EFV dynamic cover and screenshot encryption, plus customized timestamp and play-count hotlink/download protection

In response to client needs, I spent several days studying timestamp-based hotlink protection and dynamic image displacement encryption. The result encrypts and decrypts covers and screenshots and provides advanced customized timestamp-based hotlink and download protection for EFV. Many users found the previous hack hls.js playback method difficult, so this feature considers all contexts, including APP, browser and mini-program playback.

Updates

• One: Added dynamic image encryption and decryption. Enable it in administration and opening covers or screenshots triggers downloads with no visible meaningful image content. Our decryption js plugin is needed to display images normally in frontend browsers. Disable it at any time to restore normal poster and cover display.
• Two: Added advanced customized timestamp protection for EFV. Developers can enable timestamp and play-count limits, configure a protection key, concatenate parameters, process them with md5 and append them to the m3u8. The backend verifies the m3u8 URL and parameters, returning normal content only when valid with the correct key; invalid requests receive 403. This diagram explains the process:

Third-party applications can integrate this customized protection. Set counts for allowed play requests and timestamp as a 13-digit millisecond expiry. Use the required m3u8 path, starting with /videos and ending in m3u8, without the domain. Concatenate it with the configured hotlink-protection key, generate a 32-character lowercase key using md5, and append the parameters to the url for access.

Recommendation: For maximum restrictions, set expiry to the current time plus 5 seconds and request count to 1. The browser fetches the m3u8 through an API and begins playback, after which the URL expires immediately. Combine this with ts encryption: processing m3u8 automatically appends the same protection parameters to its key file. With counts set to 1, m3u8 can be requested once, and its key can likewise load once. Combined with TS encryption, this prevents a user who captures m3u8 from immediately constructing a third-party m3u8 with the TS segments and key contents.

Contact support for the detailed string-concatenation logic.

References

Test md5 hashing: https://tool.chinaz.com/tools/md5.aspx

Timestamp explanation: https://www.cnblogs.com/hanzongze/p/js-timestamp.html