;
    int nb_samples;
    double pts;
    AUDIOCODEC_FORMAT format;
  } AUDIOCODEC_FRAME;

  typedef struct AUDIOCODEC_INITDATA
  {
    enum STREAMCODEC_PROFILE codecProfile;
    const uint8_t* extraData;
    unsigned int extraDataSize;
    unsigned int sampleRate;
    unsigned int channels;
    unsigned int bitsPerSample;
    unsigned int blockAlign;
    const char* cryptoSession;
  } AUDIOCODEC_INITDATA;

  typedef struct AddonToKodiFuncTable_AudioCodec
  {
    // Reserved for future use
    void* unused;
  } AddonToKodiFuncTable_AudioCodec;

  typedef struct KodiToAddonFuncTable_AudioCodec
  {
    void* addonInstance;
    bool(__cdecl* open)(const struct AddonInstance_AudioCodec* instance,
                        const struct AUDIOCODEC_INITDATA* initData);
    bool(__cdecl* reconfigure)(const struct AddonInstance_AudioCodec* instance,
                               const struct AUDIOCODEC_INITDATA* initData);
    bool(__cdecl* add_data)(const struct AddonInstance_AudioCodec* instance,
                            const struct DEMUX_PACKET* packet);
    enum AUDIOCODEC_RETVAL(__cdecl* get_frame)(const struct AddonInstance_AudioCodec* instance,
                                               struct AUDIOCODEC_FRAME* frame);
    const char* (__cdecl* get_name)(const struct AddonInstance_AudioCodec* instance);
    void(__cdecl* reset)(const struct AddonInstance_AudioCodec* instance);
  } KodiToAddonFuncTable_AudioCodec;

  typedef struct AddonInstance_AudioCodec
  {
    struct AddonToKodiFuncTable_AudioCodec* toAddon;
    struct KodiToAddonFuncTable_AudioCodec* toKodi;
  } AddonInstance_AudioCodec;

#ifdef __cplusplus
}
#endif

#endif /* !C_API_ADDONINSTANCE_AUDIOCODEC_H */

(4) Register Audio Codec Handler in Addon Manager

File: xbmc/addons/AddonManager.cpp

Add audio codec instance registration similar to existing video codec registration.

Summary

These changes mirror the existing CInstanceVideoCodec pattern (xbmc/addons/kodi-dev-kit/include/kodi/addon-instance/VideoCodec.h) but for audio streams. Once these are in place, inputstream.adaptive can:

1. Return true from IsSecureDecoderAudioSupported() in WVDecrypter.h:58
2. Create CInstanceAudioCodec instances via CreateInstance() for ADDON_INSTANCE_AUDIOCODEC
3. Extend IDecrypterDecoder to add audio methods: OpenAudioDecoder(), DecryptAndDecodeAudio(), ResetAudio()
4. Enable audio streams with secure path in Session.cpp:224-234

The cryptoSession field in AUDIOCODEC_INITDATA allows the addon to pass the DRM session identifier so Kodi's audio decoder can access the secure CDM context.

[drewvs]

@CastagnaIT Do you think it's possible to backport this to Kodi 21 with all the changes within ISA? YTTV uses these types of audio streams and I'm having to manually decrypt with a built CDM.

[CastagnaIT]

Absolutely not, this involves modifying not only ISA but also the Kodi interface,
Kodi 21 has reached end-of-life of developments

This is also just an attempt to get some sort of guideline from AI, i'm not entirely sure I'll be able to finish it since i dont have so clear all parts, but the idea is to get started, this missing feature is currently obstructing various developments and appropriate fixes for the add-on

It’s also possible that I won’t be able to finish this before the API changes on the main project are locked down, since the beta release is just around the corner, so this might get delayed to Kodi 23

Also, the only way i know to test it is through Am@zon, hoping that it still provides encrypted audio in this way...
"YTTV" require an account? Otherwise i could use your service to run these type of tests

[drewvs]

@CastagnaIT Yeah I kind of figured that would be the case, no worry! Yeah YoutubeTV does require an account and unfortunately doesn't offer any kind of free-stream option.

There is some pretty complex stuff I need to do in a proxy to even get it work: hard-coded cookie values, manually decrypt audio and remux, getting around SABR and forcing DASH, and certain channels ISA doesn't like the keys I'm trying to feed in, so premium/movie channels don't play. All the encryption stuff is becoming a bit daunting and I don't know if it's my code or the lack of L1 but I do know I'm running into this issue... Depending on how far I continue with even developing this add-on I could probably pay and provide an account you could use if AMZ doesn't work.

You've certainly given a lot to the community, very much appreciated!

[dimkroon]

I'm not absolutely sure, but I think we have the same problem with my addon viwX, playing some streams from ITVX. In particular those originating from Disney+. Video plays, but no audio.

If it may help @CastagnaIT , streams are freely playable on a free account.
One steam with the issue can be found at: categories/drama/A/The affair. Select any episode from any series.
Ensure to have "Enable full HD" selected in viwX's settings, page General. (it's switched off by default)

Just drop me a note if you have problems creating an account, or experience other access issues. I'm sure I'll be able to help.
Many thanks for all your great work, and my sincere apologies if it turns out to be a different issue after all.

log
manifest
licensedata.zip

[CastagnaIT]

@dimkroon i dont see on log prints as "Secure path decoder on audio stream is not supported"
so your problem is something different

first thing i suggest you to test under kodi 22 since a log of changes has been done and could be already solved,
if the same happens please open an issue thread

EDIT: i dont remember anymore if "Secure path decoder on audio stream is not supported" prints has been added from v21 so test v22 and looks if you see that log prints, then we will see

[dimkroon]

Thanks for the quick repsonse! Sorry, I should have tried Piers in the first place.

Yes, it looks like that particular log line was added in v 22. I installed kodi 22 on a system that does play the same video in a web browser (although browsers play another variant) and now the line you refering to is in the log. Again, no audio while video plays fine.

If you try to test with viwX, please do not forget to enable Full HD is viwX's settings.

log
manifest
license_data.zip

[CastagnaIT]

yeah so its about this missing feature
i tried test your addon but its geoblocked and my free VPN to UK dont works

[dimkroon]

I've sent you an email with info how to use my server.

[CastagnaIT]

thanks i will take a look on next days
anyway i haven't started developing anything yet
this is just a starting point