How do I save the buffered flash video (on Linux)?

Question

There used to be a method for extracting buffered flash video in any browsers (like firefox, chrome, etc.), which makes use of the command ps and spies the fd that is pointing to an in-memory temporary file. Unfortunately, this method doesn't work any more. For example, all fd used by chromium is:

chrome    19412  ymf   69u   REG   0,14   470364     0  270129 /dev/shm/.org.chromium.Chromium.1fzPuo (deleted)
chrome    19412  ymf   77u   REG   0,14   131060     0  270141 /dev/shm/.org.chromium.Chromium.94K6Di (deleted)
chrome    19412  ymf  103u   REG    8,5     2052     0 4230990 /var/tmp/etilqs_01QDHFotJcLOpBS (deleted)
chrome    19412  ymf  112u   REG    8,5    24600     0 4232788 /var/tmp/etilqs_tFao7GamL5cslaZ (deleted)
chrome    19412  ymf  188u   REG    8,6    16384     0 1310851 /home/ymf/.config/chromium/Default/History Index 2013-07-journal (deleted)
chrome    19412  ymf  189u   REG    8,5    16400     0 4232787 /var/tmp/etilqs_D5p3BT7rtTSWLsy (deleted)

None of them contains media content.

And I firmly believe that there's someway we can grip the playing video (on Linux), since the video is streamed from the server whenever we play it (without the help of any browser-specific plugins).

Answer 1

You say "all fd used by chromium is: ... None of them contains media content." but you list very few open files that look all owned by a single process. Not how typically chrome runs. How did you get that info?

On my machine (Linux Mint and Chrome 28.0.1500.95) I could retrieve a streamed flash file right in the place you were looking for it. I suspect you're missing something in the process.

First, you need to identify the process that is running pepper and find the file descriptor id corresponding to your file.

This is possible thanks to /proc and the per-process fd directory

With the video open in a browser window, run this command:

for ID in $( pgrep chrome ) ; do ( sudo ls -l /proc/$ID/fd|grep Pepper ) && echo /proc/$ID/fd; done

The output will be similar to:

lrwx------ 1 root root 64 ago  2 12:52 29 -> /home/me/.chromecache/Default/Pepper Data/Shockwave Flash/.com.google.Chrome.ulDLo0 (deleted)
/proc/1196/fd

Ignore the path the link it's pointing to: it's deleted. You need to access the file via /proc/$PROCID/fd/$FDID

In the example above you would run:

sudo cat /proc/1196/fd/29 > my_video.flv

[EDIT]

To do the same for chromium, change the process name from google-chrome to chro and the string to look for in the file name to /tmp/Flash like so:

for ID in $( pgrep chro ) ; do ( sudo ls -l /proc/$ID/fd|grep /tmp/Flash ) && echo /proc/$ID/fd; done

[EDIT] (again)

This one-liner should work with both chrome and chromium (at least it did on my machine):

for ID in $( pgrep -f chro ) ; do ( sudo ls -l /proc/$ID/fd|egrep "(/tmp/Flash|Pepper)" ) && echo /proc/$ID/fd; done

Answer 2

You could also use @silviot's method in a script:

#!/bin/bash
#
# Show all chrome cached video files!
#
for ID in $( pgrep chrom ) ; do 
    sudo ls -l /proc/$ID/fd|grep Pepper|cut -d' ' -f9|sed "s/\(.*\)/\/proc\/$ID\/\1/g"
done | grep -v '^$'

I have not tested this with more than 1 videos running, but it should work.

Answer 3

I tried all the extensions which get disallowed and then you have to update all the time. Then stumbled onto this: Use the KeepVid.com bookmarklet. Just drag the button on the web page to your bookmarks bar. Just click the link while watching a video