Add spatial audio support

Source/AudibleUtilities/AccountsSettings.cs

@@ -47,6 +47,22 @@ namespace AudibleUtilities
 				update_no_validate();
 			}
 		}
+
+		private string _cdm;
+		[JsonProperty]
+		public string Cdm
+		{
+			get => _cdm;
+			set
+			{
+				if (value is null)
+					return;
+
+				_cdm = value;
+				update_no_validate();
+			}
+		}
+
 		[JsonIgnore]
 		public IReadOnlyList<Account> Accounts => _accounts_json.AsReadOnly();
 		#endregion

Source/AudibleUtilities/AudibleUtilities.csproj

@@ -5,7 +5,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="AudibleApi" Version="9.3.2.1" />
+    <PackageReference Include="AudibleApi" Version="9.4.0.1" />
+    <PackageReference Include="Google.Protobuf" Version="3.30.2" />
   </ItemGroup>
 
   <ItemGroup>
@@ -20,4 +21,9 @@
 		<DebugType>embedded</DebugType>
 	</PropertyGroup>
 
+	<ItemGroup>
+		<Compile Update="Widevine\Cdm.*.cs">
+			<DependentUpon>Cdm.cs</DependentUpon>
+		</Compile>
+	</ItemGroup>
 </Project>

Source/AudibleUtilities/Widevine/Cdm.Api.cs

@@ -0,0 +1,189 @@
+using AudibleApi;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using System.Net.Http;
+using AudibleApi.Cryptography;
+using Newtonsoft.Json.Linq;
+using Dinah.Core.Net.Http;
+using System.Text.Json.Nodes;
+
+#nullable enable
+namespace AudibleUtilities.Widevine;
+
+public partial class Cdm
+{
+	/// <summary>
+	/// Get a <see cref="Cdm"/> from <see cref="AccountsSettings"/> or from the API.
+	/// </summary>
+	/// <returns>A <see cref="Cdm"/> if successful, otherwise <see cref="null"/></returns>
+	public static async Task<Cdm?> GetCdmAsync()
+	{
+		using var persister = AudibleApiStorage.GetAccountsSettingsPersister();
+
+		//Check if there are any Android accounts. If not, we can't use Widevine.
+		if (!persister.Target.Accounts.Any(a => a.IdentityTokens.DeviceType == Resources.DeviceType))
+			return null;
+
+		if (!string.IsNullOrEmpty(persister.Target.Cdm))
+		{
+			try
+			{
+				var cdm = Convert.FromBase64String(persister.Target.Cdm);
+				return new Cdm(new Device(cdm));
+			}
+			catch (Exception ex)
+			{
+				Serilog.Log.Logger.Error(ex, "Error loading CDM from account settings.");
+				persister.Target.Cdm = string.Empty;
+				//Clear the stored Cdm and try getting a fresh one from the server.
+			}
+		}
+
+		if (string.IsNullOrEmpty(persister.Target.Cdm))
+		{
+			using var client = new HttpClient();
+			if (await GetCdmUris(client) is not Uri[] uris)
+				return null;
+
+			//try to get a CDM file for any account that's registered as an android device.
+			//CDMs are not account-specific, so it doesn't matter which account we're successful with.
+			foreach (var account in persister.Target.Accounts.Where(a => a.IdentityTokens.DeviceType == Resources.DeviceType))
+			{
+				try
+				{
+					var requestMessage = CreateApiRequest(account);
+
+					await TestApiRequest(client, new JsonObject { { "body", requestMessage.ToString() } });
+
+					//Try all CDM URIs until a CDM has been retrieved successfully
+					foreach (var uri in uris)
+					{
+						try
+						{
+							var resp = await client.PostAsync(uri, ((HttpBody)requestMessage).Content);
+
+							if (!resp.IsSuccessStatusCode)
+							{
+								var message = await resp.Content.ReadAsStringAsync();
+								throw new ApiErrorException(uri, null, message);
+							}
+
+							var cdmBts = await resp.Content.ReadAsByteArrayAsync();
+							var device = new Device(cdmBts);
+							persister.Target.Cdm = Convert.ToBase64String(cdmBts);
+							return new Cdm(device);
+						}
+						catch (Exception ex)
+						{
+							Serilog.Log.Logger.Error(ex, "Error getting a CDM from URI: " + uri);
+							//try the next URI
+						}
+					}
+				}
+				catch (Exception ex)
+				{
+					Serilog.Log.Logger.Error(ex, "Error getting a CDM for account: " + account.MaskedLogEntry);
+					//try the next Account
+				}
+			}
+		}
+
+		return null;
+	}
+
+	/// <summary>
+	/// Get a list of CDM API URIs from the main Gitgub repository's .cdmurls.json file.
+	/// </summary>
+	/// <returns>If successful, an array of URIs to try. Otherwise null</returns>
+	private static async Task<Uri[]?> GetCdmUris(HttpClient httpClient)
+	{
+		const string CdmUrlListFile = "https://raw.githubusercontent.com/rmcrackan/Libation/refs/heads/master/.cdmurls.json";
+
+		try
+		{
+			var fileContents = await httpClient.GetStringAsync(CdmUrlListFile);
+			var releaseIndex = JObject.Parse(fileContents);
+			var urlArray = releaseIndex["CdmUrls"] as JArray;
+			if (urlArray is null)
+				throw new System.IO.InvalidDataException("CDM url list not found in JSON: " + fileContents);
+
+			var uris = urlArray.Select(u => u.Value<string>()).OfType<string>().Select(u => new Uri(u)).ToArray();
+
+			if (uris.Length == 0)
+				throw  new System.IO.InvalidDataException("No CDM url found in JSON: " + fileContents);
+
+			return uris;
+		}
+		catch (Exception ex)
+		{
+			Serilog.Log.Logger.Error(ex, "Error getting CDM URLs");
+			return null;
+		}
+	}
+
+
+	static readonly string[] TLDs = ["com", "co.uk", "com.au", "com.br", "ca", "fr", "de", "in", "it", "co.jp", "es"];
+
+	//Ensure that the request can be made successfully before sending it to the API
+	//The API uses System.Text.Json, so perform test with same.
+	private static async Task TestApiRequest(HttpClient client, JsonObject input)
+	{
+		if (input["body"]?.GetValue<string>() is not string body
+				|| JsonNode.Parse(body) is not JsonNode bodyJson)
+			throw new Exception("Api request doesn't contain a body");
+
+		if (bodyJson?["Url"]?.GetValue<string>() is not string url
+			|| !Uri.TryCreate(url, UriKind.Absolute, out var uri))
+			throw new Exception("Api request doesn't contain a url");
+
+		if (!TLDs.Select(tld => "api.audible." + tld).Contains(uri.Host.ToLower()))
+			throw new Exception($"Unknown Audible Api domain: {uri.Host}");
+
+		if (bodyJson?["Headers"] is not JsonObject headers)
+			throw new Exception($"Api request doesn't contain any headers");
+
+		using var request = new HttpRequestMessage(HttpMethod.Get, uri);
+
+		Dictionary<string, string>? headersDict = null;
+		try
+		{
+			headersDict = System.Text.Json.JsonSerializer.Deserialize<Dictionary<string, string>>(headers);
+		}
+		catch (Exception ex)
+		{
+			throw new Exception("Failed to read Audible Api headers.", ex);
+		}
+
+		if (headersDict is null)
+			throw new Exception("Failed to read Audible Api headers.");
+
+		foreach (var kvp in headersDict)
+			request.Headers.Add(kvp.Key, kvp.Value);
+
+		using var resp = await client.SendAsync(request);
+		resp.EnsureSuccessStatusCode();
+	}
+
+	/// <summary>
+	/// Create a request body to send to the API
+	/// </summary>
+	/// <param name="account">An authenticated account</param>
+	private static JObject CreateApiRequest(Account account)
+	{
+		const string ACCOUNT_INFO_PATH = "/1.0/account/information";
+
+		var message = new HttpRequestMessage(HttpMethod.Get, ACCOUNT_INFO_PATH);
+		message.SignRequest(
+					DateTime.UtcNow,
+					account.IdentityTokens.AdpToken,
+					account.IdentityTokens.PrivateKey);
+
+		return new JObject
+		{
+			{ "Url", new Uri(account.Locale.AudibleApiUri(), ACCOUNT_INFO_PATH) },
+			{ "Headers", JObject.FromObject(message.Headers.ToDictionary(kvp => kvp.Key, kvp => kvp.Value.Single())) }
+		};
+	}
+}

Source/AudibleUtilities/Widevine/Cdm.cs

@@ -0,0 +1,300 @@
+using Google.Protobuf;
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
+
+#nullable enable
+namespace AudibleUtilities.Widevine;
+
+public enum KeyType
+{
+	/// <summary>
+	/// Exactly one key of this type must appear.
+	/// </summary>
+	Signing = 1,
+	/// <summary>
+	/// Content key.
+	/// </summary>
+	Content = 2,
+	/// <summary>
+	/// Key control block for license renewals. No key.
+	/// </summary>
+	KeyControl = 3,
+	/// <summary>
+	/// wrapped keys for auxiliary crypto operations.
+	/// </summary>
+	OperatorSession = 4,
+	/// <summary>
+	/// Entitlement keys.
+	/// </summary>
+	Entitlement = 5,
+	/// <summary>
+	/// Partner-specific content key.
+	/// </summary>
+	OemContent = 6,
+}
+
+public interface ISession : IDisposable
+{
+	string? GetLicenseChallenge(MpegDash dash);
+	WidevineKey[] ParseLicense(string licenseMessage);
+}
+
+public class WidevineKey
+{
+	public Guid Kid { get; }
+	public KeyType Type { get; }
+	public byte[] Key { get; }
+	internal WidevineKey(Guid kid, License.Types.KeyContainer.Types.KeyType type, byte[] key)
+	{
+		Kid = kid;
+		Type = (KeyType)type;
+		Key = key;
+	}
+	public override string ToString() => $"{Convert.ToHexString(Kid.ToByteArray()).ToLower()}:{Convert.ToHexString(Key).ToLower()}";
+}
+
+public partial class Cdm
+{
+	public static Guid WidevineContentProtection { get; } = new("edef8ba9-79d6-4ace-a3c8-27dcd51d21ed");
+	private const int MAX_NUM_OF_SESSIONS = 16;
+	internal Device Device { get; }
+
+	private ConcurrentDictionary<Guid, Session> Sessions { get; } = new(-1, MAX_NUM_OF_SESSIONS);
+
+	internal Cdm(Device device)
+	{
+		Device = device;
+	}
+
+	public ISession OpenSession()
+	{
+		if (Sessions.Count == MAX_NUM_OF_SESSIONS)
+			throw new Exception("Too Many Sessions");
+
+		var session = new Session(Sessions.Count + 1, this);
+
+		var ddd = Sessions.TryAdd(session.Id, session);
+		return session;
+	}
+
+	#region Session
+
+	internal class Session : ISession
+	{
+		public Guid Id { get; } = Guid.NewGuid();
+		private int SessionNumber { get; }
+		private Cdm Cdm { get; }
+		private byte[]? EncryptionContext { get; set; }
+		private byte[]? AuthenticationContext { get; set; }
+
+		public Session(int number, Cdm cdm)
+		{
+			SessionNumber = number;
+			Cdm = cdm;
+		}
+
+		private string GetRequestId()
+			=> $"{RandomUint():x8}00000000{Convert.ToHexString(BitConverter.GetBytes((long)SessionNumber)).ToLowerInvariant()}";
+
+		public void Dispose()
+		{
+			if (Cdm.Sessions.ContainsKey(Id))
+				Cdm.Sessions.TryRemove(Id, out var session);
+		}
+
+		public string? GetLicenseChallenge(MpegDash dash)
+		{
+			if (!dash.TryGetPssh(Cdm.WidevineContentProtection, out var pssh))
+				return null;
+
+			var licRequest = new LicenseRequest
+			{
+				ClientId = Cdm.Device.ClientId,
+				ContentId = new()
+				{
+					WidevinePsshData = new()
+					{
+						LicenseType = LicenseType.Offline,
+						RequestId = ByteString.CopyFrom(GetRequestId(), Encoding.ASCII)
+					}
+				},
+				Type = LicenseRequest.Types.RequestType.New,
+				RequestTime = DateTimeOffset.UtcNow.ToUnixTimeSeconds(),
+				ProtocolVersion = ProtocolVersion.Version21,
+				KeyControlNonce = RandomUint()
+			};
+
+			licRequest.ContentId.WidevinePsshData.PsshData.Add(ByteString.CopyFrom(pssh.InitData));
+
+			var licRequestBts = licRequest.ToByteArray();
+			EncryptionContext = CreateContext("ENCRYPTION", 128, licRequestBts);
+			AuthenticationContext = CreateContext("AUTHENTICATION", 512, licRequestBts);
+
+			var signedMessage = new SignedMessage
+			{
+				Type = SignedMessage.Types.MessageType.LicenseRequest,
+				Msg = ByteString.CopyFrom(licRequestBts),
+				Signature = ByteString.CopyFrom(Cdm.Device.SignMessage(licRequestBts))
+			};
+
+			return Convert.ToBase64String(signedMessage.ToByteArray());
+		}
+
+		public WidevineKey[] ParseLicense(string licenseMessage)
+		{
+			if (EncryptionContext is null || AuthenticationContext is null)
+				throw new InvalidOperationException($"{nameof(GetLicenseChallenge)}() must be called before calling {nameof(ParseLicense)}()");
+
+			var signedMessage = SignedMessage.Parser.ParseFrom(Convert.FromBase64String(licenseMessage));
+			if (signedMessage.Type != SignedMessage.Types.MessageType.License)
+				throw new InvalidDataException("Invalid license");
+
+			var sessionKey = Cdm.Device.DecryptSessionKey(signedMessage.SessionKey.ToByteArray());
+
+			if (!VerifySignature(signedMessage, AuthenticationContext, sessionKey))
+				throw new InvalidDataException("Message signature is invalid");
+
+			var license = License.Parser.ParseFrom(signedMessage.Msg);
+			var keyToTheKeys = DeriveKey(sessionKey, EncryptionContext, 1);
+
+			return DecryptKeys(keyToTheKeys, license.Key);
+		}
+
+		private static WidevineKey[] DecryptKeys(byte[] keyToTheKeys, IList<License.Types.KeyContainer> licenseKeys)
+		{
+			using var aes = Aes.Create();
+			aes.Key = keyToTheKeys;
+			var keys = new WidevineKey[licenseKeys.Count];
+
+			for (int i = 0; i < licenseKeys.Count; i++)
+			{
+				var keyContainer = licenseKeys[i];
+
+				var keyBytes = aes.DecryptCbc(keyContainer.Key.ToByteArray(), keyContainer.Iv.ToByteArray(), PaddingMode.PKCS7);
+				var id = keyContainer.Id.ToByteArray();
+
+				if (id.Length > 16)
+				{
+					var tryB64 = new byte[id.Length * 3 / 4];
+					if (Convert.TryFromBase64String(Encoding.ASCII.GetString(id), tryB64, out int bytesWritten))
+					{
+						id = tryB64;
+					}
+					Array.Resize(ref id, 16);
+				}
+				else if (id.Length < 16)
+				{
+					id = id.Append(new byte[16 - id.Length]);
+				}
+
+				keys[i] = new WidevineKey(new Guid(id), keyContainer.Type, keyBytes);
+			}
+			return keys;
+		}
+
+		private static bool VerifySignature(SignedMessage signedMessage, byte[] authContext, byte[] sessionKey)
+		{
+			var mac_key_server = DeriveKey(sessionKey, authContext, 1).Append(DeriveKey(sessionKey, authContext, 2));
+
+			var hmacData = (signedMessage.OemcryptoCoreMessage?.ToByteArray() ?? []).Append(signedMessage.Msg?.ToByteArray() ?? []);
+
+			var computed_signature = HMACSHA256.HashData(mac_key_server, hmacData);
+
+			return computed_signature.SequenceEqual(signedMessage.Signature);
+		}
+
+		private static byte[] DeriveKey(byte[] session_key, byte[] context, int counter)
+		{
+			var data = new byte[context.Length + 1];
+			Array.Copy(context, 0, data, 1, context.Length);
+			data[0] = (byte)counter;
+
+			return AESCMAC(session_key, data);
+		}
+
+		private static byte[] AESCMAC(byte[] key, byte[] data)
+		{
+			using var aes = Aes.Create();
+			aes.Key = key;
+
+			// SubKey generation
+			// step 1, AES-128 with key K is applied to an all-zero input block.
+			byte[] subKey = aes.EncryptCbc(new byte[16], new byte[16], PaddingMode.None);
+
+			nextSubKey();
+
+			// MAC computing
+			if ((data.Length == 0) || (data.Length % 16 != 0))
+			{
+				// If the size of the input message block is not equal to a positive
+				// multiple of the block size (namely, 128 bits), the last block shall
+				// be padded with 10^i
+				nextSubKey();
+				var padLen = 16 - data.Length % 16;
+				Array.Resize(ref data, data.Length + padLen);
+				data[^padLen] = 0x80;
+			}
+
+			// the last block shall be exclusive-OR'ed with K1 before processing
+			for (int j = 0; j < subKey.Length; j++)
+				data[data.Length - 16 + j] ^= subKey[j];
+
+			// The result of the previous process will be the input of the last encryption.
+			byte[] encResult = aes.EncryptCbc(data, new byte[16], PaddingMode.None);
+
+			byte[] HashValue = new byte[16];
+			Array.Copy(encResult, encResult.Length - HashValue.Length, HashValue, 0, HashValue.Length);
+
+			return HashValue;
+
+			void nextSubKey()
+			{
+				const byte const_Rb = 0x87;
+				if (Rol(subKey) != 0)
+					subKey[15] ^= const_Rb;
+
+				static int Rol(byte[] b)
+				{
+					int carry = 0;
+
+					for (int i = b.Length - 1; i >= 0; i--)
+					{
+						ushort u = (ushort)(b[i] << 1);
+						b[i] = (byte)((u & 0xff) + carry);
+						carry = (u & 0xff00) >> 8;
+					}
+					return carry;
+				}
+			}
+		}
+
+		private static byte[] CreateContext(string label, int keySize, byte[] licRequestBts)
+		{
+			var contextSize = label.Length + 1 + licRequestBts.Length + sizeof(int);
+
+			var context = new byte[contextSize];
+			var numChars = Encoding.ASCII.GetBytes(label.AsSpan(), context);
+			Array.Copy(licRequestBts, 0, context, numChars + 1, licRequestBts.Length);
+
+			var numBts = BitConverter.GetBytes(keySize);
+			if (BitConverter.IsLittleEndian)
+				Array.Reverse(numBts);
+			Array.Copy(numBts, 0, context, context.Length - sizeof(int), sizeof(int));
+			return context;
+		}
+
+		private static uint RandomUint()
+		{
+			var bts = new byte[4];
+			new Random().NextBytes(bts);
+			return BitConverter.ToUInt32(bts, 0);
+		}
+	}
+
+	#endregion
+}

Source/AudibleUtilities/Widevine/Device.cs

@@ -0,0 +1,73 @@
+using System;
+using System.IO;
+using System.Security.Cryptography;
+
+#nullable enable
+namespace AudibleUtilities.Widevine;
+
+internal enum DeviceTypes : byte
+{
+	Unknown = 0,
+	Chrome = 1,
+	Android = 2
+}
+
+internal class Device
+{
+	public DeviceTypes Type { get; }
+	public int FileVersion { get; }
+	public int SecurityLevel { get; }
+	public int Flags { get; }
+
+	public RSA CdmKey { get; }
+	internal ClientIdentification ClientId { get; }
+
+	public Device(Span<byte> fileData)
+	{
+		if (fileData.Length < 7 || fileData[0] != 'W' || fileData[1] != 'V' || fileData[2] != 'D')
+			throw new InvalidDataException();
+
+		FileVersion = fileData[3];
+		Type = (DeviceTypes)fileData[4];
+		SecurityLevel = fileData[5];
+		Flags = fileData[6];
+
+		if (FileVersion != 2)
+			throw new InvalidDataException($"Unknown CDM File Version: '{FileVersion}'");
+		if (Type != DeviceTypes.Android)
+			throw new InvalidDataException($"Unknown CDM Type: '{Type}'");
+		if (SecurityLevel != 3)
+			throw new InvalidDataException($"Unknown CDM Security Level: '{SecurityLevel}'");
+
+		var privateKeyLength = (fileData[7] << 8) | fileData[8];
+
+		if (privateKeyLength <= 0 || fileData.Length < 9 + privateKeyLength + 2)
+			throw new InvalidDataException($"Invalid private key length: '{privateKeyLength}'");
+
+		var clientIdLength = (fileData[9 + privateKeyLength] << 8) | fileData[10 + privateKeyLength];
+
+		if (clientIdLength <= 0 || fileData.Length < 11 + privateKeyLength + clientIdLength)
+			throw new InvalidDataException($"Invalid client id length: '{clientIdLength}'");
+
+		ClientId = ClientIdentification.Parser.ParseFrom(fileData.Slice(11 + privateKeyLength));
+		CdmKey = RSA.Create();
+		CdmKey.ImportRSAPrivateKey(fileData.Slice(9, privateKeyLength), out _);
+	}
+
+	public byte[] SignMessage(byte[] message)
+	{
+		using var sha1 = SHA1.Create();
+		var digestion = sha1.ComputeHash(message);
+		return CdmKey.SignHash(digestion, HashAlgorithmName.SHA1, RSASignaturePadding.Pss);
+	}
+
+	public bool VerifyMessage(byte[] message, byte[] signature)
+	{
+		using var sha1 = SHA1.Create();
+		var digestion = sha1.ComputeHash(message);
+		return CdmKey.VerifyHash(digestion, signature, HashAlgorithmName.SHA1, RSASignaturePadding.Pss);
+	}
+
+	public byte[] DecryptSessionKey(byte[] sessionKey)
+		=> CdmKey.Decrypt(sessionKey, RSAEncryptionPadding.OaepSHA1);
+}

Source/AudibleUtilities/Widevine/Extensions.cs

@@ -0,0 +1,15 @@
+using System;
+
+#nullable enable
+namespace AudibleUtilities.Widevine;
+
+internal static class Extensions
+{
+	public static T[] Append<T>(this T[] message, T[] appendData)
+	{
+		var origLength = message.Length;
+		Array.Resize(ref message, origLength + appendData.Length);
+		Array.Copy(appendData, 0, message, origLength, appendData.Length);
+		return message;
+	}
+}

Source/AudibleUtilities/Widevine/MpegDash.cs

@@ -0,0 +1,70 @@
+using Mpeg4Lib.Boxes;
+using System;
+using System.Diagnostics.CodeAnalysis;
+using System.IO;
+using System.Xml;
+using System.Xml.Linq;
+using System.Xml.XPath;
+
+#nullable enable
+namespace AudibleUtilities.Widevine;
+
+public class MpegDash
+{
+	private const string MpegDashNamespace = "urn:mpeg:dash:schema:mpd:2011";
+	private const string CencNamespace = "urn:mpeg:cenc:2013";
+	private const string UuidPreamble = "urn:uuid:";
+	private XElement DashMpd { get; }
+	private static XmlNamespaceManager NamespaceManager { get; } = new(new NameTable());
+	static MpegDash()
+	{
+		NamespaceManager.AddNamespace("dash", MpegDashNamespace);
+		NamespaceManager.AddNamespace("cenc", CencNamespace);
+	}
+
+	public MpegDash(Stream contents)
+	{
+		DashMpd = XElement.Load(contents);
+	}
+
+	public bool TryGetUri(Uri baseUri, [NotNullWhen(true)] out Uri? fileUri)
+	{
+		foreach (var baseUrl in DashMpd.XPathSelectElements("/dash:Period/dash:AdaptationSet/dash:Representation/dash:BaseURL", NamespaceManager))
+		{
+			try
+			{
+				fileUri = new Uri(baseUri, baseUrl.Value);
+				return true;
+			}
+			catch
+			{
+				fileUri = null;
+				return false;
+			}
+		}
+		fileUri = null;
+		return false;
+	}
+
+	public bool TryGetPssh(Guid protectionSystemId, [NotNullWhen(true)] out PsshBox? pssh)
+	{
+		foreach (var psshEle in DashMpd.XPathSelectElements("/dash:Period/dash:AdaptationSet/dash:ContentProtection/cenc:pssh", NamespaceManager))
+		{
+			if (psshEle?.Value?.Trim() is string psshStr
+				&& psshEle.Parent?.Attribute(XName.Get("schemeIdUri")) is XAttribute scheme
+				&& scheme.Value is string uuid
+				&& uuid.Equals(UuidPreamble + protectionSystemId.ToString(), StringComparison.OrdinalIgnoreCase))
+			{
+				Span<byte> buffer = new byte[psshStr.Length * 3 / 4];
+				if (Convert.TryFromBase64String(psshStr, buffer, out var written))
+				{
+					using var ms = new MemoryStream(buffer.Slice(0, written).ToArray());
+					pssh = BoxFactory.CreateBox(ms, null) as PsshBox;
+					return pssh is not null;
+				}
+			}
+		}
+		pssh = null;
+		return false;
+	}
+}