Studying Polyv hotlink protection: customized hls.js with multiple encryption layers against hotlinking, merging and downloads

I recently studied Polyv's hotlink-protection strategy. Its core is custom encryption and decryption of the key in m3u8, implemented through modified hls.js logic with symmetric encryption, protected by JS obfuscation. I spent 3 days examining hls.js source. Once familiar with it, I produced a customized HLS.JS similar to Polyv, with domain-bound playback, symmetric encryption and decryption with EFV, and protection against hotlinking, downloading, merging and cracking.

Features

• One: Customized HLS.JS implements our encryption and decryption logic.
• Two: Symmetric encryption between EFV and frontend HLS.JS fundamentally addresses hotlinking, merging and downloads.
• Three: Multiple encryption layers in HLS.JS make cracking difficult, with tens of thousands of lines of code.
• Four: The communication KEY makes cracking impossible according to this design. Each change to the protection KEY and regenerated HLS.JS produces a new version and protection architecture in only 1 minute.
• Five: Experts are welcome to test and attempt cracking or unauthorized playback. Testing is ongoing; contact customer support on QQ for details.

Example

https://moeb.me/ is bound to moeb.me and the corresponding EFV protection KEY. Only this domain can play it, with unauthorized playback, downloading and merging protected through one file. You are welcome to inspect and test it.

Limitations

Mobile browsers that intercept the player and replace M3U8 parsing cannot play it. Polyv has the same limitation because both use custom decryption. Direct users to browsers such as Google's, or implement an APP using the decryption logic.