How to bypass Secure Download Manager while downloading from Dreamspark

About a month or so ago I had an urgent need to download a copy of Microsoft Windows from Dreamspark. Unfortunately I haven’t Windows installed then so had to do this using Linux. After successful transaction I was given a link to SDX file and program called SDM. It looked that it would be easy. But it wasn’t. Program that I was encouraged to download was archive with .pkg extension. As I discovered few minutes later it was OS X application package. So the next step was to try to download Windows version and try to execute it with help of Wine. It failed. Then I tried to find some tips on the Net. I found a few other people having the same problem. Some of them could download using Wine and some not. For me there was only one solution: do it myself. As you probably guessed that way was a (almost) full success.

Solution

If you already have SDC file please do not skip since you probably still don’t have a key needed to unpack the file. The first step is to open SDX file in your favorite text editor. You will see a link. Open it in a web browser. Now you need to get to page source. The way it can be done depends on your web browser. Now we need to find few strange values in the code. The easiest way to achieve this is to search for keyword ‘edv*’ where * is the number of file you want to download counting from 1 (they are on ‘Items’ list on page you opened). Now you need to copy somewhere values of the following variables: ‘oiopu*’, ‘oiop*’, ‘fileID*’ (*-see above). The last one we need is ‘dlSelect*’ but for that one you need to search cause it is in a different place. Now you can build URL that will let you to file containing two interesting values: file URL and decryption string. This URL’s format is:

http://[SDXdomain]/WebStore/Account/SDMAuthorize.ashx?oiopu=[oiopu]&f=[fileID]&oiop=[oiop]&dl=[dlSelect]

Now you should see XML file that looks similar to this:

1
2
3
4
5
6
7
8
<information>
 <oiopua>01234abcd-0123-4567-890a-0123456789ab</oiopua>
 <edv>0123456789^^0123456789QwErTyUiOpAsDfGhJkLzXc0123456789QwErTyUiOpAsDfGhJkLzXc12345678</edv>
 <linkAvailable>1</linkAvailable>
 <errorTextKey/>
 <invokeExternalDownload>0</invokeExternalDownload>
 <fileUrl><![CDATA[http://software.dreamspark.com/dreamspark/ENGLISH/SDCfileName.sdc]]></fileUrl>
</information>

The last step here will be downloading file from fileUrl and saving edv value in file. The important thing is that the file with a key should be named exactly as SDC file with addition of ‘.key’ suffix.

Update:

I’ve just discovered that things are getting a bit different when the file size exceeds 2.0 GB. In that case Dreamspark is splitting file in two or more files. That situation could be easily recognized, because sdc file name’s suffix is: ‘.01.sdc’. In that case you need to try to download file which URL differs by only that one digit, ie. ‘.01.sdc’, ‘.02.sdc’, ‘.03.sdc’. When you encounter last file it should have smaller size than the rest and incrementing that number by one should give you BlobNotFound error.

After downloading all the files they just need to be joined into one. It can be easily achieved with dd, ie.

dd if=pl_windows_7_professional_with_sp1_x64_dvd_u_676944.02.sdc >> pl_windows_7_professional_with_sp1_x64_dvd_u_676944.01.sdc

and then optionally

dd if=pl_windows_7_professional_with_sp1_x64_dvd_u_676944.03.sdc >> pl_windows_7_professional_with_sp1_x64_dvd_u_676944.01.sdc

After that you will get sdc file prepared to unpack.

Unpacking SDC

Now since you have SDC file you can start unpacking it. The previous part was, at least for me, very easy. The problem started when I tried to discover how the file is stored in that container. But don’t worry, I’ve written simple program to do it for you. As of now (1st June) it is still in really early alpha stage and have lot of constraints. It is able to unpack containers that contains only one file packed, doesn’t create any directories, cannot verify file’s checksum and probably few other problems I don’t remember or don’t know about.

If you were searching a bit in the Internet, you probably found out that someone cracked that container in the past. Unfortunately Microsoft changed format since then. It is also possible that in response to this article it will be changed again. To make it a bit harder for them to block my software I’m publishing source code on github and after the process of reverse engineering is finished will write second article describing how things works under the hood and describe sdc file format.

But let’s get back to unpacking. Now you need to download xSDM from github. The newest version can be downloaded by typing

git clone https://github.com/v3l0c1r4pt0r/xSDM.git

in your terminal (of course you need to have git installed). Nevertheless I advice you to download newest tagged release. You can do this by clicking on releases on project page and then choosing the one on the top (or first beta/stable if any) and clicking on “tar.gz”. tar.gz can be unpacked by typing

tar -zxvf xSDM-[tag-name].tar.gz

into console. Then get into xSDM directory by typing

cd xSDM

(or your release directory) and compile the program by standard

./configure
make
make install

where installation is optional. Now to unpack your file you just need to type

src/xsdm [path-to-your-sdc-file]

And that’s it, you should now be able to open file you downloaded. As mentioned above the program is in very early alpha so I cannot guarantee that it will work in any case. If you will encounter any problems feel free to open issue on project page at github.

This entry was posted in Tutorials and tagged , , , , , , . Bookmark the permalink. Follow any comments here with the RSS feed for this post. Post a comment or leave a trackback.

38 Comments

  1. dranoelf
    Posted July 7, 2014 at 21:20 | Permalink

    Thanks for this great solution.
    Got some hard time with microsofts dreamspark and their policy of handicaping
    linux users.

    Worked for me with one minor change.
    Instead of the URL you provide to get to the XML-file I was successful with an URL like this:

    http://[SDXdomain]/WebStore/Account/SDMAuthorize.ashx?oiopu=%5Boiopu%5D&f=%5BfileID%5D&oiop=%5Boiop%5D&dl=%5BdlSelect%5D

    Note, that all occurences of & are replaced by just &.

    Maybe other people struggle with a similar issue and this comment helps.

    • v3l0c1r4pt0r
      Posted July 8, 2014 at 09:21 | Permalink

      Fixed. That was just WordPress issue. Thanks.

  2. GMMan
    Posted July 8, 2014 at 23:11 | Permalink

    Interesting tidbit: if you never fire back a request with the oiopua field and value, the site won’t count it as a download. Also, you can place whatever valid fileID in there and it would give you the decryption key for it.

  3. tatsu
    Posted September 14, 2014 at 16:18 | Permalink

    It doesn’t work.

    here’s the point where it fell appart in config (and the make didn’t work either) :

    checking for CHECK… no
    configure: error: Package requirements (check >= 0.9.4) were not met:

    No package ‘check’ found

    Consider adjusting the PKG_CONFIG_PATH environment variable if you
    installed software in a non-standard prefix.

    Alternatively, you may set the environment variables CHECK_CFLAGS
    and CHECK_LIBS to avoid the need to call pkg-config.
    See the pkg-config man page for more details.
    t@tsu:~/xSDM-master$ make
    Making all in src
    make[1]: Entering directory `/home/t/xSDM-master/src’
    Makefile:336: *** missing separator. Stop.
    make[1]: Leaving directory `/home/t/xSDM-master/src’
    make: *** [all-recursive] Error 1

    what is this “check” and why is it not finding it? could you leave a .deb in your github, please?

    • tatsu
      Posted September 14, 2014 at 16:23 | Permalink

      never mind i installed check and now it goes further but stops at missing Libmcrypt (-lmcrypt) so i tired sudo apt-get install mcrypt wich worked but still the same error.

    • v3l0c1r4pt0r
      Posted September 14, 2014 at 19:14 | Permalink

      Try looking at config.log file. It should contain more hints what went wrong. If it didn’t help please post issue on github and include its content.

    • Tijs
      Posted June 24, 2015 at 03:02 | Permalink

      You are compiling software manually here, and that may be challenging, but you should not be beaten that easily :p. By examining the configure file I found out that the linker (ld) could simply not find lmcrypt and then I realized that I needed to install dependency libmcrypt-devel.

  4. pauka
    Posted January 6, 2015 at 02:09 | Permalink

    Hello,
    to begin, thank you for this tutorial, it is clear, accurate and easy.
    But I am having an error in the execution :
    src/xsdm: error while loading shared libraries: libmcrypt.so.4: cannot open shared object file: No such file or directory
    it seems to a bug known, but I have execute
    sudo make uninstall
    ./configure \
    > –with-libdir=lib64 \
    > –with-apxs2=/usr/sbin/apxs \
    > –with-config-file-path=/etc \
    > –enable-sigchild \
    > –with-openssl \
    > –enable-bcmath \
    > –with-curl \
    > –with-mcrypt \
    > –with-mysql \
    > –with-mysqli=/usr/bin/mysql_config \
    > –enable-sockets \
    > –with-gd \
    > –with-jpeg-dir=lib64 \
    > –with-png-dir \
    > –with-freetype-dir \
    > –with-zlib

    make

    sudo make install

    but the error is still there.
    Do you know why ?

    • v3l0c1r4pt0r
      Posted January 6, 2015 at 10:58 | Permalink

      The information you gave may not be sufficient to tell what have gone wrong. Maybe config.log could tell what’s going on. It maybe useful to look into /proc/$XSDM_PID/environ or the same file of a shell and at first check if libmcrypt.so.4 really exists in your lib directory. If you cannot manage it yourself, please open an issue on projects github page.

  5. Gulliver
    Posted January 29, 2015 at 22:53 | Permalink

    Hi,
    for comfortable downloading is good this testing (beta) script:
    https://github.com/RadekSimkanic/Linux-SDM-Downloader

    This script copy the above steps.
    Have fun.

  6. jeffg
    Posted February 9, 2015 at 02:25 | Permalink

    Hey-

    A linux illiterate here. I’m getting makefile errors, line 336, about a missing separator.

    Any ideas?

    Thanks.

    https://drive.google.com/file/d/0B-olREfWlf_4NGJkQUthN2NIYWs/view?usp=sharing

    • v3l0c1r4pt0r
      Posted February 9, 2015 at 16:56 | Permalink

      No prerequisites installed, again. Please read Readme.md before installation. Before installation you have to have check, zlib, libmcrypt and sometimes libmcrypt-dev (it depends on distro, afaik).
      Edit: and one more thing: you CANNOT make if configuration fails, because it is meaningless!

    • jeffg
      Posted February 9, 2015 at 19:14 | Permalink

      Hey bud,

      Finding my way along here, made major progress but hung up at very end.

      Here is what transpired – remember, I am brand new at Linux.

      Installed Ubuntu in a VM instance. The Ubuntu website automatically sent me the amd64 version of the iso. I didn’t catch it until much later.

      So now on i386. I can’t get networking to run, other win vm’s have no issues, whatever. I’ll just copy files in by hand.

      Well, not so nice, turns out Linux has a cool package installer which I can’t use due to lack of network. Anyway…

      I start with xsdm tarball, tells me it has a dependancy on zlib (or something else), get that tarball, another dependency….Go through them all and everything appears to be cool. I can run make install on xsdm and it goes no problem.

      Then I try to run it. Get nor found errors on the libmcrypt libraries. Digging around I found I had to set an environment variable, LD_LIBRARY_PATH.

      Did that and xsdm runs!

      Ok, I copy in my SDC file (2 stitched together) and the key file, run xsdm and am told that ” the value is too long for defined data type”. I shortened up the sdc filename in case that was it but no difference.

      Thanks man.

    • v3l0c1r4pt0r
      Posted February 9, 2015 at 22:40 | Permalink

      You are second person that got ‘value too long’ error. Maybe the problem is that you are using i386 system? Honestly I wasn’t testing xsdm against that architecture because I forgot that it exists long time ago πŸ™‚ . In Linux world there is no reason to use it unless you use something made in pre-x64 era.

    • jeffg
      Posted February 9, 2015 at 22:46 | Permalink

      I just chose i386 b/c I was having trouble and realized I was on an AMD package.

      I’ll try loading your source in a C IDE and see if I can get it to run and give the same error.

      I’d really like to get this, the download manager is so so so broken I am going nuts.

      Thanks man.

    • jeffg
      Posted February 14, 2015 at 04:17 | Permalink

      Oh well, I guess it isn’t meant to be. I got everything running under amd64, got networking, xsdm running – all cool.

      Small file, about 50M, passes crc but then gives a pointer error.

      The larger files, multi-part, after joining fail crc check every time. I even redownload, from w/in Ubuntu, and get a fail with different CRC every time.

    • jeffg
      Posted February 16, 2015 at 02:08 | Permalink

      Having success. Got your source to run in Eclipse, the compiled version gave a pointer error when trying to create the output file, runs fine in the IDE.

      Just can’t get multi-part files to pass CRC. The downloads always stop and I have to resume, I don’t know if that is a factor. I forced them to be made anyways and the decompression failed.

      Of well, thx for the work.

  7. McAko
    Posted February 11, 2015 at 03:08 | Permalink

    Thanks for your job! I had problems using Software Download Manager for Mac OS X because it was always freezing, not responding and crashing. Finally I downloaded the files manually and I run your tool on my Mac OS X Snow Leopard and surprisingly it could decrypt them without any problems.

  8. SomeUser
    Posted March 28, 2015 at 09:58 | Permalink

    First thank you for the great work. I think this helps a lot of academic linux user to download m$ related stuff.

    Currently I am seeing problems unpacking large sdc containers. E.g.:

    xsdm en_windows_embedded_compact_7_disc_2_x86_x64_dvd_645485.sdc
    Opening SDC file… [OK]
    Verifying keyfile… [OK]
    Validating SDC header… [FAIL]
    xsdm: File given is not valid SDC file or decryption key wrong

    This sdc is 7.3G in size and glued together using dd. For smaller sdc (e.g. 3.5G I did not receive such an error this is why I think sdc size may be the showbreaker)

    • SomeUser
      Posted March 28, 2015 at 10:39 | Permalink

      Well the isue seems to be caused by a 32bit unsigned int limit for for sdc filesize within the sdc header. So a simple fix worked for me:

      — snip —
      //check if valid sdc file

      if(header->compressedSize + headerSize + 4 != sdcSize)
      >> changed to >>
      if(header->compressedSize + headerSize + 4 != (sdcSize % 4294967296))

    • v3l0c1r4pt0r
      Posted March 29, 2015 at 12:21 | Permalink

      There was an easier method to obey this error. xSDM has –force option which should have ignored this one, because that line just checks if you have given him valid sdc file and key file. The workaround you have done will void the verification procedure on all files you will unpack in future so you won’t know what have gone wrong next time.
      Nonetheless thanks for info that on i386 there are still problems to solve.

      Edit: OK, I think I’ve managed to fix it anyway.

  9. Posted April 8, 2015 at 00:25 | Permalink

    Hi guys and girls,

    when I try to extract my SDC file (after I merged them), I get the following error:
    Opening SDC file… [OK]
    [FAIL]
    de_windows_8_1_x64_dvd_2707227.sdc.key: No such file or directory

    what is or where can I get this key file?? Anybody experienced the same?

    greetings!!

  10. Tijs
    Posted June 24, 2015 at 01:37 | Permalink

    When I open the link in the SDX I see a fancy webpage with a download bar. For those of you who are constructing the link manually, in my case there is a hidden element fileUrl1 with the contained in it πŸ™‚

  11. Dechcaudron
    Posted July 3, 2015 at 19:04 | Permalink

    Thanks a lot for the amazing tool. Didn’t have Windows at hand and this worked perfectly. You did a brilliant job. Do you accept donations?

    • v3l0c1r4pt0r
      Posted July 4, 2015 at 14:23 | Permalink

      Thanks for your thanks πŸ™‚ I’ve never thought about any method for receiving donations but if you’d like to send me some you could try to send it to my PayPal account: kamill1993 at gmail dot com

  12. Posted July 21, 2015 at 17:34 | Permalink

    Great, it still works (as of 21 July 2015)!

  13. Tito_Li
    Posted August 31, 2015 at 14:32 | Permalink

    Good job.
    yesterday everything works fin for me.
    Today in the moring also. Now I can’t get the xml file.
    ValidationExceptions.DownloadNotAllowedForFile

    best regards
    Tito_Li

  14. Dido_Mi
    Posted October 22, 2015 at 00:49 | Permalink

    It works. You’re a fucking genius! Keep up the good stuff πŸ™‚

    best regards
    Dido_Mi

  15. 4lian7
    Posted October 27, 2015 at 00:30 | Permalink

    Flo Posted:

    “Hi guys and girls,

    when I try to extract my SDC file (after I merged them), I get the following error:
    Opening SDC file… [OK]
    [FAIL]
    de_windows_8_1_x64_dvd_2707227.sdc.key: No such file or directory

    what is or where can I get this key file?? Anybody experienced the same?

    greetings!!”

    I’ve exactly the same problem. Could anybody explain what’s wrng?

    • Adam
      Posted October 29, 2015 at 21:53 | Permalink

      Same here…

    • Adam
      Posted October 29, 2015 at 22:13 | Permalink

      Nevermind, IT WORKED! Wielkie dzieki, v3l0c1r4pt0r!!!!

      Flo, you have to create a file called ‘de_windows_8_1_x64_dvd_2707227.sdc.key’ which contains the edv value you have obtained in a previous step.

  16. MariuszF
    Posted November 14, 2015 at 12:05 | Permalink

    Thanks a lot to you and all the ppl who were solving problems in comments πŸ˜‰ (I’ve got almost every one of them). You R true hero for me.

  17. student
    Posted January 18, 2016 at 19:43 | Permalink

    Thank you, you are awesome!

  18. Nithanim
    Posted October 9, 2016 at 02:19 | Permalink

    Holy fu*** %&$&$%Β§!
    I really, really hate MS for this bu§$%§&!
    I didn’t read this but the version you posted on SO but you saved my good old Win7 from the virus called SDM since this does not work in sandboxie and I refuse to setup a windows vm only for this sh***.
    THANK YOU

  19. Jodelking
    Posted October 15, 2016 at 13:20 | Permalink

    Hello πŸ™‚

    First of all, thank you a lot for the great description and the solution to this problem. I have a small question regarding an error, that ocurred while doing the very last step: Somehow everything stops while checking the file integrity. The CRC32 part of my key-file seems to be wrong (I used the edv-part of the XML-file of dreamspark). The exact text is:

    src/xsdm: CRC32 of sdc file did not match the one supplied in keyfile (0xF69F170A expected while have 0x8A2F17D2)

    thank you very much πŸ™‚

    • Jodelking
      Posted October 15, 2016 at 13:36 | Permalink

      Hello again πŸ˜€

      I found a solution to this problem and it is rather funny (I have no idea, what happened there).
      When I converted my CRC32 into a hexdecimal number, it was F69F170A. So apparently, your application is reading it in hexadecimal. However, Microsoft seems to have changed the key. By comparing the numbers, I realised, that 8A2F17D2 is exactly the half of F69F170A. So I just had to divide the CRC32-part of the edv-number by two in my key file and everything worked just fine πŸ˜€

      Thanks anyways πŸ™‚

  20. zardoz
    Posted April 10, 2017 at 19:05 | Permalink

    Doesn’t work for me, neither does the python script.

    In both cases the first url respons with “Your request could not be processed: either the page does not exist or a general error has occurred.”

    guess api changed? could someone investigate?

    • v3l0c1r4pt0r
      Posted April 11, 2017 at 17:47 | Permalink

      It seems that (at least I checked that on one random product) the xSDM is not needed anymore. Current interface allows to download exe/zip/whatever directly on any operating system. Thanks for notifying me, BTW!
      Edit: at least one of my previous orders still serves SDX file, so xSDM is not completely dead, yet. Anyway, you should try direct download and check if it helps.

1 Trackback

  1. […] promised in my previous post I’m publishing description of Microsoft’s SDC file format. At the beginning I’d […]

Leave a Reply

Your email address will not be published. Required fields are marked *

Your email address will never be published.