Under the black flag post, or As I did not put your video course on the tracker

DISCLAIMER. All of the following is published for research purposes and is intended to perform an educational function only. The author is not responsible for the misuse of information from this post and in no case does not call to perceive it as a "guide to action."

How it was

The video information protection mechanism of InfoProtector Company has been applied to this video course; Internet access is required for the first launch (read “product activation”) ; viewing videos is only possible from our program, from our player; video course installation is possible only on two computers (the video course is tied to the OS / hardware environment configuration, as it turns out later).

Restrictions imposed by InfoProtector

1. The activation key is generated randomly when paying for the course and is used to be an authenticated server, which, if successful, sends the client an AES key to decrypt the video materials available from under the company's custom player. Reversing the application for a long time and the most time-consuming (that is, it is inappropriate for this kind of task), so I decided to leave this way.
2. The use of screen recording tools is mercilessly blocked in a number of areas: the player and any screen capturer cannot be simultaneously launched on the same host, since the program will detect running processes with their metadata: window title names; description of executable files; names of vendors embedded in exe's capture apps; even the browser opened on the page, in the title of which there is the word “Fraps”, for example, is also subject to alert and shutdown of the player.
3. Sandboxes, virtual machines and streaming of content from remote connections (rdesktop, RAdmin, TeamViewer) is also not an option - not for years does clever software know how to identify them, suicide at every opportunity.

1. Find a capture program that does not contain beacon words in its name / manufacturer / description that InfoProtector does not know, and which, therefore, the latter will not trigger. Cons: long, boring and not a fact that, in principle, doable.
2. Find an open-source product with the necessary functionality, and compile your version of the screen hijacker, replacing in the source code all that the protection of InfoProtector in theory may seem suspicious. Cons: long, boring, time consuming (usually such projects are rather cumbersome, consist of hundreds (?) Of files and have heaps of dependencies in the source code, so just Ctrl-H does not roll, you don’t need to edit mimikatz so that Windows Defender will not be trimmed).
3. Write your solution on something scripted so as not to risk with a compiled executable file of unknown nature (it is not known what this infection will say), implementing the trivial functionality of quickly taking screenshots from the selected screen area (good, InfoProtector allows it), and separately write sound track, which also turned out to be legitimate and as simple as possible.

Screenshot the whole world

1. Set the size of the player window equal to the resolution of the output video that we would like to have (it is logical to take into account the space for the script controls - a window with a terminal, for example, which should not fall into the recording area). This can be done with such a wonderful software.
2. Place the player window in such a position as to find which it would be easiest to explain to the script - the lower right corner of the screen (I think the reference system associated with the screen borders is the most convenient option).
3. Let's add a script already written (which will be a little lower) to take screenshots of this area.
4. Do not touch this clumsy system during the whole video playback.

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

# Usage: python3 fckInfoprotector.py <WIDTH> <HEIGHT>

import sys

import numpy as np
import cv2
from mss.windows import MSS as mss
from PIL import Image


class Capturer:

	def __init__(self, w, h, resolution='1080p', fps=24.975):
		if resolution == '1080p':
			self.monitor = {
				'top': 1080 - h,
				'left': 1920 - w,
				'width': w,
				'height': h
			}

		elif resolution == '1440p':
			self.monitor = {
				'top': 1440 - h,
				'left': 2560 - w,
				'width': w,
				'height': h
			}

		else:
			raise ValueError('Unsupported monitor resolution')

		self.sct = mss()

		self.vid = cv2.VideoWriter(
			'output.avi',
			cv2.VideoWriter_fourcc(*'XVID'),
			fps=fps,
			frameSize=(
				self.monitor['width'],
				self.monitor['height']
			)
		)

	def mainloop(self):
		while True:
			sct_img = self.sct.grab(self.monitor)
			sct_img_size = (sct_img.width, sct_img.height)

			img = Image.frombytes(
				'RGB',
				sct_img_size,
				sct_img.rgb
			)

			frame = cv2.cvtColor(
				np.array(img),
				cv2.COLOR_BGR2RGB
			)

			self.vid.write(frame)


if __name__ == '__main__':
	if len(sys.argv) != 3:
		print(f'Usage: {sys.argv[0]} <WIDTH> <HEIGHT>')
		sys.exit()

	w, h = (int(x) for x in sys.argv[1:3])
	capturer = Capturer(w, h, fps=50.0)

	try:
		capturer.mainloop()
	except KeyboardInterrupt:
		print('Interrupted')