Reply to thread

Message

<blockquote data-quote="fforde" data-source="post: 680941" data-attributes="member: 52082">Re: Pandora MusicBox 1.0.3 BetaTo be honest rolls1400, other people blazed the trail. There is a Linux command line application called <a href="https://github.com/PromyLOPh/pianobar" target="_blank">PianoBar</a> that connects with the Pandora API in the same way we do. This application helped tremendously in figuring out the encryption scheme used by Pandora. The Pandora API uses a well documented encryption algorithm called the Blowfish Cypher (<a href="http://code.google.com/p/pandora-musicbox/source/browse/trunk/Source/Engine/Encryption/BlowfishCipher.cs" target="_blank">here is our implementation</a>). I have no idea how the PianoBar guys figured this out though, I really think that maybe one of them had an inside source. But regardless, once we figured out the encryption algorithm, everything else was easy. It's all just encrypted HTTP connections to and from the Pandora servers, and if you know how to decrypt the payload it just boils down to XMLRPC calls. And those are easy to figure out.Since we have been working on this project, Pandora has changed the decryption keys every few months or so. This is a nuisance but the new keys can be figured out with a flash decompiler and a bit of ingenuity.</blockquote>

[QUOTE="fforde, post: 680941, member: 52082"] [b]Re: Pandora MusicBox 1.0.3 Beta[/b] To be honest rolls1400, other people blazed the trail. There is a Linux command line application called [URL="https://github.com/PromyLOPh/pianobar"]PianoBar[/URL] that connects with the Pandora API in the same way we do. This application helped [B]tremendously[/B] in figuring out the encryption scheme used by Pandora. The Pandora API uses a well documented encryption algorithm called the Blowfish Cypher ([URL="http://code.google.com/p/pandora-musicbox/source/browse/trunk/Source/Engine/Encryption/BlowfishCipher.cs"]here is our implementation[/URL]). I have no idea how the PianoBar guys figured this out though, I really think that maybe one of them had an inside source. But regardless, once we figured out the encryption algorithm, everything else was easy. It's all just encrypted HTTP connections to and from the Pandora servers, and if you know how to decrypt the payload it just boils down to XMLRPC calls. And those are easy to figure out. Since we have been working on this project, Pandora has changed the decryption keys every few months or so. This is a nuisance but the new keys can be figured out with a flash decompiler and a bit of ingenuity. [/QUOTE]

Verification