Intended use

EFV Advanced offers several protection systems: image/poster encryption, hls double encryption, and timestamp-based protection with request limits. Developers can integrate them into their own systems. Principles and details: View documentation.

Double encryption based on hls

Inspired by Polyv's protection strategy, this system modifies hls.js to implement custom symmetric encryption and decryption in both directions. JS obfuscation protects that logic. Like Polyv's customized HLS.JS, it binds playback to specified domains and performs symmetric encryption/decryption with the EFV backend, protecting against hotlinking, downloads, segment merging and cracking.

1. Customized HLS.JS implements our encryption and decryption logic.
2. Symmetric encryption/decryption between EFV and frontend HLS.JS addresses hotlinking, merging and downloads at their source.
3. Multiple encryption/decryption layers in HLS.JS, with tens of thousands of code lines, make cracking extremely difficult.
4. The communication KEY makes cracking impossible. Change the protection KEY and regenerate HLS.JS to create a completely new version and protection architecture in just 1 minute.
5. Experts are welcome to try cracking it: successfully copying playback would prove me wrong!

Image and poster encryption

When enabled, transcoded posters and screenshots become encrypted, unreadable files. Opening their URLs downloads files without visible image content. Our frontend decryption js plugin is required to display them normally in the browser. Disable encryption at any time to restore ordinary poster and screenshot display.

Image and poster conversion to text

Automatically enabled text conversion dynamically converts poster/screenshot URLs into bash64 txt URLs. Opening one shows text rather than an image, using very few server resources. The frontend can decode bash64 to display it.

Timestamp protection and request limits

Enable timestamp and play-count protection in settings and set the protection key. Use this key to assemble parameters, apply md5 and append them to m3u8. The backend checks the URL and parameters and returns normal content only when valid. Invalid requests return 403 or a random advertisement from the configured segment advertisements.